diff --git a/.gitignore b/.gitignore
index c9e6b038..b7d65008 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,7 @@ Thumbs.db
 
 # Setup window build (spec 15.7)
 /app/dist-setup/
+/app/dist-phone/
 
 # Design sync (claude.ai/design): staged scripts, build output, machine state
 /.ds-sync/
diff --git a/Cargo.lock b/Cargo.lock
index abb5aeb4..16dd6717 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,6 +18,41 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
+[[package]]
+name = "aes"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
+dependencies = [
+ "cipher 0.5.2",
+ "cpubits",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
+dependencies = [
+ "aead 0.6.1",
+ "aes",
+ "cipher 0.5.2",
+ "ctr",
+ "ctutils",
+ "ghash",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.5"
@@ -372,6 +407,12 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -506,6 +547,8 @@ dependencies = [
  "hex",
  "lettre",
  "object_store",
+ "p256",
+ "reqwest",
  "rusqlite",
  "serde",
  "serde_json",
@@ -513,6 +556,7 @@ dependencies = [
  "tempfile",
  "thiserror 2.0.21",
  "tokio",
+ "tokio-tungstenite 0.30.0",
  "toml 1.1.6+spec-1.1.0",
  "tower",
  "tracing",
@@ -559,6 +603,7 @@ dependencies = [
 name = "botloftd"
 version = "0.13.0"
 dependencies = [
+ "aes-gcm",
  "anyhow",
  "argon2",
  "axum",
@@ -577,6 +622,7 @@ dependencies = [
  "jiff",
  "jpeg-encoder",
  "libc",
+ "p256",
  "reqwest",
  "serde",
  "serde_json",
@@ -789,7 +835,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
@@ -810,9 +856,9 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
- "aead",
+ "aead 0.5.2",
  "chacha20 0.9.1",
- "cipher",
+ "cipher 0.4.4",
  "poly1305",
  "zeroize",
 ]
@@ -836,10 +882,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout",
+ "inout 0.1.4",
  "zeroize",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
 [[package]]
 name = "clap"
 version = "4.6.7"
@@ -889,6 +946,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -980,6 +1043,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1032,6 +1101,21 @@ version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
+[[package]]
+name = "crypto-bigint"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -1049,7 +1133,9 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1081,6 +1167,25 @@ version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d"
 
+[[package]]
+name = "ctr"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+dependencies = [
+ "cmov",
+ "subtle",
+]
+
 [[package]]
 name = "darling"
 version = "0.24.1"
@@ -1163,6 +1268,16 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "der"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -1230,6 +1345,7 @@ dependencies = [
  "block-buffer 0.12.1",
  "const-oid",
  "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -1359,12 +1475,48 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
+[[package]]
+name = "ecdsa"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
+dependencies = [
+ "der",
+ "digest 0.11.3",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+ "zeroize",
+]
+
 [[package]]
 name = "either"
 version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 
+[[package]]
+name = "elliptic-curve"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "crypto-common 0.2.2",
+ "digest 0.11.3",
+ "ff",
+ "group",
+ "hkdf",
+ "hybrid-array",
+ "pkcs8",
+ "rand_core 0.10.1",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "email-encoding"
 version = "0.4.2"
@@ -1502,6 +1654,16 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "ff"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+dependencies = [
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "field-offset"
 version = "0.3.6"
@@ -1826,6 +1988,15 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
+dependencies = [
+ "polyval",
+]
+
 [[package]]
 name = "gio"
 version = "0.18.4"
@@ -1922,6 +2093,17 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "group"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
+dependencies = [
+ "ff",
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "gtk"
 version = "0.18.2"
@@ -2050,6 +2232,24 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.39.0"
@@ -2117,7 +2317,9 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
+ "subtle",
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -2377,6 +2579,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.2"
@@ -2644,7 +2855,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "url",
- "webpki-roots",
+ "webpki-roots 1.0.9",
 ]
 
 [[package]]
@@ -3300,6 +3511,19 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "p256"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primefield",
+ "primeorder",
+ "sha2 0.11.0",
+]
+
 [[package]]
 name = "pango"
 version = "0.18.3"
@@ -3441,6 +3665,16 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.34"
@@ -3508,7 +3742,18 @@ checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
  "cpufeatures 0.2.17",
  "opaque-debug",
- "universal-hash",
+ "universal-hash 0.5.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
+dependencies = [
+ "cpubits",
+ "cpufeatures 0.3.1",
+ "universal-hash 0.6.1",
 ]
 
 [[package]]
@@ -3556,6 +3801,32 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
+[[package]]
+name = "primefield"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
+dependencies = [
+ "crypto-bigint",
+ "crypto-common 0.2.2",
+ "ff",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
+dependencies = [
+ "elliptic-curve",
+ "primefield",
+ "serdect",
+ "wnaf",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "1.3.1"
@@ -3900,6 +4171,16 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
+dependencies = [
+ "crypto-bigint",
+ "hmac",
+]
+
 [[package]]
 name = "rfd"
 version = "0.16.0"
@@ -4155,6 +4436,20 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sec1"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+dependencies = [
+ "base16ct",
+ "ctutils",
+ "der",
+ "hybrid-array",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -4358,6 +4653,16 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "serialize-to-javascript"
 version = "0.1.2"
@@ -4458,6 +4763,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
@@ -4562,6 +4877,16 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
+[[package]]
+name = "spki"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "sqlite-wasm-rs"
 version = "0.5.5"
@@ -5320,8 +5645,12 @@ checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71"
 dependencies = [
  "futures-util",
  "log",
+ "rustls",
+ "rustls-pki-types",
  "tokio",
+ "tokio-rustls",
  "tungstenite 0.30.0",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -5634,6 +5963,8 @@ dependencies = [
  "httparse",
  "log",
  "rand 0.10.3",
+ "rustls",
+ "rustls-pki-types",
  "sha1 0.11.0",
  "thiserror 2.0.21",
 ]
@@ -5699,6 +6030,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -5986,6 +6327,15 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.9",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.9"
@@ -6471,6 +6821,18 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wnaf"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
+dependencies = [
+ "ff",
+ "group",
+ "hybrid-array",
+ "primefield",
+]
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
diff --git a/app/package.json b/app/package.json
index d085b2c6..392e4d2f 100644
--- a/app/package.json
+++ b/app/package.json
@@ -8,6 +8,7 @@
   "scripts": {
     "dev": "vite",
     "build": "pnpm typecheck && vite build",
+    "build:phone": "vite build --mode phone",
     "preview": "vite preview",
     "tauri": "tauri",
     "bundle": "node scripts/sidecar.mjs && tauri build --config src-tauri/tauri.bundle.conf.json",
@@ -28,6 +29,7 @@
     "@tauri-apps/plugin-notification": "^2.5.0",
     "@tauri-apps/plugin-updater": "^2.13.0",
     "lucide-react": "^1.48.0",
+    "qrcode-generator": "2.0.4",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "react-markdown": "^10.1.0",
diff --git a/app/pnpm-lock.yaml b/app/pnpm-lock.yaml
index bd82fe4a..f50e8c59 100644
--- a/app/pnpm-lock.yaml
+++ b/app/pnpm-lock.yaml
@@ -187,6 +187,9 @@ importers:
       lucide-react:
         specifier: ^1.48.0
         version: 1.48.0(react@19.3.0)
+      qrcode-generator:
+        specifier: 2.0.4
+        version: 2.0.4
       react:
         specifier: ^19.3.0
         version: 19.3.0
@@ -1423,6 +1426,9 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
+  qrcode-generator@2.0.4:
+    resolution: {integrity: sha512-mZSiP6RnbHl4xL2Ap5HfkjLnmxfKcPWpWe/c+5XxCuetEenqmNFf1FH/ftXPCtFG5/TDobjsjz6sSNL0Sr8Z9g==}
+
   react-dom@19.3.0:
     resolution: {integrity: sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q==}
     peerDependencies:
@@ -2822,6 +2828,8 @@ snapshots:
 
   punycode@2.3.1: {}
 
+  qrcode-generator@2.0.4: {}
+
   react-dom@19.3.0(react@19.3.0):
     dependencies:
       react: 19.3.0
diff --git a/app/public-phone/apple-touch-icon.png b/app/public-phone/apple-touch-icon.png
new file mode 100644
index 00000000..d392523b
Binary files /dev/null and b/app/public-phone/apple-touch-icon.png differ
diff --git a/app/public-phone/icon-192.png b/app/public-phone/icon-192.png
new file mode 100644
index 00000000..178b781a
Binary files /dev/null and b/app/public-phone/icon-192.png differ
diff --git a/app/public-phone/icon-512.png b/app/public-phone/icon-512.png
new file mode 100644
index 00000000..0c479f3a
Binary files /dev/null and b/app/public-phone/icon-512.png differ
diff --git a/app/public-phone/manifest.webmanifest b/app/public-phone/manifest.webmanifest
new file mode 100644
index 00000000..e6c80bd6
--- /dev/null
+++ b/app/public-phone/manifest.webmanifest
@@ -0,0 +1,14 @@
+{
+  "name": "Botloft",
+  "short_name": "Botloft",
+  "description": "Approve requests and answer questions from your bots.",
+  "start_url": "/m/",
+  "scope": "/m/",
+  "display": "standalone",
+  "background_color": "#0b0b0b",
+  "theme_color": "#0b0b0b",
+  "icons": [
+    { "src": "/m/icon-192.png", "sizes": "192x192", "type": "image/png" },
+    { "src": "/m/icon-512.png", "sizes": "512x512", "type": "image/png" }
+  ]
+}
diff --git a/app/public-phone/sw.js b/app/public-phone/sw.js
new file mode 100644
index 00000000..35d4e8dd
--- /dev/null
+++ b/app/public-phone/sw.js
@@ -0,0 +1,92 @@
+// The phone's page keeps its own files for the next visit, and nothing else:
+// never an answer from the server and never what a bot asked (spec 28.7).
+const CACHE = "botloft-phone-1";
+
+self.addEventListener("install", () => self.skipWaiting());
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches
+      .keys()
+      .then((names) =>
+        Promise.all(names.filter((name) => name !== CACHE).map((name) => caches.delete(name))),
+      )
+      .then(() => self.clients.claim()),
+  );
+});
+
+// A push says only that something waits, with nothing in it (spec 28.8): the
+// words are here, in the phone's language, and the details are in the page.
+const WORDS = {
+  en: ["Botloft needs you", "Something is waiting for you."],
+  pt: ["O Botloft precisa de você", "Tem algo esperando você."],
+  es: ["Botloft te necesita", "Hay algo esperando."],
+};
+
+function words() {
+  const language = (self.navigator.language || "en").toLowerCase();
+  if (language.startsWith("pt")) return WORDS.pt;
+  if (language.startsWith("es")) return WORDS.es;
+  return WORDS.en;
+}
+
+self.addEventListener("push", (event) => {
+  const [title, body] = words();
+  // One notice stands for all that wait; a new push brings it back up.
+  event.waitUntil(
+    self.registration.showNotification(title, {
+      body,
+      tag: "botloft-waiting",
+      renotify: true,
+      icon: "/m/icon-192.png",
+      badge: "/m/icon-192.png",
+    }),
+  );
+});
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  event.waitUntil(
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((windows) => {
+      const open = windows.find((window) => new URL(window.url).pathname.startsWith("/m"));
+      return open ? open.focus() : self.clients.openWindow("/m/");
+    }),
+  );
+});
+
+self.addEventListener("fetch", (event) => {
+  const { request } = event;
+  const url = new URL(request.url);
+  if (
+    request.method !== "GET" ||
+    url.origin !== self.location.origin ||
+    !url.pathname.startsWith("/m/")
+  ) {
+    return;
+  }
+  // The built files have a hash in their names: once kept, they never change.
+  if (url.pathname.startsWith("/m/assets/")) {
+    event.respondWith(
+      caches.match(request).then(
+        (kept) =>
+          kept ||
+          fetch(request).then((fresh) => {
+            const copy = fresh.clone();
+            caches.open(CACHE).then((cache) => cache.put(request, copy));
+            return fresh;
+          }),
+      ),
+    );
+    return;
+  }
+  // The page itself comes from the server when it can, and from here when not.
+  event.respondWith(
+    fetch(request)
+      .then((fresh) => {
+        const copy = fresh.clone();
+        caches.open(CACHE).then((cache) => cache.put(request, copy));
+        return fresh;
+      })
+      .catch(() => caches.match(request).then((kept) => kept || caches.match("/m/"))),
+  );
+});
diff --git a/app/src/features/account/BackupSettings.tsx b/app/src/features/account/BackupSettings.tsx
index 590dfa39..377caa3f 100644
--- a/app/src/features/account/BackupSettings.tsx
+++ b/app/src/features/account/BackupSettings.tsx
@@ -13,6 +13,7 @@ import { Callout } from "../../ui/Callout";
 import { BackupRestore } from "./BackupRestore";
 import { backupError } from "./backupError";
 import { CloudAccount } from "./CloudAccount";
+import { MobilePhones } from "./MobilePhones";
 import { PassphraseFields, usePassphrase } from "./PassphraseFields";
 import { Section } from "./settingsParts";
 
@@ -26,6 +27,7 @@ export function BackupSettings() {
       <Section title={cloud.title}>
         <CloudAccount />
       </Section>
+      <MobilePhones />
       <Section title={b.exportTitle}>
         <p className="text-ink-soft text-sm leading-relaxed">{b.exportIntro}</p>
         <ExportCopy />
diff --git a/app/src/features/account/MobilePairing.tsx b/app/src/features/account/MobilePairing.tsx
new file mode 100644
index 00000000..eb7d8f92
--- /dev/null
+++ b/app/src/features/account/MobilePairing.tsx
@@ -0,0 +1,102 @@
+// A code waiting to be scanned (spec 28.3, 28.7): the picture, the time left,
+// and, once a phone scanned it, the name and the two codes to compare.
+
+import { useEffect, useRef, useState } from "react";
+import { useT } from "../../i18n";
+import type { MobilePairStarted, MobilePairing as Pending } from "../../lib/protocol.gen";
+import { useApi } from "../../store/context";
+import { Button } from "../../ui/Button";
+import { Callout } from "../../ui/Callout";
+import { QrCode } from "../../ui/QrCode";
+import { backupError } from "./backupError";
+import { clock, useSecondsLeft } from "./useMobile";
+
+/** "482913" as "482 913", easier to compare by eye. */
+const spaced = (code: string) => `${code.slice(0, 3)} ${code.slice(3)}`;
+
+export function MobilePairing({
+  pending,
+  started,
+  done,
+  lapsed,
+  refresh,
+}: {
+  pending: Pending;
+  started: MobilePairStarted | null;
+  /** The owner is done with this code: refused, cancelled or connected. */
+  done(): void;
+  /** It ran out. */
+  lapsed(): void;
+  refresh(): Promise<void>;
+}) {
+  const m = useT().account.mobile;
+  const reasons = useT().account.cloud.reasons;
+  const api = useApi();
+  const left = useSecondsLeft(pending.expiresAt);
+  const [accepting, setAccepting] = useState(false);
+  const [problem, setProblem] = useState<string | null>(null);
+
+  // The time is up: the daemon forgets the code, and this one goes away.
+  const over = useRef(false);
+  useEffect(() => {
+    if (left === 0 && !accepting && !over.current) {
+      over.current = true;
+      lapsed();
+      void refresh();
+    }
+  }, [left, accepting, lapsed, refresh]);
+
+  const answer = async (accept: boolean) => {
+    setProblem(null);
+    setAccepting(accept);
+    try {
+      await api.call("mobile.pair_confirm", { pairId: pending.pairId, accept });
+      if (!accept) {
+        done();
+      }
+    } catch (failure) {
+      setAccepting(false);
+      setProblem(backupError(failure, reasons));
+    }
+  };
+
+  const cancel = async () => {
+    done();
+    await api.call("mobile.pair_cancel", { pairId: pending.pairId }).catch(() => null);
+    await refresh();
+  };
+
+  return (
+    <div className="flex flex-col gap-3 rounded-md border border-line p-4">
+      {pending.joined ? (
+        <>
+          <p className="font-medium text-sm">{m.wants(pending.joined.name)}</p>
+          <p className="font-mono text-3xl tracking-[0.2em]">{spaced(pending.joined.code)}</p>
+          <p className="text-ink-soft text-sm">{m.compare(spaced(pending.joined.code))}</p>
+          <div className="flex gap-3">
+            <Button disabled={accepting} onClick={() => answer(true)}>
+              {accepting ? m.connecting : m.accept}
+            </Button>
+            <Button variant="ghost" disabled={accepting} onClick={() => answer(false)}>
+              {m.refuse}
+            </Button>
+          </div>
+        </>
+      ) : (
+        <>
+          {started && <QrCode text={started.url} label={m.qrLabel} />}
+          <p className="text-ink-soft text-sm">{m.scan}</p>
+          <p className="text-muted text-xs">{m.expires(clock(left))}</p>
+          <Button variant="ghost" className="self-start" onClick={cancel}>
+            {m.cancel}
+          </Button>
+        </>
+      )}
+      {problem && (
+        <Callout tone="danger" title={m.failed}>
+          {problem}
+        </Callout>
+      )}
+    </div>
+  );
+}
diff --git a/app/src/features/account/MobilePhones.tsx b/app/src/features/account/MobilePhones.tsx
new file mode 100644
index 00000000..423a7967
--- /dev/null
+++ b/app/src/features/account/MobilePhones.tsx
@@ -0,0 +1,32 @@
+// Settings, "Backup", the phone block (spec 28.7): connect a phone by showing
+// a code for it to scan, compare the two codes, and cut a phone off.
+
+import { Smartphone } from "lucide-react";
+import { useT } from "../../i18n";
+import { MobileSignedIn } from "./MobileSignedIn";
+import { Section } from "./settingsParts";
+import { useCloud } from "./useCloud";
+import { useMobile } from "./useMobile";
+
+export function MobilePhones() {
+  const m = useT().account.mobile;
+  const { status: cloud } = useCloud();
+  const { status, refresh } = useMobile();
+  // No cloud set up, nothing to connect a phone to.
+  if (!cloud?.url) {
+    return null;
+  }
+  return (
+    <Section title={m.title}>
+      <p className="flex items-start gap-2 text-ink-soft text-sm leading-relaxed">
+        <Smartphone size={16} aria-hidden className="mt-0.5 shrink-0 text-muted" />
+        {m.intro}
+      </p>
+      {!cloud.signedIn ? (
+        <p className="text-muted text-sm">{m.needAccount}</p>
+      ) : (
+        status && <MobileSignedIn status={status} refresh={refresh} />
+      )}
+    </Section>
+  );
+}
diff --git a/app/src/features/account/MobileSignedIn.tsx b/app/src/features/account/MobileSignedIn.tsx
new file mode 100644
index 00000000..6e3ee043
--- /dev/null
+++ b/app/src/features/account/MobileSignedIn.tsx
@@ -0,0 +1,127 @@
+// The phone block once the computer is in the account (spec 28.7): the phones
+// that are connected, and the way to connect another.
+
+import { useState } from "react";
+import { useT } from "../../i18n";
+import { when } from "../../lib/format";
+import type { MobilePairStarted, MobilePhone, MobileStatus } from "../../lib/protocol.gen";
+import { useApi } from "../../store/context";
+import { Button } from "../../ui/Button";
+import { Callout } from "../../ui/Callout";
+import { Confirm } from "../../ui/Confirm";
+import { backupError } from "./backupError";
+import { MobilePairing } from "./MobilePairing";
+
+export function MobileSignedIn({
+  status,
+  refresh,
+}: {
+  status: MobileStatus;
+  refresh(): Promise<void>;
+}) {
+  const m = useT().account.mobile;
+  const reasons = useT().account.cloud.reasons;
+  const api = useApi();
+  const [started, setStarted] = useState<MobilePairStarted | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [problem, setProblem] = useState<string | null>(null);
+  const [lapsed, setLapsed] = useState(false);
+  const [leaving, setLeaving] = useState<MobilePhone | null>(null);
+
+  const connect = async () => {
+    setBusy(true);
+    setProblem(null);
+    setLapsed(false);
+    try {
+      setStarted(await api.call("mobile.pair_start"));
+    } catch (failure) {
+      setProblem(backupError(failure, reasons));
+    }
+    setBusy(false);
+  };
+
+  const disconnect = async (phone: MobilePhone) => {
+    try {
+      await api.call("mobile.revoke", { phoneId: phone.id });
+    } catch (failure) {
+      setProblem(backupError(failure, reasons));
+    }
+    await refresh();
+  };
+
+  // A code on screen: this window's own, or one left from before it opened.
+  const pending = status.pending;
+  const showing = pending && (!started || started.pairId === pending.pairId);
+
+  return (
+    <div className="flex flex-col gap-4">
+      {status.phones.length === 0 ? (
+        <p className="text-muted text-sm">{m.none}</p>
+      ) : (
+        <div className="flex flex-col gap-2">
+          <h4 className="font-medium text-sm">{m.phones}</h4>
+          <ul className="flex flex-col divide-y divide-line rounded-md border border-line">
+            {status.phones.map((phone) => (
+              <li key={phone.id} className="flex items-center justify-between gap-3 px-3 py-2">
+                <div className="min-w-0">
+                  <p className="truncate font-medium text-sm">{phone.name}</p>
+                  <p className={phone.online ? "text-ok text-xs" : "text-muted text-xs"}>
+                    {phone.online
+                      ? m.online
+                      : phone.lastSeenAt !== undefined
+                        ? m.seen(when(phone.lastSeenAt))
+                        : m.neverSeen}
+                  </p>
+                </div>
+                <Button variant="ghost" onClick={() => setLeaving(phone)}>
+                  {m.disconnect}
+                </Button>
+              </li>
+            ))}
+          </ul>
+          <p className="text-muted text-xs">{m.warning}</p>
+        </div>
+      )}
+
+      {showing && pending ? (
+        <MobilePairing
+          pending={pending}
+          started={started}
+          done={() => setStarted(null)}
+          lapsed={() => {
+            setStarted(null);
+            setLapsed(true);
+          }}
+          refresh={refresh}
+        />
+      ) : (
+        <div className="flex flex-col gap-2">
+          {lapsed && (
+            <p role="status" className="text-muted text-sm">
+              {m.expired}
+            </p>
+          )}
+          <Button className="self-start" disabled={busy} onClick={connect}>
+            {busy ? m.starting : m.connect}
+          </Button>
+        </div>
+      )}
+
+      {problem && (
+        <Callout tone="danger" title={m.failed}>
+          {problem}
+        </Callout>
+      )}
+      {leaving && (
+        <Confirm
+          title={m.disconnectTitle(leaving.name)}
+          confirmLabel={m.disconnect}
+          onConfirm={() => disconnect(leaving)}
+          onClose={() => setLeaving(null)}
+        >
+          {m.disconnectText}
+        </Confirm>
+      )}
+    </div>
+  );
+}
diff --git a/app/src/features/account/mobile.test.tsx b/app/src/features/account/mobile.test.tsx
new file mode 100644
index 00000000..05a0b0f9
--- /dev/null
+++ b/app/src/features/account/mobile.test.tsx
@@ -0,0 +1,86 @@
+import { act, cleanup, fireEvent, screen, waitFor, within } from "@testing-library/react";
+import { afterEach, describe, expect, test } from "vitest";
+import { FakeBotloft } from "../../lib/fake";
+import { openFakeCloudLink } from "../../lib/fakeCloud";
+import { FakeHost } from "../../lib/fakeHost";
+import { joinFakePhone } from "../../lib/fakeMobile";
+import { crewOpened, renderApp } from "../../test/app";
+
+afterEach(cleanup);
+
+async function openBackup() {
+  const fake = new FakeBotloft();
+  const ops = fake.addCrew("Ops");
+  fake.addBot(ops.id, "Scout");
+  renderApp(fake, new FakeHost());
+  await crewOpened("Ops");
+  fireEvent.click(await screen.findByRole("button", { name: /Ana Lima/ }));
+  fireEvent.click(screen.getByRole("menuitem", { name: "Settings" }));
+  const dialog = screen.getByRole("dialog", { name: "Settings" });
+  fireEvent.click(within(dialog).getByRole("tab", { name: "Backup" }));
+  return { fake, dialog };
+}
+
+/** Signs in through the screen, the way the owner does. */
+async function signIn(fake: FakeBotloft, dialog: HTMLElement) {
+  fireEvent.change(await within(dialog).findByLabelText("Your e-mail"), {
+    target: { value: "ana@exemplo.com" },
+  });
+  fireEvent.click(within(dialog).getByRole("button", { name: "Send me the link" }));
+  await within(dialog).findByText(/We sent a link to ana@exemplo.com/);
+  act(() => openFakeCloudLink(fake));
+  await within(dialog).findByText("Signed in as ana@exemplo.com");
+}
+
+describe("the phone block in Settings", () => {
+  test("waits for the account, then shows a code, compares it and connects the phone", async () => {
+    const { fake, dialog } = await openBackup();
+    await within(dialog).findByText("Sign in to the account above to use the phone.");
+    expect(within(dialog).queryByRole("button", { name: "Connect a phone" })).toBeNull();
+    await signIn(fake, dialog);
+
+    expect(await within(dialog).findByText("No phone connected yet.")).toBeTruthy();
+    fireEvent.click(within(dialog).getByRole("button", { name: "Connect a phone" }));
+    // The code to scan is a picture, with the time it still works.
+    expect(
+      await within(dialog).findByRole("img", { name: "Code to scan with your phone" }),
+    ).toBeTruthy();
+    expect(within(dialog).getByText(/The code works for [45]:[0-5][0-9] more/)).toBeTruthy();
+
+    // A phone scans it: its name, and the code to compare with the phone's screen.
+    act(() => joinFakePhone(fake, "Celular da Ana", "482913"));
+    expect(await within(dialog).findByText("Celular da Ana wants to connect.")).toBeTruthy();
+    expect(within(dialog).getByText("482 913", { selector: "p.font-mono" })).toBeTruthy();
+    expect(within(dialog).queryByRole("img", { name: "Code to scan with your phone" })).toBeNull();
+
+    fireEvent.click(within(dialog).getByRole("button", { name: "Connect" }));
+    const list = await within(dialog).findByRole("list");
+    expect(within(list).getByText("Celular da Ana")).toBeTruthy();
+    expect(within(list).getByText("Online now")).toBeTruthy();
+    expect(within(dialog).getByRole("button", { name: "Connect a phone" })).toBeTruthy();
+
+    // Disconnecting asks first, and the phone is gone.
+    fireEvent.click(within(list).getByRole("button", { name: "Disconnect" }));
+    const confirm = await screen.findByRole("dialog", { name: "Disconnect Celular da Ana?" });
+    fireEvent.click(within(confirm).getByRole("button", { name: "Disconnect" }));
+    await within(dialog).findByText("No phone connected yet.");
+    expect(fake.calls.some((call) => call.method === "mobile.revoke")).toBe(true);
+  });
+
+  test("cancelling or refusing leaves no phone and brings the button back", async () => {
+    const { fake, dialog } = await openBackup();
+    await signIn(fake, dialog);
+    fireEvent.click(await within(dialog).findByRole("button", { name: "Connect a phone" }));
+    await within(dialog).findByRole("img", { name: "Code to scan with your phone" });
+    fireEvent.click(within(dialog).getByRole("button", { name: "Cancel" }));
+    await within(dialog).findByRole("button", { name: "Connect a phone" });
+    expect((await fake.call("mobile.status")).pending).toBeUndefined();
+
+    fireEvent.click(within(dialog).getByRole("button", { name: "Connect a phone" }));
+    await within(dialog).findByRole("img", { name: "Code to scan with your phone" });
+    act(() => joinFakePhone(fake));
+    fireEvent.click(await within(dialog).findByRole("button", { name: "Not this one" }));
+    await within(dialog).findByRole("button", { name: "Connect a phone" });
+    await waitFor(async () => expect((await fake.call("mobile.status")).phones).toEqual([]));
+  });
+});
diff --git a/app/src/features/account/useMobile.ts b/app/src/features/account/useMobile.ts
new file mode 100644
index 00000000..ea513764
--- /dev/null
+++ b/app/src/features/account/useMobile.ts
@@ -0,0 +1,50 @@
+// What the Settings screen knows of the phones (spec 28.5): their status,
+// kept current by the daemon's notifications, and the time left on a code.
+
+import { useCallback, useEffect, useState } from "react";
+import type { MobileStatus } from "../../lib/protocol.gen";
+import { useApi } from "../../store/context";
+
+export function useMobile() {
+  const api = useApi();
+  const [status, setStatus] = useState<MobileStatus | null>(null);
+
+  const refresh = useCallback(async () => {
+    try {
+      setStatus(await api.call("mobile.status"));
+    } catch {
+      // The screen keeps what it had.
+    }
+  }, [api]);
+
+  useEffect(() => {
+    void refresh();
+    return api.subscribe((event) => {
+      if (event.name === "mobile.changed") {
+        setStatus(event.params);
+      }
+    });
+  }, [api, refresh]);
+
+  return { status, refresh };
+}
+
+/** Seconds left until `expiresAt`, counted down each second; 0 when it is past. */
+export function useSecondsLeft(expiresAt: number | undefined): number {
+  const [seconds, setSeconds] = useState(() => secondsUntil(expiresAt));
+  useEffect(() => {
+    setSeconds(secondsUntil(expiresAt));
+    const timer = setInterval(() => setSeconds(secondsUntil(expiresAt)), 1000);
+    return () => clearInterval(timer);
+  }, [expiresAt]);
+  return seconds;
+}
+
+function secondsUntil(at: number | undefined): number {
+  return at === undefined ? 0 : Math.max(0, Math.ceil((at - Date.now()) / 1000));
+}
+
+/** "4:32". */
+export function clock(seconds: number): string {
+  return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
diff --git a/app/src/i18n/en/account.ts b/app/src/i18n/en/account.ts
index 5d8e67f3..26cb9996 100644
--- a/app/src/i18n/en/account.ts
+++ b/app/src/i18n/en/account.ts
@@ -175,6 +175,35 @@ export const account = {
         "The passphrase is gone from this computer, so automatic copies stopped. Turn them on again.",
     } as Record<string, string>,
   },
+  mobile: {
+    title: "Phone",
+    intro:
+      "Approve your bots' requests and answer their questions from anywhere. Chats and files stay only on this computer.",
+    needAccount: "Sign in to the account above to use the phone.",
+    warning:
+      "Whoever holds a connected phone, unlocked, can allow requests until you disconnect it.",
+    connect: "Connect a phone",
+    starting: "Preparing…",
+    qrLabel: "Code to scan with your phone",
+    scan: "Open your phone's camera and point it at this code.",
+    expires: (time: string) => `The code works for ${time} more.`,
+    expired: "The code ran out. Ask for a new one.",
+    cancel: "Cancel",
+    wants: (name: string) => `${name} wants to connect.`,
+    compare: (code: string) => `Check that the phone shows ${code} too, and only then connect it.`,
+    accept: "Connect",
+    refuse: "Not this one",
+    connecting: "Connecting…",
+    phones: "Connected phones",
+    none: "No phone connected yet.",
+    online: "Online now",
+    seen: (when: string) => `Seen ${when}`,
+    neverSeen: "Not seen yet",
+    disconnect: "Disconnect",
+    disconnectTitle: (name: string) => `Disconnect ${name}?`,
+    disconnectText: "The phone loses access right away. To use it again, connect it anew.",
+    failed: "Something went wrong",
+  },
   settings: {
     title: "Settings",
     background: "In the background",
diff --git a/app/src/i18n/en/index.ts b/app/src/i18n/en/index.ts
index fc900f23..570deaa9 100644
--- a/app/src/i18n/en/index.ts
+++ b/app/src/i18n/en/index.ts
@@ -13,6 +13,7 @@ import { desktop } from "./desktop";
 import { files } from "./files";
 import { messages } from "./messages";
 import { onboarding } from "./onboarding";
+import { phone } from "./phone";
 import { questions } from "./questions";
 import { routines } from "./routines";
 import { screens } from "./screens";
@@ -39,6 +40,7 @@ export const en = {
   desktop,
   files,
   messages,
+  phone,
   questions,
   routines,
   screens,
diff --git a/app/src/i18n/en/phone.ts b/app/src/i18n/en/phone.ts
new file mode 100644
index 00000000..eb98d41b
--- /dev/null
+++ b/app/src/i18n/en/phone.ts
@@ -0,0 +1,86 @@
+// The phone's page (spec 28.7): connecting it, and approving and answering
+// from it. What the bots ask is data and never passes through here.
+
+export const phone = {
+  pair: {
+    title: "Connect this phone",
+    intro:
+      "This phone will approve your bots' requests and answer their questions, from anywhere. Chats and files stay on your computer.",
+    nameLabel: "Name of this phone",
+    connect: "Connect",
+    connecting: "Connecting…",
+    compare: (code: string) =>
+      `Check that your computer shows ${code} too. Then press Connect on the computer.`,
+    waiting: "Waiting for you to accept on the computer…",
+    notALink:
+      "To connect a phone, point its camera at the code on your computer: Settings, Backup, Phone.",
+    expired: "The code ran out or was already used. Ask for a new one on the computer.",
+    offline: "Could not reach Botloft. Check the connection and try again.",
+    failed: "Could not connect. Ask for a new code on the computer.",
+    names: { iphone: "iPhone", ipad: "iPad", android: "Android phone", other: "Phone" },
+  },
+  inbox: {
+    title: "Waiting for you",
+    empty: "Nothing is waiting for you",
+    emptyBody: "When a bot needs you, it shows up here.",
+    loading: "Checking what is waiting…",
+    computerOff: "Your computer is off or has no internet. Requests keep waiting there.",
+    noConnection: "No connection. Trying again…",
+    thisPhone: "This phone",
+    inCrew: (crew: string) => `in ${crew}`,
+  },
+  approval: {
+    asks: (bot: string) => `${bot} asks to`,
+    explanationBy: (bot: string) => `${bot} wrote this`,
+    noExplanation: (bot: string) =>
+      `${bot} did not say what this is for. Consider denying it and asking.`,
+    showAll: "Show the whole request",
+    hideAll: "Hide it",
+    allow: "Allow",
+    deny: "Deny",
+    sending: "Sending…",
+    noteLabel: "Note for the bot (optional)",
+    cut: "Too long to read on a phone. You can deny it here, or answer it at the computer.",
+    atComputer: "This one needs you at the computer. Here you can only deny it.",
+    failed: "Not sent. Check the connection and try again.",
+    ended: { allowed: "Allowed", denied: "Denied", expired: "Ran out" },
+  },
+  question: {
+    asks: (bot: string) => `${bot} asks`,
+    pick: "Pick an answer",
+    answerLabel: "Your answer",
+    placeholder: "Write your answer",
+    send: "Answer",
+    sending: "Sending…",
+    dismiss: "Dismiss",
+    dismissHint: (bot: string) =>
+      `Closes the question without telling ${bot}. To let it know, answer instead.`,
+    failed: "Not sent. Check the connection and try again.",
+    ended: { answered: "You answered", dismissed: "Dismissed" },
+  },
+  settings: {
+    notices: {
+      turnOn: "Turn on notices",
+      turnOff: "Turn off notices",
+      on: "Notices are on. You get one when a bot needs you.",
+      off: "Notices are off.",
+      blocked: "Notices are blocked for this page. Allow them in the browser's settings.",
+      unsupported: "This browser cannot give notices.",
+    },
+    title: "This phone",
+    back: "Back",
+    name: "Name",
+    disconnect: "Disconnect this phone",
+    disconnectTitle: "Disconnect this phone?",
+    disconnectText:
+      "It stops receiving requests. To use it again, connect it anew on your computer.",
+    cancel: "Cancel",
+    install: "To get notices, add Botloft to your Home Screen: tap Share, then Add to Home Screen.",
+  },
+  cut: {
+    revokedTitle: "This phone was disconnected",
+    leftTitle: "Phone disconnected",
+    body: "To use it again, connect it from Botloft on your computer: Settings, Backup, Phone.",
+    ok: "OK",
+  },
+};
diff --git a/app/src/i18n/es/account.ts b/app/src/i18n/es/account.ts
index af957206..7c376c25 100644
--- a/app/src/i18n/es/account.ts
+++ b/app/src/i18n/es/account.ts
@@ -177,6 +177,37 @@ export const account: Messages["account"] = {
         "La contraseña ya no está en este equipo, así que las copias automáticas se detuvieron. Actívalas de nuevo.",
     } as Record<string, string>,
   },
+  mobile: {
+    title: "Móvil",
+    intro:
+      "Aprueba las solicitudes de tus bots y responde a sus preguntas desde cualquier lugar. Las conversaciones y los archivos se quedan solo en este ordenador.",
+    needAccount: "Inicia sesión en la cuenta de arriba para usar el móvil.",
+    warning:
+      "Quien tenga un móvil conectado y desbloqueado puede permitir solicitudes hasta que lo desconectes.",
+    connect: "Conectar un móvil",
+    starting: "Preparando…",
+    qrLabel: "Código para escanear con el móvil",
+    scan: "Abre la cámara del móvil y apúntala a este código.",
+    expires: (time: string) => `El código vale ${time} más.`,
+    expired: "El código venció. Pide otro.",
+    cancel: "Cancelar",
+    wants: (name: string) => `${name} quiere conectarse.`,
+    compare: (code: string) =>
+      `Comprueba que el móvil muestre ${code} también, y solo entonces conéctalo.`,
+    accept: "Conectar",
+    refuse: "No es este",
+    connecting: "Conectando…",
+    phones: "Móviles conectados",
+    none: "Todavía no hay ningún móvil conectado.",
+    online: "En línea ahora",
+    seen: (when: string) => `Visto ${when}`,
+    neverSeen: "Aún no visto",
+    disconnect: "Desconectar",
+    disconnectTitle: (name: string) => `¿Desconectar ${name}?`,
+    disconnectText:
+      "El móvil pierde el acceso al instante. Para usarlo de nuevo, conéctalo otra vez.",
+    failed: "Algo salió mal",
+  },
   settings: {
     title: "Configuración",
     background: "En segundo plano",
diff --git a/app/src/i18n/es/index.ts b/app/src/i18n/es/index.ts
index eb5c57b1..f566a000 100644
--- a/app/src/i18n/es/index.ts
+++ b/app/src/i18n/es/index.ts
@@ -14,6 +14,7 @@ import { desktop } from "./desktop";
 import { files } from "./files";
 import { messages } from "./messages";
 import { onboarding } from "./onboarding";
+import { phone } from "./phone";
 import { questions } from "./questions";
 import { routines } from "./routines";
 import { screens } from "./screens";
@@ -40,6 +41,7 @@ export const es: Messages = {
   desktop,
   files,
   messages,
+  phone,
   questions,
   routines,
   screens,
diff --git a/app/src/i18n/es/phone.ts b/app/src/i18n/es/phone.ts
new file mode 100644
index 00000000..05acadc5
--- /dev/null
+++ b/app/src/i18n/es/phone.ts
@@ -0,0 +1,88 @@
+// La página del móvil (spec 28.7).
+
+import type { Messages } from "../en";
+
+export const phone: Messages["phone"] = {
+  pair: {
+    title: "Conectar este móvil",
+    intro:
+      "Este móvil aprobará las solicitudes de tus bots y responderá a sus preguntas, desde cualquier lugar. Las conversaciones y los archivos se quedan en tu ordenador.",
+    nameLabel: "Nombre de este móvil",
+    connect: "Conectar",
+    connecting: "Conectando…",
+    compare: (code: string) =>
+      `Comprueba que el ordenador muestre ${code} también. Luego pulsa Conectar en el ordenador.`,
+    waiting: "Esperando a que aceptes en el ordenador…",
+    notALink:
+      "Para conectar un móvil, apunta su cámara al código que aparece en el ordenador: Ajustes, Copia de seguridad, Móvil.",
+    expired: "El código venció o ya se usó. Pide uno nuevo en el ordenador.",
+    offline: "No se pudo hablar con Botloft. Comprueba la conexión e inténtalo de nuevo.",
+    failed: "No se pudo conectar. Pide un código nuevo en el ordenador.",
+    names: { iphone: "iPhone", ipad: "iPad", android: "Móvil Android", other: "Móvil" },
+  },
+  inbox: {
+    title: "Esperándote",
+    empty: "Nada te está esperando",
+    emptyBody: "Cuando un bot te necesite, aparecerá aquí.",
+    loading: "Viendo qué está esperando…",
+    computerOff: "El ordenador está apagado o sin internet. Las solicitudes siguen esperando allí.",
+    noConnection: "Sin conexión. Intentando de nuevo…",
+    thisPhone: "Este móvil",
+    inCrew: (crew: string) => `en ${crew}`,
+  },
+  approval: {
+    asks: (bot: string) => `${bot} pide`,
+    explanationBy: (bot: string) => `${bot} escribió esto`,
+    noExplanation: (bot: string) => `${bot} no dijo para qué sirve. Conviene denegar y preguntar.`,
+    showAll: "Mostrar la solicitud entera",
+    hideAll: "Ocultar",
+    allow: "Permitir",
+    deny: "Denegar",
+    sending: "Enviando…",
+    noteLabel: "Nota para el bot (opcional)",
+    cut: "Demasiado larga para leerla en el móvil. Aquí solo puedes denegarla, o responderla en el ordenador.",
+    atComputer: "Esta solicitud te necesita en el ordenador. Aquí solo puedes denegarla.",
+    failed: "No se envió. Comprueba la conexión e inténtalo de nuevo.",
+    ended: { allowed: "Permitido", denied: "Denegado", expired: "Venció" },
+  },
+  question: {
+    asks: (bot: string) => `${bot} pregunta`,
+    pick: "Elige una respuesta",
+    answerLabel: "Tu respuesta",
+    placeholder: "Escribe tu respuesta",
+    send: "Responder",
+    sending: "Enviando…",
+    dismiss: "Descartar",
+    dismissHint: (bot: string) =>
+      `Cierra la pregunta sin avisar a ${bot}. Para que lo sepa, responde.`,
+    failed: "No se envió. Comprueba la conexión e inténtalo de nuevo.",
+    ended: { answered: "Respondiste", dismissed: "Descartada" },
+  },
+  settings: {
+    notices: {
+      turnOn: "Activar los avisos",
+      turnOff: "Desactivar los avisos",
+      on: "Los avisos están activados. Recibes uno cuando un bot te necesite.",
+      off: "Los avisos están desactivados.",
+      blocked:
+        "Los avisos están bloqueados para esta página. Permítelos en los ajustes del navegador.",
+      unsupported: "Este navegador no puede dar avisos.",
+    },
+    title: "Este móvil",
+    back: "Volver",
+    name: "Nombre",
+    disconnect: "Desconectar este móvil",
+    disconnectTitle: "¿Desconectar este móvil?",
+    disconnectText:
+      "Deja de recibir solicitudes. Para usarlo de nuevo, conéctalo otra vez en el ordenador.",
+    cancel: "Cancelar",
+    install:
+      "Para recibir avisos, añade Botloft a la pantalla de inicio: toca Compartir y luego Añadir a pantalla de inicio.",
+  },
+  cut: {
+    revokedTitle: "Este móvil fue desconectado",
+    leftTitle: "Móvil desconectado",
+    body: "Para usarlo de nuevo, conéctalo desde Botloft en el ordenador: Ajustes, Copia de seguridad, Móvil.",
+    ok: "OK",
+  },
+};
diff --git a/app/src/i18n/pt-BR/account.ts b/app/src/i18n/pt-BR/account.ts
index 66c01026..501b8663 100644
--- a/app/src/i18n/pt-BR/account.ts
+++ b/app/src/i18n/pt-BR/account.ts
@@ -177,6 +177,35 @@ export const account: Messages["account"] = {
         "A senha sumiu deste computador, então as cópias automáticas pararam. Ligue de novo.",
     } as Record<string, string>,
   },
+  mobile: {
+    title: "Celular",
+    intro:
+      "Aprove os pedidos dos seus bots e responda às perguntas deles de qualquer lugar. As conversas e os arquivos ficam só neste computador.",
+    needAccount: "Entre na conta acima para usar o celular.",
+    warning:
+      "Quem estiver com um celular conectado e desbloqueado pode permitir pedidos até você desconectá-lo.",
+    connect: "Conectar um celular",
+    starting: "Preparando…",
+    qrLabel: "Código para ler com o celular",
+    scan: "Abra a câmera do celular e aponte para este código.",
+    expires: (time: string) => `O código vale por mais ${time}.`,
+    expired: "O código venceu. Peça outro.",
+    cancel: "Cancelar",
+    wants: (name: string) => `${name} quer se conectar.`,
+    compare: (code: string) => `Confira se o celular mostra ${code} também, e só então conecte.`,
+    accept: "Conectar",
+    refuse: "Não é este",
+    connecting: "Conectando…",
+    phones: "Celulares conectados",
+    none: "Nenhum celular conectado ainda.",
+    online: "Online agora",
+    seen: (when: string) => `Visto ${when}`,
+    neverSeen: "Ainda não visto",
+    disconnect: "Desconectar",
+    disconnectTitle: (name: string) => `Desconectar ${name}?`,
+    disconnectText: "O celular perde o acesso na hora. Para usar de novo, conecte outra vez.",
+    failed: "Algo deu errado",
+  },
   settings: {
     title: "Configurações",
     background: "Em segundo plano",
diff --git a/app/src/i18n/pt-BR/index.ts b/app/src/i18n/pt-BR/index.ts
index 3dd9eb77..e3b376db 100644
--- a/app/src/i18n/pt-BR/index.ts
+++ b/app/src/i18n/pt-BR/index.ts
@@ -14,6 +14,7 @@ import { desktop } from "./desktop";
 import { files } from "./files";
 import { messages } from "./messages";
 import { onboarding } from "./onboarding";
+import { phone } from "./phone";
 import { questions } from "./questions";
 import { routines } from "./routines";
 import { screens } from "./screens";
@@ -40,6 +41,7 @@ export const ptBR: Messages = {
   desktop,
   files,
   messages,
+  phone,
   questions,
   routines,
   screens,
diff --git a/app/src/i18n/pt-BR/phone.ts b/app/src/i18n/pt-BR/phone.ts
new file mode 100644
index 00000000..97bba213
--- /dev/null
+++ b/app/src/i18n/pt-BR/phone.ts
@@ -0,0 +1,87 @@
+// A página do celular (spec 28.7).
+
+import type { Messages } from "../en";
+
+export const phone: Messages["phone"] = {
+  pair: {
+    title: "Conectar este celular",
+    intro:
+      "Este celular vai aprovar os pedidos dos seus bots e responder às perguntas deles, de qualquer lugar. As conversas e os arquivos ficam no seu computador.",
+    nameLabel: "Nome deste celular",
+    connect: "Conectar",
+    connecting: "Conectando…",
+    compare: (code: string) =>
+      `Confira se o computador mostra ${code} também. Depois aperte Conectar no computador.`,
+    waiting: "Esperando você aceitar no computador…",
+    notALink:
+      "Para conectar um celular, aponte a câmera dele para o código que aparece no computador: Configurações, Cópia de segurança, Celular.",
+    expired: "O código venceu ou já foi usado. Peça um novo no computador.",
+    offline: "Não foi possível falar com o Botloft. Confira a conexão e tente de novo.",
+    failed: "Não foi possível conectar. Peça um novo código no computador.",
+    names: { iphone: "iPhone", ipad: "iPad", android: "Celular Android", other: "Celular" },
+  },
+  inbox: {
+    title: "Esperando você",
+    empty: "Nada esperando você",
+    emptyBody: "Quando um bot precisar de você, aparece aqui.",
+    loading: "Vendo o que está esperando…",
+    computerOff: "O computador está desligado ou sem internet. Os pedidos continuam esperando lá.",
+    noConnection: "Sem conexão. Tentando de novo…",
+    thisPhone: "Este celular",
+    inCrew: (crew: string) => `em ${crew}`,
+  },
+  approval: {
+    asks: (bot: string) => `${bot} pede para`,
+    explanationBy: (bot: string) => `${bot} escreveu isto`,
+    noExplanation: (bot: string) => `${bot} não disse para que serve. Vale negar e perguntar.`,
+    showAll: "Mostrar o pedido inteiro",
+    hideAll: "Esconder",
+    allow: "Permitir",
+    deny: "Negar",
+    sending: "Enviando…",
+    noteLabel: "Recado para o bot (opcional)",
+    cut: "Longo demais para ler no celular. Aqui você só pode negar, ou responder no computador.",
+    atComputer: "Este pedido precisa de você no computador. Aqui você só pode negar.",
+    failed: "Não foi enviado. Confira a conexão e tente de novo.",
+    ended: { allowed: "Permitido", denied: "Negado", expired: "Venceu" },
+  },
+  question: {
+    asks: (bot: string) => `${bot} pergunta`,
+    pick: "Escolha uma resposta",
+    answerLabel: "Sua resposta",
+    placeholder: "Escreva sua resposta",
+    send: "Responder",
+    sending: "Enviando…",
+    dismiss: "Descartar",
+    dismissHint: (bot: string) => `Fecha a pergunta sem avisar ${bot}. Para ele saber, responda.`,
+    failed: "Não foi enviado. Confira a conexão e tente de novo.",
+    ended: { answered: "Você respondeu", dismissed: "Descartada" },
+  },
+  settings: {
+    notices: {
+      turnOn: "Ligar os avisos",
+      turnOff: "Desligar os avisos",
+      on: "Os avisos estão ligados. Você recebe um quando um bot precisar de você.",
+      off: "Os avisos estão desligados.",
+      blocked:
+        "Os avisos estão bloqueados para esta página. Libere nas configurações do navegador.",
+      unsupported: "Este navegador não consegue dar avisos.",
+    },
+    title: "Este celular",
+    back: "Voltar",
+    name: "Nome",
+    disconnect: "Desconectar este celular",
+    disconnectTitle: "Desconectar este celular?",
+    disconnectText:
+      "Ele deixa de receber pedidos. Para usar de novo, conecte outra vez no computador.",
+    cancel: "Cancelar",
+    install:
+      "Para receber avisos, ponha o Botloft na tela inicial: toque em Compartilhar e depois em Adicionar à Tela de Início.",
+  },
+  cut: {
+    revokedTitle: "Este celular foi desconectado",
+    leftTitle: "Celular desconectado",
+    body: "Para usar de novo, conecte pelo Botloft no computador: Configurações, Cópia de segurança, Celular.",
+    ok: "OK",
+  },
+};
diff --git a/app/src/lib/fake.ts b/app/src/lib/fake.ts
index 5e41da56..8d200dba 100644
--- a/app/src/lib/fake.ts
+++ b/app/src/lib/fake.ts
@@ -18,6 +18,7 @@ import { FakeDesktop } from "./fakeDesktop";
 import { FakeFiles } from "./fakeFiles";
 import { FakeLesson } from "./fakeLesson";
 import { FakeMcp } from "./fakeMcp";
+import { mobileHandlers } from "./fakeMobile";
 import { FakeQuestions } from "./fakeQuestions";
 import { FakeReactions } from "./fakeReactions";
 import { FakeRoutines } from "./fakeRoutines";
@@ -293,6 +294,7 @@ export class FakeBotloft implements BotloftApi {
     ...backupHandlers(this),
     ...cloudHandlers(this),
     ...autoBackupHandlers(this),
+    ...mobileHandlers(this),
     ...searchHandlers(this),
   };
 }
diff --git a/app/src/lib/fakeCloud.ts b/app/src/lib/fakeCloud.ts
index 0db3d9b6..fa4d5771 100644
--- a/app/src/lib/fakeCloud.ts
+++ b/app/src/lib/fakeCloud.ts
@@ -4,6 +4,7 @@
 
 import type { FakeBotloft, Handlers } from "./fake";
 import { turnOffFakeAutoBackup } from "./fakeAutoBackup";
+import { forgetFakePhones } from "./fakeMobile";
 import { type CloudCopy, type CloudStatus, RpcErrorCode } from "./protocol.gen";
 import { RpcError } from "./rpc";
 
@@ -41,6 +42,11 @@ function signedIn(state: CloudState): void {
   if (!state.signedIn) throw refused("not_signed_in", "sign in to the account first");
 }
 
+/** Whether the fake is signed in to the account. */
+export function fakeSignedIn(fake: FakeBotloft): boolean {
+  return stateOf(fake).signedIn;
+}
+
 /** The owner opens the link in the e-mail: the waiting sign-in finishes. */
 export function openFakeCloudLink(fake: FakeBotloft): void {
   const state = stateOf(fake);
@@ -87,6 +93,7 @@ export function cloudHandlers(fake: FakeBotloft): Pick<Handlers, CloudMethods> {
     },
     "cloud.signout": () => {
       turnOffFakeAutoBackup(fake);
+      forgetFakePhones(fake);
       state.signedIn = false;
       state.email = null;
       state.pending = null;
diff --git a/app/src/lib/fakeMobile.test.ts b/app/src/lib/fakeMobile.test.ts
new file mode 100644
index 00000000..ff124c26
--- /dev/null
+++ b/app/src/lib/fakeMobile.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { FakeBotloft } from "./fake";
+import { openFakeCloudLink } from "./fakeCloud";
+import { joinFakePhone } from "./fakeMobile";
+
+describe("the fake's phones", () => {
+  it("needs the account, shows the code a phone brings, connects it and cuts it off", async () => {
+    const fake = new FakeBotloft();
+    const seen: string[] = [];
+    fake.subscribe((event) => seen.push(event.name));
+
+    await expect(fake.call("mobile.pair_start")).rejects.toMatchObject({ reason: "not_signed_in" });
+    await fake.call("cloud.signin", { email: "ana@exemplo.com" });
+    openFakeCloudLink(fake);
+
+    const started = await fake.call("mobile.pair_start");
+    expect(started.url).toContain("#p=");
+    expect((await fake.call("mobile.status")).pending?.pairId).toBe(started.pairId);
+    await expect(
+      fake.call("mobile.pair_confirm", { pairId: started.pairId, accept: true }),
+    ).rejects.toMatchObject({ reason: "conflict" });
+
+    joinFakePhone(fake, "Celular da Ana", "482913");
+    expect(seen).toContain("mobile.pair_request");
+    expect((await fake.call("mobile.status")).pending?.joined).toEqual({
+      name: "Celular da Ana",
+      code: "482913",
+    });
+    await fake.call("mobile.pair_confirm", { pairId: started.pairId, accept: true });
+    const status = await fake.call("mobile.status");
+    expect(status.pending).toBeUndefined();
+    expect(status.phones).toHaveLength(1);
+    expect(status.phones[0]?.name).toBe("Celular da Ana");
+
+    const gone = await fake.call("mobile.revoke", { phoneId: status.phones[0]?.id ?? "" });
+    expect(gone.phones).toEqual([]);
+    await expect(fake.call("mobile.revoke", { phoneId: "dev_none" })).rejects.toMatchObject({
+      reason: "not_found",
+    });
+  });
+
+  it("is cleared when the account is left", async () => {
+    const fake = new FakeBotloft();
+    await fake.call("cloud.signin", { email: "ana@exemplo.com" });
+    openFakeCloudLink(fake);
+    const started = await fake.call("mobile.pair_start");
+    joinFakePhone(fake);
+    await fake.call("mobile.pair_confirm", { pairId: started.pairId, accept: true });
+    await fake.call("cloud.signout");
+    expect((await fake.call("mobile.status")).phones).toEqual([]);
+  });
+});
diff --git a/app/src/lib/fakeMobile.ts b/app/src/lib/fakeMobile.ts
new file mode 100644
index 00000000..0e8987bd
--- /dev/null
+++ b/app/src/lib/fakeMobile.ts
@@ -0,0 +1,121 @@
+// The fake daemon's phones (spec 28), in memory. A code on screen waits until
+// `joinFakePhone` plays a phone scanning it; nothing leaves the page.
+
+import type { FakeBotloft, Handlers } from "./fake";
+import { fakeSignedIn } from "./fakeCloud";
+import {
+  type MobilePairing,
+  type MobilePhone,
+  type MobileStatus,
+  RpcErrorCode,
+} from "./protocol.gen";
+import { RpcError } from "./rpc";
+
+type MobileMethods = Extract<keyof Handlers, `mobile.${string}`>;
+
+const EXPIRES_IN = 300;
+
+interface MobileState {
+  phones: MobilePhone[];
+  pending: MobilePairing | null;
+  next: number;
+}
+
+const states = new WeakMap<FakeBotloft, MobileState>();
+
+function stateOf(fake: FakeBotloft): MobileState {
+  let state = states.get(fake);
+  if (!state) {
+    state = { phones: [], pending: null, next: 1 };
+    states.set(fake, state);
+  }
+  return state;
+}
+
+function refused(code: number, reason: string, message: string): RpcError {
+  return new RpcError(code, message, reason);
+}
+
+function statusOf(fake: FakeBotloft): MobileStatus {
+  const state = stateOf(fake);
+  const status: MobileStatus = {
+    relay: state.phones.length > 0 || state.pending ? "connected" : "off",
+    phones: state.phones.map((phone) => ({ ...phone })),
+  };
+  if (state.pending) status.pending = { ...state.pending };
+  return status;
+}
+
+function told(fake: FakeBotloft): MobileStatus {
+  const status = statusOf(fake);
+  fake.emit({ name: "mobile.changed", params: status });
+  return status;
+}
+
+/** A phone scans the code on screen and shows `code` to be compared. */
+export function joinFakePhone(fake: FakeBotloft, name = "Celular da Ana", code = "482913"): void {
+  const { pending } = stateOf(fake);
+  if (!pending) return;
+  pending.joined = { name, code };
+  fake.emit({ name: "mobile.pair_request", params: { pairId: pending.pairId, name, code } });
+  told(fake);
+}
+
+/** Signing out of the account takes every phone with it. */
+export function forgetFakePhones(fake: FakeBotloft): void {
+  const state = stateOf(fake);
+  state.phones = [];
+  state.pending = null;
+}
+
+export function mobileHandlers(fake: FakeBotloft): Pick<Handlers, MobileMethods> {
+  const state = stateOf(fake);
+  return {
+    "mobile.status": () => statusOf(fake),
+    "mobile.pair_start": () => {
+      if (!fakeSignedIn(fake)) {
+        throw refused(RpcErrorCode.validation, "not_signed_in", "sign in to the account first");
+      }
+      const pairId = `pair${state.next++}`;
+      state.pending = { pairId, expiresAt: fake.now + EXPIRES_IN * 1000 };
+      told(fake);
+      return {
+        pairId,
+        url: `https://cloud.botloft.example/m#p=${pairId}&s=secret&d=key`,
+        expiresIn: EXPIRES_IN,
+      };
+    },
+    "mobile.pair_cancel": ({ pairId }) => {
+      if (state.pending?.pairId === pairId) {
+        state.pending = null;
+        told(fake);
+      }
+      return null;
+    },
+    "mobile.pair_confirm": ({ pairId, accept }) => {
+      const pending = state.pending;
+      if (!pending || pending.pairId !== pairId || !pending.joined) {
+        throw refused(RpcErrorCode.conflict, "conflict", "there is no phone waiting on that code");
+      }
+      state.pending = null;
+      if (accept) {
+        state.phones.push({
+          id: `dev_phone${state.next++}`,
+          name: pending.joined.name,
+          pairedAt: fake.now,
+          online: true,
+        });
+      }
+      told(fake);
+      return null;
+    },
+    "mobile.revoke": ({ phoneId }) => {
+      const before = state.phones.length;
+      state.phones = state.phones.filter((phone) => phone.id !== phoneId);
+      if (state.phones.length === before) {
+        throw refused(RpcErrorCode.notFound, "not_found", `phone ${phoneId}`);
+      }
+      return told(fake);
+    },
+  };
+}
diff --git a/app/src/lib/protocol.gen.ts b/app/src/lib/protocol.gen.ts
index b1742d49..218e2f5a 100644
--- a/app/src/lib/protocol.gen.ts
+++ b/app/src/lib/protocol.gen.ts
@@ -1341,6 +1341,128 @@ export type AutoBackupEnableParams = { passphrase: string, every: AutoBackupEver
  */
 export type AutoBackupEveryParams = { every: AutoBackupEvery, };
 
+/**
+ * Whether the computer's connection to the relay is up.
+ */
+export type MobileRelay = "off" | "connecting" | "connected";
+
+/**
+ * A phone the owner connected.
+ */
+export type MobilePhone = { id: string, name: string, 
+/**
+ * Unix time in milliseconds.
+ */
+pairedAt: number, 
+/**
+ * When the phone last sent anything, in Unix milliseconds.
+ */
+lastSeenAt?: number, online: boolean, };
+
+/**
+ * A phone that opened the QR code and waits for the owner to compare the
+ * code and accept it.
+ */
+export type MobileJoined = { name: string, 
+/**
+ * Six digits, the same on the phone's screen.
+ */
+code: string, };
+
+/**
+ * A QR code on screen.
+ */
+export type MobilePairing = { pairId: string, 
+/**
+ * Unix time in milliseconds the code stops working.
+ */
+expiresAt: number, joined?: MobileJoined, };
+
+/**
+ * `mobile.status`, and the `mobile.changed` notification.
+ */
+export type MobileStatus = { relay: MobileRelay, phones: Array<MobilePhone>, pending?: MobilePairing, };
+
+/**
+ * `mobile.pair_start`: what the QR code carries.
+ */
+export type MobilePairStarted = { pairId: string, 
+/**
+ * The address the QR code holds, `#` and all.
+ */
+url: string, 
+/**
+ * Seconds the code works.
+ */
+expiresIn: number, };
+
+/**
+ * `mobile.pair_cancel`.
+ */
+export type MobilePairIdParams = { pairId: string, };
+
+/**
+ * `mobile.pair_confirm`: the owner compared the codes.
+ */
+export type MobilePairConfirmParams = { pairId: string, accept: boolean, };
+
+/**
+ * `mobile.revoke`.
+ */
+export type MobileRevokeParams = { phoneId: string, };
+
+/**
+ * The `mobile.pair_request` notification: a phone opened the code.
+ */
+export type MobilePairRequest = { pairId: string, name: string, code: string, };
+
+/**
+ * The bot that asks, as the phone shows it.
+ */
+export type CardBot = { name: string, color: string, };
+
+/**
+ * A request waiting for the owner, as the phone shows it (spec 28.5). It
+ * carries what the owner needs to decide, and nothing else of the bot.
+ */
+export type ApprovalCard = { approvalId: ApprovalId, bot: CardBot, crew: string, 
+/**
+ * Unix time in milliseconds.
+ */
+createdAt: number, toolName: string, summary: string, 
+/**
+ * What the bot says the command is for; the bot wrote it.
+ */
+explanation?: string, 
+/**
+ * The command, the plan or the request, whole unless `cut`.
+ */
+text: string, 
+/**
+ * `text` is not the whole request: the phone may only deny it.
+ */
+cut: boolean, 
+/**
+ * The request is of a kind that is answered at the computer: the phone
+ * may only deny it.
+ */
+atComputer: boolean, };
+
+/**
+ * A question waiting for the owner, as the phone shows it.
+ */
+export type QuestionCard = { questionId: QuestionId, bot: CardBot, crew: string, createdAt: number, text: string, options: Array<string>, };
+
+/**
+ * What the computer sends the phone, sealed (spec 28.3).
+ */
+export type ToPhone = { "t": "snapshot", approvals: Array<ApprovalCard>, questions: Array<QuestionCard>, } | { "t": "approval.open", card: ApprovalCard, } | { "t": "approval.closed", approvalId: ApprovalId, status: ApprovalStatus, } | { "t": "question.open", card: QuestionCard, } | { "t": "question.closed", questionId: QuestionId, status: QuestionStatus, };
+
+/**
+ * What the phone sends the computer, sealed (spec 28.3).
+ */
+export type FromPhone = { "t": "sync" } | { "t": "approval.answer", approvalId: ApprovalId, allow: boolean, note?: string, } | { "t": "question.answer", questionId: QuestionId, answer: string, } | { "t": "question.dismiss", questionId: QuestionId, };
+
 export type ApprovalItem = { approvalId: ApprovalId, toolName: string, summary: string, 
 /**
  * What the bot says the command is for, as in `ToolItem`. The bot
@@ -2064,6 +2186,11 @@ export interface RpcMethods {
   "autobackup.enable": { params: AutoBackupEnableParams; result: AutoBackupStatus };
   "autobackup.set_every": { params: AutoBackupEveryParams; result: AutoBackupStatus };
   "autobackup.disable": { params: undefined; result: AutoBackupStatus };
+  "mobile.status": { params: undefined; result: MobileStatus };
+  "mobile.pair_start": { params: undefined; result: MobilePairStarted };
+  "mobile.pair_cancel": { params: MobilePairIdParams; result: null };
+  "mobile.pair_confirm": { params: MobilePairConfirmParams; result: null };
+  "mobile.revoke": { params: MobileRevokeParams; result: MobileStatus };
   "routines.list": { params: RoutinesListParams; result: Array<Routine> };
   "routines.create": { params: RoutinesCreateParams; result: Routine };
   "routines.update": { params: RoutinesUpdateParams; result: Routine };
@@ -2123,6 +2250,8 @@ export interface RpcNotifications {
   "cloud.progress": CloudProgress;
   "cloud.signin_expired": null;
   "autobackup.changed": AutoBackupStatus;
+  "mobile.changed": MobileStatus;
+  "mobile.pair_request": MobilePairRequest;
   "browser.changed": BrowserState;
   "browser.action": BrowserAction;
   "browser.frame": BrowserFrame;
diff --git a/app/src/phone/ApprovalView.tsx b/app/src/phone/ApprovalView.tsx
new file mode 100644
index 00000000..10b4aae2
--- /dev/null
+++ b/app/src/phone/ApprovalView.tsx
@@ -0,0 +1,110 @@
+// A request waiting for the owner, as the phone shows it (spec 28.5, 28.7):
+// what the bot wants, what it says it is for, the whole request a tap away,
+// and Allow or Deny. Allow is off for what is cut or belongs to the computer.
+
+import { useState } from "react";
+import { useT } from "../i18n";
+import { when } from "../lib/format";
+import type { ApprovalCard } from "../lib/protocol.gen";
+import { Callout } from "../ui/Callout";
+import { BotDot, PhoneButton } from "./parts";
+
+export function ApprovalView({
+  card,
+  sending,
+  answer,
+}: {
+  card: ApprovalCard;
+  sending: boolean;
+  /** False if the answer could not be sent. */
+  answer(allow: boolean, note?: string): Promise<boolean>;
+}) {
+  const t = useT().phone;
+  const a = t.approval;
+  const [all, setAll] = useState(false);
+  const [note, setNote] = useState("");
+  const [failed, setFailed] = useState(false);
+  const [pressed, setPressed] = useState<boolean | null>(null);
+
+  const send = async (allow: boolean) => {
+    setFailed(false);
+    setPressed(allow);
+    const sent = await answer(allow, note);
+    setFailed(!sent);
+  };
+  const canAllow = !card.cut && !card.atComputer;
+
+  return (
+    <article className="flex flex-col gap-3 rounded-2xl border border-line bg-panel p-4">
+      <header className="flex items-center gap-3">
+        <BotDot name={card.bot.name} color={card.bot.color} />
+        <div className="min-w-0">
+          <p className="truncate font-semibold">{card.bot.name}</p>
+          <p className="truncate text-muted text-xs">
+            {t.inbox.inCrew(card.crew)} · {when(card.createdAt)}
+          </p>
+        </div>
+      </header>
+
+      <div>
+        <p className="text-muted text-sm">{a.asks(card.bot.name)}</p>
+        <p className="break-words font-medium text-base">{card.summary || card.toolName}</p>
+      </div>
+
+      {card.explanation ? (
+        <div className="rounded-xl bg-sunken px-3 py-2.5">
+          <p className="whitespace-pre-wrap break-words text-base">{card.explanation}</p>
+          <p className="mt-1 text-muted text-xs">{a.explanationBy(card.bot.name)}</p>
+        </div>
+      ) : (
+        canAllow && <Callout tone="warn" title={a.noExplanation(card.bot.name)} />
+      )}
+
+      <div>
+        <button
+          type="button"
+          aria-expanded={all}
+          onClick={() => setAll(!all)}
+          className="min-h-11 font-medium text-work text-sm underline underline-offset-2"
+        >
+          {all ? a.hideAll : a.showAll}
+        </button>
+        {all && (
+          <pre
+            data-selectable
+            className="mt-1 max-h-72 overflow-auto whitespace-pre-wrap break-words rounded-xl bg-sunken p-3 font-mono text-sm"
+          >
+            {card.text}
+          </pre>
+        )}
+      </div>
+
+      {card.cut && <Callout tone="warn" title={a.cut} />}
+      {!card.cut && card.atComputer && <Callout tone="warn" title={a.atComputer} />}
+
+      <label className="flex flex-col gap-1 text-muted text-sm">
+        {a.noteLabel}
+        <input
+          value={note}
+          maxLength={500}
+          onChange={(event) => setNote(event.target.value)}
+          className="h-12 rounded-xl border border-line-strong bg-canvas px-3 text-base text-ink"
+        />
+      </label>
+
+      <div className="flex gap-3">
+        <PhoneButton look="primary" disabled={!canAllow || sending} onClick={() => send(true)}>
+          {sending && pressed === true ? a.sending : a.allow}
+        </PhoneButton>
+        <PhoneButton look="danger" disabled={sending} onClick={() => send(false)}>
+          {sending && pressed === false ? a.sending : a.deny}
+        </PhoneButton>
+      </div>
+      {failed && (
+        <p role="alert" className="text-danger text-sm">
+          {a.failed}
+        </p>
+      )}
+    </article>
+  );
+}
diff --git a/app/src/phone/NoticesControl.tsx b/app/src/phone/NoticesControl.tsx
new file mode 100644
index 00000000..96d69aa4
--- /dev/null
+++ b/app/src/phone/NoticesControl.tsx
@@ -0,0 +1,60 @@
+// Notices on this phone (spec 28.8): an invitation on the inbox while they
+// are off, and the whole control on the page about this phone.
+
+import { useEffect, useState } from "react";
+import { useT } from "../i18n";
+import type { PhoneApi } from "./client";
+import type { NoticeState } from "./notices";
+import { PhoneButton } from "./parts";
+
+export function Notices({ api, invite = false }: { api: PhoneApi; invite?: boolean }) {
+  const n = useT().phone.settings.notices;
+  const [state, setState] = useState<NoticeState | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  useEffect(() => {
+    let live = true;
+    void api.noticeState().then((now) => live && setState(now));
+    return () => {
+      live = false;
+    };
+  }, [api]);
+
+  const change = async (work: () => Promise<NoticeState>) => {
+    setBusy(true);
+    setState(await work());
+    setBusy(false);
+  };
+
+  // The Home Screen has its own words, and nothing else is for the inbox.
+  if (state === null || state === "home-screen" || (invite && state !== "off")) {
+    return null;
+  }
+  return (
+    <div className="flex flex-col gap-2">
+      {!invite && state === "on" && <p className="text-ink-soft text-sm">{n.on}</p>}
+      {!invite && state === "off" && <p className="text-ink-soft text-sm">{n.off}</p>}
+      {state === "blocked" && <p className="text-ink-soft text-sm">{n.blocked}</p>}
+      {state === "unsupported" && <p className="text-muted text-sm">{n.unsupported}</p>}
+      {state === "off" && (
+        <PhoneButton
+          look={invite ? "quiet" : "primary"}
+          disabled={busy}
+          onClick={() => change(api.turnOnNotices)}
+          className="flex-none"
+        >
+          {n.turnOn}
+        </PhoneButton>
+      )}
+      {!invite && state === "on" && (
+        <PhoneButton
+          disabled={busy}
+          onClick={() => change(api.turnOffNotices)}
+          className="flex-none"
+        >
+          {n.turnOff}
+        </PhoneButton>
+      )}
+    </div>
+  );
+}
diff --git a/app/src/phone/PairScreen.tsx b/app/src/phone/PairScreen.tsx
new file mode 100644
index 00000000..b21359e6
--- /dev/null
+++ b/app/src/phone/PairScreen.tsx
@@ -0,0 +1,98 @@
+// Connecting this phone (spec 28.3, 28.7): the owner scanned the code on the
+// computer. Here the phone gets a name, joins, shows six digits to compare
+// with the computer's, and waits for the owner to accept there.
+
+import { useState } from "react";
+import { useT } from "../i18n";
+import { Callout } from "../ui/Callout";
+import { type Pair, PairError, type PairFailure } from "./pair";
+import { PhoneButton } from "./parts";
+import type { Session } from "./store";
+
+/** A name to start from, by the kind of phone this is. */
+export function guessName(
+  names: { iphone: string; ipad: string; android: string; other: string },
+  agent = typeof navigator === "undefined" ? "" : navigator.userAgent,
+): string {
+  if (/iPhone|iPod/.test(agent)) {
+    return names.iphone;
+  }
+  if (/iPad/.test(agent)) {
+    return names.ipad;
+  }
+  return /Android/.test(agent) ? names.android : names.other;
+}
+
+const spaced = (code: string) => `${code.slice(0, 3)} ${code.slice(3)}`;
+
+export function PairScreen({
+  pair,
+  onSession,
+}: {
+  /** `null` when the page was not opened from a code. */
+  pair: Pair | null;
+  onSession(session: Session): void;
+}) {
+  const t = useT().phone;
+  const p = t.pair;
+  const [name, setName] = useState(() => guessName(p.names));
+  const [step, setStep] = useState<"form" | "joining" | "waiting">("form");
+  const [code, setCode] = useState("");
+  const [failure, setFailure] = useState<PairFailure | null>(null);
+
+  const connect = async () => {
+    if (!pair) {
+      return;
+    }
+    setFailure(null);
+    setStep("joining");
+    try {
+      const joined = await pair.join(name.trim() || guessName(p.names));
+      setCode(joined.code);
+      setStep("waiting");
+      onSession(await joined.collect());
+    } catch (error) {
+      setFailure(error instanceof PairError ? error.reason : "failed");
+      setStep("form");
+    }
+  };
+
+  return (
+    <main className="mx-auto flex min-h-full w-full max-w-md flex-col gap-4 px-4 pt-[max(2rem,env(safe-area-inset-top))] pb-[max(2rem,env(safe-area-inset-bottom))]">
+      <h1 className="font-semibold text-xl">{p.title}</h1>
+      {!pair ? (
+        <p className="text-ink-soft">{p.notALink}</p>
+      ) : step === "waiting" ? (
+        <>
+          <p className="font-mono text-4xl tracking-[0.2em]">{spaced(code)}</p>
+          <p className="text-ink-soft">{p.compare(spaced(code))}</p>
+          <p role="status" className="text-muted text-sm">
+            {p.waiting}
+          </p>
+        </>
+      ) : (
+        <>
+          <p className="text-ink-soft">{p.intro}</p>
+          <label className="flex flex-col gap-1 text-muted text-sm">
+            {p.nameLabel}
+            <input
+              value={name}
+              maxLength={60}
+              onChange={(event) => setName(event.target.value)}
+              className="h-12 rounded-xl border border-line-strong bg-canvas px-3 text-base text-ink"
+            />
+          </label>
+          <PhoneButton
+            look="primary"
+            disabled={step === "joining"}
+            onClick={connect}
+            className="flex-none"
+          >
+            {step === "joining" ? p.connecting : p.connect}
+          </PhoneButton>
+          {failure && <Callout tone="danger" title={p[failure]} />}
+        </>
+      )}
+    </main>
+  );
+}
diff --git a/app/src/phone/PhoneApp.tsx b/app/src/phone/PhoneApp.tsx
new file mode 100644
index 00000000..9039b7b5
--- /dev/null
+++ b/app/src/phone/PhoneApp.tsx
@@ -0,0 +1,153 @@
+// The phone's page once it is connected (spec 28.7): what waits for the
+// owner, oldest first, and a small screen about this phone.
+
+import { Settings, Smartphone } from "lucide-react";
+import { useState, useSyncExternalStore } from "react";
+import { useT } from "../i18n";
+import { Callout } from "../ui/Callout";
+import { Confirm } from "../ui/Confirm";
+import { ApprovalView } from "./ApprovalView";
+import type { PhoneApi } from "./client";
+import { Notices } from "./NoticesControl";
+import { PhoneButton } from "./parts";
+import { QuestionView } from "./QuestionView";
+
+export function usePhone(api: PhoneApi) {
+  return useSyncExternalStore(api.subscribe, api.getState);
+}
+
+/** Safari on an iPhone gives notices only to a page on the Home Screen. */
+function needsHomeScreen(): boolean {
+  if (typeof navigator === "undefined") {
+    return false;
+  }
+  const ios = /iPad|iPhone|iPod/.test(navigator.userAgent);
+  const standalone = (navigator as Navigator & { standalone?: boolean }).standalone === true;
+  return ios && !standalone && !window.matchMedia?.("(display-mode: standalone)").matches;
+}
+
+export function PhoneApp({ api, onGone }: { api: PhoneApi; onGone?(): void }) {
+  const t = useT().phone;
+  const state = usePhone(api);
+  const [view, setView] = useState<"inbox" | "phone">("inbox");
+
+  if (state.session !== "ok") {
+    return (
+      <Shell>
+        <div className="flex flex-col gap-4 pt-10">
+          <h1 className="font-semibold text-xl">
+            {state.session === "revoked" ? t.cut.revokedTitle : t.cut.leftTitle}
+          </h1>
+          <p className="text-ink-soft">{t.cut.body}</p>
+          <PhoneButton
+            look="primary"
+            onClick={() => void api.disconnect().then(() => onGone?.())}
+            className="flex-none"
+          >
+            {t.cut.ok}
+          </PhoneButton>
+        </div>
+      </Shell>
+    );
+  }
+  if (view === "phone") {
+    return <ThisPhone api={api} name={state.name} back={() => setView("inbox")} />;
+  }
+
+  const waiting = state.approvals.length + state.questions.length;
+  return (
+    <Shell>
+      <header className="flex items-center justify-between gap-3 py-2">
+        <h1 className="font-semibold text-xl">{t.inbox.title}</h1>
+        <button
+          type="button"
+          aria-label={t.inbox.thisPhone}
+          onClick={() => setView("phone")}
+          className="inline-flex h-11 w-11 items-center justify-center rounded-xl text-ink-soft"
+        >
+          <Settings aria-hidden size={20} />
+        </button>
+      </header>
+
+      {state.computer === "offline" && <Callout tone="warn" title={t.inbox.computerOff} />}
+      {state.link !== "online" && <Callout tone="info" title={t.inbox.noConnection} />}
+      {needsHomeScreen() && <Callout tone="info" title={t.settings.install} />}
+      <Notices api={api} invite />
+
+      <div className="flex flex-col gap-4">
+        {state.approvals.map((card) => (
+          <ApprovalView
+            key={card.approvalId}
+            card={card}
+            sending={state.sending.includes(card.approvalId)}
+            answer={(allow, note) => api.answerApproval(card.approvalId, allow, note)}
+          />
+        ))}
+        {state.questions.map((card) => (
+          <QuestionView
+            key={card.questionId}
+            card={card}
+            sending={state.sending.includes(card.questionId)}
+            answer={(text) => api.answerQuestion(card.questionId, text)}
+            dismiss={() => api.dismissQuestion(card.questionId)}
+          />
+        ))}
+        {waiting === 0 && (
+          <div className="flex flex-col items-center gap-2 py-16 text-center">
+            <Smartphone aria-hidden size={28} className="text-muted" />
+            {state.loaded || state.computer === "offline" ? (
+              <>
+                <p className="font-medium text-base">{t.inbox.empty}</p>
+                <p className="text-muted text-sm">{t.inbox.emptyBody}</p>
+              </>
+            ) : (
+              <p className="text-muted text-sm">{t.inbox.loading}</p>
+            )}
+          </div>
+        )}
+      </div>
+    </Shell>
+  );
+}
+
+function Shell({ children }: { children: React.ReactNode }) {
+  return (
+    <main className="mx-auto flex min-h-full w-full max-w-md flex-col gap-4 px-4 pt-[max(1rem,env(safe-area-inset-top))] pb-[max(2rem,env(safe-area-inset-bottom))]">
+      {children}
+    </main>
+  );
+}
+
+function ThisPhone({ api, name, back }: { api: PhoneApi; name: string; back(): void }) {
+  const t = useT().phone;
+  const [leaving, setLeaving] = useState(false);
+  return (
+    <Shell>
+      <header className="flex items-center gap-3 py-2">
+        <PhoneButton onClick={back} className="flex-none">
+          {t.settings.back}
+        </PhoneButton>
+        <h1 className="font-semibold text-xl">{t.settings.title}</h1>
+      </header>
+      <p className="text-ink-soft">
+        <span className="text-muted">{t.settings.name}: </span>
+        {name}
+      </p>
+      {needsHomeScreen() && <Callout tone="info" title={t.settings.install} />}
+      <Notices api={api} />
+      <PhoneButton look="danger" onClick={() => setLeaving(true)} className="flex-none">
+        {t.settings.disconnect}
+      </PhoneButton>
+      {leaving && (
+        <Confirm
+          title={t.settings.disconnectTitle}
+          confirmLabel={t.settings.disconnect}
+          onConfirm={() => api.disconnect()}
+          onClose={() => setLeaving(false)}
+        >
+          {t.settings.disconnectText}
+        </Confirm>
+      )}
+    </Shell>
+  );
+}
diff --git a/app/src/phone/QuestionView.tsx b/app/src/phone/QuestionView.tsx
new file mode 100644
index 00000000..9bac2388
--- /dev/null
+++ b/app/src/phone/QuestionView.tsx
@@ -0,0 +1,92 @@
+// A question waiting for the owner (spec 23, 28.7): the text, the ready
+// answers as buttons, a field for another one, and Dismiss.
+
+import { useState } from "react";
+import { useT } from "../i18n";
+import { when } from "../lib/format";
+import type { QuestionCard } from "../lib/protocol.gen";
+import { BotDot, PhoneButton, PhoneMarkdown } from "./parts";
+
+export function QuestionView({
+  card,
+  sending,
+  answer,
+  dismiss,
+}: {
+  card: QuestionCard;
+  sending: boolean;
+  /** False if the answer could not be sent. */
+  answer(text: string): Promise<boolean>;
+  dismiss(): Promise<boolean>;
+}) {
+  const t = useT().phone;
+  const q = t.question;
+  const [text, setText] = useState("");
+  const [failed, setFailed] = useState(false);
+
+  const run = async (work: () => Promise<boolean>) => {
+    setFailed(false);
+    setFailed(!(await work()));
+  };
+
+  return (
+    <article className="flex flex-col gap-3 rounded-2xl border border-line bg-panel p-4">
+      <header className="flex items-center gap-3">
+        <BotDot name={card.bot.name} color={card.bot.color} />
+        <div className="min-w-0">
+          <p className="truncate font-semibold">{q.asks(card.bot.name)}</p>
+          <p className="truncate text-muted text-xs">
+            {t.inbox.inCrew(card.crew)} · {when(card.createdAt)}
+          </p>
+        </div>
+      </header>
+
+      <PhoneMarkdown>{card.text}</PhoneMarkdown>
+
+      {card.options.length > 0 && (
+        <fieldset className="m-0 flex min-w-0 flex-col gap-2 border-0 p-0">
+          <legend className="sr-only">{q.pick}</legend>
+          {card.options.map((option) => (
+            <PhoneButton
+              key={option}
+              disabled={sending}
+              onClick={() => run(() => answer(option))}
+              className="flex-none"
+            >
+              {option}
+            </PhoneButton>
+          ))}
+        </fieldset>
+      )}
+
+      <label className="flex flex-col gap-1 text-muted text-sm">
+        {q.answerLabel}
+        <textarea
+          value={text}
+          rows={2}
+          placeholder={q.placeholder}
+          onChange={(event) => setText(event.target.value)}
+          className="rounded-xl border border-line-strong bg-canvas px-3 py-2 text-base text-ink"
+        />
+      </label>
+      <div className="flex gap-3">
+        <PhoneButton
+          look="primary"
+          disabled={sending || text.trim() === ""}
+          onClick={() => run(() => answer(text.trim()))}
+        >
+          {sending ? q.sending : q.send}
+        </PhoneButton>
+        <PhoneButton disabled={sending} onClick={() => run(dismiss)}>
+          {q.dismiss}
+        </PhoneButton>
+      </div>
+      <p className="text-muted text-xs">{q.dismissHint(card.bot.name)}</p>
+      {failed && (
+        <p role="alert" className="text-danger text-sm">
+          {q.failed}
+        </p>
+      )}
+    </article>
+  );
+}
diff --git a/app/src/phone/client.test.ts b/app/src/phone/client.test.ts
new file mode 100644
index 00000000..bd92da59
--- /dev/null
+++ b/app/src/phone/client.test.ts
@@ -0,0 +1,446 @@
+// @vitest-environment node
+// The phone's connection and its connecting, against a computer made here
+// out of the same sealing (spec 28.3, 28.4).
+
+import { describe, expect, test, vi } from "vitest";
+import type { ApprovalCard, FromPhone, QuestionCard, ToPhone } from "../lib/protocol.gen";
+import { PhoneClient } from "./client";
+import {
+  acceptProof,
+  deriveKeys,
+  fromB64,
+  generateKeypair,
+  importKey,
+  joinProof,
+  open,
+  seal,
+  toB64,
+} from "./crypto";
+import type { NoticePlatform } from "./notices";
+import { PairError, pairing } from "./pair";
+import { memoryStore, type Session } from "./store";
+
+const text = new TextEncoder();
+const DEVICE = "dev_phone";
+const PEER = "dev_computer";
+
+class FakeSocket {
+  static all: FakeSocket[] = [];
+  readyState = 0;
+  sent: string[] = [];
+  onopen: (() => void) | null = null;
+  onmessage: ((event: { data: string }) => void) | null = null;
+  onclose: (() => void) | null = null;
+  constructor(readonly url: string) {
+    FakeSocket.all.push(this);
+    queueMicrotask(() => {
+      this.readyState = 1;
+      this.onopen?.();
+    });
+  }
+  send(data: string) {
+    this.sent.push(data);
+  }
+  close() {
+    this.readyState = 3;
+    this.onclose?.();
+  }
+  serverSend(frame: unknown) {
+    this.onmessage?.({ data: JSON.stringify(frame) });
+  }
+}
+
+const card = (id: string, at: number): ApprovalCard => ({
+  approvalId: id,
+  bot: { name: "Scout", color: "#aabbcc" },
+  crew: "Ops",
+  createdAt: at,
+  toolName: "Bash",
+  summary: "git status",
+  text: "git status",
+  cut: false,
+  atComputer: false,
+});
+
+const question = (id: string, at: number): QuestionCard => ({
+  questionId: id,
+  bot: { name: "Scout", color: "#aabbcc" },
+  crew: "Ops",
+  createdAt: at,
+  text: "Which first?",
+  options: ["A", "B"],
+});
+
+/** The computer's end: the same keys, the other direction. */
+async function setup(notices?: NoticePlatform) {
+  FakeSocket.all = [];
+  const raw = (fill: number) => new Uint8Array(32).fill(fill);
+  const [c2p, p2c] = [await importKey(raw(1)), await importKey(raw(2))];
+  const store = memoryStore();
+  const session: Session = {
+    token: "tok",
+    device: DEVICE,
+    peer: PEER,
+    name: "Phone",
+    keys: { c2p, p2c },
+    sent: 0,
+    received: 0,
+  };
+  await store.save(session);
+  const fetchMock = vi.fn(async (url: string, init?: RequestInit) =>
+    String(url).endsWith("/v1/push/key") && init?.method === "GET"
+      ? Response.json({ key: toB64(new Uint8Array(65).fill(4)) })
+      : new Response(null, { status: 204 }),
+  );
+  const client = new PhoneClient(session, {
+    origin: "http://127.0.0.1:1",
+    webSocket: FakeSocket as unknown as typeof WebSocket,
+    fetch: fetchMock as unknown as typeof fetch,
+    store,
+    retry: { min: 5, max: 20 },
+    answerWait: 50,
+    ...(notices ? { notices } : {}),
+  });
+  client.start();
+  const socket = () => FakeSocket.all[FakeSocket.all.length - 1] as FakeSocket;
+  await vi.waitFor(() => expect(socket().readyState).toBe(1));
+  let sentByComputer = 0;
+  const computer = {
+    async say(message: ToPhone, to: FakeSocket = socket()) {
+      sentByComputer += 1;
+      await this.sayRaw(sentByComputer, message, to);
+    },
+    async sayRaw(seq: number, message: ToPhone, to: FakeSocket = socket()) {
+      const body = await seal(
+        c2p,
+        "computerToPhone",
+        DEVICE,
+        seq,
+        text.encode(JSON.stringify(message)),
+      );
+      to.serverSend({ t: "msg", seq, body });
+    },
+    /** The messages the phone sealed, opened, in order. */
+    async heard(from: FakeSocket = socket()): Promise<{ seq: number; message: FromPhone }[]> {
+      const out = [];
+      for (const raw of from.sent) {
+        const frame = JSON.parse(raw);
+        if (frame.t !== "msg") continue;
+        const opened = await open(p2c, "phoneToComputer", DEVICE, frame.body);
+        expect(opened.seq).toBe(frame.seq);
+        out.push({ seq: opened.seq, message: JSON.parse(new TextDecoder().decode(opened.plain)) });
+      }
+      return out;
+    },
+  };
+  return { client, store, socket, computer, fetchMock };
+}
+
+describe("the phone's connection", () => {
+  test("says hello with the token, asks for what waits and shows what comes", async () => {
+    const { client, socket, computer } = await setup();
+    expect(JSON.parse(socket().sent[0] as string)).toEqual({ t: "hello", token: "tok" });
+    expect(client.getState().link).toBe("connecting");
+
+    socket().serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    await vi.waitFor(() => expect(client.getState().computer).toBe("online"));
+    expect(client.getState().link).toBe("online");
+    await vi.waitFor(async () => expect((await computer.heard()).length).toBe(1));
+    expect((await computer.heard())[0]).toEqual({ seq: 1, message: { t: "sync" } });
+
+    // The list arrives newest-last, whatever the order it was sent in.
+    await computer.say({
+      t: "snapshot",
+      approvals: [card("apr_b", 20), card("apr_a", 10)],
+      questions: [question("qst_1", 5)],
+    });
+    await vi.waitFor(() => expect(client.getState().loaded).toBe(true));
+    expect(client.getState().approvals.map((c) => c.approvalId)).toEqual(["apr_a", "apr_b"]);
+    expect(client.getState().questions).toHaveLength(1);
+
+    await computer.say({ t: "approval.open", card: card("apr_c", 30) });
+    await vi.waitFor(() => expect(client.getState().approvals).toHaveLength(3));
+    await computer.say({ t: "approval.closed", approvalId: "apr_a", status: "allowed" });
+    await vi.waitFor(() => expect(client.getState().ended.apr_a).toBe("allowed"));
+    expect(client.getState().approvals.map((c) => c.approvalId)).toEqual(["apr_b", "apr_c"]);
+    await computer.say({ t: "question.closed", questionId: "qst_1", status: "answered" });
+    await vi.waitFor(() => expect(client.getState().questions).toHaveLength(0));
+  });
+
+  test("answers are sealed with counters that rise and are saved first", async () => {
+    const { client, store, socket, computer } = await setup();
+    socket().serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    await vi.waitFor(async () => expect((await computer.heard()).length).toBe(1));
+    await computer.say({ t: "approval.open", card: card("apr_a", 1) });
+    await vi.waitFor(() => expect(client.getState().approvals).toHaveLength(1));
+
+    // Two answers at once still go in order: the counter never goes back.
+    const both = Promise.all([
+      client.answerApproval("apr_a", true, "  fine  "),
+      client.answerQuestion("qst_x", "A"),
+    ]);
+    expect(await both).toEqual([true, true]);
+    const heard = await computer.heard();
+    expect(heard.map((h) => h.seq)).toEqual([1, 2, 3]);
+    expect(heard[1]?.message).toEqual({
+      t: "approval.answer",
+      approvalId: "apr_a",
+      allow: true,
+      note: "fine",
+    });
+    expect(heard[2]?.message).toEqual({ t: "question.answer", questionId: "qst_x", answer: "A" });
+    expect((await store.load())?.sent).toBe(3);
+    expect(client.getState().sending).toContain("apr_a");
+
+    // The computer says it closed: the button is not waiting any more.
+    await computer.say({ t: "approval.closed", approvalId: "apr_a", status: "allowed" });
+    await vi.waitFor(() => expect(client.getState().sending).not.toContain("apr_a"));
+    // And with no word back, the button returns by itself.
+    await vi.waitFor(() => expect(client.getState().sending).toEqual([]));
+  });
+
+  test("a message that is repeated, old, changed or not for this phone does nothing", async () => {
+    const { client, store, socket, computer } = await setup();
+    socket().serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    await computer.say({ t: "approval.open", card: card("apr_a", 1) });
+    await vi.waitFor(() => expect(client.getState().approvals).toHaveLength(1));
+    const first = JSON.parse(JSON.stringify(socket().sent));
+    expect(first.length).toBeGreaterThan(0);
+
+    // The same counter again, with another card: refused.
+    await computer.sayRaw(1, { t: "approval.open", card: card("apr_old", 2) });
+    // Changed on the way, and sealed for another device: refused.
+    const body = await seal(
+      await importKey(new Uint8Array(32).fill(1)),
+      "computerToPhone",
+      "dev_other",
+      5,
+      text.encode("{}"),
+    );
+    socket().serverSend({ t: "msg", seq: 5, body });
+    const tampered = await seal(
+      await importKey(new Uint8Array(32).fill(1)),
+      "computerToPhone",
+      DEVICE,
+      6,
+      text.encode(JSON.stringify({ t: "approval.open", card: card("apr_x", 3) })),
+    );
+    socket().serverSend({ t: "msg", seq: 6, body: tampered.replace('"seq":6', '"seq":7') });
+    // The frame's counter is not the sealed one: refused.
+    await computer.sayRaw(9, { t: "approval.open", card: card("apr_y", 4) });
+    socket().serverSend({
+      t: "msg",
+      seq: 8,
+      body: await seal(
+        await importKey(new Uint8Array(32).fill(1)),
+        "computerToPhone",
+        DEVICE,
+        9,
+        text.encode("{}"),
+      ),
+    });
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(
+      client
+        .getState()
+        .approvals.map((c) => c.approvalId)
+        .sort(),
+    ).toEqual(["apr_a", "apr_y"]);
+    // What was taken is counted, and saved.
+    expect((await store.load())?.received).toBe(9);
+  });
+
+  test("comes back after the connection drops and asks again for what waits", async () => {
+    const { client, socket, computer } = await setup();
+    const first = socket();
+    first.serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    await vi.waitFor(async () => expect((await computer.heard(first)).length).toBe(1));
+    first.close();
+    expect(client.getState()).toMatchObject({ link: "offline", computer: "unknown" });
+    expect(await client.answerApproval("apr_a", true)).toBe(false);
+    expect(client.getState().sending).toEqual([]);
+
+    await vi.waitFor(() => expect(FakeSocket.all.length).toBe(2));
+    const second = socket();
+    await vi.waitFor(() => expect(second.readyState).toBe(1));
+    second.serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: false });
+    await vi.waitFor(() => expect(client.getState().computer).toBe("offline"));
+    // Presence of the computer: when it comes back, the phone asks again.
+    second.serverSend({ t: "presence", device: PEER, online: true });
+    await vi.waitFor(async () =>
+      expect((await computer.heard(second)).length).toBeGreaterThanOrEqual(2),
+    );
+    expect((await computer.heard(second)).every((h) => h.message.t === "sync")).toBe(true);
+    // The counter went on rising across connections.
+    expect((await computer.heard(second)).map((h) => h.seq)).toEqual([2, 3]);
+  });
+
+  test("a token the server refuses ends the phone, and leaving forgets the keys", async () => {
+    const { client, store, socket } = await setup();
+    socket().serverSend({ t: "error", reason: "unauthorized" });
+    await vi.waitFor(() => expect(client.getState().session).toBe("revoked"));
+    expect(await store.load()).not.toBeNull();
+    await client.forget();
+    expect(await store.load()).toBeNull();
+    // No new connection is tried.
+    await new Promise((resolve) => setTimeout(resolve, 60));
+    expect(FakeSocket.all.length).toBe(1);
+  });
+
+  test("leaving from the phone tells the server and clears everything", async () => {
+    const { client, store, socket } = await setup();
+    socket().serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    await client.disconnect();
+    expect(client.getState().session).toBe("left");
+    expect(await store.load()).toBeNull();
+  });
+});
+
+describe("connecting this phone", () => {
+  /** The computer's side of 28.3, with a server that only carries what it is given. */
+  async function world(
+    changes: {
+      daemonPub?: "swapped";
+      proof2?: "wrong";
+      joinStatus?: number;
+      expire?: boolean;
+    } = {},
+  ) {
+    const secret = crypto.getRandomValues(new Uint8Array(32));
+    const daemon = await generateKeypair();
+    const fragment = {
+      id: toB64(crypto.getRandomValues(new Uint8Array(16))),
+      secret,
+      daemonPub: daemon.publicRaw,
+    };
+    let joined: { phone_pub: string; device_name: string; proof: string } | null = null;
+    let polls = 0;
+    const fetchFake = (async (url: string, init?: RequestInit) => {
+      const path = new URL(url).pathname;
+      if (path.endsWith("/join")) {
+        if (changes.joinStatus) return new Response(null, { status: changes.joinStatus });
+        joined = JSON.parse(String(init?.body));
+        return Response.json({ poll: "poll-secret" }, { status: 202 });
+      }
+      polls += 1;
+      expect(new Headers(init?.headers).get("Authorization")).toBe("Bearer poll-secret");
+      if (changes.expire) return Response.json({ status: "expired" });
+      if (polls < 2 || !joined) return Response.json({ status: "pending" });
+      const phonePub = fromB64(joined.phone_pub);
+      // The computer checks the proof, then accepts.
+      expect(toB64(await joinProof(secret, fragment.id, phonePub))).toBe(joined.proof);
+      const other = await generateKeypair();
+      const proof2 = await acceptProof(secret, fragment.id, daemon.publicRaw, phonePub);
+      return Response.json({
+        status: "approved",
+        token: "the-token",
+        device: DEVICE,
+        peer: PEER,
+        daemon_pub: toB64(changes.daemonPub === "swapped" ? other.publicRaw : daemon.publicRaw),
+        proof2: toB64(changes.proof2 === "wrong" ? new Uint8Array(32) : proof2),
+      });
+    }) as unknown as typeof fetch;
+    const pair = pairing(fragment, {
+      origin: "http://127.0.0.1:1",
+      fetch: fetchFake,
+      sleep: async () => {},
+    });
+    return {
+      pair,
+      daemon,
+      secret,
+      fragment,
+      phonePub: () => (joined ? fromB64(joined.phone_pub) : new Uint8Array()),
+    };
+  }
+
+  test("joins with a proof, shows the code and collects a session that talks to the computer", async () => {
+    const w = await world();
+    const joined = await w.pair.join("Celular da Ana");
+    expect(joined.code).toMatch(/^\d{6}$/);
+    const session = await joined.collect();
+    expect(session).toMatchObject({
+      token: "the-token",
+      device: DEVICE,
+      peer: PEER,
+      name: "Celular da Ana",
+      sent: 0,
+      received: 0,
+    });
+    // Both ends hold the same keys: what the computer seals, the phone opens.
+    const computerKeys = await deriveKeys(w.daemon.privateKey, w.phonePub(), w.secret);
+    const body = await seal(computerKeys.c2p, "computerToPhone", DEVICE, 1, text.encode("hi"));
+    expect(
+      new TextDecoder().decode(
+        (await open(session.keys.c2p, "computerToPhone", DEVICE, body)).plain,
+      ),
+    ).toBe("hi");
+  });
+
+  test("refuses a key that is not the one in the QR, or an accept without the secret's proof", async () => {
+    for (const changes of [{ daemonPub: "swapped" }, { proof2: "wrong" }] as const) {
+      const joined = await (await world(changes)).pair.join("Phone");
+      await expect(joined.collect()).rejects.toMatchObject({ reason: "failed" });
+    }
+  });
+
+  test("tells a code that ran out from one that never worked", async () => {
+    await expect((await world({ joinStatus: 410 })).pair.join("Phone")).rejects.toBeInstanceOf(
+      PairError,
+    );
+    await expect((await world({ joinStatus: 410 })).pair.join("Phone")).rejects.toMatchObject({
+      reason: "expired",
+    });
+    await expect((await world({ joinStatus: 500 })).pair.join("Phone")).rejects.toMatchObject({
+      reason: "failed",
+    });
+    const joined = await (await world({ expire: true })).pair.join("Phone");
+    await expect(joined.collect()).rejects.toMatchObject({ reason: "expired" });
+  });
+});
+
+describe("notices", () => {
+  const granted = (): NoticePlatform => ({
+    supported: () => true,
+    homeScreenNeeded: () => false,
+    permission: () => "granted",
+    requestPermission: async () => "granted",
+    subscription: async () => ({ endpoint: "https://push.example/abc" }),
+    subscribe: async () => ({ endpoint: "https://push.example/abc" }),
+    unsubscribe: async () => {},
+  });
+
+  test("a phone with notices on tells the server its address each time it connects", async () => {
+    const { socket, fetchMock } = await setup(granted());
+    socket().serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    await vi.waitFor(() =>
+      expect(
+        fetchMock.mock.calls.some(
+          ([url, init]) =>
+            String(url).endsWith("/v1/push/subscribe") &&
+            init?.method === "POST" &&
+            init.body === JSON.stringify({ endpoint: "https://push.example/abc" }) &&
+            new Headers(init.headers).get("Authorization") === "Bearer tok",
+        ),
+      ).toBe(true),
+    );
+  });
+
+  test("without the browser's push there is nothing to turn on", async () => {
+    const { client, socket, fetchMock } = await setup();
+    socket().serverSend({ t: "ready", kind: "phone", device: DEVICE, peer: PEER, online: true });
+    expect(await client.noticeState()).toBe("unsupported");
+    expect(await client.turnOnNotices()).toBe("unsupported");
+    expect(fetchMock.mock.calls.some(([url]) => String(url).includes("/v1/push/"))).toBe(false);
+  });
+
+  test("turning them off asks the server to forget the address", async () => {
+    const { client, fetchMock } = await setup(granted());
+    await client.turnOffNotices();
+    expect(
+      fetchMock.mock.calls.some(
+        ([url, init]) => String(url).endsWith("/v1/push/subscribe") && init?.method === "DELETE",
+      ),
+    ).toBe(true);
+  });
+});
diff --git a/app/src/phone/client.ts b/app/src/phone/client.ts
new file mode 100644
index 00000000..25c4c806
--- /dev/null
+++ b/app/src/phone/client.ts
@@ -0,0 +1,418 @@
+// The phone's connection (spec 28.4): one WebSocket to the relay, the sealed
+// messages both ways, and what the screen shows, which is in memory only.
+
+import type {
+  ApprovalCard,
+  ApprovalStatus,
+  FromPhone,
+  QuestionCard,
+  QuestionStatus,
+  ToPhone,
+} from "../lib/protocol.gen";
+import { open, SealError, seal } from "./crypto";
+import {
+  keepNotices,
+  type NoticePlatform,
+  type NoticeServer,
+  type NoticeState,
+  noticeState,
+  turnOff,
+  turnOn,
+} from "./notices";
+import type { Session, SessionStore } from "./store";
+
+export type Ended = Exclude<ApprovalStatus, "pending"> | Exclude<QuestionStatus, "open">;
+
+export interface PhoneState {
+  /** `revoked`: the server or the computer cut this phone off. `left`: the owner left from here. */
+  session: "ok" | "revoked" | "left";
+  link: "connecting" | "online" | "offline";
+  /** Whether the computer is on, as the relay says. */
+  computer: "unknown" | "online" | "offline";
+  /** The first list from the computer arrived. */
+  loaded: boolean;
+  approvals: ApprovalCard[];
+  questions: QuestionCard[];
+  /** Answers on their way, by the id of what they answer. */
+  sending: string[];
+  /** How the last things that closed ended, for a word on screen. */
+  ended: Record<string, Ended>;
+  name: string;
+}
+
+/** What the screens use; the real client and the fake both are one. */
+export interface PhoneApi {
+  getState(): PhoneState;
+  subscribe(listener: () => void): () => void;
+  /** False when there is no connection to send it through. */
+  answerApproval(id: string, allow: boolean, note?: string): Promise<boolean>;
+  answerQuestion(id: string, answer: string): Promise<boolean>;
+  dismissQuestion(id: string): Promise<boolean>;
+  /** Leaves from this side: the computer is told, and the keys go. */
+  disconnect(): Promise<void>;
+  /** Notices when something waits (spec 28.8). */
+  noticeState(): Promise<NoticeState>;
+  turnOnNotices(): Promise<NoticeState>;
+  turnOffNotices(): Promise<NoticeState>;
+}
+
+export interface Deps {
+  /** The server's address, such as `https://cloud.example.org`. */
+  origin: string;
+  webSocket: typeof WebSocket;
+  fetch: typeof fetch;
+  store: SessionStore;
+  /** How long to wait before trying again: 1 s, doubling to 30 s. */
+  retry?: { min: number; max: number };
+  /** How long an answer may be on its way before the button comes back. */
+  answerWait?: number;
+  /** The browser's push; without it, this phone gives no notices. */
+  notices?: NoticePlatform;
+}
+
+const text = new TextEncoder();
+const decode = new TextDecoder();
+const OPEN = 1;
+
+function oldestFirst<T extends { createdAt: number }>(cards: T[]): T[] {
+  return [...cards].sort((a, b) => a.createdAt - b.createdAt);
+}
+
+export class PhoneClient implements PhoneApi {
+  private state: PhoneState;
+  private readonly listeners = new Set<() => void>();
+  private socket: WebSocket | null = null;
+  private stopped = false;
+  private delay: number;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  /** Frames and sends go one at a time, in order: the counters depend on it. */
+  private inbox: Promise<void> = Promise.resolve();
+  private outbox: Promise<unknown> = Promise.resolve();
+  private saving: Promise<void> = Promise.resolve();
+
+  constructor(
+    private session: Session,
+    private readonly deps: Deps,
+  ) {
+    this.delay = deps.retry?.min ?? 1000;
+    this.state = {
+      session: "ok",
+      link: "connecting",
+      computer: "unknown",
+      loaded: false,
+      approvals: [],
+      questions: [],
+      sending: [],
+      ended: {},
+      name: session.name,
+    };
+  }
+
+  getState = (): PhoneState => this.state;
+
+  subscribe = (listener: () => void): (() => void) => {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  };
+
+  private set(change: Partial<PhoneState>): void {
+    this.state = { ...this.state, ...change };
+    for (const listener of this.listeners) {
+      listener();
+    }
+  }
+
+  start(): void {
+    this.stopped = false;
+    this.connect();
+  }
+
+  stop(): void {
+    this.stopped = true;
+    if (this.timer) {
+      clearTimeout(this.timer);
+    }
+    this.socket?.close();
+    this.socket = null;
+  }
+
+  private url(): string {
+    return `${this.deps.origin.replace(/^http/, "ws")}/v1/relay`;
+  }
+
+  private connect(): void {
+    this.set({ link: "connecting" });
+    const socket = new this.deps.webSocket(this.url());
+    this.socket = socket;
+    socket.onopen = () => socket.send(JSON.stringify({ t: "hello", token: this.session.token }));
+    socket.onmessage = (event) => {
+      const frame = String(event.data);
+      this.inbox = this.inbox.then(() => this.onFrame(frame)).catch(() => {});
+    };
+    socket.onclose = () => {
+      if (this.socket !== socket) {
+        return;
+      }
+      this.socket = null;
+      if (this.state.session !== "ok" || this.stopped) {
+        return;
+      }
+      this.set({ link: "offline", computer: "unknown" });
+      this.timer = setTimeout(() => this.connect(), this.delay);
+      this.delay = Math.min(this.delay * 2, this.deps.retry?.max ?? 30000);
+    };
+  }
+
+  private async onFrame(raw: string): Promise<void> {
+    let frame: Record<string, unknown>;
+    try {
+      frame = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    switch (frame.t) {
+      case "ready":
+        this.delay = this.deps.retry?.min ?? 1000;
+        // The server may have lost this phone's address for notices.
+        void this.keepNotices();
+        this.set({ link: "online", computer: frame.online === true ? "online" : "offline" });
+        await this.send({ t: "sync" });
+        break;
+      case "presence":
+        if (frame.device === this.session.peer) {
+          const online = frame.online === true;
+          this.set({ computer: online ? "online" : "offline" });
+          if (online) {
+            await this.send({ t: "sync" });
+          }
+        }
+        break;
+      case "msg":
+        await this.onMessage(frame);
+        break;
+      case "error":
+        if (frame.reason === "unauthorized") {
+          this.cut("revoked");
+        }
+        break;
+      default:
+    }
+  }
+
+  private async onMessage(frame: Record<string, unknown>): Promise<void> {
+    if (typeof frame.body !== "string") {
+      return;
+    }
+    let opened: { seq: number; plain: Uint8Array };
+    try {
+      opened = await open(
+        this.session.keys.c2p,
+        "computerToPhone",
+        this.session.device,
+        frame.body,
+      );
+    } catch (failure) {
+      if (failure instanceof SealError) {
+        return;
+      }
+      throw failure;
+    }
+    // The same message again, or an old one sent back.
+    if (opened.seq !== frame.seq || opened.seq <= this.session.received) {
+      return;
+    }
+    this.session = { ...this.session, received: opened.seq };
+    await this.persist();
+    let message: ToPhone;
+    try {
+      message = JSON.parse(decode.decode(opened.plain));
+    } catch {
+      return;
+    }
+    this.apply(message);
+  }
+
+  private apply(message: ToPhone): void {
+    const { state } = this;
+    switch (message.t) {
+      case "snapshot":
+        this.set({
+          loaded: true,
+          approvals: oldestFirst(message.approvals),
+          questions: oldestFirst(message.questions),
+        });
+        break;
+      case "approval.open":
+        this.set({
+          approvals: oldestFirst([
+            ...state.approvals.filter((card) => card.approvalId !== message.card.approvalId),
+            message.card,
+          ]),
+          sending: state.sending.filter((id) => id !== message.card.approvalId),
+        });
+        break;
+      case "approval.closed":
+        if (message.status !== "pending") {
+          this.close(message.approvalId, message.status);
+        }
+        break;
+      case "question.open":
+        this.set({
+          questions: oldestFirst([
+            ...state.questions.filter((card) => card.questionId !== message.card.questionId),
+            message.card,
+          ]),
+        });
+        break;
+      case "question.closed":
+        if (message.status !== "open") {
+          this.close(message.questionId, message.status);
+        }
+        break;
+      default:
+    }
+  }
+
+  private close(id: string, status: Ended): void {
+    const { state } = this;
+    const ended = { ...state.ended, [id]: status };
+    for (const old of Object.keys(ended).slice(0, -20)) {
+      delete ended[old];
+    }
+    this.set({
+      approvals: state.approvals.filter((card) => card.approvalId !== id),
+      questions: state.questions.filter((card) => card.questionId !== id),
+      sending: state.sending.filter((sending) => sending !== id),
+      ended,
+    });
+  }
+
+  private persist(): Promise<void> {
+    const session = this.session;
+    this.saving = this.saving.then(() => this.deps.store.save(session)).catch(() => {});
+    return this.saving;
+  }
+
+  /** Seals and sends one message, after the ones before it. False if there is no connection. */
+  private send(message: FromPhone): Promise<boolean> {
+    const run = async (): Promise<boolean> => {
+      const socket = this.socket;
+      if (!socket || socket.readyState !== OPEN || this.state.link !== "online") {
+        return false;
+      }
+      const seq = this.session.sent + 1;
+      this.session = { ...this.session, sent: seq };
+      // Saved before the message goes, so a counter is never used twice.
+      await this.persist();
+      const body = await seal(
+        this.session.keys.p2c,
+        "phoneToComputer",
+        this.session.device,
+        seq,
+        text.encode(JSON.stringify(message)),
+      );
+      socket.send(JSON.stringify({ t: "msg", seq, body }));
+      return true;
+    };
+    const sent = this.outbox.then(run, run);
+    this.outbox = sent.catch(() => false);
+    return sent;
+  }
+
+  private async answer(id: string, message: FromPhone): Promise<boolean> {
+    this.set({ sending: [...this.state.sending.filter((other) => other !== id), id] });
+    const sent = await this.send(message).catch(() => false);
+    if (!sent) {
+      this.set({ sending: this.state.sending.filter((other) => other !== id) });
+      return false;
+    }
+    // If nothing comes back, the button returns and the owner may try again.
+    setTimeout(
+      () => this.set({ sending: this.state.sending.filter((other) => other !== id) }),
+      this.deps.answerWait ?? 15000,
+    );
+    return true;
+  }
+
+  answerApproval = (id: string, allow: boolean, note?: string): Promise<boolean> => {
+    const trimmed = note?.trim();
+    return this.answer(id, {
+      t: "approval.answer",
+      approvalId: id,
+      allow,
+      ...(trimmed ? { note: trimmed } : {}),
+    });
+  };
+
+  answerQuestion = (id: string, answer: string): Promise<boolean> =>
+    this.answer(id, { t: "question.answer", questionId: id, answer });
+
+  dismissQuestion = (id: string): Promise<boolean> =>
+    this.answer(id, { t: "question.dismiss", questionId: id });
+
+  private noticeServer(): NoticeServer {
+    const call = (method: string, path: string, body?: unknown) =>
+      this.deps.fetch(`${this.deps.origin}/v1/push/${path}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${this.session.token}`,
+          ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      });
+    return {
+      key: async () => {
+        const answer = await call("GET", "key");
+        return answer.ok ? (((await answer.json()) as { key?: string }).key ?? null) : null;
+      },
+      subscribe: async (endpoint) => (await call("POST", "subscribe", { endpoint })).ok,
+      unsubscribe: async () => {
+        await call("DELETE", "subscribe");
+      },
+    };
+  }
+
+  private async keepNotices(): Promise<void> {
+    if (this.deps.notices) {
+      await keepNotices(this.deps.notices, this.noticeServer()).catch(() => {});
+    }
+  }
+
+  noticeState = async (): Promise<NoticeState> =>
+    this.deps.notices
+      ? noticeState(this.deps.notices, this.noticeServer()).catch(() => "unsupported")
+      : "unsupported";
+
+  turnOnNotices = async (): Promise<NoticeState> =>
+    this.deps.notices
+      ? turnOn(this.deps.notices, this.noticeServer()).catch(() => "off")
+      : "unsupported";
+
+  turnOffNotices = async (): Promise<NoticeState> =>
+    this.deps.notices
+      ? turnOff(this.deps.notices, this.noticeServer()).catch(() => "off")
+      : "unsupported";
+
+  private cut(session: "revoked" | "left"): void {
+    this.stop();
+    this.set({ session, link: "offline", computer: "unknown", approvals: [], questions: [] });
+  }
+
+  disconnect = async (): Promise<void> => {
+    try {
+      await this.deps.fetch(`${this.deps.origin}/v1/logout`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${this.session.token}` },
+      });
+    } catch {
+      // The keys go either way; the computer drops the phone at its next look.
+    }
+    await this.forget("left");
+  };
+
+  /** The phone was cut off from the other side: nothing here can work any more. */
+  forget = async (session: "revoked" | "left" = "revoked"): Promise<void> => {
+    this.cut(session);
+    await this.deps.store.clear();
+  };
+}
diff --git a/app/src/phone/crypto.test.ts b/app/src/phone/crypto.test.ts
new file mode 100644
index 00000000..1fb3196c
--- /dev/null
+++ b/app/src/phone/crypto.test.ts
@@ -0,0 +1,131 @@
+// @vitest-environment node
+// The phone's sealing against the bytes the computer's Rust code made
+// (docs/test-vectors/mobile.json, written by botloftd's tests).
+
+import { describe, expect, test } from "vitest";
+import vectorsText from "../../../docs/test-vectors/mobile.json?raw";
+import {
+  acceptProof,
+  deriveRaw,
+  fromB64,
+  generateKeypair,
+  importKey,
+  joinProof,
+  open,
+  pairCode,
+  SealError,
+  seal,
+  toB64,
+} from "./crypto";
+
+const vectors = JSON.parse(vectorsText);
+const pair = vectors.pair;
+const hex = (value: string) =>
+  Uint8Array.from(value.match(/../g) ?? [], (byte) => Number.parseInt(byte, 16));
+const same = (a: Uint8Array, b: Uint8Array) => expect(Array.from(a)).toEqual(Array.from(b));
+
+/** The vectors' private key, from the bytes the Rust side used. */
+async function privateKey(privateHex: string, publicRaw: Uint8Array) {
+  return crypto.subtle.importKey(
+    "jwk",
+    {
+      kty: "EC",
+      crv: "P-256",
+      d: toB64(hex(privateHex)),
+      x: toB64(publicRaw.slice(1, 33)),
+      y: toB64(publicRaw.slice(33, 65)),
+    },
+    { name: "ECDH", namedCurve: "P-256" },
+    false,
+    ["deriveBits"],
+  );
+}
+
+describe("the computer's vectors", () => {
+  const secret = fromB64(pair.secret);
+  const daemonPub = fromB64(pair.daemonPublic);
+  const phonePub = fromB64(pair.phonePublic);
+
+  test("the proofs and the code come out the same", async () => {
+    same(await joinProof(secret, pair.id, phonePub), fromB64(pair.joinProof));
+    same(await acceptProof(secret, pair.id, daemonPub, phonePub), fromB64(pair.acceptProof));
+    expect(await pairCode(secret, daemonPub, phonePub)).toBe(pair.code);
+  });
+
+  test("the two keys come out the same from the phone's side", async () => {
+    const mine = await privateKey(pair.phonePrivateHex, phonePub);
+    const keys = await deriveRaw(mine, daemonPub, secret);
+    same(keys.c2p, hex(pair.computerToPhoneKeyHex));
+    same(keys.p2c, hex(pair.phoneToComputerKeyHex));
+  });
+
+  test("what the computer sealed opens, and what the phone seals is the same bytes", async () => {
+    for (const vector of vectors.seal) {
+      const key = await importKey(hex(vector.keyHex));
+      const opened = await open(key, vector.direction, vector.device, vector.body);
+      expect(opened.seq).toBe(vector.seq);
+      expect(new TextDecoder().decode(opened.plain)).toBe(vector.plain);
+      const again = await seal(
+        key,
+        vector.direction,
+        vector.device,
+        vector.seq,
+        new TextEncoder().encode(vector.plain),
+      );
+      expect(again).toBe(vector.body);
+    }
+  });
+});
+
+describe("a message that was touched", () => {
+  const vector = vectors.seal[0];
+
+  test("does not open with another key, direction, device or counter, or when cut", async () => {
+    const key = await importKey(hex(vector.keyHex));
+    const other = await importKey(hex(vectors.seal[1].keyHex));
+    const body: string = vector.body;
+    await expect(open(other, vector.direction, vector.device, body)).rejects.toBeInstanceOf(
+      SealError,
+    );
+    await expect(open(key, "phoneToComputer", vector.device, body)).rejects.toBeInstanceOf(
+      SealError,
+    );
+    await expect(open(key, vector.direction, "dev_other", body)).rejects.toBeInstanceOf(SealError);
+    await expect(
+      open(key, vector.direction, vector.device, body.replace('"seq":1', '"seq":2')),
+    ).rejects.toBeInstanceOf(SealError);
+    for (const bad of ["", "nope", '{"v":2,"seq":1,"ct":"AA"}', '{"v":1,"seq":-1,"ct":"AA"}']) {
+      await expect(open(key, vector.direction, vector.device, bad)).rejects.toBeInstanceOf(
+        SealError,
+      );
+    }
+  });
+});
+
+describe("a fresh exchange", () => {
+  test("two keypairs agree, and the QR's secret is part of the keys", async () => {
+    const [a, b] = [await generateKeypair(), await generateKeypair()];
+    expect(a.publicRaw.length).toBe(65);
+    expect(a.publicRaw[0]).toBe(4);
+    const secret = crypto.getRandomValues(new Uint8Array(32));
+    const fromA = await deriveRaw(a.privateKey, b.publicRaw, secret);
+    const fromB = await deriveRaw(b.privateKey, a.publicRaw, secret);
+    same(fromA.c2p, fromB.c2p);
+    same(fromA.p2c, fromB.p2c);
+    const other = await deriveRaw(
+      a.privateKey,
+      b.publicRaw,
+      crypto.getRandomValues(new Uint8Array(32)),
+    );
+    expect(Array.from(other.c2p)).not.toEqual(Array.from(fromA.c2p));
+  });
+
+  test("base64url round trips and has no padding", () => {
+    for (const length of [0, 1, 2, 3, 31, 32, 65]) {
+      const bytes = crypto.getRandomValues(new Uint8Array(length));
+      const text = toB64(bytes);
+      expect(text).toMatch(/^[A-Za-z0-9_-]*$/);
+      same(fromB64(text), bytes);
+    }
+  });
+});
diff --git a/app/src/phone/crypto.ts b/app/src/phone/crypto.ts
new file mode 100644
index 00000000..5a5cdae7
--- /dev/null
+++ b/app/src/phone/crypto.ts
@@ -0,0 +1,207 @@
+// The phone's side of the sealing (spec 28.3), with the browser's own
+// WebCrypto: ECDH P-256, HKDF-SHA-256, HMAC-SHA-256 and AES-256-GCM. The
+// computer does the same in Rust, and `docs/test-vectors/mobile.json` holds
+// bytes both sides must agree on (crypto.test.ts reads it).
+
+const text = new TextEncoder();
+const VERSION = 1;
+
+/** base64url without padding, as the computer writes it. */
+export function toB64(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+
+export function fromB64(value: string): Uint8Array {
+  const padded = value.replaceAll("-", "+").replaceAll("_", "/");
+  const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+
+export class SealError extends Error {}
+
+function concat(...parts: Uint8Array[]): Uint8Array {
+  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+
+/** WebCrypto wants buffers it can be sure are not shared. */
+const own = (bytes: Uint8Array): Uint8Array<ArrayBuffer> => new Uint8Array(bytes);
+
+async function hmac(key: Uint8Array, ...parts: Uint8Array[]): Promise<Uint8Array> {
+  const imported = await crypto.subtle.importKey(
+    "raw",
+    own(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", imported, own(concat(...parts))));
+}
+
+async function hkdf(
+  ikm: Uint8Array,
+  salt: Uint8Array,
+  info: string,
+  bytes: number,
+): Promise<Uint8Array> {
+  const imported = await crypto.subtle.importKey("raw", own(ikm), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: own(salt), info: text.encode(info) },
+    imported,
+    bytes * 8,
+  );
+  return new Uint8Array(bits);
+}
+
+/** This phone's key for the exchange: the private half never leaves the browser. */
+export interface Keypair {
+  privateKey: CryptoKey;
+  /** The point, uncompressed (65 bytes). */
+  publicRaw: Uint8Array;
+}
+
+export async function generateKeypair(): Promise<Keypair> {
+  const pair = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, false, [
+    "deriveBits",
+  ]);
+  const publicRaw = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+  return { privateKey: pair.privateKey, publicRaw };
+}
+
+/** What the phone proves when it joins: that it read the QR's secret. */
+export function joinProof(secret: Uint8Array, id: string, phonePub: Uint8Array) {
+  return hmac(secret, text.encode("botloft-pair-1"), text.encode(id), phonePub);
+}
+
+/** What the computer proves when it accepts. */
+export function acceptProof(
+  secret: Uint8Array,
+  id: string,
+  daemonPub: Uint8Array,
+  phonePub: Uint8Array,
+) {
+  return hmac(secret, text.encode("botloft-pair-1-accept"), text.encode(id), daemonPub, phonePub);
+}
+
+/** Six digits both screens show. */
+export async function pairCode(
+  secret: Uint8Array,
+  daemonPub: Uint8Array,
+  phonePub: Uint8Array,
+): Promise<string> {
+  const bytes = await hkdf(concat(daemonPub, phonePub), secret, "botloft-pair-1-code", 3);
+  const bits = ((bytes[0] ?? 0) << 12) | ((bytes[1] ?? 0) << 4) | ((bytes[2] ?? 0) >> 4);
+  return String(bits % 1_000_000).padStart(6, "0");
+}
+
+/** The two keys of a connection, as bytes (for the tests). */
+export async function deriveRaw(
+  mine: CryptoKey,
+  theirPublic: Uint8Array,
+  secret: Uint8Array,
+): Promise<{ c2p: Uint8Array; p2c: Uint8Array }> {
+  const theirs = await crypto.subtle.importKey(
+    "raw",
+    own(theirPublic),
+    { name: "ECDH", namedCurve: "P-256" },
+    false,
+    [],
+  );
+  const shared = new Uint8Array(
+    await crypto.subtle.deriveBits({ name: "ECDH", public: theirs }, mine, 256),
+  );
+  const okm = await hkdf(shared, secret, "botloft-mobile-1", 64);
+  return { c2p: okm.slice(0, 32), p2c: okm.slice(32) };
+}
+
+/** One key per direction; the browser keeps them and cannot export them. */
+export interface Keys {
+  c2p: CryptoKey;
+  p2c: CryptoKey;
+}
+
+export async function importKey(raw: Uint8Array): Promise<CryptoKey> {
+  return crypto.subtle.importKey("raw", own(raw), "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+
+export async function deriveKeys(
+  mine: CryptoKey,
+  theirPublic: Uint8Array,
+  secret: Uint8Array,
+): Promise<Keys> {
+  const raw = await deriveRaw(mine, theirPublic, secret);
+  return { c2p: await importKey(raw.c2p), p2c: await importKey(raw.p2c) };
+}
+
+export type Direction = "computerToPhone" | "phoneToComputer";
+
+const DIRECTION: Record<Direction, number> = { computerToPhone: 1, phoneToComputer: 2 };
+
+function parts(direction: Direction, device: string, seq: number) {
+  const counter = new Uint8Array(8);
+  new DataView(counter.buffer).setBigUint64(0, BigInt(seq));
+  const aad = concat(Uint8Array.of(VERSION, DIRECTION[direction]), text.encode(device), counter);
+  // The nonce is four zero bytes and the counter.
+  return { aad, iv: concat(new Uint8Array(4), counter) };
+}
+
+/** `{"v":1,"seq":N,"ct":"..."}`, the text the relay carries. */
+export async function seal(
+  key: CryptoKey,
+  direction: Direction,
+  device: string,
+  seq: number,
+  plain: Uint8Array,
+): Promise<string> {
+  const { aad, iv } = parts(direction, device, seq);
+  const ct = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: own(iv), additionalData: own(aad) },
+    key,
+    own(plain),
+  );
+  return JSON.stringify({ v: VERSION, seq, ct: toB64(new Uint8Array(ct)) });
+}
+
+/** The counter and the plain text of a sealed message; throws if it does not open. */
+export async function open(
+  key: CryptoKey,
+  direction: Direction,
+  device: string,
+  body: string,
+): Promise<{ seq: number; plain: Uint8Array }> {
+  let sealed: { v?: unknown; seq?: unknown; ct?: unknown };
+  try {
+    sealed = JSON.parse(body);
+  } catch {
+    throw new SealError("not a sealed message");
+  }
+  if (
+    sealed.v !== VERSION ||
+    typeof sealed.seq !== "number" ||
+    !Number.isSafeInteger(sealed.seq) ||
+    sealed.seq < 0 ||
+    typeof sealed.ct !== "string"
+  ) {
+    throw new SealError("not a sealed message");
+  }
+  const { aad, iv } = parts(direction, device, sealed.seq);
+  try {
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: own(iv), additionalData: own(aad) },
+      key,
+      own(fromB64(sealed.ct)),
+    );
+    return { seq: sealed.seq, plain: new Uint8Array(plain) };
+  } catch {
+    throw new SealError("the message does not open");
+  }
+}
diff --git a/app/src/phone/fake.ts b/app/src/phone/fake.ts
new file mode 100644
index 00000000..a68b370f
--- /dev/null
+++ b/app/src/phone/fake.ts
@@ -0,0 +1,73 @@
+// A phone connection for the tests and the preview: the screens read its
+// state and call its methods, and nothing leaves the page.
+
+import type { ApprovalCard, QuestionCard } from "../lib/protocol.gen";
+import type { PhoneApi, PhoneState } from "./client";
+import type { NoticeState } from "./notices";
+
+export class FakePhone implements PhoneApi {
+  private state: PhoneState = {
+    session: "ok",
+    link: "online",
+    computer: "online",
+    loaded: true,
+    approvals: [],
+    questions: [],
+    sending: [],
+    ended: {},
+    name: "Celular da Ana",
+  };
+  private readonly listeners = new Set<() => void>();
+  /** How notices stand; the buttons change it as the browser would. */
+  notices: NoticeState = "off";
+  /** Whether an answer can be sent, for a test of the failure. */
+  sendable = true;
+  readonly calls: { method: string; args: unknown[] }[] = [];
+
+  getState = (): PhoneState => this.state;
+
+  subscribe = (listener: () => void): (() => void) => {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  };
+
+  /** Plays a change the computer or the connection makes. */
+  set(change: Partial<PhoneState>): void {
+    this.state = { ...this.state, ...change };
+    for (const listener of this.listeners) {
+      listener();
+    }
+  }
+
+  add(approval?: ApprovalCard, question?: QuestionCard): void {
+    this.set({
+      approvals: approval ? [...this.state.approvals, approval] : this.state.approvals,
+      questions: question ? [...this.state.questions, question] : this.state.questions,
+    });
+  }
+
+  private async answer(method: string, ...args: unknown[]): Promise<boolean> {
+    this.calls.push({ method, args });
+    return this.sendable;
+  }
+
+  answerApproval = (id: string, allow: boolean, note?: string) =>
+    this.answer("answerApproval", id, allow, note);
+  answerQuestion = (id: string, text: string) => this.answer("answerQuestion", id, text);
+  dismissQuestion = (id: string) => this.answer("dismissQuestion", id);
+  noticeState = async (): Promise<NoticeState> => this.notices;
+  turnOnNotices = async (): Promise<NoticeState> => {
+    this.calls.push({ method: "turnOnNotices", args: [] });
+    this.notices = this.notices === "off" ? "on" : this.notices;
+    return this.notices;
+  };
+  turnOffNotices = async (): Promise<NoticeState> => {
+    this.calls.push({ method: "turnOffNotices", args: [] });
+    this.notices = this.notices === "on" ? "off" : this.notices;
+    return this.notices;
+  };
+  disconnect = async () => {
+    this.calls.push({ method: "disconnect", args: [] });
+    this.set({ session: "left" });
+  };
+}
diff --git a/app/src/phone/index.html b/app/src/phone/index.html
new file mode 100644
index 00000000..b4bad637
--- /dev/null
+++ b/app/src/phone/index.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+    <meta name="theme-color" content="#0b0b0b" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="referrer" content="no-referrer" />
+    <link rel="manifest" href="/m/manifest.webmanifest" />
+    <link rel="apple-touch-icon" href="/m/apple-touch-icon.png" />
+    <title>Botloft</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="./main.tsx"></script>
+  </body>
+</html>
diff --git a/app/src/phone/main.tsx b/app/src/phone/main.tsx
new file mode 100644
index 00000000..9df98f8c
--- /dev/null
+++ b/app/src/phone/main.tsx
@@ -0,0 +1,115 @@
+// The phone's page, served by the account server at /m (spec 28.7). It opens
+// either from a code on the computer (the part after `#` holds what the
+// phone needs to join) or as a phone that is already connected.
+
+import { StrictMode, useEffect, useState } from "react";
+import { createRoot } from "react-dom/client";
+import { PhoneClient } from "./client";
+import { browserPlatform } from "./notices";
+import { PairScreen } from "./PairScreen";
+import { PhoneApp } from "./PhoneApp";
+import { pairing, parseFragment } from "./pair";
+import { browserStore, type Session } from "./store";
+import "./phone.css";
+
+const root = document.getElementById("root");
+if (!root) {
+  throw new Error("missing #root element");
+}
+
+const store = browserStore();
+const origin = window.location.origin;
+const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+/** The dark theme follows the phone's. */
+function followTheme(): void {
+  const dark = window.matchMedia("(prefers-color-scheme: dark)");
+  const apply = () => {
+    document.documentElement.dataset.theme = dark.matches ? "dark" : "light";
+  };
+  apply();
+  dark.addEventListener("change", apply);
+}
+
+function clientFor(session: Session): PhoneClient {
+  const client = new PhoneClient(session, {
+    origin,
+    webSocket: WebSocket,
+    fetch: window.fetch.bind(window),
+    store,
+    notices: browserPlatform(),
+  });
+  client.start();
+  return client;
+}
+
+function Boot() {
+  const [session, setSession] = useState<Session | null | undefined>(undefined);
+  const [client, setClient] = useState<PhoneClient | null>(null);
+  // Taken once, and then taken off the address: the secret it holds is for
+  // joining and must not stay in the history.
+  const [fragment] = useState(() => {
+    const parsed = parseFragment(window.location.hash);
+    if (window.location.hash) {
+      history.replaceState(null, "", window.location.pathname);
+    }
+    return parsed;
+  });
+
+  useEffect(() => {
+    store.load().then(
+      (kept) => setSession(kept),
+      () => setSession(null),
+    );
+  }, []);
+
+  useEffect(() => {
+    if (!session) {
+      return;
+    }
+    const started = clientFor(session);
+    setClient(started);
+    return () => started.stop();
+  }, [session]);
+
+  if (session === undefined) {
+    return null;
+  }
+  if (session && client) {
+    return (
+      <PhoneApp
+        api={client}
+        onGone={() => {
+          setClient(null);
+          setSession(null);
+        }}
+      />
+    );
+  }
+  if (session) {
+    return null;
+  }
+  const pair = fragment
+    ? pairing(fragment, { origin, fetch: window.fetch.bind(window), sleep })
+    : null;
+  return (
+    <PairScreen
+      pair={pair}
+      onSession={(connected) => {
+        void store.save(connected).then(() => setSession(connected));
+      }}
+    />
+  );
+}
+
+followTheme();
+createRoot(root).render(
+  <StrictMode>
+    <Boot />
+  </StrictMode>,
+);
+
+// Only the page's own files are kept for the next visit, never what a bot asked.
+if ("serviceWorker" in navigator) {
+  navigator.serviceWorker.register("/m/sw.js", { scope: "/m/" }).catch(() => {});
+}
diff --git a/app/src/phone/notices.test.ts b/app/src/phone/notices.test.ts
new file mode 100644
index 00000000..1e306b44
--- /dev/null
+++ b/app/src/phone/notices.test.ts
@@ -0,0 +1,144 @@
+import { describe, expect, test } from "vitest";
+import { toB64 } from "./crypto";
+import {
+  keepNotices,
+  type NoticePlatform,
+  type NoticeServer,
+  noticeState,
+  turnOff,
+  turnOn,
+} from "./notices";
+
+const KEY = toB64(new Uint8Array(65).fill(4));
+
+/** A browser that can be told how it answers, and what it was asked. */
+function browser(change: Partial<NoticePlatform> = {}) {
+  let permission: NotificationPermission = "default";
+  let kept: { endpoint: string } | null = null;
+  const asked: string[] = [];
+  const platform: NoticePlatform = {
+    supported: () => true,
+    homeScreenNeeded: () => false,
+    permission: () => permission,
+    requestPermission: async () => {
+      asked.push("permission");
+      permission = "granted";
+      return permission;
+    },
+    subscription: async () => kept,
+    subscribe: async (key) => {
+      asked.push(`subscribe:${key.length}`);
+      kept = { endpoint: "https://push.example/abc" };
+      return kept;
+    },
+    unsubscribe: async () => {
+      asked.push("unsubscribe");
+      kept = null;
+    },
+    ...change,
+  };
+  return {
+    platform,
+    asked,
+    grant: () => (permission = "granted"),
+    deny: () => (permission = "denied"),
+  };
+}
+
+function server(key: string | null = KEY, accepts = true) {
+  const told: string[] = [];
+  const api: NoticeServer = {
+    key: async () => key,
+    subscribe: async (endpoint) => {
+      told.push(endpoint);
+      return accepts;
+    },
+    unsubscribe: async () => {
+      told.push("unsubscribe");
+    },
+  };
+  return { api, told };
+}
+
+describe("what the page can say about its notices", () => {
+  test("is off until asked, and on after", async () => {
+    const b = browser();
+    const s = server();
+    expect(await noticeState(b.platform, s.api)).toBe("off");
+    expect(await turnOn(b.platform, s.api)).toBe("on");
+    // The server got the address the push service gave, and the key had 65 bytes.
+    expect(s.told).toEqual(["https://push.example/abc"]);
+    expect(b.asked).toEqual(["permission", "subscribe:65"]);
+    expect(await noticeState(b.platform, s.api)).toBe("on");
+  });
+
+  test("says why it cannot: no support, no server push, the Home Screen, or a no", async () => {
+    expect(await noticeState(browser({ supported: () => false }).platform, server().api)).toBe(
+      "unsupported",
+    );
+    expect(await noticeState(browser().platform, server(null).api)).toBe("unsupported");
+    expect(
+      await noticeState(browser({ homeScreenNeeded: () => true }).platform, server().api),
+    ).toBe("home-screen");
+    const denied = browser();
+    denied.deny();
+    expect(await noticeState(denied.platform, server().api)).toBe("blocked");
+    // None of them asks the browser for anything.
+    expect(denied.asked).toEqual([]);
+  });
+
+  test("a refusal in the browser leaves it off or blocked, and subscribes to nothing", async () => {
+    const no = browser({
+      requestPermission: async () => "denied",
+    });
+    expect(await turnOn(no.platform, server().api)).toBe("off");
+    expect(no.asked).toEqual([]);
+    const closed = browser({ requestPermission: async () => "default" });
+    const s = server();
+    expect(await turnOn(closed.platform, s.api)).toBe("off");
+    expect(s.told).toEqual([]);
+  });
+
+  test("an address the server refuses is given back to the browser", async () => {
+    const b = browser();
+    const s = server(KEY, false);
+    expect(await turnOn(b.platform, s.api)).toBe("off");
+    expect(b.asked).toEqual(["permission", "subscribe:65", "unsubscribe"]);
+    expect(await b.platform.subscription()).toBeNull();
+  });
+
+  test("turning off tells the server and the browser", async () => {
+    const b = browser();
+    const s = server();
+    await turnOn(b.platform, s.api);
+    expect(await turnOff(b.platform, s.api)).toBe("off");
+    expect(s.told.at(-1)).toBe("unsubscribe");
+    expect(b.asked.at(-1)).toBe("unsubscribe");
+  });
+});
+
+describe("keeping notices working", () => {
+  test("tells the server again, and subscribes again if the browser lost the address", async () => {
+    const b = browser();
+    const s = server();
+    await keepNotices(b.platform, s.api);
+    expect(s.told).toEqual([]);
+
+    b.grant();
+    await keepNotices(b.platform, s.api);
+    expect(b.asked).toEqual(["subscribe:65"]);
+    expect(s.told).toEqual(["https://push.example/abc"]);
+    await keepNotices(b.platform, s.api);
+    expect(b.asked).toEqual(["subscribe:65"]);
+    expect(s.told.length).toBe(2);
+  });
+
+  test("does nothing when this server sends no notices", async () => {
+    const b = browser();
+    b.grant();
+    const s = server(null);
+    await keepNotices(b.platform, s.api);
+    expect(b.asked).toEqual([]);
+    expect(s.told).toEqual([]);
+  });
+});
diff --git a/app/src/phone/notices.ts b/app/src/phone/notices.ts
new file mode 100644
index 00000000..852cc0f6
--- /dev/null
+++ b/app/src/phone/notices.ts
@@ -0,0 +1,136 @@
+// Notices on the phone (spec 28.8): the browser's push service tells this page
+// something waits, with no content, and the page's worker writes the notice.
+// Here is turning that on and off, and keeping it working.
+
+import { fromB64 } from "./crypto";
+
+/** What the page can say about its notices. */
+export type NoticeState =
+  /** This browser, or this server, cannot give them. */
+  | "unsupported"
+  /** Safari gives them only to a page on the Home Screen. */
+  | "home-screen"
+  | "off"
+  /** The owner said no in the browser; only its settings can change that. */
+  | "blocked"
+  | "on";
+
+/** The browser's side of it, so the page can be tested without one. */
+export interface NoticePlatform {
+  supported(): boolean;
+  homeScreenNeeded(): boolean;
+  permission(): NotificationPermission;
+  requestPermission(): Promise<NotificationPermission>;
+  /** The address the push service gave this page, if it has one. */
+  subscription(): Promise<{ endpoint: string } | null>;
+  subscribe(key: Uint8Array): Promise<{ endpoint: string }>;
+  unsubscribe(): Promise<void>;
+}
+
+/** The server's side of it. */
+export interface NoticeServer {
+  /** The key to subscribe with; `null` when this server sends no notices. */
+  key(): Promise<string | null>;
+  /** False if the server refused the address. */
+  subscribe(endpoint: string): Promise<boolean>;
+  unsubscribe(): Promise<void>;
+}
+
+export async function noticeState(
+  platform: NoticePlatform,
+  server: NoticeServer,
+): Promise<NoticeState> {
+  if (!platform.supported()) {
+    return "unsupported";
+  }
+  if (platform.homeScreenNeeded()) {
+    return "home-screen";
+  }
+  if (platform.permission() === "denied") {
+    return "blocked";
+  }
+  if (platform.permission() === "granted" && (await platform.subscription())) {
+    return "on";
+  }
+  return (await server.key()) === null ? "unsupported" : "off";
+}
+
+/** Asks for permission (this must come from a tap), subscribes and tells the server. */
+export async function turnOn(platform: NoticePlatform, server: NoticeServer): Promise<NoticeState> {
+  const state = await noticeState(platform, server);
+  if (state !== "off") {
+    return state;
+  }
+  if ((await platform.requestPermission()) !== "granted") {
+    return platform.permission() === "denied" ? "blocked" : "off";
+  }
+  const key = await server.key();
+  if (key === null) {
+    return "unsupported";
+  }
+  const subscription = await platform.subscribe(fromB64(key));
+  if (!(await server.subscribe(subscription.endpoint))) {
+    await platform.unsubscribe();
+    return "off";
+  }
+  return "on";
+}
+
+export async function turnOff(
+  platform: NoticePlatform,
+  server: NoticeServer,
+): Promise<NoticeState> {
+  await server.unsubscribe().catch(() => {});
+  await platform.unsubscribe().catch(() => {});
+  return noticeState(platform, server);
+}
+
+/**
+ * When the page opens with notices on, the server is told the address again:
+ * the push service may have changed it, and the server may have lost it.
+ */
+export async function keepNotices(platform: NoticePlatform, server: NoticeServer): Promise<void> {
+  if (!platform.supported() || platform.permission() !== "granted") {
+    return;
+  }
+  let subscription = await platform.subscription();
+  if (!subscription) {
+    const key = await server.key();
+    if (key === null) {
+      return;
+    }
+    subscription = await platform.subscribe(fromB64(key));
+  }
+  await server.subscribe(subscription.endpoint);
+}
+
+/** The browser's own push, from the page's service worker. */
+export function browserPlatform(): NoticePlatform {
+  const registration = () => navigator.serviceWorker.ready;
+  const subscription = async () => (await registration()).pushManager.getSubscription();
+  return {
+    supported: () =>
+      typeof navigator !== "undefined" &&
+      "serviceWorker" in navigator &&
+      "PushManager" in window &&
+      "Notification" in window,
+    homeScreenNeeded: () => {
+      const ios = /iPad|iPhone|iPod/.test(navigator.userAgent);
+      const standalone =
+        (navigator as Navigator & { standalone?: boolean }).standalone === true ||
+        window.matchMedia?.("(display-mode: standalone)").matches === true;
+      return ios && !standalone;
+    },
+    permission: () => Notification.permission,
+    requestPermission: () => Notification.requestPermission(),
+    subscription,
+    subscribe: async (key) =>
+      (await registration()).pushManager.subscribe({
+        userVisibleOnly: true,
+        applicationServerKey: new Uint8Array(key),
+      }),
+    unsubscribe: async () => {
+      await (await subscription())?.unsubscribe();
+    },
+  };
+}
diff --git a/app/src/phone/pair.ts b/app/src/phone/pair.ts
new file mode 100644
index 00000000..5a61e03f
--- /dev/null
+++ b/app/src/phone/pair.ts
@@ -0,0 +1,154 @@
+// Connecting this phone (spec 28.3): read the QR's address, join the code with
+// a proof, show the six digits to compare, and collect the token once the
+// owner accepts at the computer.
+
+import {
+  acceptProof,
+  deriveKeys,
+  fromB64,
+  generateKeypair,
+  joinProof,
+  type Keypair,
+  pairCode,
+  toB64,
+} from "./crypto";
+import type { Session } from "./store";
+
+/** What the QR holds after the `#`; the browser never sends it to the server. */
+export interface Fragment {
+  id: string;
+  secret: Uint8Array;
+  daemonPub: Uint8Array;
+}
+
+export function parseFragment(hash: string): Fragment | null {
+  const params = new URLSearchParams(hash.replace(/^#/, ""));
+  const [id, secret, daemonPub] = [params.get("p"), params.get("s"), params.get("d")];
+  if (!id || !secret || !daemonPub) {
+    return null;
+  }
+  try {
+    const parsed = { id, secret: fromB64(secret), daemonPub: fromB64(daemonPub) };
+    return parsed.secret.length === 32 && parsed.daemonPub.length === 65 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Why a connection did not happen; the screen words it. */
+export type PairFailure = "expired" | "offline" | "failed";
+
+export class PairError extends Error {
+  constructor(readonly reason: PairFailure) {
+    super(reason);
+  }
+}
+
+export interface PairDeps {
+  origin: string;
+  fetch: typeof fetch;
+  sleep(ms: number): Promise<void>;
+}
+
+/** A phone that joined the code and waits for the owner. */
+export interface Joined {
+  /** Six digits, the same as the computer shows. */
+  code: string;
+  /** Waits until the owner accepts; throws `PairError` if the code ran out. */
+  collect(): Promise<Session>;
+}
+
+export interface Pair {
+  join(name: string): Promise<Joined>;
+}
+
+export function pairing(fragment: Fragment, deps: PairDeps): Pair {
+  const call = async (path: string, init?: RequestInit) => {
+    try {
+      return await deps.fetch(`${deps.origin}${path}`, init);
+    } catch {
+      throw new PairError("offline");
+    }
+  };
+  return {
+    async join(name) {
+      const keys = await generateKeypair();
+      const proof = await joinProof(fragment.secret, fragment.id, keys.publicRaw);
+      const joined = await call(`/v1/pairings/${fragment.id}/join`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          phone_pub: toB64(keys.publicRaw),
+          device_name: name,
+          proof: toB64(proof),
+        }),
+      });
+      if (joined.status === 410) {
+        throw new PairError("expired");
+      }
+      if (!joined.ok) {
+        throw new PairError("failed");
+      }
+      const { poll } = (await joined.json()) as { poll: string };
+      const code = await pairCode(fragment.secret, fragment.daemonPub, keys.publicRaw);
+      return {
+        code,
+        async collect() {
+          for (;;) {
+            const answer = await call(`/v1/pairings/${fragment.id}/result`, {
+              headers: { Authorization: `Bearer ${poll}` },
+            });
+            if (!answer.ok) {
+              throw new PairError("failed");
+            }
+            const result = (await answer.json()) as Record<string, string>;
+            if (result.status === "expired") {
+              throw new PairError("expired");
+            }
+            if (result.status === "approved") {
+              return finish(result, keys, name);
+            }
+            await deps.sleep(1000);
+          }
+        },
+      };
+    },
+  };
+
+  async function finish(
+    result: Record<string, string>,
+    mine: Keypair,
+    name: string,
+  ): Promise<Session> {
+    const [token, device, peer, daemonPub, proof2] = [
+      result.token,
+      result.device,
+      result.peer,
+      result.daemon_pub,
+      result.proof2,
+    ];
+    if (!token || !device || !peer || !daemonPub || !proof2) {
+      throw new PairError("failed");
+    }
+    const theirs = fromB64(daemonPub);
+    // The key must be the one in the QR, and the computer must prove it
+    // accepted with the QR's secret: a server in the middle can do neither.
+    const expected = await acceptProof(fragment.secret, fragment.id, theirs, mine.publicRaw);
+    if (!sameBytes(theirs, fragment.daemonPub) || !sameBytes(expected, fromB64(proof2))) {
+      throw new PairError("failed");
+    }
+    return {
+      token,
+      device,
+      peer,
+      name,
+      keys: await deriveKeys(mine.privateKey, theirs, fragment.secret),
+      sent: 0,
+      received: 0,
+    };
+  }
+}
+
+function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+  return a.length === b.length && a.every((byte, index) => byte === b[index]);
+}
diff --git a/app/src/phone/parts.tsx b/app/src/phone/parts.tsx
new file mode 100644
index 00000000..ee2bd07e
--- /dev/null
+++ b/app/src/phone/parts.tsx
@@ -0,0 +1,63 @@
+// The small pieces the phone's screens share: big buttons for a thumb, the
+// bot's dot, and a bot's markdown with no links and no pictures.
+
+import type { ButtonHTMLAttributes, ReactNode } from "react";
+import ReactMarkdown from "react-markdown";
+import remarkGfm from "remark-gfm";
+
+type Look = "primary" | "danger" | "quiet";
+
+const looks: Record<Look, string> = {
+  primary: "border-ink bg-ink text-canvas",
+  danger: "border-danger/60 bg-panel text-danger",
+  quiet: "border-line-strong bg-panel text-ink",
+};
+
+/** 48 px tall: a target a thumb finds. */
+export function PhoneButton({
+  look = "quiet",
+  className = "",
+  type = "button",
+  ...rest
+}: ButtonHTMLAttributes<HTMLButtonElement> & { look?: Look }) {
+  return (
+    <button
+      type={type}
+      className={`inline-flex h-12 min-w-0 flex-1 items-center justify-center rounded-xl border px-4 font-medium text-base active:scale-[0.98] disabled:pointer-events-none disabled:opacity-45 ${looks[look]} ${className}`}
+      {...rest}
+    />
+  );
+}
+
+/** The bot's color and first letter. */
+export function BotDot({ name, color }: { name: string; color: string }) {
+  return (
+    <span
+      aria-hidden
+      style={{ backgroundColor: /^#[0-9a-f]{3,8}$/i.test(color) ? color : undefined }}
+      className="inline-flex h-8 w-8 shrink-0 items-center justify-center rounded-full border border-black/20 bg-sunken font-semibold text-black/80 text-sm"
+    >
+      {name.slice(0, 1).toUpperCase()}
+    </span>
+  );
+}
+
+/** What a bot wrote as markdown; links and pictures are shown as words only. */
+export function PhoneMarkdown({ children }: { children: string }) {
+  return (
+    <div className="chat-md text-base">
+      <ReactMarkdown
+        remarkPlugins={[remarkGfm]}
+        skipHtml
+        components={{
+          a: ({ children: label }: { children?: ReactNode }) => (
+            <span className="underline decoration-dotted">{label}</span>
+          ),
+          img: ({ alt }: { alt?: string | undefined }) => <span>{alt}</span>,
+        }}
+      >
+        {children}
+      </ReactMarkdown>
+    </div>
+  );
+}
diff --git a/app/src/phone/phone.css b/app/src/phone/phone.css
new file mode 100644
index 00000000..1b1b3b5c
--- /dev/null
+++ b/app/src/phone/phone.css
@@ -0,0 +1,21 @@
+/* The phone's page (spec 28.7): the app's colors and fonts, and a page that
+   scrolls and whose text can be selected, as on any phone. */
+@import "../index.css";
+@source "../";
+
+@layer base {
+  html,
+  body,
+  #root {
+    height: auto;
+    min-height: 100%;
+  }
+
+  body {
+    overflow: auto;
+    user-select: text;
+    font-size: 1rem;
+    -webkit-text-size-adjust: 100%;
+    overscroll-behavior-y: contain;
+  }
+}
diff --git a/app/src/phone/phone.test.tsx b/app/src/phone/phone.test.tsx
new file mode 100644
index 00000000..d47ffe97
--- /dev/null
+++ b/app/src/phone/phone.test.tsx
@@ -0,0 +1,250 @@
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import type { ApprovalCard, QuestionCard } from "../lib/protocol.gen";
+import { FakePhone } from "./fake";
+import { guessName, PairScreen } from "./PairScreen";
+import { PhoneApp } from "./PhoneApp";
+import { type Pair, PairError } from "./pair";
+import type { Session } from "./store";
+
+afterEach(cleanup);
+
+const approval = (change: Partial<ApprovalCard> = {}): ApprovalCard => ({
+  approvalId: "apr_1",
+  bot: { name: "Scout", color: "#aabbcc" },
+  crew: "Ops",
+  createdAt: Date.now(),
+  toolName: "Bash",
+  summary: "git status",
+  explanation: "Shows what changed",
+  text: "git status --short",
+  cut: false,
+  atComputer: false,
+  ...change,
+});
+
+const question = (change: Partial<QuestionCard> = {}): QuestionCard => ({
+  questionId: "qst_1",
+  bot: { name: "Writer", color: "#ccbbaa" },
+  crew: "Ops",
+  createdAt: Date.now(),
+  text: "Which **client** first?",
+  options: ["Acme", "Globex"],
+  ...change,
+});
+
+describe("what waits for the owner", () => {
+  test("says when it is looking, and when nothing waits", () => {
+    const phone = new FakePhone();
+    phone.set({ loaded: false });
+    render(<PhoneApp api={phone} />);
+    expect(screen.getByText("Checking what is waiting…")).toBeTruthy();
+    act(() => phone.set({ loaded: true }));
+    expect(screen.getByText("Nothing is waiting for you")).toBeTruthy();
+  });
+
+  test("shows a request with what the bot says it is for, and the whole of it a tap away", async () => {
+    const phone = new FakePhone();
+    phone.add(approval());
+    render(<PhoneApp api={phone} />);
+    expect(screen.getByText("Scout asks to")).toBeTruthy();
+    expect(screen.getByText("git status")).toBeTruthy();
+    expect(screen.getByText("Shows what changed")).toBeTruthy();
+    expect(screen.getByText("Scout wrote this")).toBeTruthy();
+    expect(screen.queryByText("git status --short")).toBeNull();
+    fireEvent.click(screen.getByRole("button", { name: "Show the whole request" }));
+    expect(screen.getByText("git status --short")).toBeTruthy();
+  });
+
+  test("warns when the bot did not say what a command is for", () => {
+    const phone = new FakePhone();
+    const { explanation: _unsaid, ...unexplained } = approval();
+    phone.add(unexplained);
+    render(<PhoneApp api={phone} />);
+    expect(screen.getByText(/Scout did not say what this is for/)).toBeTruthy();
+  });
+
+  test("allows with a note, denies, and says when it could not send", async () => {
+    const phone = new FakePhone();
+    phone.add(approval());
+    render(<PhoneApp api={phone} />);
+    fireEvent.change(screen.getByLabelText("Note for the bot (optional)"), {
+      target: { value: "go on" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Allow" }));
+    await waitFor(() =>
+      expect(phone.calls).toEqual([{ method: "answerApproval", args: ["apr_1", true, "go on"] }]),
+    );
+
+    phone.sendable = false;
+    fireEvent.click(screen.getByRole("button", { name: "Deny" }));
+    expect(await screen.findByText("Not sent. Check the connection and try again.")).toBeTruthy();
+    expect(phone.calls[1]?.args).toEqual(["apr_1", false, "go on"]);
+  });
+
+  test("a request that is cut, or belongs to the computer, can only be denied", () => {
+    const phone = new FakePhone();
+    phone.add(approval({ approvalId: "apr_cut", cut: true }));
+    phone.add(approval({ approvalId: "apr_pc", atComputer: true }));
+    render(<PhoneApp api={phone} />);
+    for (const allow of screen.getAllByRole("button", { name: "Allow" })) {
+      expect((allow as HTMLButtonElement).disabled).toBe(true);
+    }
+    for (const deny of screen.getAllByRole("button", { name: "Deny" })) {
+      expect((deny as HTMLButtonElement).disabled).toBe(false);
+    }
+    expect(screen.getByText(/Too long to read on a phone/)).toBeTruthy();
+    expect(screen.getByText(/needs you at the computer/)).toBeTruthy();
+  });
+
+  test("a request on its way cannot be pressed twice", () => {
+    const phone = new FakePhone();
+    phone.add(approval());
+    phone.set({ sending: ["apr_1"] });
+    render(<PhoneApp api={phone} />);
+    for (const button of [
+      screen.getByRole("button", { name: "Allow" }),
+      screen.getByRole("button", { name: "Deny" }),
+    ]) {
+      expect((button as HTMLButtonElement).disabled).toBe(true);
+    }
+  });
+
+  test("answers a question with a ready answer or with words, or dismisses it", async () => {
+    const phone = new FakePhone();
+    phone.add(undefined, question());
+    render(<PhoneApp api={phone} />);
+    // The text is markdown: the emphasis is not shown as asterisks.
+    expect(screen.getByText("client").tagName).toBe("STRONG");
+    fireEvent.click(screen.getByRole("button", { name: "Globex" }));
+    fireEvent.change(screen.getByLabelText("Your answer"), { target: { value: "  Initech " } });
+    fireEvent.click(screen.getByRole("button", { name: "Answer" }));
+    fireEvent.click(screen.getByRole("button", { name: "Dismiss" }));
+    await waitFor(() => expect(phone.calls.length).toBe(3));
+    expect(phone.calls).toEqual([
+      { method: "answerQuestion", args: ["qst_1", "Globex"] },
+      { method: "answerQuestion", args: ["qst_1", "Initech"] },
+      { method: "dismissQuestion", args: ["qst_1"] },
+    ]);
+  });
+
+  test("lists the oldest first and says when the computer is off or the connection is lost", () => {
+    const phone = new FakePhone();
+    phone.add(approval());
+    phone.set({ computer: "offline", link: "offline" });
+    render(<PhoneApp api={phone} />);
+    expect(screen.getByText(/Your computer is off or has no internet/)).toBeTruthy();
+    expect(screen.getByText("No connection. Trying again…")).toBeTruthy();
+  });
+});
+
+describe("this phone", () => {
+  test("disconnecting asks first, then leaves", async () => {
+    const phone = new FakePhone();
+    render(<PhoneApp api={phone} />);
+    fireEvent.click(screen.getByRole("button", { name: "This phone" }));
+    expect(screen.getByText("Celular da Ana", { exact: false })).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "Disconnect this phone" }));
+    const dialog = await screen.findByRole("dialog", { name: "Disconnect this phone?" });
+    fireEvent.click(within(dialog).getByRole("button", { name: "Disconnect this phone" }));
+    await waitFor(() => expect(phone.calls.map((call) => call.method)).toEqual(["disconnect"]));
+    expect(await screen.findByText("Phone disconnected")).toBeTruthy();
+  });
+
+  test("a phone the computer cut off says so and forgets itself on OK", async () => {
+    const phone = new FakePhone();
+    phone.set({ session: "revoked" });
+    render(<PhoneApp api={phone} />);
+    expect(screen.getByText("This phone was disconnected")).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "OK" }));
+    expect(phone.calls.map((call) => call.method)).toEqual(["disconnect"]);
+  });
+});
+
+describe("connecting this phone", () => {
+  const session = { token: "t", device: "d", peer: "p", name: "Phone" } as unknown as Session;
+  const pairOf = (join: Pair["join"]): Pair => ({ join });
+
+  test("explains how to get here when the page was not opened from a code", () => {
+    render(<PairScreen pair={null} onSession={() => {}} />);
+    expect(screen.getByText(/point its camera at the code on your computer/)).toBeTruthy();
+    expect(screen.queryByRole("button", { name: "Connect" })).toBeNull();
+  });
+
+  test("takes a name, shows the six digits to compare and hands over the session", async () => {
+    const onSession = vi.fn();
+    const join = vi.fn(async (name: string) => ({
+      code: "482913",
+      collect: async () => ({ ...session, name }),
+    }));
+    render(<PairScreen pair={pairOf(join)} onSession={onSession} />);
+    fireEvent.change(screen.getByLabelText("Name of this phone"), {
+      target: { value: "Celular da Ana" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Connect" }));
+    expect(await screen.findByText("482 913")).toBeTruthy();
+    expect(screen.getByText(/Check that your computer shows 482 913 too/)).toBeTruthy();
+    await waitFor(() =>
+      expect(onSession).toHaveBeenCalledWith({ ...session, name: "Celular da Ana" }),
+    );
+    expect(join).toHaveBeenCalledWith("Celular da Ana");
+  });
+
+  test("says why it could not connect, and lets the owner try again", async () => {
+    const join = vi.fn(async () => {
+      throw new PairError("expired");
+    });
+    render(<PairScreen pair={pairOf(join)} onSession={() => {}} />);
+    fireEvent.click(screen.getByRole("button", { name: "Connect" }));
+    expect(await screen.findByText(/ran out or was already used/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Connect" })).toBeTruthy();
+  });
+
+  test("starts from a name that fits the kind of phone", () => {
+    const names = { iphone: "iPhone", ipad: "iPad", android: "Android phone", other: "Phone" };
+    expect(guessName(names, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0)")).toBe("iPhone");
+    expect(guessName(names, "Mozilla/5.0 (iPad; CPU OS 17_0)")).toBe("iPad");
+    expect(guessName(names, "Mozilla/5.0 (Linux; Android 14; Pixel 8)")).toBe("Android phone");
+    expect(guessName(names, "Mozilla/5.0 (X11; Linux x86_64)")).toBe("Phone");
+  });
+});
+
+describe("notices", () => {
+  test("the inbox invites while they are off and goes quiet once they are on", async () => {
+    const phone = new FakePhone();
+    render(<PhoneApp api={phone} />);
+    fireEvent.click(await screen.findByRole("button", { name: "Turn on notices" }));
+    await waitFor(() => expect(phone.calls.map((call) => call.method)).toEqual(["turnOnNotices"]));
+    await waitFor(() =>
+      expect(screen.queryByRole("button", { name: "Turn on notices" })).toBeNull(),
+    );
+  });
+
+  test("the page about this phone turns them on and off and says when they are blocked", async () => {
+    const phone = new FakePhone();
+    phone.notices = "on";
+    render(<PhoneApp api={phone} />);
+    // On: the inbox has nothing to say; this phone's page has the control.
+    expect(screen.queryByRole("button", { name: "Turn on notices" })).toBeNull();
+    fireEvent.click(screen.getByRole("button", { name: "This phone" }));
+    expect(await screen.findByText(/Notices are on/)).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "Turn off notices" }));
+    expect(await screen.findByText("Notices are off.")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Turn on notices" })).toBeTruthy();
+  });
+
+  test("says when the owner blocked them or the browser cannot", async () => {
+    for (const [state, words] of [
+      ["blocked", /blocked for this page/],
+      ["unsupported", /cannot give notices/],
+    ] as const) {
+      cleanup();
+      const phone = new FakePhone();
+      phone.notices = state;
+      render(<PhoneApp api={phone} />);
+      fireEvent.click(screen.getByRole("button", { name: "This phone" }));
+      expect(await screen.findByText(words)).toBeTruthy();
+      expect(screen.queryByRole("button", { name: "Turn on notices" })).toBeNull();
+    }
+  });
+});
diff --git a/app/src/phone/store.ts b/app/src/phone/store.ts
new file mode 100644
index 00000000..9af19733
--- /dev/null
+++ b/app/src/phone/store.ts
@@ -0,0 +1,103 @@
+// What the phone keeps between visits (spec 28.7): the token, the keys and the
+// two counters, in IndexedDB. The keys are CryptoKeys that cannot be
+// exported. Nothing a bot asked is ever kept: the cards live in memory only.
+
+import type { Keys } from "./crypto";
+
+export interface Session {
+  /** What the server knows this phone by. */
+  token: string;
+  /** This phone's device id on the server: part of every sealed message. */
+  device: string;
+  /** The computer it serves. */
+  peer: string;
+  name: string;
+  keys: Keys;
+  /** The last number this phone sealed with; saved before the message goes. */
+  sent: number;
+  /** The highest number taken from the computer; the next must be greater. */
+  received: number;
+}
+
+export interface SessionStore {
+  load(): Promise<Session | null>;
+  save(session: Session): Promise<void>;
+  clear(): Promise<void>;
+}
+
+/** For tests, and for a browser that has no IndexedDB. */
+export function memoryStore(initial: Session | null = null): SessionStore {
+  let kept = initial;
+  return {
+    load: async () => kept,
+    save: async (session) => {
+      kept = session;
+    },
+    clear: async () => {
+      kept = null;
+    },
+  };
+}
+
+const DB = "botloft-phone";
+const STORE = "session";
+const KEY = "session";
+
+function request<T>(wanted: IDBRequest<T>): Promise<T> {
+  return new Promise((resolve, reject) => {
+    wanted.onsuccess = () => resolve(wanted.result);
+    wanted.onerror = () => reject(wanted.error);
+  });
+}
+
+function openDb(): Promise<IDBDatabase> {
+  return new Promise((resolve, reject) => {
+    const opening = indexedDB.open(DB, 1);
+    opening.onupgradeneeded = () => opening.result.createObjectStore(STORE);
+    opening.onsuccess = () => resolve(opening.result);
+    opening.onerror = () => reject(opening.error);
+  });
+}
+
+/** The session in IndexedDB; the page works from memory if the browser refuses. */
+export function browserStore(): SessionStore {
+  if (typeof indexedDB === "undefined") {
+    return memoryStore();
+  }
+  const fallback = memoryStore();
+  const work = async <T>(
+    use: (store: IDBObjectStore) => IDBRequest<T>,
+    mode: IDBTransactionMode,
+  ) => {
+    const db = await openDb();
+    try {
+      return await request(use(db.transaction(STORE, mode).objectStore(STORE)));
+    } finally {
+      db.close();
+    }
+  };
+  return {
+    load: async () => {
+      try {
+        return ((await work((store) => store.get(KEY), "readonly")) as Session | undefined) ?? null;
+      } catch {
+        return fallback.load();
+      }
+    },
+    save: async (session) => {
+      try {
+        await work((store) => store.put(session, KEY), "readwrite");
+      } catch {
+        await fallback.save(session);
+      }
+    },
+    clear: async () => {
+      await fallback.clear();
+      try {
+        await work((store) => store.delete(KEY), "readwrite");
+      } catch {
+        // Nothing more to forget.
+      }
+    },
+  };
+}
diff --git a/app/src/phone/sw.test.ts b/app/src/phone/sw.test.ts
new file mode 100644
index 00000000..88b93ae8
--- /dev/null
+++ b/app/src/phone/sw.test.ts
@@ -0,0 +1,81 @@
+// @vitest-environment node
+// The phone's service worker (public-phone/sw.js), run against a stand-in for
+// the worker's world: what a push shows, in which words, and where a tap goes.
+
+import { describe, expect, test, vi } from "vitest";
+import code from "../../public-phone/sw.js?raw";
+
+type Listener = (event: Record<string, unknown>) => void;
+
+function worker(language: string, windows: { url: string; focus: () => unknown }[] = []) {
+  const listeners: Record<string, Listener> = {};
+  const shown: { title: string; options: Record<string, unknown> }[] = [];
+  const opened: string[] = [];
+  const self = {
+    addEventListener: (name: string, listener: Listener) => {
+      listeners[name] = listener;
+    },
+    navigator: { language },
+    location: { origin: "https://cloud.example.org" },
+    registration: {
+      showNotification: async (title: string, options: Record<string, unknown>) => {
+        shown.push({ title, options });
+      },
+    },
+    clients: {
+      matchAll: async () => windows,
+      openWindow: async (url: string) => {
+        opened.push(url);
+      },
+      claim: async () => {},
+    },
+    skipWaiting: () => {},
+  };
+  new Function("self", "caches", "fetch", code)(self, {}, vi.fn());
+  /** Fires `name` and waits for what the worker waited on. */
+  const fire = async (name: string, event: Record<string, unknown> = {}) => {
+    const waited: Promise<unknown>[] = [];
+    listeners[name]?.({ ...event, waitUntil: (work: Promise<unknown>) => waited.push(work) });
+    await Promise.all(waited);
+  };
+  return { fire, shown, opened };
+}
+
+describe("a push", () => {
+  test("shows one notice in the phone's language, with nothing from the push in it", async () => {
+    for (const [language, title] of [
+      ["en-US", "Botloft needs you"],
+      ["pt-BR", "O Botloft precisa de você"],
+      ["es-ES", "Botloft te necesita"],
+      ["de", "Botloft needs you"],
+    ] as const) {
+      const w = worker(language);
+      // Even a push that carried something is not read: the page has the details.
+      await w.fire("push", { data: { text: () => "a secret command" } });
+      expect(w.shown).toHaveLength(1);
+      expect(w.shown[0]?.title).toBe(title);
+      expect(JSON.stringify(w.shown[0])).not.toContain("secret");
+      // One notice stands for all that wait, and a new push brings it back up.
+      expect(w.shown[0]?.options).toMatchObject({ tag: "botloft-waiting", renotify: true });
+    }
+  });
+});
+
+describe("a tap on the notice", () => {
+  test("goes to the page that is open, or opens it", async () => {
+    const focus = vi.fn();
+    const closed = vi.fn();
+    const open = worker("en", [
+      { url: "https://cloud.example.org/other", focus: vi.fn() },
+      { url: "https://cloud.example.org/m/", focus },
+    ]);
+    await open.fire("notificationclick", { notification: { close: closed } });
+    expect(closed).toHaveBeenCalled();
+    expect(focus).toHaveBeenCalled();
+    expect(open.opened).toEqual([]);
+
+    const none = worker("en", []);
+    await none.fire("notificationclick", { notification: { close: vi.fn() } });
+    expect(none.opened).toEqual(["/m/"]);
+  });
+});
diff --git a/app/src/ui/QrCode.tsx b/app/src/ui/QrCode.tsx
new file mode 100644
index 00000000..40861f74
--- /dev/null
+++ b/app/src/ui/QrCode.tsx
@@ -0,0 +1,53 @@
+// A QR code drawn as an image, made here: nothing about what it holds leaves
+// the computer. Black on white whatever the theme, because scanners need it.
+
+import qrcode from "qrcode-generator";
+import { useMemo } from "react";
+
+/** One path for every dark square, row by row. */
+function draw(text: string): { path: string; size: number } {
+  const code = qrcode(0, "M");
+  code.addData(text);
+  code.make();
+  const count = code.getModuleCount();
+  let path = "";
+  for (let row = 0; row < count; row++) {
+    let column = 0;
+    while (column < count) {
+      if (!code.isDark(row, column)) {
+        column++;
+        continue;
+      }
+      const start = column;
+      while (column < count && code.isDark(row, column)) {
+        column++;
+      }
+      path += `M${start} ${row}h${column - start}v1h-${column - start}z`;
+    }
+  }
+  return { path, size: count };
+}
+
+/** `label` says what the code is, for whoever cannot see it. */
+export function QrCode({ text, label }: { text: string; label: string }) {
+  const { path, size } = useMemo(() => draw(text), [text]);
+  const margin = 4;
+  return (
+    <svg
+      role="img"
+      aria-label={label}
+      viewBox={`${-margin} ${-margin} ${size + margin * 2} ${size + margin * 2}`}
+      shapeRendering="crispEdges"
+      className="h-60 w-60 rounded-md"
+    >
+      <rect
+        x={-margin}
+        y={-margin}
+        width={size + margin * 2}
+        height={size + margin * 2}
+        fill="#fff"
+      />
+      <path d={path} fill="#000" />
+    </svg>
+  );
+}
diff --git a/app/src/ui/qrcode.test.tsx b/app/src/ui/qrcode.test.tsx
new file mode 100644
index 00000000..e0de42ec
--- /dev/null
+++ b/app/src/ui/qrcode.test.tsx
@@ -0,0 +1,41 @@
+import { cleanup, render, screen } from "@testing-library/react";
+import qrcode from "qrcode-generator";
+import { afterEach, expect, test } from "vitest";
+import { QrCode } from "./QrCode";
+
+afterEach(cleanup);
+
+/** The dark squares a path draws, as "row,column". */
+function squares(path: string): Set<string> {
+  const dark = new Set<string>();
+  for (const [, x, y, width] of path.matchAll(/M(\d+) (\d+)h(\d+)v1h-\d+z/g)) {
+    for (let column = Number(x); column < Number(x) + Number(width); column++) {
+      dark.add(`${y},${column}`);
+    }
+  }
+  return dark;
+}
+
+test("the picture holds exactly the squares of the code for the address", () => {
+  const url = `https://botloft.example/m#p=${"A".repeat(22)}&s=${"b".repeat(43)}&d=${"C".repeat(87)}`;
+  render(<QrCode text={url} label="Code" />);
+  const image = screen.getByRole("img", { name: "Code" });
+  const drawn = squares(image.querySelector("path")?.getAttribute("d") ?? "");
+
+  const code = qrcode(0, "M");
+  code.addData(url);
+  code.make();
+  const expected = new Set<string>();
+  for (let row = 0; row < code.getModuleCount(); row++) {
+    for (let column = 0; column < code.getModuleCount(); column++) {
+      if (code.isDark(row, column)) {
+        expected.add(`${row},${column}`);
+      }
+    }
+  }
+  expect(drawn.size).toBeGreaterThan(500);
+  expect(drawn).toEqual(expected);
+  // Black on white and a quiet margin, whatever the theme.
+  expect(image.querySelector("rect")?.getAttribute("fill")).toBe("#fff");
+  expect(image.getAttribute("viewBox")?.startsWith("-4 -4")).toBe(true);
+});
diff --git a/app/vite.config.ts b/app/vite.config.ts
index f0777aaa..6c5af669 100644
--- a/app/vite.config.ts
+++ b/app/vite.config.ts
@@ -10,8 +10,15 @@ const host = process.env.TAURI_DEV_HOST;
 
 // `vite build --mode setup` builds the setup window alone (setup.html,
 // spec 15.7) into dist-setup, which the botloft-setup crate embeds.
+// `vite build --mode phone` builds the phone's page (src/phone, spec 28.7)
+// into dist-phone, which the account server serves at /m.
 export default defineConfig(({ mode }) => ({
   plugins: [react(), tailwindcss()],
+  ...(mode === "phone" && {
+    root: fileURLToPath(new URL("./src/phone", import.meta.url)),
+    base: "/m/",
+    publicDir: fileURLToPath(new URL("./public-phone", import.meta.url)),
+  }),
   // Keep Rust compiler errors visible in the terminal.
   clearScreen: false,
   server: {
@@ -30,6 +37,8 @@ export default defineConfig(({ mode }) => ({
         fileURLToPath(new URL("../crates/botloftd/src/screens", import.meta.url)),
         // The sheets of the Bot agency, which a test reads (spec 26.2).
         fileURLToPath(new URL("../crates/botloftd/catalog", import.meta.url)),
+        // The bytes the computer and the phone must agree on (spec 28.3).
+        fileURLToPath(new URL("../docs/test-vectors", import.meta.url)),
       ],
     },
   },
@@ -37,6 +46,11 @@ export default defineConfig(({ mode }) => ({
     // WebView2 on Windows is evergreen Chromium.
     target: "chrome120",
     ...(mode === "setup" && { outDir: "dist-setup", rollupOptions: { input: "setup.html" } }),
+    ...(mode === "phone" && {
+      target: "es2022",
+      outDir: fileURLToPath(new URL("./dist-phone", import.meta.url)),
+      emptyOutDir: true,
+    }),
   },
   test: {
     environment: "jsdom",
diff --git a/crates/botloft-cloud/Cargo.toml b/crates/botloft-cloud/Cargo.toml
index 004e3062..f69eb275 100644
--- a/crates/botloft-cloud/Cargo.toml
+++ b/crates/botloft-cloud/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 
 [dependencies]
 anyhow = "1.0.104"
-axum = "0.8.9"
+axum = { version = "0.8.9", features = ["ws"] }
 base64 = "0.23.1"
 bytes = "1.12.1"
 clap = { version = "4.6.7", features = ["derive"] }
@@ -21,6 +21,8 @@ getrandom = "0.4.3"
 hex = "0.4.3"
 lettre = { version = "0.11.23", default-features = false, features = ["builder", "smtp-transport", "tokio1-rustls", "ring", "webpki-roots"] }
 object_store = { version = "0.14.2", default-features = false, features = ["aws", "fs", "tokio"] }
+p256 = { version = "0.14.0", default-features = false, features = ["ecdsa", "alloc"] }
+reqwest = { version = "0.13.5", default-features = false, features = ["rustls"] }
 rusqlite = { version = "0.40.2", features = ["bundled"] }
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
@@ -33,4 +35,5 @@ tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 
 [dev-dependencies]
 tempfile = "3.27.0"
+tokio-tungstenite = "0.30.0"
 tower = { version = "0.5.3", features = ["util"] }
diff --git a/crates/botloft-cloud/migrations/0003_mobile.sql b/crates/botloft-cloud/migrations/0003_mobile.sql
new file mode 100644
index 00000000..2bcb4748
--- /dev/null
+++ b/crates/botloft-cloud/migrations/0003_mobile.sql
@@ -0,0 +1,38 @@
+-- The phone (spec 28). A device is a `computer` (as before) or a `phone`; a
+-- phone belongs to the computer it was connected with (`peer`), and goes with
+-- it when that computer is removed.
+ALTER TABLE devices ADD COLUMN kind TEXT NOT NULL DEFAULT 'computer'
+    CHECK (kind IN ('computer', 'phone'));
+ALTER TABLE devices ADD COLUMN peer TEXT REFERENCES devices(id) ON DELETE CASCADE;
+CREATE INDEX devices_by_peer ON devices(peer);
+
+-- A phone being connected (spec 28.3). The computer opens the row; the phone
+-- joins with its public key and a proof; the computer accepts with its own;
+-- the phone then collects its token once and the row goes away. The server
+-- never sees the QR's secret, so it can only carry these values, not forge them.
+CREATE TABLE pairings (
+    id         TEXT PRIMARY KEY,
+    account_id INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    computer   TEXT NOT NULL REFERENCES devices(id) ON DELETE CASCADE,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    phone_pub  TEXT,
+    phone_name TEXT,
+    proof      TEXT,
+    poll_hash  TEXT,
+    daemon_pub TEXT,
+    proof2     TEXT
+);
+CREATE INDEX pairings_by_computer ON pairings(computer);
+
+-- Sealed messages from a phone that the computer has not acknowledged (spec
+-- 28.4). The server never reads `body`. Nothing is queued the other way.
+CREATE TABLE relay_queue (
+    from_device TEXT NOT NULL REFERENCES devices(id) ON DELETE CASCADE,
+    to_device   TEXT NOT NULL REFERENCES devices(id) ON DELETE CASCADE,
+    seq         INTEGER NOT NULL,
+    body        TEXT NOT NULL,
+    expires_at  INTEGER NOT NULL,
+    PRIMARY KEY (from_device, seq)
+);
+CREATE INDEX relay_queue_by_to ON relay_queue(to_device, from_device, seq);
diff --git a/crates/botloft-cloud/migrations/0004_push.sql b/crates/botloft-cloud/migrations/0004_push.sql
new file mode 100644
index 00000000..aa9ea75f
--- /dev/null
+++ b/crates/botloft-cloud/migrations/0004_push.sql
@@ -0,0 +1,7 @@
+-- Where a phone is told something waits for it (spec 28.8): the address its
+-- browser's push service gave it. One per phone; it goes with the phone.
+CREATE TABLE push_subscriptions (
+    device     TEXT PRIMARY KEY REFERENCES devices(id) ON DELETE CASCADE,
+    endpoint   TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+);
diff --git a/crates/botloft-cloud/src/accounts.rs b/crates/botloft-cloud/src/accounts.rs
index f5cb9724..817730fe 100644
--- a/crates/botloft-cloud/src/accounts.rs
+++ b/crates/botloft-cloud/src/accounts.rs
@@ -1,7 +1,6 @@
 //! Queries for logins, accounts and devices (spec 27.3).
 
 use rusqlite::{Connection, OptionalExtension, params};
-use serde::Serialize;
 
 /// How long a sign-in link and its request live.
 pub const LOGIN_TTL_MS: i64 = 600_000;
@@ -169,75 +168,13 @@ pub fn finish_login(
     Ok(true)
 }
 
-/// Who a token belongs to.
-pub struct Who {
-    pub account_id: i64,
-    pub device_id: String,
-    pub email: String,
-}
-
-/// Looks the token up and notes that the device was used, at most once a minute.
-pub fn who_is(conn: &Connection, token_hash: &str, now: i64) -> rusqlite::Result<Option<Who>> {
-    let who = conn
-        .query_row(
-            "SELECT devices.account_id, devices.id, accounts.email FROM devices \
-             JOIN accounts ON accounts.id = devices.account_id WHERE devices.token_hash = ?1",
-            [token_hash],
-            |row| {
-                Ok(Who {
-                    account_id: row.get(0)?,
-                    device_id: row.get(1)?,
-                    email: row.get(2)?,
-                })
-            },
-        )
-        .optional()?;
-    if let Some(who) = &who {
-        conn.execute(
-            "UPDATE devices SET last_used_at = ?1 WHERE id = ?2 AND last_used_at < ?1 - 60000",
-            params![now, who.device_id],
-        )?;
-    }
-    Ok(who)
-}
-
-#[derive(Serialize)]
-pub struct Device {
-    pub id: String,
-    pub name: String,
-    pub created_at: i64,
-    pub last_used_at: i64,
-}
-
-pub fn devices(conn: &Connection, account_id: i64) -> rusqlite::Result<Vec<Device>> {
-    let mut stmt = conn.prepare(
-        "SELECT id, name, created_at, last_used_at FROM devices \
-         WHERE account_id = ?1 ORDER BY created_at",
-    )?;
-    stmt.query_map([account_id], |row| {
-        Ok(Device {
-            id: row.get(0)?,
-            name: row.get(1)?,
-            created_at: row.get(2)?,
-            last_used_at: row.get(3)?,
-        })
-    })?
-    .collect()
-}
-
-/// False when the account has no such device.
-pub fn delete_device(conn: &Connection, account_id: i64, id: &str) -> rusqlite::Result<bool> {
-    let removed = conn.execute(
-        "DELETE FROM devices WHERE id = ?1 AND account_id = ?2",
-        params![id, account_id],
-    )?;
-    Ok(removed > 0)
-}
-
-/// Drops what ran out: links and the old counts of the rate limits.
+/// Drops what ran out: links, phones being connected, messages nobody took,
+/// and the old counts of the rate limits.
 pub fn purge(conn: &Connection, now: i64) -> rusqlite::Result<()> {
     conn.execute("DELETE FROM logins WHERE expires_at <= ?1", [now])?;
     conn.execute("DELETE FROM attempts WHERE at <= ?1", [now - 3_600_000])?;
     conn.execute("DELETE FROM deletions WHERE expires_at <= ?1", [now])?;
+    conn.execute("DELETE FROM pairings WHERE expires_at <= ?1", [now])?;
+    conn.execute("DELETE FROM relay_queue WHERE expires_at <= ?1", [now])?;
     Ok(())
 }
diff --git a/crates/botloft-cloud/src/app.rs b/crates/botloft-cloud/src/app.rs
index 104dc8f2..0d6f25d7 100644
--- a/crates/botloft-cloud/src/app.rs
+++ b/crates/botloft-cloud/src/app.rs
@@ -8,9 +8,11 @@ use axum::routing::{delete, get, post};
 use crate::clock::Clock;
 use crate::config::Config;
 use crate::db::Db;
+use crate::hub::Hub;
 use crate::mailer::Mailer;
+use crate::push::Pusher;
 use crate::store::CopyStore;
-use crate::{copies, login, removal, session};
+use crate::{copies, login, pairing, phone, push_api, relay, removal, session};
 
 #[derive(Clone)]
 pub struct AppState {
@@ -19,6 +21,8 @@ pub struct AppState {
     pub clock: Clock,
     pub config: Arc<Config>,
     pub store: CopyStore,
+    pub hub: Hub,
+    pub push: Pusher,
 }
 
 pub fn router(state: AppState) -> Router {
@@ -34,6 +38,23 @@ pub fn router(state: AppState) -> Router {
         .route("/v1/me", get(session::me))
         .route("/v1/logout", post(session::logout))
         .route("/v1/devices/{id}", delete(session::remove_device))
+        .route("/m", get(phone::index))
+        .route("/m/", get(phone::index))
+        .route("/m/{*path}", get(phone::file))
+        .route("/v1/push/key", get(push_api::key))
+        .route(
+            "/v1/push/subscribe",
+            post(push_api::subscribe).delete(push_api::unsubscribe),
+        )
+        .route("/v1/relay", get(relay::relay))
+        .route("/v1/pairings", post(pairing::open))
+        .route(
+            "/v1/pairings/{id}",
+            get(pairing::status).delete(pairing::cancel),
+        )
+        .route("/v1/pairings/{id}/join", post(pairing::join))
+        .route("/v1/pairings/{id}/accept", post(pairing::accept))
+        .route("/v1/pairings/{id}/result", get(pairing::result))
         .route("/v1/copies", get(copies::list).put(copies::put))
         .route("/v1/copies/{id}", get(copies::get).delete(copies::remove))
         .route("/v1/account/delete", post(removal::ask))
diff --git a/crates/botloft-cloud/src/config.rs b/crates/botloft-cloud/src/config.rs
index d1d62ac4..1b7e7646 100644
--- a/crates/botloft-cloud/src/config.rs
+++ b/crates/botloft-cloud/src/config.rs
@@ -29,6 +29,14 @@ pub struct Config {
     /// `X-Forwarded-For`.
     #[serde(default)]
     pub client_ip_header: Option<String>,
+    /// The built files of the phone page (`app/dist-phone`), which the
+    /// server serves at `/m` (spec 28.7). Without it there is no page.
+    #[serde(default)]
+    pub phone_dir: Option<PathBuf>,
+    /// Notices to phones through their browser's push service (spec 28.8).
+    /// Without it, a phone shows only what is there when it is opened.
+    #[serde(default)]
+    pub push: Option<Push>,
     #[serde(default)]
     pub storage: Storage,
     /// Where the copies go when `storage = "bucket"`.
@@ -36,6 +44,26 @@ pub struct Config {
     pub smtp: Smtp,
 }
 
+/// Web Push (spec 28.8): the server signs its calls to the push services
+/// with a key of its own (VAPID, RFC 8292) and sends no content.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Push {
+    /// Who runs this server, for the push services: a `mailto:` or `https:`
+    /// address.
+    pub subject: String,
+    /// A file with the private key alone (`botloft-cloud vapid-key` makes
+    /// one). The variable `BOTLOFT_CLOUD_VAPID_KEY` does the same, and wins.
+    #[serde(default)]
+    pub vapid_key_file: Option<PathBuf>,
+    /// The push services a phone may name, by host (a host also covers its
+    /// subdomains). Empty means the ones of the browsers: Chrome, Firefox,
+    /// Edge and Safari. The server calls only these, so a phone cannot make
+    /// it call another address.
+    #[serde(default)]
+    pub allow_hosts: Vec<String>,
+}
+
 /// Where the bytes of the copies are kept (spec 27.2).
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Deserialize)]
 #[serde(rename_all = "lowercase")]
@@ -82,6 +110,7 @@ pub const CONFIG_VAR: &str = "BOTLOFT_CLOUD_CONFIG";
 /// The variables that can carry a secret, for the same platforms.
 pub const SMTP_PASSWORD_VAR: &str = "BOTLOFT_CLOUD_SMTP_PASSWORD";
 pub const BUCKET_SECRET_VAR: &str = "BOTLOFT_CLOUD_BUCKET_SECRET";
+pub const VAPID_KEY_VAR: &str = "BOTLOFT_CLOUD_VAPID_KEY";
 
 /// A secret from the variable `var` if it is set, else from `file`. `what`
 /// names it in the error, which never holds the value.
@@ -165,6 +194,12 @@ impl Config {
         {
             anyhow::bail!("client_ip_header is not a header name");
         }
+        if let Some(push) = &config.push
+            && !push.subject.starts_with("mailto:")
+            && !push.subject.starts_with("https://")
+        {
+            anyhow::bail!("[push] subject must be a mailto: or https: address");
+        }
         if config.storage == Storage::Bucket && config.bucket.is_none() {
             anyhow::bail!("storage = \"bucket\" needs a [bucket] section");
         }
@@ -187,6 +222,8 @@ impl Config {
             keep: default_keep(),
             behind_proxy: true,
             client_ip_header: None,
+            phone_dir: None,
+            push: None,
             storage: Storage::Disk,
             bucket: None,
             smtp: Smtp {
@@ -236,6 +273,44 @@ mod tests {
         );
     }
 
+    #[test]
+    fn push_needs_a_subject_that_says_who_runs_the_server() {
+        let with = |subject: &str| {
+            let (_dir, path) = write(&format!(
+                "public_url = \"https://cloud.example.org\"
+                 [smtp]
+host = \"mail\"
+user = \"u\"
+from = \"a <a@b.c>\"
+                 [push]
+subject = \"{subject}\"
+vapid_key_file = \"k\"
+"
+            ));
+            Config::load(&path)
+        };
+        for good in ["mailto:ops@example.org", "https://example.org/contact"] {
+            let config = with(good).expect(good);
+            let push = config.push.expect("push");
+            assert!(
+                push.allow_hosts.is_empty(),
+                "the browsers' services by default"
+            );
+        }
+        for bad in ["ops@example.org", "http://example.org", ""] {
+            assert!(with(bad).is_err(), "{bad}");
+        }
+        let (_dir, path) = write(
+            "public_url = \"https://cloud.example.org\"
+[smtp]
+host = \"mail\"
+user = \"u\"
+             from = \"a <a@b.c>\"
+",
+        );
+        assert!(Config::load(&path).expect("load").push.is_none());
+    }
+
     #[test]
     fn a_small_file_gets_the_defaults() {
         let (_dir, path) = write(
diff --git a/crates/botloft-cloud/src/copies.rs b/crates/botloft-cloud/src/copies.rs
index c530b724..b18d1e35 100644
--- a/crates/botloft-cloud/src/copies.rs
+++ b/crates/botloft-cloud/src/copies.rs
@@ -17,7 +17,7 @@ use tokio::io::AsyncWriteExt;
 use crate::app::AppState;
 use crate::copy_rows::{self, Copy, blob_key};
 use crate::error::ApiError;
-use crate::session::Authed;
+use crate::session::Computer;
 use crate::tokens;
 
 /// The upload's temp file goes away however the request ends.
@@ -32,7 +32,7 @@ impl Drop for Temp {
 /// `PUT /v1/copies`
 pub async fn put(
     State(state): State<AppState>,
-    Authed(who): Authed,
+    Computer(who): Computer,
     headers: HeaderMap,
     body: Body,
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
@@ -115,7 +115,7 @@ pub async fn put(
 /// `GET /v1/copies`, newest first.
 pub async fn list(
     State(state): State<AppState>,
-    Authed(who): Authed,
+    Computer(who): Computer,
 ) -> Result<Json<Value>, ApiError> {
     let copies = state.db.run(|conn| copy_rows::list(conn, who.account_id))?;
     let copies: Vec<Value> = copies
@@ -128,7 +128,7 @@ pub async fn list(
 /// `GET /v1/copies/<id>`, all of it or one `Range: bytes=`.
 pub async fn get(
     State(state): State<AppState>,
-    Authed(who): Authed,
+    Computer(who): Computer,
     Path(id): Path<String>,
     headers: HeaderMap,
 ) -> Result<Response, ApiError> {
@@ -171,7 +171,7 @@ pub async fn get(
 /// `DELETE /v1/copies/<id>`
 pub async fn remove(
     State(state): State<AppState>,
-    Authed(who): Authed,
+    Computer(who): Computer,
     Path(id): Path<String>,
 ) -> Result<StatusCode, ApiError> {
     let removed = state
diff --git a/crates/botloft-cloud/src/db.rs b/crates/botloft-cloud/src/db.rs
index 74cf4a08..626ae399 100644
--- a/crates/botloft-cloud/src/db.rs
+++ b/crates/botloft-cloud/src/db.rs
@@ -13,6 +13,8 @@ use crate::error::ApiError;
 const MIGRATIONS: &[(u32, &str)] = &[
     (1, include_str!("../migrations/0001_accounts.sql")),
     (2, include_str!("../migrations/0002_copies.sql")),
+    (3, include_str!("../migrations/0003_mobile.sql")),
+    (4, include_str!("../migrations/0004_push.sql")),
 ];
 
 #[derive(Clone)]
@@ -118,6 +120,9 @@ mod tests {
             "deletions",
             "devices",
             "logins",
+            "pairings",
+            "push_subscriptions",
+            "relay_queue",
         ] {
             assert!(tables.iter().any(|table| table == name), "{name}");
         }
diff --git a/crates/botloft-cloud/src/devices.rs b/crates/botloft-cloud/src/devices.rs
new file mode 100644
index 00000000..4954c499
--- /dev/null
+++ b/crates/botloft-cloud/src/devices.rs
@@ -0,0 +1,142 @@
+//! Devices behind the tokens (spec 27.3, 28.2): who a token is, the list of an
+//! account's devices, and removing one.
+
+use rusqlite::{Connection, OptionalExtension, params};
+use serde::Serialize;
+
+/// What a device is (spec 28.2): a phone only reaches the relay.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Kind {
+    Computer,
+    Phone,
+}
+
+impl Kind {
+    pub fn tag(self) -> &'static str {
+        match self {
+            Self::Computer => "computer",
+            Self::Phone => "phone",
+        }
+    }
+
+    fn parse(tag: &str) -> Self {
+        if tag == "phone" {
+            Self::Phone
+        } else {
+            Self::Computer
+        }
+    }
+}
+
+/// Who a token belongs to.
+pub struct Who {
+    pub account_id: i64,
+    pub device_id: String,
+    pub email: String,
+    pub kind: Kind,
+    /// The computer a phone was connected with.
+    pub peer: Option<String>,
+}
+
+/// Looks the token up and notes that the device was used, at most once a minute.
+pub fn who_is(conn: &Connection, token_hash: &str, now: i64) -> rusqlite::Result<Option<Who>> {
+    let who = conn
+        .query_row(
+            "SELECT devices.account_id, devices.id, accounts.email, devices.kind, devices.peer \
+             FROM devices JOIN accounts ON accounts.id = devices.account_id \
+             WHERE devices.token_hash = ?1",
+            [token_hash],
+            |row| {
+                Ok(Who {
+                    account_id: row.get(0)?,
+                    device_id: row.get(1)?,
+                    email: row.get(2)?,
+                    kind: Kind::parse(&row.get::<_, String>(3)?),
+                    peer: row.get(4)?,
+                })
+            },
+        )
+        .optional()?;
+    if let Some(who) = &who {
+        conn.execute(
+            "UPDATE devices SET last_used_at = ?1 WHERE id = ?2 AND last_used_at < ?1 - 60000",
+            params![now, who.device_id],
+        )?;
+    }
+    Ok(who)
+}
+
+#[derive(Serialize)]
+pub struct Device {
+    pub id: String,
+    pub name: String,
+    pub kind: String,
+    pub peer: Option<String>,
+    pub created_at: i64,
+    pub last_used_at: i64,
+}
+
+pub fn devices(conn: &Connection, account_id: i64) -> rusqlite::Result<Vec<Device>> {
+    let mut stmt = conn.prepare(
+        "SELECT id, name, kind, peer, created_at, last_used_at FROM devices \
+         WHERE account_id = ?1 ORDER BY created_at",
+    )?;
+    stmt.query_map([account_id], |row| {
+        Ok(Device {
+            id: row.get(0)?,
+            name: row.get(1)?,
+            kind: row.get(2)?,
+            peer: row.get(3)?,
+            created_at: row.get(4)?,
+            last_used_at: row.get(5)?,
+        })
+    })?
+    .collect()
+}
+
+/// A device that left, and the computer that must hear of it if it was a phone.
+pub struct Removed {
+    pub id: String,
+    pub peer: Option<String>,
+}
+
+/// Removes a device and, with a computer, the phones connected to it (the
+/// foreign key does it). Says who left; empty when the account has no such
+/// device.
+pub fn delete_device(
+    conn: &mut Connection,
+    account_id: i64,
+    id: &str,
+) -> rusqlite::Result<Vec<Removed>> {
+    let tx = conn.transaction()?;
+    let mut gone = Vec::new();
+    {
+        let mut stmt = tx.prepare(
+            "SELECT id, peer FROM devices WHERE account_id = ?2 AND (id = ?1 OR peer = ?1)",
+        )?;
+        let rows = stmt.query_map(params![id, account_id], |row| {
+            Ok(Removed {
+                id: row.get(0)?,
+                peer: row.get(1)?,
+            })
+        })?;
+        for row in rows {
+            gone.push(row?);
+        }
+    }
+    if !gone.iter().any(|device| device.id == id) {
+        return Ok(Vec::new());
+    }
+    tx.execute(
+        "DELETE FROM devices WHERE id = ?1 AND account_id = ?2",
+        params![id, account_id],
+    )?;
+    tx.commit()?;
+    Ok(gone)
+}
+
+/// Every device of an account, for closing their sockets before it goes.
+pub fn device_ids(conn: &Connection, account_id: i64) -> rusqlite::Result<Vec<String>> {
+    let mut stmt = conn.prepare("SELECT id FROM devices WHERE account_id = ?1")?;
+    stmt.query_map([account_id], |row| row.get(0))?.collect()
+}
diff --git a/crates/botloft-cloud/src/error.rs b/crates/botloft-cloud/src/error.rs
index a623e021..95e1ee19 100644
--- a/crates/botloft-cloud/src/error.rs
+++ b/crates/botloft-cloud/src/error.rs
@@ -35,6 +35,46 @@ impl ApiError {
         Self::new(StatusCode::NOT_FOUND, "not_found", "There is nothing here.")
     }
 
+    pub fn wrong_device() -> Self {
+        Self::new(
+            StatusCode::FORBIDDEN,
+            "wrong_device",
+            "This device is not allowed to do that.",
+        )
+    }
+
+    pub fn bad_pairing() -> Self {
+        Self::new(
+            StatusCode::BAD_REQUEST,
+            "bad_pairing",
+            "That is not a valid pairing request.",
+        )
+    }
+
+    pub fn pair_expired() -> Self {
+        Self::new(
+            StatusCode::GONE,
+            "pair_expired",
+            "This code was used or has run out. Ask for a new one.",
+        )
+    }
+
+    pub fn no_push() -> Self {
+        Self::new(
+            StatusCode::NOT_FOUND,
+            "no_push",
+            "This server does not send notices.",
+        )
+    }
+
+    pub fn bad_endpoint() -> Self {
+        Self::new(
+            StatusCode::BAD_REQUEST,
+            "bad_endpoint",
+            "That is not an address of a push service this server uses.",
+        )
+    }
+
     pub fn bad_email() -> Self {
         Self::new(
             StatusCode::BAD_REQUEST,
diff --git a/crates/botloft-cloud/src/hub.rs b/crates/botloft-cloud/src/hub.rs
new file mode 100644
index 00000000..e8c93463
--- /dev/null
+++ b/crates/botloft-cloud/src/hub.rs
@@ -0,0 +1,112 @@
+//! Who is connected to the relay right now (spec 28.4): one socket per
+//! device, found by its id. Nothing here is stored; it is the live pipes.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+
+use tokio::sync::mpsc;
+
+/// What a socket's writer is asked to do.
+pub enum Out {
+    Text(String),
+    Close,
+}
+
+struct Conn {
+    id: u64,
+    tx: mpsc::Sender<Out>,
+}
+
+#[derive(Default)]
+struct Inner {
+    next: u64,
+    conns: HashMap<String, Conn>,
+}
+
+#[derive(Clone, Default)]
+pub struct Hub(Arc<Mutex<Inner>>);
+
+impl Hub {
+    fn inner(&self) -> std::sync::MutexGuard<'_, Inner> {
+        self.0
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    /// Registers the socket of `device`; a second socket of the same device
+    /// replaces the first, which is told to close. The number goes back to
+    /// `detach`.
+    pub fn attach(&self, device: &str, tx: mpsc::Sender<Out>) -> u64 {
+        let mut inner = self.inner();
+        inner.next += 1;
+        let id = inner.next;
+        if let Some(old) = inner.conns.insert(device.to_owned(), Conn { id, tx }) {
+            let _ = old.tx.try_send(Out::Close);
+        }
+        id
+    }
+
+    /// Drops the registration, unless a newer socket took the place.
+    pub fn detach(&self, device: &str, id: u64) {
+        let mut inner = self.inner();
+        if inner.conns.get(device).is_some_and(|conn| conn.id == id) {
+            inner.conns.remove(device);
+        }
+    }
+
+    pub fn online(&self, device: &str) -> bool {
+        self.inner().conns.contains_key(device)
+    }
+
+    /// Hands `text` to the device's socket. False when it is not connected or
+    /// cannot keep up (a slow reader loses the frame, the queue keeps what
+    /// matters).
+    pub fn send(&self, device: &str, text: String) -> bool {
+        let inner = self.inner();
+        inner
+            .conns
+            .get(device)
+            .is_some_and(|conn| conn.tx.try_send(Out::Text(text)).is_ok())
+    }
+
+    /// Closes the device's socket: its token is gone.
+    pub fn kick(&self, device: &str) {
+        if let Some(conn) = self.inner().conns.remove(device) {
+            let _ = conn.tx.try_send(Out::Close);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_newer_socket_replaces_the_older_and_the_older_cannot_detach_it() {
+        let hub = Hub::default();
+        let (first, mut first_rx) = mpsc::channel(4);
+        let (second, mut second_rx) = mpsc::channel(4);
+        let a = hub.attach("dev", first);
+        let b = hub.attach("dev", second);
+        assert!(matches!(first_rx.try_recv(), Ok(Out::Close)));
+        hub.detach("dev", a);
+        assert!(hub.online("dev"));
+        assert!(hub.send("dev", "hi".into()));
+        assert!(matches!(second_rx.try_recv(), Ok(Out::Text(text)) if text == "hi"));
+        hub.detach("dev", b);
+        assert!(!hub.online("dev"));
+        assert!(!hub.send("dev", "lost".into()));
+    }
+
+    #[test]
+    fn a_full_socket_loses_the_frame_and_a_kick_closes() {
+        let hub = Hub::default();
+        let (tx, mut rx) = mpsc::channel(1);
+        hub.attach("dev", tx);
+        assert!(hub.send("dev", "one".into()));
+        assert!(!hub.send("dev", "two".into()));
+        hub.kick("dev");
+        assert!(!hub.online("dev"));
+        assert!(matches!(rx.try_recv(), Ok(Out::Text(_))));
+    }
+}
diff --git a/crates/botloft-cloud/src/lib.rs b/crates/botloft-cloud/src/lib.rs
index 84529ae1..daf7f8d3 100644
--- a/crates/botloft-cloud/src/lib.rs
+++ b/crates/botloft-cloud/src/lib.rs
@@ -8,14 +8,23 @@ mod config;
 mod copies;
 mod copy_rows;
 mod db;
+mod devices;
 mod error;
 mod html;
+mod hub;
 mod limits;
 mod login;
 mod mail_html;
 mod mail_text;
 mod mailer;
 mod pages;
+mod pairing;
+mod pairing_rows;
+mod phone;
+mod push;
+mod push_api;
+mod relay;
+mod relay_rows;
 mod removal;
 mod session;
 mod store;
@@ -26,5 +35,7 @@ pub use clock::Clock;
 pub use config::{Bucket, Config, Smtp, Storage};
 pub use db::Db;
 pub use error::ApiError;
+pub use hub::Hub;
 pub use mailer::{Mail, Mailer, Outbox, SmtpMailer};
+pub use push::{Pusher, new_key};
 pub use store::CopyStore;
diff --git a/crates/botloft-cloud/src/limits.rs b/crates/botloft-cloud/src/limits.rs
index 543d7642..b030d3c5 100644
--- a/crates/botloft-cloud/src/limits.rs
+++ b/crates/botloft-cloud/src/limits.rs
@@ -19,6 +19,12 @@ pub const PER_ADDRESS: Rule = Rule {
     limit: 20,
     window_ms: 3_600_000,
 };
+/// Phones joining a pairing (spec 28.3), per address.
+pub const PAIR_PER_ADDRESS: Rule = Rule {
+    kind: "pair",
+    limit: 30,
+    window_ms: 3_600_000,
+};
 pub const GAP: Rule = Rule {
     kind: "gap",
     limit: 1,
diff --git a/crates/botloft-cloud/src/login.rs b/crates/botloft-cloud/src/login.rs
index 31e90097..dcd051d5 100644
--- a/crates/botloft-cloud/src/login.rs
+++ b/crates/botloft-cloud/src/login.rs
@@ -176,7 +176,7 @@ pub async fn confirm(
 /// Where the request really comes from: the header the config names, if it
 /// holds an address; else, behind a proxy, the last `X-Forwarded-For`; else
 /// the connection.
-fn client_address(
+pub(crate) fn client_address(
     state: &AppState,
     headers: &HeaderMap,
     connection: Option<ConnectInfo<SocketAddr>>,
@@ -222,7 +222,7 @@ fn clean_email(raw: &str) -> Option<String> {
 }
 
 /// The name of the computer: printable, at most 60 characters.
-fn clean_device(raw: &str) -> String {
+pub(crate) fn clean_device(raw: &str) -> String {
     let name: String = raw
         .chars()
         .filter(|c| !c.is_control())
diff --git a/crates/botloft-cloud/src/main.rs b/crates/botloft-cloud/src/main.rs
index eb4ec683..a85417bc 100644
--- a/crates/botloft-cloud/src/main.rs
+++ b/crates/botloft-cloud/src/main.rs
@@ -6,7 +6,9 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use anyhow::Context;
-use botloft_cloud::{AppState, Clock, Config, CopyStore, Db, Mailer, SmtpMailer, Storage, router};
+use botloft_cloud::{
+    AppState, Clock, Config, CopyStore, Db, Hub, Mailer, Pusher, SmtpMailer, Storage, router,
+};
 use clap::{Parser, Subcommand};
 
 #[derive(Parser)]
@@ -33,6 +35,13 @@ enum Command {
         #[arg(long)]
         to: PathBuf,
     },
+    /// Makes the key the server signs its Web Push calls with (spec 28.8):
+    /// the private half goes in a new file, the public half is printed.
+    VapidKey {
+        /// The file to write; it must not exist yet.
+        #[arg(long)]
+        to: PathBuf,
+    },
 }
 
 /// Waits for Ctrl+C, or for the `SIGTERM` that Docker and systemd send.
@@ -61,6 +70,20 @@ async fn main() -> anyhow::Result<()> {
         .init();
     match Cli::parse().command {
         Command::Serve { config } => serve(Config::load(&config)?).await,
+        Command::VapidKey { to } => {
+            let (private, public) = botloft_cloud::new_key()?;
+            let mut file = std::fs::OpenOptions::new();
+            file.write(true).create_new(true);
+            #[cfg(unix)]
+            std::os::unix::fs::OpenOptionsExt::mode(&mut file, 0o600);
+            let mut file = file
+                .open(&to)
+                .context("cannot create the file (it must not exist)")?;
+            std::io::Write::write_all(&mut file, private.as_bytes())?;
+            println!("private key written to {}", to.display());
+            println!("public key (the phones get it from the server): {public}");
+            Ok(())
+        }
         Command::Backup { config, to } => {
             let config = Config::load(&config)?;
             if let Some(folder) = to.parent().filter(|folder| !folder.as_os_str().is_empty()) {
@@ -87,6 +110,8 @@ async fn serve(config: Config) -> anyhow::Result<()> {
         mailer: Arc::new(Mailer::Smtp(Box::new(SmtpMailer::new(&config.smtp)?))),
         clock: Clock::default(),
         config: Arc::new(config.clone()),
+        hub: Hub::default(),
+        push: Pusher::from_config(&config)?,
     };
     let listener = tokio::net::TcpListener::bind(config.listen).await?;
     tracing::info!("listening on {}", config.listen);
diff --git a/crates/botloft-cloud/src/pairing.rs b/crates/botloft-cloud/src/pairing.rs
new file mode 100644
index 00000000..24a83671
--- /dev/null
+++ b/crates/botloft-cloud/src/pairing.rs
@@ -0,0 +1,250 @@
+//! Connecting a phone (spec 28.3): the computer opens a pairing, the phone
+//! joins with its public key and a proof, the computer accepts, and the phone
+//! collects its token once. The server carries these values and checks their
+//! shape; it cannot forge a proof, because it never sees the QR's secret.
+
+use std::net::SocketAddr;
+
+use axum::Json;
+use axum::extract::{ConnectInfo, Extension, Path, State};
+use axum::http::header::AUTHORIZATION;
+use axum::http::{HeaderMap, StatusCode};
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use crate::app::AppState;
+use crate::error::ApiError;
+use crate::limits::{self, PAIR_PER_ADDRESS};
+use crate::login::{clean_device, client_address};
+use crate::pairing_rows::{self as rows, Collected, Join, PAIR_TTL_MS, Seen};
+use crate::session::Computer;
+use crate::tokens;
+
+/// A base64url value without padding of exactly `len` characters, or at most
+/// `max` when `len` is 0.
+fn b64url(text: &str, len: usize, max: usize) -> bool {
+    let shaped = text
+        .bytes()
+        .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_');
+    shaped
+        && if len > 0 {
+            text.len() == len
+        } else {
+            !text.is_empty() && text.len() <= max
+        }
+}
+
+/// 16 bytes, which is 22 characters.
+const ID_LEN: usize = 22;
+/// A 32-byte HMAC.
+const PROOF_LEN: usize = 43;
+/// An uncompressed P-256 point is 65 bytes, 87 characters; leave room.
+const KEY_MAX: usize = 100;
+
+fn tell_computer(state: &AppState, computer: &str, id: &str) {
+    state
+        .hub
+        .send(computer, json!({ "t": "pairing", "id": id }).to_string());
+}
+
+#[derive(Deserialize)]
+pub struct Open {
+    id: String,
+}
+
+/// `POST /v1/pairings`: the computer opens a pairing for its QR code.
+pub async fn open(
+    State(state): State<AppState>,
+    Computer(who): Computer,
+    Json(Open { id }): Json<Open>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    if !b64url(&id, ID_LEN, 0) {
+        return Err(ApiError::bad_pairing());
+    }
+    let now = state.clock.now();
+    let opened = state
+        .db
+        .run(|conn| rows::open(conn, &id, who.account_id, &who.device_id, now))?;
+    if !opened {
+        return Err(ApiError::rate_limited(60));
+    }
+    Ok((
+        StatusCode::CREATED,
+        Json(json!({ "expires_in": PAIR_TTL_MS / 1000 })),
+    ))
+}
+
+/// `GET /v1/pairings/<id>`: the computer looks at whether a phone joined.
+pub async fn status(
+    State(state): State<AppState>,
+    Computer(who): Computer,
+    Path(id): Path<String>,
+) -> Result<Json<Value>, ApiError> {
+    let now = state.clock.now();
+    let seen = state
+        .db
+        .run(|conn| rows::seen(conn, &id, &who.device_id, now))?;
+    Ok(Json(match seen {
+        None => json!({ "status": "expired" }),
+        Some(Seen::Waiting) => json!({ "status": "waiting" }),
+        Some(Seen::Joined {
+            phone_name,
+            phone_pub,
+            proof,
+        }) => json!({
+            "status": "joined",
+            "device_name": phone_name,
+            "phone_pub": phone_pub,
+            "proof": proof,
+        }),
+    }))
+}
+
+#[derive(Deserialize)]
+pub struct JoinBody {
+    phone_pub: String,
+    #[serde(default)]
+    device_name: String,
+    proof: String,
+}
+
+/// `POST /v1/pairings/<id>/join`: the phone, which has no token yet. The
+/// answer holds a secret only this phone knows, for collecting its token.
+pub async fn join(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    connection: Option<Extension<ConnectInfo<SocketAddr>>>,
+    Path(id): Path<String>,
+    Json(body): Json<JoinBody>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    if !b64url(&id, ID_LEN, 0)
+        || !b64url(&body.phone_pub, 0, KEY_MAX)
+        || !b64url(&body.proof, PROOF_LEN, 0)
+    {
+        return Err(ApiError::bad_pairing());
+    }
+    let address = client_address(&state, &headers, connection.map(|Extension(info)| info));
+    let (key, now) = (tokens::hash(&address), state.clock.now());
+    let taken = state
+        .db
+        .run(|conn| limits::take(conn, now, &[(&PAIR_PER_ADDRESS, &key)]))?;
+    taken.map_err(ApiError::rate_limited)?;
+
+    let poll = tokens::random()?;
+    let name = clean_device(&body.device_name);
+    let joined = state.db.run(|conn| {
+        rows::join(
+            conn,
+            &id,
+            &Join {
+                phone_pub: &body.phone_pub,
+                phone_name: &name,
+                proof: &body.proof,
+                poll_hash: &tokens::hash(&poll),
+            },
+            now,
+        )
+    })?;
+    let computer = joined.ok_or_else(ApiError::pair_expired)?;
+    tell_computer(&state, &computer, &id);
+    Ok((StatusCode::ACCEPTED, Json(json!({ "poll": poll }))))
+}
+
+#[derive(Deserialize)]
+pub struct Accept {
+    daemon_pub: String,
+    proof2: String,
+}
+
+/// `POST /v1/pairings/<id>/accept`: the computer accepts the phone that joined.
+pub async fn accept(
+    State(state): State<AppState>,
+    Computer(who): Computer,
+    Path(id): Path<String>,
+    Json(body): Json<Accept>,
+) -> Result<StatusCode, ApiError> {
+    if !b64url(&body.daemon_pub, 0, KEY_MAX) || !b64url(&body.proof2, PROOF_LEN, 0) {
+        return Err(ApiError::bad_pairing());
+    }
+    let now = state.clock.now();
+    let accepted = state.db.run(|conn| {
+        rows::accept(
+            conn,
+            &id,
+            &who.device_id,
+            &body.daemon_pub,
+            &body.proof2,
+            now,
+        )
+    })?;
+    if accepted {
+        Ok(StatusCode::NO_CONTENT)
+    } else {
+        Err(ApiError::not_found())
+    }
+}
+
+/// `DELETE /v1/pairings/<id>`: the computer cancels, or refuses the phone.
+pub async fn cancel(
+    State(state): State<AppState>,
+    Computer(who): Computer,
+    Path(id): Path<String>,
+) -> Result<StatusCode, ApiError> {
+    let removed = state
+        .db
+        .run(|conn| rows::remove(conn, &id, &who.device_id))?;
+    if removed {
+        Ok(StatusCode::NO_CONTENT)
+    } else {
+        Err(ApiError::not_found())
+    }
+}
+
+/// `GET /v1/pairings/<id>/result`: the phone polls with its secret as the
+/// bearer. Once the computer accepted, the first poll takes the token.
+pub async fn result(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+) -> Result<Json<Value>, ApiError> {
+    let poll = headers
+        .get(AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .ok_or_else(ApiError::unauthorized)?;
+    let (poll_hash, now) = (tokens::hash(poll.trim()), state.clock.now());
+    let found = state
+        .db
+        .run(|conn| rows::collect(conn, &id, &poll_hash, now))?;
+    match found {
+        Collected::Gone => Ok(Json(json!({ "status": "expired" }))),
+        Collected::Pending => Ok(Json(json!({ "status": "pending" }))),
+        Collected::Ready(ready) => {
+            let (token, device) = (
+                tokens::random()?,
+                format!("dev_{}", &tokens::random()?[..16]),
+            );
+            let token_hash = tokens::hash(&token);
+            let finished = state
+                .db
+                .run(|conn| rows::finish(conn, &id, &ready, &device, &token_hash, now))?;
+            if !finished {
+                // Two polls at once: the other one took it.
+                return Ok(Json(json!({ "status": "expired" })));
+            }
+            // The computer learns the phone's id, which only the phone had.
+            state.hub.send(
+                &ready.computer,
+                json!({ "t": "paired", "pairing": id, "device": device }).to_string(),
+            );
+            Ok(Json(json!({
+                "status": "approved",
+                "token": token,
+                "device": device,
+                "peer": ready.computer,
+                "daemon_pub": ready.daemon_pub,
+                "proof2": ready.proof2,
+            })))
+        }
+    }
+}
diff --git a/crates/botloft-cloud/src/pairing_rows.rs b/crates/botloft-cloud/src/pairing_rows.rs
new file mode 100644
index 00000000..237b041f
--- /dev/null
+++ b/crates/botloft-cloud/src/pairing_rows.rs
@@ -0,0 +1,222 @@
+//! Queries for connecting a phone (spec 28.3).
+
+use rusqlite::{Connection, OptionalExtension, params};
+
+/// How long a QR code stays good.
+pub const PAIR_TTL_MS: i64 = 300_000;
+/// How many QR codes one computer may have open at once.
+pub const OPEN_MAX: i64 = 3;
+
+/// What the computer finds when it looks at its pairing.
+pub enum Seen {
+    Waiting,
+    Joined {
+        phone_name: String,
+        phone_pub: String,
+        proof: String,
+    },
+}
+
+/// False when the computer already has too many open, or the id is taken.
+pub fn open(
+    conn: &Connection,
+    id: &str,
+    account_id: i64,
+    computer: &str,
+    now: i64,
+) -> rusqlite::Result<bool> {
+    conn.execute("DELETE FROM pairings WHERE expires_at <= ?1", [now])?;
+    let open: i64 = conn.query_row(
+        "SELECT COUNT(*) FROM pairings WHERE computer = ?1",
+        [computer],
+        |row| row.get(0),
+    )?;
+    if open >= OPEN_MAX {
+        return Ok(false);
+    }
+    let added = conn.execute(
+        "INSERT OR IGNORE INTO pairings (id, account_id, computer, created_at, expires_at) \
+         VALUES (?1, ?2, ?3, ?4, ?5)",
+        params![id, account_id, computer, now, now + PAIR_TTL_MS],
+    )?;
+    Ok(added > 0)
+}
+
+pub struct Join<'a> {
+    pub phone_pub: &'a str,
+    pub phone_name: &'a str,
+    pub proof: &'a str,
+    pub poll_hash: &'a str,
+}
+
+/// The phone joins an open, unjoined pairing. Says which computer to tell, or
+/// nothing when the code is unknown, expired or already used.
+pub fn join(
+    conn: &Connection,
+    id: &str,
+    join: &Join,
+    now: i64,
+) -> rusqlite::Result<Option<String>> {
+    let computer: Option<String> = conn
+        .query_row(
+            "SELECT computer FROM pairings \
+             WHERE id = ?1 AND expires_at > ?2 AND phone_pub IS NULL",
+            params![id, now],
+            |row| row.get(0),
+        )
+        .optional()?;
+    let Some(computer) = computer else {
+        return Ok(None);
+    };
+    conn.execute(
+        "UPDATE pairings SET phone_pub = ?2, phone_name = ?3, proof = ?4, poll_hash = ?5 \
+         WHERE id = ?1",
+        params![
+            id,
+            join.phone_pub,
+            join.phone_name,
+            join.proof,
+            join.poll_hash
+        ],
+    )?;
+    Ok(Some(computer))
+}
+
+/// What the computer's own pairing looks like. `None`: unknown or expired.
+pub fn seen(
+    conn: &Connection,
+    id: &str,
+    computer: &str,
+    now: i64,
+) -> rusqlite::Result<Option<Seen>> {
+    conn.query_row(
+        "SELECT phone_name, phone_pub, proof FROM pairings \
+         WHERE id = ?1 AND computer = ?2 AND expires_at > ?3",
+        params![id, computer, now],
+        |row| {
+            Ok(match row.get::<_, Option<String>>(1)? {
+                None => Seen::Waiting,
+                Some(phone_pub) => Seen::Joined {
+                    phone_name: row.get::<_, Option<String>>(0)?.unwrap_or_default(),
+                    phone_pub,
+                    proof: row.get::<_, Option<String>>(2)?.unwrap_or_default(),
+                },
+            })
+        },
+    )
+    .optional()
+}
+
+/// The computer accepts the phone that joined. False when there is nothing to
+/// accept (no such pairing, nobody joined, or already accepted).
+pub fn accept(
+    conn: &Connection,
+    id: &str,
+    computer: &str,
+    daemon_pub: &str,
+    proof2: &str,
+    now: i64,
+) -> rusqlite::Result<bool> {
+    let changed = conn.execute(
+        "UPDATE pairings SET daemon_pub = ?3, proof2 = ?4 \
+         WHERE id = ?1 AND computer = ?2 AND expires_at > ?5 \
+           AND phone_pub IS NOT NULL AND daemon_pub IS NULL",
+        params![id, computer, daemon_pub, proof2, now],
+    )?;
+    Ok(changed > 0)
+}
+
+/// The computer cancels, or refuses the phone that joined.
+pub fn remove(conn: &Connection, id: &str, computer: &str) -> rusqlite::Result<bool> {
+    let removed = conn.execute(
+        "DELETE FROM pairings WHERE id = ?1 AND computer = ?2",
+        params![id, computer],
+    )?;
+    Ok(removed > 0)
+}
+
+/// What the phone's poll finds.
+pub enum Collected {
+    /// Unknown, wrong poll secret, expired, cancelled or already collected.
+    Gone,
+    Pending,
+    Ready(Ready),
+}
+
+pub struct Ready {
+    pub account_id: i64,
+    pub computer: String,
+    pub phone_name: String,
+    pub daemon_pub: String,
+    pub proof2: String,
+}
+
+/// Looks at the pairing by its id and the hash of the phone's poll secret.
+pub fn collect(
+    conn: &Connection,
+    id: &str,
+    poll_hash: &str,
+    now: i64,
+) -> rusqlite::Result<Collected> {
+    let row = conn
+        .query_row(
+            "SELECT account_id, computer, phone_name, daemon_pub, proof2 FROM pairings \
+             WHERE id = ?1 AND poll_hash = ?2 AND expires_at > ?3",
+            params![id, poll_hash, now],
+            |row| {
+                Ok((
+                    row.get::<_, i64>(0)?,
+                    row.get::<_, String>(1)?,
+                    row.get::<_, Option<String>>(2)?,
+                    row.get::<_, Option<String>>(3)?,
+                    row.get::<_, Option<String>>(4)?,
+                ))
+            },
+        )
+        .optional()?;
+    Ok(match row {
+        None => Collected::Gone,
+        Some((account_id, computer, name, Some(daemon_pub), Some(proof2))) => {
+            Collected::Ready(Ready {
+                account_id,
+                computer,
+                phone_name: name.unwrap_or_default(),
+                daemon_pub,
+                proof2,
+            })
+        }
+        Some(_) => Collected::Pending,
+    })
+}
+
+/// The phone collected its answer: a device with the hash of its new token,
+/// and the pairing is gone, so the token is handed out once. False if someone
+/// else collected it first.
+pub fn finish(
+    conn: &mut Connection,
+    id: &str,
+    ready: &Ready,
+    device_id: &str,
+    token_hash: &str,
+    now: i64,
+) -> rusqlite::Result<bool> {
+    let tx = conn.transaction()?;
+    let removed = tx.execute("DELETE FROM pairings WHERE id = ?1", [id])?;
+    if removed == 0 {
+        return Ok(false);
+    }
+    tx.execute(
+        "INSERT INTO devices (id, account_id, name, token_hash, created_at, last_used_at, \
+         kind, peer) VALUES (?1, ?2, ?3, ?4, ?5, ?5, 'phone', ?6)",
+        params![
+            device_id,
+            ready.account_id,
+            ready.phone_name,
+            token_hash,
+            now,
+            ready.computer
+        ],
+    )?;
+    tx.commit()?;
+    Ok(true)
+}
diff --git a/crates/botloft-cloud/src/phone.rs b/crates/botloft-cloud/src/phone.rs
new file mode 100644
index 00000000..ec976742
--- /dev/null
+++ b/crates/botloft-cloud/src/phone.rs
@@ -0,0 +1,141 @@
+//! The phone's page (spec 28.7): the files of `app/dist-phone`, served at
+//! `/m`. They are the page and nothing else; what a bot asks never passes
+//! here. Every answer says what the page may do (a policy of its own), so a
+//! page that was changed could not send what it holds anywhere else.
+
+use std::path::{Component, Path, PathBuf};
+
+use axum::extract::{Path as UrlPath, State};
+use axum::http::{HeaderValue, StatusCode, header};
+use axum::response::{IntoResponse, Response};
+
+use crate::app::AppState;
+
+/// What the page may load and talk to: its own address, and nothing more.
+const POLICY: &str = "default-src 'none'; script-src 'self'; style-src 'self'; \
+img-src 'self' data:; font-src 'self'; connect-src 'self'; manifest-src 'self'; \
+worker-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+
+/// `GET /m` and `GET /m/`
+pub async fn index(State(state): State<AppState>) -> Response {
+    send(state.config.phone_dir.as_deref(), "index.html").await
+}
+
+/// `GET /m/<path>`: a file of the page; a path with no file extension is the
+/// page itself, so a reload anywhere in it works.
+pub async fn file(State(state): State<AppState>, UrlPath(path): UrlPath<String>) -> Response {
+    let dir = state.config.phone_dir.as_deref();
+    if Path::new(&path).extension().is_none() {
+        return send(dir, "index.html").await;
+    }
+    send(dir, &path).await
+}
+
+/// The file, from inside `dir` only.
+async fn send(dir: Option<&Path>, relative: &str) -> Response {
+    let Some(dir) = dir else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let Some(path) = inside(dir, relative) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    // A link inside the folder that leads out of it is not the page.
+    let (Ok(real), Ok(root)) = (
+        tokio::fs::canonicalize(&path).await,
+        tokio::fs::canonicalize(dir).await,
+    ) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    if !real.starts_with(&root) {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+    let Ok(bytes) = tokio::fs::read(&real).await else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let mut response = bytes.into_response();
+    let headers = response.headers_mut();
+    let mut put = |name: header::HeaderName, value: &str| {
+        if let Ok(value) = HeaderValue::from_str(value) {
+            headers.insert(name, value);
+        }
+    };
+    put(header::CONTENT_TYPE, kind(&real));
+    // The built files carry a hash in their names; the page itself, the
+    // worker and the manifest are looked at every time.
+    put(
+        header::CACHE_CONTROL,
+        if relative.starts_with("assets/") {
+            "public, max-age=31536000, immutable"
+        } else {
+            "no-cache"
+        },
+    );
+    put(header::CONTENT_SECURITY_POLICY, POLICY);
+    put(header::X_CONTENT_TYPE_OPTIONS, "nosniff");
+    put(header::REFERRER_POLICY, "no-referrer");
+    response
+}
+
+/// `relative` under `dir`, if it holds only plain names: no `..`, no root,
+/// no drive, no empty part.
+fn inside(dir: &Path, relative: &str) -> Option<PathBuf> {
+    if relative.is_empty() || relative.contains('\\') || relative.contains('\0') {
+        return None;
+    }
+    let mut path = dir.to_path_buf();
+    for part in Path::new(relative).components() {
+        match part {
+            Component::Normal(name) if !name.to_string_lossy().contains(':') => path.push(name),
+            _ => return None,
+        }
+    }
+    Some(path)
+}
+
+fn kind(path: &Path) -> &'static str {
+    match path
+        .extension()
+        .and_then(|extension| extension.to_str())
+        .unwrap_or_default()
+    {
+        "html" => "text/html; charset=utf-8",
+        "js" | "mjs" => "text/javascript; charset=utf-8",
+        "css" => "text/css; charset=utf-8",
+        "json" | "map" => "application/json",
+        "webmanifest" => "application/manifest+json",
+        "svg" => "image/svg+xml",
+        "png" => "image/png",
+        "ico" => "image/x-icon",
+        "woff" => "font/woff",
+        "woff2" => "font/woff2",
+        "txt" => "text/plain; charset=utf-8",
+        _ => "application/octet-stream",
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_plain_names_stay_inside_the_folder() {
+        let dir = Path::new("/srv/phone");
+        assert_eq!(
+            inside(dir, "assets/app.js"),
+            Some(PathBuf::from("/srv/phone/assets/app.js"))
+        );
+        for bad in [
+            "",
+            "..",
+            "../x",
+            "a/../../x",
+            "/etc/passwd",
+            "a\\b",
+            "c:/x",
+            "a/c:x",
+            "a\0",
+        ] {
+            assert_eq!(inside(dir, bad), None, "{bad:?}");
+        }
+    }
+}
diff --git a/crates/botloft-cloud/src/push.rs b/crates/botloft-cloud/src/push.rs
new file mode 100644
index 00000000..f63caa7c
--- /dev/null
+++ b/crates/botloft-cloud/src/push.rs
@@ -0,0 +1,270 @@
+//! Web Push (spec 28.8): when the computer says something waits, each phone
+//! connected with it gets a push with **no content**. The phone's own page
+//! writes the notice. The server signs its call with a key of its own (VAPID,
+//! RFC 8292) and calls only the push services it was told to, never an
+//! address a phone made up.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD as B64;
+use p256::ecdsa::signature::Signer;
+use p256::ecdsa::{Signature, SigningKey};
+use reqwest::Url;
+use rusqlite::{Connection, params};
+
+use crate::app::AppState;
+use crate::config::{Config, VAPID_KEY_VAR, secret};
+
+/// The push services of the browsers, which a phone may name by default.
+const DEFAULT_HOSTS: &[&str] = &[
+    "fcm.googleapis.com",
+    "push.services.mozilla.com",
+    "notify.windows.com",
+    "push.apple.com",
+];
+
+/// How long apart two notices to the same computer's phones go; the ones in
+/// between merge into a single notice at the end of the wait.
+pub const WAKE_GAP: Duration = Duration::from_secs(30);
+
+/// A new key for the server: the private half as the file holds it, and the
+/// public half the phones need (`applicationServerKey`), both base64url.
+pub fn new_key() -> anyhow::Result<(String, String)> {
+    loop {
+        let mut bytes = [0u8; 32];
+        getrandom::fill(&mut bytes).map_err(|err| anyhow::anyhow!("no random bytes: {err}"))?;
+        // Not every 32 bytes are a key; try again.
+        if let Ok(key) = SigningKey::from_slice(&bytes) {
+            return Ok((B64.encode(bytes), public_of(&key)));
+        }
+    }
+}
+
+fn public_of(key: &SigningKey) -> String {
+    B64.encode(key.verifying_key().to_sec1_point(false).as_bytes())
+}
+
+struct Inner {
+    key: SigningKey,
+    public: String,
+    subject: String,
+    allowed: Vec<String>,
+    gap: Duration,
+    http: reqwest::Client,
+    /// Per computer: when its phones were last told, and whether a notice is
+    /// already set for the end of the wait.
+    told: Mutex<HashMap<String, (Instant, bool)>>,
+}
+
+/// What sends the notices; off when `[push]` is not configured.
+#[derive(Clone, Default)]
+pub struct Pusher(Option<Arc<Inner>>);
+
+impl Pusher {
+    pub fn off() -> Self {
+        Self(None)
+    }
+
+    pub fn from_config(config: &Config) -> anyhow::Result<Self> {
+        let Some(push) = &config.push else {
+            return Ok(Self::off());
+        };
+        let text = secret(push.vapid_key_file.as_deref(), VAPID_KEY_VAR, "VAPID key")?;
+        Self::new(&text, &push.subject, &push.allow_hosts, WAKE_GAP)
+    }
+
+    /// `key` is the private half in base64url, as `new_key` made it.
+    pub fn new(key: &str, subject: &str, allow: &[String], gap: Duration) -> anyhow::Result<Self> {
+        let bytes = B64
+            .decode(key.trim())
+            .map_err(|_| anyhow::anyhow!("the VAPID key is not base64url"))?;
+        let key = SigningKey::from_slice(&bytes)
+            .map_err(|_| anyhow::anyhow!("the VAPID key is not a P-256 key"))?;
+        let allowed = if allow.is_empty() {
+            DEFAULT_HOSTS
+                .iter()
+                .map(|host| (*host).to_owned())
+                .collect()
+        } else {
+            allow.iter().map(|host| host.to_ascii_lowercase()).collect()
+        };
+        let http = reqwest::Client::builder()
+            .timeout(Duration::from_secs(10))
+            .redirect(reqwest::redirect::Policy::none())
+            .user_agent(concat!("botloft-cloud/", env!("CARGO_PKG_VERSION")))
+            .build()?;
+        Ok(Self(Some(Arc::new(Inner {
+            public: public_of(&key),
+            key,
+            subject: subject.to_owned(),
+            allowed,
+            gap,
+            http,
+            told: Mutex::default(),
+        }))))
+    }
+
+    /// The public key a phone subscribes with, if pushes are on.
+    pub fn public_key(&self) -> Option<&str> {
+        self.0.as_deref().map(|inner| inner.public.as_str())
+    }
+
+    /// Whether `endpoint` is a push service the server may call: `https`, no
+    /// credentials, a host that is one of the allowed or under one of them.
+    pub fn allows(&self, endpoint: &str) -> bool {
+        let Some(inner) = &self.0 else {
+            return false;
+        };
+        let Ok(url) = Url::parse(endpoint) else {
+            return false;
+        };
+        let local = matches!(url.host_str(), Some("127.0.0.1" | "localhost"));
+        let scheme_ok = url.scheme() == "https" || (url.scheme() == "http" && local);
+        let Some(host) = url.host_str().map(str::to_ascii_lowercase) else {
+            return false;
+        };
+        scheme_ok
+            && url.username().is_empty()
+            && url.password().is_none()
+            && inner
+                .allowed
+                .iter()
+                .any(|allowed| host == *allowed || host.ends_with(&format!(".{allowed}")))
+    }
+
+    /// Something waits for the phones of `computer`: tell them, now if they
+    /// were not told lately, else once when the wait is over.
+    pub fn wake(&self, state: &AppState, computer: &str) {
+        let Some(inner) = &self.0 else {
+            return;
+        };
+        let wait = {
+            let mut told = inner
+                .told
+                .lock()
+                .unwrap_or_else(|poisoned| poisoned.into_inner());
+            let entry = told.entry(computer.to_owned()).or_insert((
+                Instant::now()
+                    .checked_sub(inner.gap)
+                    .unwrap_or_else(Instant::now),
+                false,
+            ));
+            let since = entry.0.elapsed();
+            if since >= inner.gap {
+                *entry = (Instant::now(), false);
+                Duration::ZERO
+            } else if entry.1 {
+                return;
+            } else {
+                entry.1 = true;
+                inner.gap - since
+            }
+        };
+        let (inner, state, computer) = (Arc::clone(inner), state.clone(), computer.to_owned());
+        tokio::spawn(async move {
+            if !wait.is_zero() {
+                tokio::time::sleep(wait).await;
+                let mut told = inner
+                    .told
+                    .lock()
+                    .unwrap_or_else(|poisoned| poisoned.into_inner());
+                told.insert(computer.clone(), (Instant::now(), false));
+            }
+            let endpoints = state
+                .db
+                .run(|conn| endpoints_of(conn, &computer))
+                .unwrap_or_default();
+            for (device, endpoint) in endpoints {
+                let sent = send(&inner, &endpoint, state.clock.now()).await;
+                if sent == Outcome::Gone {
+                    let _ = state.db.run(|conn| forget(conn, &device));
+                }
+            }
+        });
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum Outcome {
+    Sent,
+    /// The push service says the phone is not reachable there any more.
+    Gone,
+    Failed,
+}
+
+/// The empty push: a signed call with a time to live and nothing in it.
+async fn send(inner: &Inner, endpoint: &str, now_ms: i64) -> Outcome {
+    let Ok(url) = Url::parse(endpoint) else {
+        return Outcome::Failed;
+    };
+    let audience = url.origin().ascii_serialization();
+    let jwt = jwt(inner, &audience, now_ms / 1000);
+    let sent = inner
+        .http
+        .post(url)
+        .header(
+            "Authorization",
+            format!("vapid t={jwt}, k={}", inner.public),
+        )
+        .header("TTL", "3600")
+        .header("Urgency", "high")
+        .header("Content-Length", "0")
+        .send()
+        .await;
+    match sent.map(|response| response.status().as_u16()) {
+        Ok(200..=202) => Outcome::Sent,
+        Ok(404 | 410) => Outcome::Gone,
+        Ok(status) => {
+            tracing::warn!(status, "a push service refused a notice");
+            Outcome::Failed
+        }
+        Err(_) => {
+            tracing::warn!("a push service could not be reached");
+            Outcome::Failed
+        }
+    }
+}
+
+/// The signed token of RFC 8292: the push service's origin, twelve hours.
+fn jwt(inner: &Inner, audience: &str, now: i64) -> String {
+    let claims =
+        serde_json::json!({ "aud": audience, "exp": now + 12 * 3600, "sub": inner.subject });
+    let head = B64.encode(br#"{"typ":"JWT","alg":"ES256"}"#);
+    let body = B64.encode(claims.to_string());
+    let signing = format!("{head}.{body}");
+    let signature: Signature = inner.key.sign(signing.as_bytes());
+    format!("{signing}.{}", B64.encode(signature.to_bytes()))
+}
+
+/// `(phone, endpoint)` for every phone connected with `computer` that has one.
+fn endpoints_of(conn: &Connection, computer: &str) -> rusqlite::Result<Vec<(String, String)>> {
+    let mut stmt = conn.prepare(
+        "SELECT devices.id, push_subscriptions.endpoint FROM devices \
+         JOIN push_subscriptions ON push_subscriptions.device = devices.id \
+         WHERE devices.peer = ?1 AND devices.kind = 'phone'",
+    )?;
+    stmt.query_map([computer], |row| Ok((row.get(0)?, row.get(1)?)))?
+        .collect()
+}
+
+pub fn subscribe(
+    conn: &Connection,
+    device: &str,
+    endpoint: &str,
+    now: i64,
+) -> rusqlite::Result<()> {
+    conn.execute(
+        "INSERT INTO push_subscriptions (device, endpoint, created_at) VALUES (?1, ?2, ?3) \
+         ON CONFLICT(device) DO UPDATE SET endpoint = excluded.endpoint, created_at = excluded.created_at",
+        params![device, endpoint, now],
+    )?;
+    Ok(())
+}
+
+pub fn forget(conn: &Connection, device: &str) -> rusqlite::Result<bool> {
+    let removed = conn.execute("DELETE FROM push_subscriptions WHERE device = ?1", [device])?;
+    Ok(removed > 0)
+}
diff --git a/crates/botloft-cloud/src/push_api.rs b/crates/botloft-cloud/src/push_api.rs
new file mode 100644
index 00000000..15ff063b
--- /dev/null
+++ b/crates/botloft-cloud/src/push_api.rs
@@ -0,0 +1,68 @@
+//! What a phone asks of the push (spec 28.8): the server's public key, and to
+//! be told, or not, through the address its browser gave it.
+
+use axum::Json;
+use axum::extract::State;
+use axum::http::StatusCode;
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use crate::app::AppState;
+use crate::devices::Kind;
+use crate::error::ApiError;
+use crate::push;
+use crate::session::Authed;
+
+/// Only a phone, and only if the server sends pushes at all.
+fn phone(state: &AppState, who: &crate::devices::Who) -> Result<(), ApiError> {
+    if who.kind != Kind::Phone {
+        return Err(ApiError::wrong_device());
+    }
+    if state.push.public_key().is_none() {
+        return Err(ApiError::no_push());
+    }
+    Ok(())
+}
+
+/// `GET /v1/push/key`: what the browser needs to subscribe to this server.
+pub async fn key(
+    State(state): State<AppState>,
+    Authed(who): Authed,
+) -> Result<Json<Value>, ApiError> {
+    phone(&state, &who)?;
+    Ok(Json(json!({ "key": state.push.public_key() })))
+}
+
+#[derive(Deserialize)]
+pub struct Subscription {
+    endpoint: String,
+}
+
+/// `POST /v1/push/subscribe`: the address of this phone's push service.
+pub async fn subscribe(
+    State(state): State<AppState>,
+    Authed(who): Authed,
+    Json(body): Json<Subscription>,
+) -> Result<StatusCode, ApiError> {
+    phone(&state, &who)?;
+    if body.endpoint.len() > 2048 || !state.push.allows(&body.endpoint) {
+        return Err(ApiError::bad_endpoint());
+    }
+    let now = state.clock.now();
+    state
+        .db
+        .run(|conn| push::subscribe(conn, &who.device_id, &body.endpoint, now))?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+/// `DELETE /v1/push/subscribe`
+pub async fn unsubscribe(
+    State(state): State<AppState>,
+    Authed(who): Authed,
+) -> Result<StatusCode, ApiError> {
+    if who.kind != Kind::Phone {
+        return Err(ApiError::wrong_device());
+    }
+    state.db.run(|conn| push::forget(conn, &who.device_id))?;
+    Ok(StatusCode::NO_CONTENT)
+}
diff --git a/crates/botloft-cloud/src/relay.rs b/crates/botloft-cloud/src/relay.rs
new file mode 100644
index 00000000..f8d6e166
--- /dev/null
+++ b/crates/botloft-cloud/src/relay.rs
@@ -0,0 +1,277 @@
+//! The relay (spec 28.4): `GET /v1/relay` is a WebSocket where the computer
+//! and its phones talk. The server routes sealed `body` strings between a
+//! phone and the computer it was connected with, and never opens them.
+//!
+//! Browsers cannot put a header on a WebSocket, so the token goes in the first
+//! frame (`{t: "hello", token}`), never in the address.
+
+use std::collections::VecDeque;
+use std::time::Duration;
+
+use axum::extract::State;
+use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
+use axum::response::Response;
+use serde_json::{Value, json};
+use tokio::sync::mpsc;
+use tokio::time::{MissedTickBehavior, interval, timeout};
+
+use crate::app::AppState;
+use crate::devices::{self, Kind, Who};
+use crate::hub::Out;
+use crate::relay_rows::{self as rows, Pushed};
+use crate::tokens;
+
+/// The biggest frame, in either direction.
+const MAX_FRAME: usize = 64 * 1024;
+/// How long a new socket has to say who it is.
+const HELLO_WAIT: Duration = Duration::from_secs(10);
+/// How often the server pings, so proxies keep the socket open.
+const PING_EVERY: Duration = Duration::from_secs(25);
+/// Frames a device may send in a minute.
+const FRAMES_PER_MINUTE: usize = 60;
+
+/// `GET /v1/relay`
+pub async fn relay(State(state): State<AppState>, upgrade: WebSocketUpgrade) -> Response {
+    upgrade
+        .max_message_size(MAX_FRAME)
+        .max_frame_size(MAX_FRAME)
+        .on_upgrade(move |socket| serve(state, socket))
+}
+
+async fn put(socket: &mut WebSocket, frame: Value) -> bool {
+    socket
+        .send(Message::Text(frame.to_string().into()))
+        .await
+        .is_ok()
+}
+
+/// The first frame, checked against the devices.
+async fn hello(state: &AppState, socket: &mut WebSocket) -> Option<Who> {
+    let first = timeout(HELLO_WAIT, socket.recv()).await.ok()??.ok()?;
+    let Message::Text(text) = first else {
+        return None;
+    };
+    let frame: Value = serde_json::from_str(&text).ok()?;
+    let token = frame
+        .get("t")
+        .filter(|kind| *kind == "hello")
+        .and(frame.get("token"))
+        .and_then(Value::as_str)?;
+    let (hash, now) = (tokens::hash(token.trim()), state.clock.now());
+    let who = state
+        .db
+        .run(|conn| devices::who_is(conn, &hash, now))
+        .ok()
+        .flatten();
+    if who.is_none() {
+        let _ = put(socket, json!({ "t": "error", "reason": "unauthorized" })).await;
+    }
+    who
+}
+
+async fn serve(state: AppState, mut socket: WebSocket) {
+    let Some(who) = hello(&state, &mut socket).await else {
+        return;
+    };
+    let (tx, mut outgoing) = mpsc::channel::<Out>(256);
+    let me = state.hub.attach(&who.device_id, tx);
+    if !ready(&state, &who, &mut socket).await {
+        state.hub.detach(&who.device_id, me);
+        return;
+    }
+    presence(&state, &who, true);
+
+    let mut ping = interval(PING_EVERY);
+    ping.set_missed_tick_behavior(MissedTickBehavior::Delay);
+    ping.tick().await;
+    let mut recent: VecDeque<i64> = VecDeque::new();
+    loop {
+        tokio::select! {
+            incoming = socket.recv() => match incoming {
+                Some(Ok(Message::Text(text))) => {
+                    if !within_limit(&state, &mut recent) {
+                        let _ = put(&mut socket, json!({"t": "error", "reason": "rate_limited"})).await;
+                        continue;
+                    }
+                    if let Some(reply) = handle(&state, &who, &text) {
+                        let _ = put(&mut socket, reply).await;
+                    }
+                }
+                Some(Ok(Message::Close(_)) | Err(_)) | None => break,
+                Some(Ok(_)) => {}
+            },
+            out = outgoing.recv() => match out {
+                Some(Out::Text(text)) => {
+                    if socket.send(Message::Text(text.into())).await.is_err() {
+                        break;
+                    }
+                }
+                Some(Out::Close) | None => {
+                    let _ = socket.send(Message::Close(None)).await;
+                    break;
+                }
+            },
+            _ = ping.tick() => {
+                if !put(&mut socket, json!({"t": "ping"})).await {
+                    break;
+                }
+            }
+        }
+    }
+    state.hub.detach(&who.device_id, me);
+    // A newer socket of the same device may have taken over: then it is still there.
+    if !state.hub.online(&who.device_id) {
+        presence(&state, &who, false);
+    }
+}
+
+/// At most `FRAMES_PER_MINUTE` frames in any minute (the server's clock).
+fn within_limit(state: &AppState, recent: &mut VecDeque<i64>) -> bool {
+    let now = state.clock.now();
+    while recent.front().is_some_and(|at| *at <= now - 60_000) {
+        recent.pop_front();
+    }
+    if recent.len() >= FRAMES_PER_MINUTE {
+        return false;
+    }
+    recent.push_back(now);
+    true
+}
+
+/// `{t: "ready"}`, then (for a computer) what its phones sent while it was away.
+async fn ready(state: &AppState, who: &Who, socket: &mut WebSocket) -> bool {
+    match who.kind {
+        Kind::Phone => {
+            let peer = who.peer.clone().unwrap_or_default();
+            let online = state.hub.online(&peer);
+            put(
+                socket,
+                json!({
+                    "t": "ready", "kind": "phone", "device": who.device_id,
+                    "peer": peer, "online": online,
+                }),
+            )
+            .await
+        }
+        Kind::Computer => {
+            let now = state.clock.now();
+            let loaded = state.db.run(|conn| {
+                Ok((
+                    rows::phones_of(conn, &who.device_id)?,
+                    rows::waiting(conn, &who.device_id, now)?,
+                ))
+            });
+            let Ok((phones, waiting)) = loaded else {
+                return false;
+            };
+            let phones: Vec<Value> = phones
+                .into_iter()
+                .map(|id| json!({ "online": state.hub.online(&id), "id": id }))
+                .collect();
+            let first = json!({
+                "t": "ready", "kind": "computer", "device": who.device_id, "phones": phones,
+            });
+            if !put(socket, first).await {
+                return false;
+            }
+            for (from, seq, body) in waiting {
+                let frame = json!({ "t": "msg", "from": from, "seq": seq, "body": body });
+                if !put(socket, frame).await {
+                    return false;
+                }
+            }
+            true
+        }
+    }
+}
+
+/// Tells the other side that this device came or went.
+fn presence(state: &AppState, who: &Who, online: bool) {
+    let frame = |device: &str| json!({ "t": "presence", "device": device, "online": online });
+    match who.kind {
+        Kind::Phone => {
+            if let Some(peer) = &who.peer {
+                state.hub.send(peer, frame(&who.device_id).to_string());
+            }
+        }
+        Kind::Computer => {
+            let phones = state
+                .db
+                .run(|conn| rows::phones_of(conn, &who.device_id))
+                .unwrap_or_default();
+            for phone in phones {
+                state.hub.send(&phone, frame(&who.device_id).to_string());
+            }
+        }
+    }
+}
+
+/// One frame from a device. Gives back an error frame for the sender, if any.
+fn handle(state: &AppState, who: &Who, text: &str) -> Option<Value> {
+    let Ok(frame) = serde_json::from_str::<Value>(text) else {
+        return Some(json!({ "t": "error", "reason": "bad_frame" }));
+    };
+    let kind = frame.get("t").and_then(Value::as_str).unwrap_or_default();
+    let seq = frame.get("seq").and_then(Value::as_i64).filter(|s| *s >= 0);
+    let body = frame.get("body").and_then(Value::as_str);
+    match (who.kind, kind) {
+        (Kind::Phone, "msg") => {
+            let (Some(seq), Some(body), Some(peer)) = (seq, body, &who.peer) else {
+                return Some(json!({ "t": "error", "reason": "bad_frame" }));
+            };
+            let now = state.clock.now();
+            match state
+                .db
+                .run(|conn| rows::push(conn, &who.device_id, peer, seq, body, now))
+            {
+                Ok(Pushed::Queued) => {
+                    let out =
+                        json!({ "t": "msg", "from": who.device_id, "seq": seq, "body": body });
+                    state.hub.send(peer, out.to_string());
+                    None
+                }
+                Ok(Pushed::Again) => None,
+                Ok(Pushed::Full) => {
+                    Some(json!({ "t": "error", "reason": "queue_full", "seq": seq }))
+                }
+                Err(_) => Some(json!({ "t": "error", "reason": "internal" })),
+            }
+        }
+        (Kind::Computer, "msg") => {
+            let (Some(seq), Some(body), Some(to)) =
+                (seq, body, frame.get("to").and_then(Value::as_str))
+            else {
+                return Some(json!({ "t": "error", "reason": "bad_frame" }));
+            };
+            let known = state
+                .db
+                .run(|conn| rows::is_phone_of(conn, to, &who.device_id))
+                .unwrap_or(false);
+            if !known {
+                return Some(json!({ "t": "error", "reason": "unknown_device", "seq": seq }));
+            }
+            let out = json!({ "t": "msg", "seq": seq, "body": body });
+            state.hub.send(to, out.to_string());
+            None
+        }
+        (Kind::Computer, "ack") => {
+            let (Some(upto), Some(from)) = (
+                frame.get("upto").and_then(Value::as_i64),
+                frame.get("from").and_then(Value::as_str),
+            ) else {
+                return Some(json!({ "t": "error", "reason": "bad_frame" }));
+            };
+            let _ = state
+                .db
+                .run(|conn| rows::ack(conn, &who.device_id, from, upto));
+            None
+        }
+        // Something waits for the owner: the phones that are not looking are told.
+        (Kind::Computer, "wake") => {
+            state.push.wake(state, &who.device_id);
+            None
+        }
+        // Pings and pongs need no answer.
+        _ => None,
+    }
+}
diff --git a/crates/botloft-cloud/src/relay_rows.rs b/crates/botloft-cloud/src/relay_rows.rs
new file mode 100644
index 00000000..8fa46dc9
--- /dev/null
+++ b/crates/botloft-cloud/src/relay_rows.rs
@@ -0,0 +1,89 @@
+//! The queue of the relay (spec 28.4): sealed messages a phone sent that its
+//! computer has not acknowledged. The server never reads a `body`.
+
+use rusqlite::{Connection, params};
+
+/// How long a message waits for a computer that is offline.
+pub const QUEUE_TTL_MS: i64 = 3_600_000;
+/// How many unacknowledged messages one phone may have waiting.
+pub const QUEUE_MAX: i64 = 50;
+
+pub enum Pushed {
+    Queued,
+    /// The same `seq` was already queued: nothing new, and not an error.
+    Again,
+    Full,
+}
+
+pub fn push(
+    conn: &Connection,
+    from: &str,
+    to: &str,
+    seq: i64,
+    body: &str,
+    now: i64,
+) -> rusqlite::Result<Pushed> {
+    conn.execute(
+        "DELETE FROM relay_queue WHERE from_device = ?1 AND expires_at <= ?2",
+        params![from, now],
+    )?;
+    let waiting: i64 = conn.query_row(
+        "SELECT COUNT(*) FROM relay_queue WHERE from_device = ?1",
+        [from],
+        |row| row.get(0),
+    )?;
+    if waiting >= QUEUE_MAX {
+        return Ok(Pushed::Full);
+    }
+    let added = conn.execute(
+        "INSERT OR IGNORE INTO relay_queue (from_device, to_device, seq, body, expires_at) \
+         VALUES (?1, ?2, ?3, ?4, ?5)",
+        params![from, to, seq, body, now + QUEUE_TTL_MS],
+    )?;
+    Ok(if added == 0 {
+        Pushed::Again
+    } else {
+        Pushed::Queued
+    })
+}
+
+/// What the computer has not acknowledged, oldest first per phone.
+pub fn waiting(
+    conn: &Connection,
+    to: &str,
+    now: i64,
+) -> rusqlite::Result<Vec<(String, i64, String)>> {
+    let mut stmt = conn.prepare(
+        "SELECT from_device, seq, body FROM relay_queue \
+         WHERE to_device = ?1 AND expires_at > ?2 ORDER BY from_device, seq",
+    )?;
+    stmt.query_map(params![to, now], |row| {
+        Ok((row.get(0)?, row.get(1)?, row.get(2)?))
+    })?
+    .collect()
+}
+
+/// The computer took everything from `from` up to and including `upto`.
+pub fn ack(conn: &Connection, to: &str, from: &str, upto: i64) -> rusqlite::Result<()> {
+    conn.execute(
+        "DELETE FROM relay_queue WHERE to_device = ?1 AND from_device = ?2 AND seq <= ?3",
+        params![to, from, upto],
+    )?;
+    Ok(())
+}
+
+/// The phones connected to a computer, for presence and for where it may send.
+pub fn phones_of(conn: &Connection, computer: &str) -> rusqlite::Result<Vec<String>> {
+    let mut stmt = conn.prepare("SELECT id FROM devices WHERE peer = ?1 ORDER BY created_at")?;
+    stmt.query_map([computer], |row| row.get(0))?.collect()
+}
+
+/// True when `phone` is a phone connected with `computer`.
+pub fn is_phone_of(conn: &Connection, phone: &str, computer: &str) -> rusqlite::Result<bool> {
+    conn.query_row(
+        "SELECT COUNT(*) FROM devices WHERE id = ?1 AND peer = ?2 AND kind = 'phone'",
+        params![phone, computer],
+        |row| row.get::<_, i64>(0),
+    )
+    .map(|count| count > 0)
+}
diff --git a/crates/botloft-cloud/src/removal.rs b/crates/botloft-cloud/src/removal.rs
index 718b6400..d20476a2 100644
--- a/crates/botloft-cloud/src/removal.rs
+++ b/crates/botloft-cloud/src/removal.rs
@@ -11,11 +11,12 @@ use serde::Deserialize;
 use crate::accounts::LOGIN_TTL_MS;
 use crate::app::AppState;
 use crate::copy_rows;
+use crate::devices;
 use crate::error::ApiError;
 use crate::limits::{self, GAP, PER_EMAIL};
 use crate::mail_text::{Locale, delete_mail};
 use crate::mailer::Mail;
-use crate::session::Authed;
+use crate::session::Computer;
 use crate::{pages, tokens};
 
 #[derive(Deserialize, Default)]
@@ -27,7 +28,7 @@ pub struct Ask {
 /// `POST /v1/account/delete`: mails a link; nothing is deleted yet.
 pub async fn ask(
     State(state): State<AppState>,
-    Authed(who): Authed,
+    Computer(who): Computer,
     body: Option<Json<Ask>>,
 ) -> Result<StatusCode, ApiError> {
     let locale = Locale::parse(&body.map(|Json(ask)| ask.locale).unwrap_or_default());
@@ -126,12 +127,16 @@ pub async fn confirm(
             return Ok(None);
         };
         let keys = copy_rows::keys(conn, account_id)?;
+        let devices = devices::device_ids(conn, account_id)?;
         conn.execute("DELETE FROM accounts WHERE id = ?1", [account_id])?;
-        Ok(Some((Locale::parse(&locale), keys)))
+        Ok(Some((Locale::parse(&locale), keys, devices)))
     })?;
-    let Some((locale, keys)) = gone else {
+    let Some((locale, keys, devices)) = gone else {
         return Ok(pages::gone(Locale::of_request(&headers)));
     };
+    for device in devices {
+        state.hub.kick(&device);
+    }
     // The rows are gone; now the bytes.
     for key in keys {
         state.store.delete(&key).await;
diff --git a/crates/botloft-cloud/src/session.rs b/crates/botloft-cloud/src/session.rs
index 71431cc9..9dec135f 100644
--- a/crates/botloft-cloud/src/session.rs
+++ b/crates/botloft-cloud/src/session.rs
@@ -1,4 +1,5 @@
 //! Who is asking, once signed in (spec 27.3): the bearer token of a device.
+//! A phone's token reaches the relay and little else (spec 28.2).
 
 use axum::Json;
 use axum::extract::{FromRequestParts, Path, State};
@@ -7,13 +8,13 @@ use axum::http::header::AUTHORIZATION;
 use axum::http::request::Parts;
 use serde_json::{Value, json};
 
-use crate::accounts::{self, Who};
 use crate::app::AppState;
 use crate::copy_rows;
+use crate::devices::{self, Kind, Removed, Who};
 use crate::error::ApiError;
 use crate::tokens;
 
-/// The device behind a request.
+/// The device behind a request, whatever it is.
 pub struct Authed(pub Who);
 
 impl FromRequestParts<AppState> for Authed {
@@ -30,19 +31,46 @@ impl FromRequestParts<AppState> for Authed {
             .and_then(|value| value.strip_prefix("Bearer "))
             .ok_or_else(ApiError::unauthorized)?;
         let (hash, now) = (tokens::hash(token.trim()), state.clock.now());
-        let who = state.db.run(|conn| accounts::who_is(conn, &hash, now))?;
+        let who = state.db.run(|conn| devices::who_is(conn, &hash, now))?;
         who.map(Self).ok_or_else(ApiError::unauthorized)
     }
 }
 
-/// `GET /v1/me`
+/// A computer: the copies, the other devices and the account are only its.
+pub struct Computer(pub Who);
+
+impl FromRequestParts<AppState> for Computer {
+    type Rejection = ApiError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let Authed(who) = Authed::from_request_parts(parts, state).await?;
+        if who.kind == Kind::Computer {
+            Ok(Self(who))
+        } else {
+            Err(ApiError::wrong_device())
+        }
+    }
+}
+
+/// `GET /v1/me`. A phone sees only whose it is and which computer it serves.
 pub async fn me(
     State(state): State<AppState>,
     Authed(who): Authed,
 ) -> Result<Json<Value>, ApiError> {
+    if who.kind == Kind::Phone {
+        return Ok(Json(json!({
+            "email": who.email,
+            "kind": who.kind.tag(),
+            "device": who.device_id,
+            "peer": who.peer,
+        })));
+    }
     let (devices, used) = state.db.run(|conn| {
         Ok((
-            accounts::devices(conn, who.account_id)?,
+            devices::devices(conn, who.account_id)?,
             copy_rows::used(conn, who.account_id)?,
         ))
     })?;
@@ -52,6 +80,8 @@ pub async fn me(
             json!({
                 "id": device.id,
                 "name": device.name,
+                "kind": device.kind,
+                "peer": device.peer,
                 "created_at": device.created_at,
                 "last_used_at": device.last_used_at,
                 "current": device.id == who.device_id,
@@ -66,29 +96,48 @@ pub async fn me(
     })))
 }
 
-/// `POST /v1/logout`: this device's token stops working.
+/// Closes the sockets of devices that are gone, and tells the computer of
+/// each phone that left (spec 28.4), so it forgets that phone's keys.
+pub fn farewell(state: &AppState, gone: &[Removed]) {
+    for device in gone {
+        state.hub.kick(&device.id);
+    }
+    for device in gone {
+        if let Some(peer) = &device.peer {
+            state.hub.send(
+                peer,
+                json!({ "t": "revoked", "device": device.id }).to_string(),
+            );
+        }
+    }
+}
+
+/// `POST /v1/logout`: this device's token stops working (a phone's too, which
+/// is how it disconnects from its side).
 pub async fn logout(
     State(state): State<AppState>,
     Authed(who): Authed,
 ) -> Result<StatusCode, ApiError> {
-    state
+    let gone = state
         .db
-        .run(|conn| accounts::delete_device(conn, who.account_id, &who.device_id))?;
+        .run(|conn| devices::delete_device(conn, who.account_id, &who.device_id))?;
+    farewell(&state, &gone);
     Ok(StatusCode::NO_CONTENT)
 }
 
-/// `DELETE /v1/devices/<id>`: another device of the same account.
+/// `DELETE /v1/devices/<id>`: another device of the same account, with the
+/// phones that belong to it.
 pub async fn remove_device(
     State(state): State<AppState>,
-    Authed(who): Authed,
+    Computer(who): Computer,
     Path(id): Path<String>,
 ) -> Result<StatusCode, ApiError> {
-    let removed = state
+    let gone = state
         .db
-        .run(|conn| accounts::delete_device(conn, who.account_id, &id))?;
-    if removed {
-        Ok(StatusCode::NO_CONTENT)
-    } else {
-        Err(ApiError::not_found())
+        .run(|conn| devices::delete_device(conn, who.account_id, &id))?;
+    if gone.is_empty() {
+        return Err(ApiError::not_found());
     }
+    farewell(&state, &gone);
+    Ok(StatusCode::NO_CONTENT)
 }
diff --git a/crates/botloft-cloud/tests/common/mobile.rs b/crates/botloft-cloud/tests/common/mobile.rs
new file mode 100644
index 00000000..fb65e6a6
--- /dev/null
+++ b/crates/botloft-cloud/tests/common/mobile.rs
@@ -0,0 +1,205 @@
+//! Helpers for the phone's tests (spec 28): a real listener for the relay, a
+//! WebSocket client, and the pairing flow with made-up (but well-shaped) keys.
+
+#![allow(dead_code)]
+
+use std::net::SocketAddr;
+use std::time::Duration;
+
+use axum::body::Body;
+use axum::http::{Request, header};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tokio::net::TcpStream;
+use tokio_tungstenite::tungstenite::Message;
+use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
+
+use super::{Reply, Server};
+
+/// 22 characters, as a pairing id is (16 bytes in base64url).
+pub fn pair_id(n: u32) -> String {
+    format!("{n:0>22}")
+}
+
+/// 43 characters, as a proof is (an HMAC-SHA-256 in base64url).
+pub fn proof(letter: char) -> String {
+    letter.to_string().repeat(43)
+}
+
+/// A key as the server sees it: only its shape matters to the server.
+pub fn key(letter: char) -> String {
+    letter.to_string().repeat(87)
+}
+
+/// A phone that finished connecting.
+pub struct Phone {
+    pub token: String,
+    pub device: String,
+    pub pairing: String,
+}
+
+impl Server {
+    /// A request with a JSON body, and a bearer token if there is one.
+    pub async fn call(
+        &self,
+        method: &str,
+        path: &str,
+        token: Option<&str>,
+        body: Option<Value>,
+    ) -> Reply {
+        let mut request = Request::builder().method(method).uri(path);
+        if let Some(token) = token {
+            request = request.header(header::AUTHORIZATION, format!("Bearer {token}"));
+        }
+        let body = match body {
+            Some(body) => {
+                request = request.header(header::CONTENT_TYPE, "application/json");
+                Body::from(body.to_string())
+            }
+            None => Body::empty(),
+        };
+        self.send(request.body(body).expect("request")).await
+    }
+
+    /// Serves the router on a free port, for the relay's sockets.
+    pub async fn listen(&self) -> SocketAddr {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind");
+        let address = listener.local_addr().expect("address");
+        let app = self.app.clone();
+        tokio::spawn(async move {
+            let _ = axum::serve(listener, app).await;
+        });
+        address
+    }
+
+    /// The whole flow of 28.3 with a computer's token: the pairing id is
+    /// `pair_id(n)`, and the phone ends up with its own token.
+    pub async fn pair(&self, computer: &str, n: u32) -> Phone {
+        let id = pair_id(n);
+        let opened = self
+            .call(
+                "POST",
+                "/v1/pairings",
+                Some(computer),
+                Some(json!({ "id": id })),
+            )
+            .await;
+        assert_eq!(opened.status, 201, "{}", opened.body);
+        let joined = self
+            .call(
+                "POST",
+                &format!("/v1/pairings/{id}/join"),
+                None,
+                Some(json!({
+                    "phone_pub": key('P'), "device_name": "Celular da Ana", "proof": proof('p'),
+                })),
+            )
+            .await;
+        assert_eq!(joined.status, 202, "{}", joined.body);
+        let poll = joined.json()["poll"].as_str().expect("poll").to_owned();
+        let accepted = self
+            .call(
+                "POST",
+                &format!("/v1/pairings/{id}/accept"),
+                Some(computer),
+                Some(json!({ "daemon_pub": key('D'), "proof2": proof('d') })),
+            )
+            .await;
+        assert_eq!(accepted.status, 204, "{}", accepted.body);
+        let got = self
+            .call(
+                "GET",
+                &format!("/v1/pairings/{id}/result"),
+                Some(&poll),
+                None,
+            )
+            .await
+            .json();
+        assert_eq!(got["status"], "approved", "{got}");
+        Phone {
+            token: got["token"].as_str().expect("token").to_owned(),
+            device: got["device"].as_str().expect("device").to_owned(),
+            pairing: id,
+        }
+    }
+}
+
+/// A client of the relay.
+pub struct Sock(WebSocketStream<MaybeTlsStream<TcpStream>>);
+
+const WAIT: Duration = Duration::from_secs(3);
+
+impl Sock {
+    /// Connects and says hello with `token`; the next frame is the server's answer.
+    pub async fn open(address: SocketAddr, token: &str) -> Self {
+        let mut sock = Self::connect(address).await;
+        sock.send(json!({ "t": "hello", "token": token })).await;
+        sock
+    }
+
+    pub async fn connect(address: SocketAddr) -> Self {
+        let (socket, _) = tokio_tungstenite::connect_async(format!("ws://{address}/v1/relay"))
+            .await
+            .expect("connect");
+        Self(socket)
+    }
+
+    pub async fn send(&mut self, frame: Value) {
+        self.send_text(&frame.to_string()).await;
+    }
+
+    pub async fn send_text(&mut self, text: &str) {
+        self.0
+            .send(Message::Text(text.to_owned().into()))
+            .await
+            .expect("send");
+    }
+
+    /// The next frame from the server.
+    pub async fn next(&mut self) -> Value {
+        let frame = tokio::time::timeout(WAIT, self.0.next())
+            .await
+            .expect("a frame in time");
+        match frame {
+            Some(Ok(Message::Text(text))) => serde_json::from_str(&text).expect("json"),
+            other => panic!("not a frame: {other:?}"),
+        }
+    }
+
+    /// Opens as `open` does and checks the `ready` frame.
+    pub async fn ready(address: SocketAddr, token: &str) -> (Self, Value) {
+        let mut sock = Self::open(address, token).await;
+        let ready = sock.next().await;
+        assert_eq!(ready["t"], "ready", "{ready}");
+        (sock, ready)
+    }
+
+    /// No frame arrives for a while.
+    pub async fn quiet(&mut self) {
+        let frame = tokio::time::timeout(Duration::from_millis(300), self.0.next()).await;
+        assert!(frame.is_err(), "unexpected: {frame:?}");
+    }
+
+    /// The server closes this socket.
+    pub async fn closed(&mut self) {
+        loop {
+            let frame = tokio::time::timeout(WAIT, self.0.next())
+                .await
+                .expect("closed in time");
+            match frame {
+                None | Some(Err(_) | Ok(Message::Close(_))) => return,
+                Some(Ok(_)) => {}
+            }
+        }
+    }
+
+    /// Once this returns, the server has handled every frame sent before it:
+    /// a frame that is not JSON is answered, and frames are handled in order.
+    pub async fn sync(&mut self) {
+        self.send_text("not json").await;
+        let reply = self.next().await;
+        assert_eq!(reply["reason"], "bad_frame", "{reply}");
+    }
+}
diff --git a/crates/botloft-cloud/tests/common/mod.rs b/crates/botloft-cloud/tests/common/mod.rs
index 5d2db796..fddaa188 100644
--- a/crates/botloft-cloud/tests/common/mod.rs
+++ b/crates/botloft-cloud/tests/common/mod.rs
@@ -8,11 +8,13 @@ use std::sync::Arc;
 use axum::Router;
 use axum::body::{Body, to_bytes};
 use axum::http::{Request, StatusCode, header};
-use botloft_cloud::{AppState, Clock, Config, CopyStore, Db, Mailer, Outbox, router};
+use botloft_cloud::{AppState, Clock, Config, CopyStore, Db, Hub, Mailer, Outbox, Pusher, router};
 use serde_json::{Value, json};
 use sha2::{Digest, Sha256};
 use tower::ServiceExt;
 
+pub mod mobile;
+
 pub struct Server {
     app: Router,
     pub store: CopyStore,
@@ -38,17 +40,22 @@ pub fn server() -> Server {
 }
 
 pub fn start(outbox: Outbox) -> Server {
-    build(outbox, Config::for_tests())
+    build(outbox, Config::for_tests(), Pusher::off())
+}
+
+/// A server that sends Web Push through `pusher`.
+pub fn server_pushing(pusher: Pusher) -> Server {
+    build(Outbox::default(), Config::for_tests(), pusher)
 }
 
 /// A server with other limits than the defaults.
 pub fn server_with(change: impl FnOnce(&mut Config)) -> Server {
     let mut config = Config::for_tests();
     change(&mut config);
-    build(Outbox::default(), config)
+    build(Outbox::default(), config, Pusher::off())
 }
 
-fn build(outbox: Outbox, config: Config) -> Server {
+fn build(outbox: Outbox, config: Config, push: Pusher) -> Server {
     let clock = Clock::default();
     let store = CopyStore::memory();
     let state = AppState {
@@ -57,6 +64,8 @@ fn build(outbox: Outbox, config: Config) -> Server {
         clock: clock.clone(),
         config: Arc::new(config),
         store: store.clone(),
+        hub: Hub::default(),
+        push,
     };
     Server {
         app: router(state),
diff --git a/crates/botloft-cloud/tests/pairing.rs b/crates/botloft-cloud/tests/pairing.rs
new file mode 100644
index 00000000..dc2cbc85
--- /dev/null
+++ b/crates/botloft-cloud/tests/pairing.rs
@@ -0,0 +1,416 @@
+//! Connecting a phone (spec 28.3) and what a phone's token may reach (28.2).
+
+mod common;
+
+use axum::http::StatusCode;
+use common::mobile::{key, pair_id, proof};
+use common::server;
+use serde_json::json;
+
+#[tokio::test]
+async fn a_phone_joins_the_computer_accepts_and_the_phone_collects_its_token_once() {
+    let s = server();
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let id = pair_id(1);
+    let path = format!("/v1/pairings/{id}");
+
+    let opened = s
+        .call(
+            "POST",
+            "/v1/pairings",
+            Some(&computer),
+            Some(json!({ "id": id })),
+        )
+        .await;
+    assert_eq!(opened.status, StatusCode::CREATED);
+    assert_eq!(opened.json()["expires_in"], 300);
+    assert_eq!(
+        s.call("GET", &path, Some(&computer), None).await.json()["status"],
+        "waiting"
+    );
+
+    // The phone has no token: it joins with its key and proof, and keeps the
+    // secret that lets it collect the answer.
+    let joined = s
+        .call(
+            "POST",
+            &format!("{path}/join"),
+            None,
+            Some(json!({
+                "phone_pub": key('P'), "device_name": "Celular da Ana", "proof": proof('p'),
+            })),
+        )
+        .await;
+    assert_eq!(joined.status, StatusCode::ACCEPTED);
+    let poll = joined.json()["poll"].as_str().expect("poll").to_owned();
+
+    // The computer sees who joined, exactly as sent.
+    let seen = s.call("GET", &path, Some(&computer), None).await.json();
+    assert_eq!(seen["status"], "joined");
+    assert_eq!(seen["device_name"], "Celular da Ana");
+    assert_eq!(seen["phone_pub"], key('P'));
+    assert_eq!(seen["proof"], proof('p'));
+
+    // Nothing for the phone until the computer accepts.
+    let result = format!("{path}/result");
+    assert_eq!(
+        s.call("GET", &result, Some(&poll), None).await.json()["status"],
+        "pending"
+    );
+    let accepted = s
+        .call(
+            "POST",
+            &format!("{path}/accept"),
+            Some(&computer),
+            Some(json!({ "daemon_pub": key('D'), "proof2": proof('d') })),
+        )
+        .await;
+    assert_eq!(accepted.status, StatusCode::NO_CONTENT);
+
+    let got = s.call("GET", &result, Some(&poll), None).await.json();
+    assert_eq!(got["status"], "approved");
+    assert_eq!(got["daemon_pub"], key('D'));
+    assert_eq!(got["proof2"], proof('d'));
+    let token = got["token"].as_str().expect("token").to_owned();
+    let device = got["device"].as_str().expect("device").to_owned();
+    // Once: the pairing is gone and the token is not handed out again.
+    assert_eq!(
+        s.call("GET", &result, Some(&poll), None).await.json()["status"],
+        "expired"
+    );
+
+    // The phone is a device of the account, tied to the computer that opened it.
+    let me = s.authed("GET", "/v1/me", &token).await.json();
+    assert_eq!(me["kind"], "phone");
+    assert_eq!(me["device"], device);
+    assert_eq!(me["email"], "ana@exemplo.com");
+    assert!(me.get("devices").is_none() && me.get("used").is_none());
+    let mine = s.authed("GET", "/v1/me", &computer).await.json();
+    let devices = mine["devices"].as_array().expect("devices");
+    assert_eq!(devices.len(), 2);
+    let phone = devices.iter().find(|d| d["id"] == device).expect("phone");
+    assert_eq!(phone["kind"], "phone");
+    assert_eq!(phone["name"], "Celular da Ana");
+    assert_eq!(me["peer"], phone["peer"]);
+    assert!(
+        devices
+            .iter()
+            .any(|d| d["kind"] == "computer" && d["peer"].is_null())
+    );
+}
+
+#[tokio::test]
+async fn a_phone_token_reaches_the_relay_and_nothing_that_belongs_to_a_computer() {
+    let s = server();
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+
+    for (method, path) in [
+        ("GET", "/v1/copies"),
+        ("GET", "/v1/copies/abc"),
+        ("DELETE", "/v1/copies/abc"),
+        ("POST", "/v1/account/delete"),
+        ("DELETE", "/v1/devices/anything"),
+        ("GET", "/v1/pairings/anything"),
+    ] {
+        let reply = s.authed(method, path, &phone.token).await;
+        assert_eq!(reply.status, StatusCode::FORBIDDEN, "{method} {path}");
+        assert_eq!(reply.json()["reason"], "wrong_device");
+    }
+    let opened = s
+        .call(
+            "POST",
+            "/v1/pairings",
+            Some(&phone.token),
+            Some(json!({ "id": pair_id(9) })),
+        )
+        .await;
+    assert_eq!(opened.status, StatusCode::FORBIDDEN);
+    let put = s.put_copy(&phone.token, b"sealed").await;
+    assert_eq!(put.status, StatusCode::FORBIDDEN);
+    assert_eq!(
+        s.authed("GET", "/v1/me", &phone.token).await.status,
+        StatusCode::OK
+    );
+
+    // It can disconnect itself, and then its token is dead.
+    assert_eq!(
+        s.authed("POST", "/v1/logout", &phone.token).await.status,
+        StatusCode::NO_CONTENT
+    );
+    assert_eq!(
+        s.authed("GET", "/v1/me", &phone.token).await.status,
+        StatusCode::UNAUTHORIZED
+    );
+    // The computer is still signed in.
+    assert_eq!(
+        s.authed("GET", "/v1/me", &computer).await.status,
+        StatusCode::OK
+    );
+}
+
+#[tokio::test]
+async fn a_pairing_is_used_once_runs_out_and_checks_what_it_is_given() {
+    let s = server();
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let id = pair_id(1);
+    let join = format!("/v1/pairings/{id}/join");
+    let body = json!({ "phone_pub": key('P'), "device_name": "X", "proof": proof('p') });
+    s.call(
+        "POST",
+        "/v1/pairings",
+        Some(&computer),
+        Some(json!({ "id": id })),
+    )
+    .await;
+
+    // Bad shapes are refused before anything is stored.
+    for bad in [
+        json!({ "phone_pub": "has space", "device_name": "X", "proof": proof('p') }),
+        json!({ "phone_pub": key('P'), "device_name": "X", "proof": "short" }),
+        json!({ "phone_pub": "", "device_name": "X", "proof": proof('p') }),
+    ] {
+        let reply = s.call("POST", &join, None, Some(bad)).await;
+        assert_eq!(reply.status, StatusCode::BAD_REQUEST);
+        assert_eq!(reply.json()["reason"], "bad_pairing");
+    }
+    let short = s
+        .call(
+            "POST",
+            "/v1/pairings",
+            Some(&computer),
+            Some(json!({ "id": "short" })),
+        )
+        .await;
+    assert_eq!(short.status, StatusCode::BAD_REQUEST);
+
+    // The first phone to join gets it; a second one finds it used.
+    assert_eq!(
+        s.call("POST", &join, None, Some(body.clone())).await.status,
+        StatusCode::ACCEPTED
+    );
+    let again = s.call("POST", &join, None, Some(body.clone())).await;
+    assert_eq!(again.status, StatusCode::GONE);
+    assert_eq!(again.json()["reason"], "pair_expired");
+
+    // Without the poll secret of the phone that joined, there is no token,
+    // even after the computer accepted.
+    s.call(
+        "POST",
+        &format!("/v1/pairings/{id}/accept"),
+        Some(&computer),
+        Some(json!({ "daemon_pub": key('D'), "proof2": proof('d') })),
+    )
+    .await;
+    let stolen = s
+        .call(
+            "GET",
+            &format!("/v1/pairings/{id}/result"),
+            Some("not-the-secret"),
+            None,
+        )
+        .await;
+    assert_eq!(stolen.json()["status"], "expired");
+    assert!(stolen.json().get("token").is_none());
+    let nobody = s
+        .call("GET", &format!("/v1/pairings/{id}/result"), None, None)
+        .await;
+    assert_eq!(nobody.status, StatusCode::UNAUTHORIZED);
+
+    // Five minutes later the code is dead, and the computer sees it so.
+    let late = pair_id(2);
+    s.call(
+        "POST",
+        "/v1/pairings",
+        Some(&computer),
+        Some(json!({ "id": late })),
+    )
+    .await;
+    s.clock.advance(301_000);
+    let expired = s
+        .call(
+            "POST",
+            &format!("/v1/pairings/{late}/join"),
+            None,
+            Some(body),
+        )
+        .await;
+    assert_eq!(expired.status, StatusCode::GONE);
+    let seen = s
+        .call(
+            "GET",
+            &format!("/v1/pairings/{late}"),
+            Some(&computer),
+            None,
+        )
+        .await;
+    assert_eq!(seen.json()["status"], "expired");
+}
+
+#[tokio::test]
+async fn a_computer_holds_three_open_codes_cancels_and_cannot_accept_what_nobody_joined() {
+    let s = server();
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    for n in 1..=3 {
+        let opened = s
+            .call(
+                "POST",
+                "/v1/pairings",
+                Some(&computer),
+                Some(json!({ "id": pair_id(n) })),
+            )
+            .await;
+        assert_eq!(opened.status, StatusCode::CREATED);
+    }
+    let fourth = s
+        .call(
+            "POST",
+            "/v1/pairings",
+            Some(&computer),
+            Some(json!({ "id": pair_id(4) })),
+        )
+        .await;
+    assert_eq!(fourth.status, StatusCode::TOO_MANY_REQUESTS);
+
+    // Accepting before anyone joined has nothing to accept.
+    let early = s
+        .call(
+            "POST",
+            &format!("/v1/pairings/{}/accept", pair_id(1)),
+            Some(&computer),
+            Some(json!({ "daemon_pub": key('D'), "proof2": proof('d') })),
+        )
+        .await;
+    assert_eq!(early.status, StatusCode::NOT_FOUND);
+
+    // Cancelling frees the slot and kills the code.
+    let path = format!("/v1/pairings/{}", pair_id(1));
+    assert_eq!(
+        s.call("DELETE", &path, Some(&computer), None).await.status,
+        StatusCode::NO_CONTENT
+    );
+    assert_eq!(
+        s.call("DELETE", &path, Some(&computer), None).await.status,
+        StatusCode::NOT_FOUND
+    );
+    let join = s
+        .call(
+            "POST",
+            &format!("{path}/join"),
+            None,
+            Some(json!({ "phone_pub": key('P'), "device_name": "X", "proof": proof('p') })),
+        )
+        .await;
+    assert_eq!(join.status, StatusCode::GONE);
+    let fourth = s
+        .call(
+            "POST",
+            "/v1/pairings",
+            Some(&computer),
+            Some(json!({ "id": pair_id(4) })),
+        )
+        .await;
+    assert_eq!(fourth.status, StatusCode::CREATED);
+}
+
+#[tokio::test]
+async fn another_computer_cannot_see_or_accept_someone_elses_pairing() {
+    let s = server();
+    let a = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    s.clock.advance(61_000);
+    let b = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let id = pair_id(1);
+    s.call("POST", "/v1/pairings", Some(&a), Some(json!({ "id": id })))
+        .await;
+    s.call(
+        "POST",
+        &format!("/v1/pairings/{id}/join"),
+        None,
+        Some(json!({ "phone_pub": key('P'), "device_name": "X", "proof": proof('p') })),
+    )
+    .await;
+    let path = format!("/v1/pairings/{id}");
+    assert_eq!(
+        s.call("GET", &path, Some(&b), None).await.json()["status"],
+        "expired"
+    );
+    let accept = s
+        .call(
+            "POST",
+            &format!("{path}/accept"),
+            Some(&b),
+            Some(json!({ "daemon_pub": key('D'), "proof2": proof('d') })),
+        )
+        .await;
+    assert_eq!(accept.status, StatusCode::NOT_FOUND);
+    assert_eq!(
+        s.call("DELETE", &path, Some(&b), None).await.status,
+        StatusCode::NOT_FOUND
+    );
+}
+
+#[tokio::test]
+async fn removing_a_phone_or_its_computer_ends_the_tokens() {
+    let s = server();
+    let a = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    s.clock.advance(61_000);
+    let b = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let first = s.pair(&a, 1).await;
+    let second = s.pair(&a, 2).await;
+
+    // Disconnecting one phone from a computer leaves the other.
+    let gone = s
+        .authed("DELETE", &format!("/v1/devices/{}", first.device), &a)
+        .await;
+    assert_eq!(gone.status, StatusCode::NO_CONTENT);
+    assert_eq!(
+        s.authed("GET", "/v1/me", &first.token).await.status,
+        StatusCode::UNAUTHORIZED
+    );
+    assert_eq!(
+        s.authed("GET", "/v1/me", &second.token).await.status,
+        StatusCode::OK
+    );
+
+    // Removing the computer takes the phones that belong to it, not another computer.
+    let me = s.authed("GET", "/v1/me", &a).await.json();
+    let a_id = me["devices"]
+        .as_array()
+        .expect("devices")
+        .iter()
+        .find(|d| d["current"] == true)
+        .expect("this device")["id"]
+        .as_str()
+        .expect("id")
+        .to_owned();
+    let removed = s.authed("DELETE", &format!("/v1/devices/{a_id}"), &b).await;
+    assert_eq!(removed.status, StatusCode::NO_CONTENT);
+    assert_eq!(
+        s.authed("GET", "/v1/me", &a).await.status,
+        StatusCode::UNAUTHORIZED
+    );
+    assert_eq!(
+        s.authed("GET", "/v1/me", &second.token).await.status,
+        StatusCode::UNAUTHORIZED
+    );
+    assert_eq!(s.authed("GET", "/v1/me", &b).await.status, StatusCode::OK);
+}
+
+#[tokio::test]
+async fn deleting_the_account_takes_the_phones_too() {
+    let s = server();
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    assert_eq!(
+        s.authed("POST", "/v1/account/delete", &computer)
+            .await
+            .status,
+        StatusCode::ACCEPTED
+    );
+    let (_, code) = s.last_link();
+    assert_eq!(s.post_delete(&code).await.status, StatusCode::OK);
+    assert_eq!(
+        s.authed("GET", "/v1/me", &phone.token).await.status,
+        StatusCode::UNAUTHORIZED
+    );
+}
diff --git a/crates/botloft-cloud/tests/phone.rs b/crates/botloft-cloud/tests/phone.rs
new file mode 100644
index 00000000..92f96c07
--- /dev/null
+++ b/crates/botloft-cloud/tests/phone.rs
@@ -0,0 +1,128 @@
+//! The phone's page (spec 28.7): files from a folder, under a policy, and
+//! nothing outside it.
+
+mod common;
+
+use axum::http::{StatusCode, header};
+use common::{server, server_with};
+
+fn folder() -> tempfile::TempDir {
+    let dir = tempfile::tempdir().expect("dir");
+    std::fs::create_dir_all(dir.path().join("assets")).expect("assets");
+    std::fs::write(
+        dir.path().join("index.html"),
+        "<!doctype html><title>Botloft</title>",
+    )
+    .expect("index");
+    std::fs::write(dir.path().join("sw.js"), "// worker").expect("worker");
+    std::fs::write(dir.path().join("manifest.webmanifest"), "{}").expect("manifest");
+    std::fs::write(
+        dir.path().join("assets").join("index-abc123.js"),
+        "console.log(1)",
+    )
+    .expect("js");
+    std::fs::write(
+        dir.path().join("assets").join("font-abc123.woff2"),
+        [0u8, 1, 2],
+    )
+    .expect("font");
+    dir
+}
+
+fn header_of(reply: &common::Reply, name: header::HeaderName) -> String {
+    reply
+        .headers
+        .get(name)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default()
+        .to_owned()
+}
+
+#[tokio::test]
+async fn the_page_is_served_with_its_own_policy_and_the_right_caching() {
+    let dir = folder();
+    let path = dir.path().to_path_buf();
+    let s = server_with(|config| config.phone_dir = Some(path));
+
+    for address in ["/m", "/m/", "/m/some/screen"] {
+        let page = s.get(address).await;
+        assert_eq!(page.status, StatusCode::OK, "{address}");
+        assert!(page.body.contains("<title>Botloft</title>"));
+        assert_eq!(
+            header_of(&page, header::CONTENT_TYPE),
+            "text/html; charset=utf-8"
+        );
+        assert_eq!(header_of(&page, header::CACHE_CONTROL), "no-cache");
+        let policy = header_of(&page, header::CONTENT_SECURITY_POLICY);
+        assert!(policy.contains("default-src 'none'") && policy.contains("connect-src 'self'"));
+        assert!(!policy.contains("unsafe-inline") && !policy.contains("unsafe-eval"));
+        assert_eq!(header_of(&page, header::REFERRER_POLICY), "no-referrer");
+        assert_eq!(header_of(&page, header::X_CONTENT_TYPE_OPTIONS), "nosniff");
+    }
+
+    let script = s.get("/m/assets/index-abc123.js").await;
+    assert_eq!(
+        header_of(&script, header::CONTENT_TYPE),
+        "text/javascript; charset=utf-8"
+    );
+    assert_eq!(
+        header_of(&script, header::CACHE_CONTROL),
+        "public, max-age=31536000, immutable"
+    );
+    assert_eq!(
+        header_of(
+            &s.get("/m/assets/font-abc123.woff2").await,
+            header::CONTENT_TYPE
+        ),
+        "font/woff2"
+    );
+    // The worker and the manifest are looked at every time.
+    let worker = s.get("/m/sw.js").await;
+    assert_eq!(header_of(&worker, header::CACHE_CONTROL), "no-cache");
+    assert_eq!(
+        header_of(
+            &s.get("/m/manifest.webmanifest").await,
+            header::CONTENT_TYPE
+        ),
+        "application/manifest+json"
+    );
+    // A file that is not there is not the page.
+    assert_eq!(
+        s.get("/m/assets/nothing.js").await.status,
+        StatusCode::NOT_FOUND
+    );
+}
+
+#[tokio::test]
+async fn nothing_outside_the_folder_can_be_asked_for() {
+    let dir = folder();
+    let outside = dir.path().join("..").join("phone-test-secret.txt");
+    std::fs::write(&outside, "secret").expect("secret");
+    let path = dir.path().to_path_buf();
+    let s = server_with(|config| config.phone_dir = Some(path));
+    for address in [
+        "/m/../phone-test-secret.txt",
+        "/m/%2e%2e/phone-test-secret.txt",
+        "/m/assets/..%2f..%2fphone-test-secret.txt",
+        "/m/assets/%2e%2e/%2e%2e/phone-test-secret.txt",
+        "/m/..%5cphone-test-secret.txt",
+        "/m/C:/Windows/win.ini",
+    ] {
+        let reply = s.get(address).await;
+        assert!(!reply.body.contains("secret"), "{address}");
+        assert_ne!(reply.status, StatusCode::OK, "{address}");
+    }
+    std::fs::remove_file(outside).ok();
+}
+
+#[tokio::test]
+async fn without_a_folder_there_is_no_page() {
+    let s = server();
+    for address in ["/m", "/m/", "/m/assets/x.js", "/m/sw.js"] {
+        assert_eq!(
+            s.get(address).await.status,
+            StatusCode::NOT_FOUND,
+            "{address}"
+        );
+    }
+}
diff --git a/crates/botloft-cloud/tests/push.rs b/crates/botloft-cloud/tests/push.rs
new file mode 100644
index 00000000..224e94e6
--- /dev/null
+++ b/crates/botloft-cloud/tests/push.rs
@@ -0,0 +1,327 @@
+//! Web Push (spec 28.8): the phone says where to tell it, the computer says
+//! something waits, and the push service gets a signed call with nothing in it.
+
+mod common;
+
+use std::net::SocketAddr;
+use std::sync::atomic::{AtomicU16, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use axum::Router;
+use axum::body::Bytes;
+use axum::extract::State;
+use axum::http::{HeaderMap, StatusCode};
+use axum::routing::post;
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD as B64;
+use botloft_cloud::{Pusher, new_key};
+use common::mobile::Sock;
+use common::{Server, server, server_pushing};
+use p256::ecdsa::signature::Verifier;
+use p256::ecdsa::{Signature, VerifyingKey};
+use serde_json::{Value, json};
+
+struct Hit {
+    path: String,
+    authorization: String,
+    ttl: String,
+    body: usize,
+}
+
+type Hits = Arc<Mutex<Vec<Hit>>>;
+
+/// A push service that answers `status` and writes down what it was asked.
+async fn service(status: Arc<AtomicU16>) -> (SocketAddr, Hits) {
+    let hits = Hits::default();
+    async fn take(
+        State((hits, status)): State<(Hits, Arc<AtomicU16>)>,
+        uri: axum::http::Uri,
+        headers: HeaderMap,
+        body: Bytes,
+    ) -> StatusCode {
+        let text = |name: &str| {
+            headers
+                .get(name)
+                .and_then(|value| value.to_str().ok())
+                .unwrap_or_default()
+                .to_owned()
+        };
+        hits.lock().expect("hits").push(Hit {
+            path: uri.path().to_owned(),
+            authorization: text("authorization"),
+            ttl: text("ttl"),
+            body: body.len(),
+        });
+        StatusCode::from_u16(status.load(Ordering::SeqCst)).expect("status")
+    }
+    let app = Router::new()
+        .route("/{*any}", post(take))
+        .with_state((hits.clone(), status));
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind");
+    let address = listener.local_addr().expect("address");
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, app).await;
+    });
+    (address, hits)
+}
+
+fn pusher(gap_ms: u64) -> (Pusher, String) {
+    let (private, public) = new_key().expect("key");
+    let pusher = Pusher::new(
+        &private,
+        "mailto:ops@example.org",
+        &["127.0.0.1".to_owned()],
+        Duration::from_millis(gap_ms),
+    )
+    .expect("pusher");
+    (pusher, public)
+}
+
+async fn subscribe(s: &Server, token: &str, endpoint: &str) -> StatusCode {
+    s.call(
+        "POST",
+        "/v1/push/subscribe",
+        Some(token),
+        Some(json!({ "endpoint": endpoint })),
+    )
+    .await
+    .status
+}
+
+async fn until(what: &str, check: impl Fn() -> bool) {
+    for _ in 0..100 {
+        if check() {
+            return;
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    panic!("{what}");
+}
+
+#[tokio::test]
+async fn a_new_key_makes_a_pusher_and_the_public_half_is_a_p256_point() {
+    let (private, public) = new_key().expect("key");
+    assert_eq!(B64.decode(&public).expect("b64").len(), 65);
+    assert!(
+        public.starts_with('B'),
+        "an uncompressed point starts with 4"
+    );
+    assert!(Pusher::new(&private, "mailto:a@b.c", &[], Duration::from_secs(1)).is_ok());
+    assert!(Pusher::new("not a key", "mailto:a@b.c", &[], Duration::from_secs(1)).is_err());
+    assert!(
+        Pusher::new(
+            &B64.encode([0u8; 32]),
+            "mailto:a@b.c",
+            &[],
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+}
+
+#[tokio::test]
+async fn only_a_phone_subscribes_and_only_to_a_push_service_the_server_knows() {
+    let (address, _) = service(Arc::new(AtomicU16::new(201))).await;
+    let (pusher, public) = pusher(50);
+    let s = server_pushing(pusher);
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    let endpoint = format!("http://{address}/push/abc");
+
+    // The key a phone subscribes with is the server's public half.
+    let key = s.authed("GET", "/v1/push/key", &phone.token).await;
+    assert_eq!(key.json()["key"], public);
+    // A computer has nothing to do here.
+    assert_eq!(
+        s.authed("GET", "/v1/push/key", &computer).await.status,
+        StatusCode::FORBIDDEN
+    );
+    assert_eq!(
+        subscribe(&s, &computer, &endpoint).await,
+        StatusCode::FORBIDDEN
+    );
+
+    // The server calls only the services it was told to: not another address,
+    // not another scheme, not one with a password in it.
+    for bad in [
+        "https://evil.example.com/push/abc",
+        "ftp://127.0.0.1/push",
+        "http://evil.example.com/push",
+        "https://user:secret@127.0.0.1/push",
+        "https://127.0.0.1.evil.example.com/push",
+        "not an address",
+        "",
+    ] {
+        let reply = s
+            .call(
+                "POST",
+                "/v1/push/subscribe",
+                Some(&phone.token),
+                Some(json!({ "endpoint": bad })),
+            )
+            .await;
+        assert_eq!(reply.status, StatusCode::BAD_REQUEST, "{bad}");
+        assert_eq!(reply.json()["reason"], "bad_endpoint");
+    }
+    assert_eq!(
+        subscribe(&s, &phone.token, &endpoint).await,
+        StatusCode::NO_CONTENT
+    );
+    // The same phone again replaces it, and it can be taken back.
+    assert_eq!(
+        subscribe(&s, &phone.token, &endpoint).await,
+        StatusCode::NO_CONTENT
+    );
+    assert_eq!(
+        s.authed("DELETE", "/v1/push/subscribe", &phone.token)
+            .await
+            .status,
+        StatusCode::NO_CONTENT
+    );
+}
+
+#[tokio::test]
+async fn a_server_without_push_says_so_and_the_default_services_are_the_browsers() {
+    let s = server();
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    let key = s.authed("GET", "/v1/push/key", &phone.token).await;
+    assert_eq!(key.status, StatusCode::NOT_FOUND);
+    assert_eq!(key.json()["reason"], "no_push");
+    assert_eq!(
+        subscribe(&s, &phone.token, "https://fcm.googleapis.com/fcm/send/x").await,
+        StatusCode::NOT_FOUND
+    );
+
+    // With no list of its own, a pusher takes the browsers' services and not a local address.
+    let (private, _) = new_key().expect("key");
+    let browsers =
+        Pusher::new(&private, "mailto:a@b.c", &[], Duration::from_secs(1)).expect("pusher");
+    for good in [
+        "https://fcm.googleapis.com/fcm/send/abc",
+        "https://updates.push.services.mozilla.com/wpush/v2/abc",
+        "https://web.push.apple.com/abc",
+        "https://wns2-par02p.notify.windows.com/w/?token=abc",
+    ] {
+        assert!(browsers.allows(good), "{good}");
+    }
+    for bad in [
+        "http://fcm.googleapis.com/x",
+        "https://googleapis.com.evil.org/x",
+        "http://127.0.0.1:1/x",
+    ] {
+        assert!(!browsers.allows(bad), "{bad}");
+    }
+}
+
+#[tokio::test]
+async fn something_waiting_sends_the_phones_of_that_computer_a_signed_push_with_nothing_in_it() {
+    let (address, hits) = service(Arc::new(AtomicU16::new(201))).await;
+    let (pusher, public) = pusher(50);
+    let s = server_pushing(pusher);
+    let relay = s.listen().await;
+    let a = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    s.clock.advance(61_000);
+    let b = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let (phone_a, phone_a2, phone_b) = (
+        s.pair(&a, 1).await,
+        s.pair(&a, 2).await,
+        s.pair(&b, 3).await,
+    );
+    subscribe(&s, &phone_a.token, &format!("http://{address}/a")).await;
+    subscribe(&s, &phone_b.token, &format!("http://{address}/b")).await;
+    // phone_a2 never subscribed: it is simply not told.
+    let _ = &phone_a2;
+
+    let (mut pc_a, _) = Sock::ready(relay, &a).await;
+    pc_a.send(json!({ "t": "wake" })).await;
+    until("a push", || !hits.lock().expect("hits").is_empty()).await;
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    let seen = hits.lock().expect("hits");
+    assert_eq!(seen.len(), 1, "only computer A's subscribed phone");
+    let hit = &seen[0];
+    assert_eq!(hit.path, "/a");
+    assert_eq!((hit.ttl.as_str(), hit.body), ("3600", 0));
+
+    // The call is signed with the key the phones subscribed with.
+    let rest = hit
+        .authorization
+        .strip_prefix("vapid t=")
+        .expect("a vapid header");
+    let (jwt, k) = rest.split_once(", k=").expect("the key");
+    assert_eq!(k, public);
+    let parts: Vec<&str> = jwt.split('.').collect();
+    assert_eq!(parts.len(), 3);
+    let head: Value = serde_json::from_slice(&B64.decode(parts[0]).expect("head")).expect("json");
+    assert_eq!(head, json!({ "typ": "JWT", "alg": "ES256" }));
+    let claims: Value =
+        serde_json::from_slice(&B64.decode(parts[1]).expect("claims")).expect("json");
+    assert_eq!(claims["aud"], format!("http://{address}"));
+    assert_eq!(claims["sub"], "mailto:ops@example.org");
+    let now = i64::try_from(
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("time")
+            .as_secs(),
+    )
+    .expect("secs");
+    let exp = claims["exp"].as_i64().expect("exp");
+    assert!(
+        exp > now + 11 * 3600 && exp <= now + 13 * 3600,
+        "twelve hours"
+    );
+    let verifying = VerifyingKey::from_sec1_bytes(&B64.decode(k).expect("key")).expect("point");
+    let signature =
+        Signature::from_slice(&B64.decode(parts[2]).expect("signature")).expect("signature");
+    verifying
+        .verify(format!("{}.{}", parts[0], parts[1]).as_bytes(), &signature)
+        .expect("the signature is the server's");
+}
+
+#[tokio::test]
+async fn notices_that_come_close_together_are_one_now_and_one_at_the_end_of_the_wait() {
+    let (address, hits) = service(Arc::new(AtomicU16::new(201))).await;
+    let (pusher, _) = pusher(400);
+    let s = server_pushing(pusher);
+    let relay = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    subscribe(&s, &phone.token, &format!("http://{address}/a")).await;
+    let (mut pc, _) = Sock::ready(relay, &computer).await;
+
+    for _ in 0..5 {
+        pc.send(json!({ "t": "wake" })).await;
+    }
+    until("the first", || hits.lock().expect("hits").len() == 1).await;
+    // The four that followed wait and go as one.
+    tokio::time::sleep(Duration::from_millis(150)).await;
+    assert_eq!(hits.lock().expect("hits").len(), 1);
+    until("the second", || hits.lock().expect("hits").len() == 2).await;
+    tokio::time::sleep(Duration::from_millis(600)).await;
+    assert_eq!(hits.lock().expect("hits").len(), 2, "and no more");
+}
+
+#[tokio::test]
+async fn a_push_service_that_says_gone_loses_the_phone_s_address() {
+    let status = Arc::new(AtomicU16::new(410));
+    let (address, hits) = service(Arc::clone(&status)).await;
+    let (pusher, _) = pusher(50);
+    let s = server_pushing(pusher);
+    let relay = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    subscribe(&s, &phone.token, &format!("http://{address}/a")).await;
+    let (mut pc, _) = Sock::ready(relay, &computer).await;
+
+    pc.send(json!({ "t": "wake" })).await;
+    until("the push", || hits.lock().expect("hits").len() == 1).await;
+    tokio::time::sleep(Duration::from_millis(150)).await;
+    // It is not asked again, even when the service would now accept.
+    status.store(201, Ordering::SeqCst);
+    pc.send(json!({ "t": "wake" })).await;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(hits.lock().expect("hits").len(), 1);
+}
diff --git a/crates/botloft-cloud/tests/relay.rs b/crates/botloft-cloud/tests/relay.rs
new file mode 100644
index 00000000..82f29a54
--- /dev/null
+++ b/crates/botloft-cloud/tests/relay.rs
@@ -0,0 +1,359 @@
+//! The relay (spec 28.4): a real server on `127.0.0.1` and real sockets.
+
+mod common;
+
+use common::mobile::{Sock, key, pair_id, proof};
+use common::server;
+use serde_json::json;
+
+/// What a sealed message looks like to the server: text it must not touch.
+const SEALED: &str = "AAECAwQF+/8=?not-base64 {\"even\":\"json\"} \u{1f525}";
+
+#[tokio::test]
+async fn the_first_frame_must_be_a_valid_hello() {
+    let s = server();
+    let address = s.listen().await;
+
+    let mut wrong = Sock::open(address, "not-a-token").await;
+    assert_eq!(wrong.next().await["reason"], "unauthorized");
+    wrong.closed().await;
+
+    let mut silent = Sock::connect(address).await;
+    silent
+        .send(json!({ "t": "msg", "seq": 1, "body": "x" }))
+        .await;
+    silent.closed().await;
+
+    // A phone that disconnected has no way back in with the old token.
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    s.authed("POST", "/v1/logout", &phone.token).await;
+    let mut gone = Sock::open(address, &phone.token).await;
+    assert_eq!(gone.next().await["reason"], "unauthorized");
+}
+
+#[tokio::test]
+async fn a_phone_and_its_computer_talk_and_see_each_other_come_and_go() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+
+    let (mut pc, ready) = Sock::ready(address, &computer).await;
+    assert_eq!(ready["kind"], "computer");
+    assert_eq!(
+        ready["phones"],
+        json!([{ "id": phone.device, "online": false }])
+    );
+
+    let (mut mobile, ready) = Sock::ready(address, &phone.token).await;
+    assert_eq!(ready["kind"], "phone");
+    assert_eq!(ready["online"], true);
+    assert_eq!(
+        pc.next().await,
+        json!({ "t": "presence", "device": phone.device, "online": true })
+    );
+
+    // Each body arrives exactly as sent.
+    mobile
+        .send(json!({ "t": "msg", "seq": 1, "body": SEALED }))
+        .await;
+    assert_eq!(
+        pc.next().await,
+        json!({ "t": "msg", "from": phone.device, "seq": 1, "body": SEALED })
+    );
+    pc.send(json!({ "t": "msg", "to": phone.device, "seq": 1, "body": SEALED }))
+        .await;
+    assert_eq!(
+        mobile.next().await,
+        json!({ "t": "msg", "seq": 1, "body": SEALED })
+    );
+
+    // A computer cannot write to a device that is not one of its phones.
+    pc.send(json!({ "t": "msg", "to": "dev_nobody", "seq": 2, "body": "x" }))
+        .await;
+    let refused = pc.next().await;
+    assert_eq!(refused["reason"], "unknown_device");
+    assert_eq!(refused["seq"], 2);
+
+    drop(mobile);
+    assert_eq!(
+        pc.next().await,
+        json!({ "t": "presence", "device": phone.device, "online": false })
+    );
+    // And the phone sees the computer leave.
+    let (mut mobile, _) = Sock::ready(address, &phone.token).await;
+    pc.next().await;
+    drop(pc);
+    assert_eq!(
+        mobile.next().await,
+        json!({ "t": "presence", "device": ready_peer(&s, &computer).await, "online": false })
+    );
+}
+
+/// The id of the computer behind `token`.
+async fn ready_peer(s: &common::Server, token: &str) -> String {
+    let me = s.authed("GET", "/v1/me", token).await.json();
+    me["devices"]
+        .as_array()
+        .expect("devices")
+        .iter()
+        .find(|d| d["current"] == true)
+        .expect("this device")["id"]
+        .as_str()
+        .expect("id")
+        .to_owned()
+}
+
+#[tokio::test]
+async fn answers_wait_for_a_computer_that_is_away_until_it_acknowledges_them() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+
+    let (mut mobile, ready) = Sock::ready(address, &phone.token).await;
+    assert_eq!(ready["online"], false);
+    for seq in [1, 2, 3] {
+        mobile
+            .send(json!({ "t": "msg", "seq": seq, "body": format!("answer {seq}") }))
+            .await;
+    }
+    // The same seq again is not queued twice.
+    mobile
+        .send(json!({ "t": "msg", "seq": 2, "body": "answer 2" }))
+        .await;
+    mobile.sync().await;
+
+    // The computer comes back: ready, then everything, in order.
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    for seq in [1, 2, 3] {
+        let frame = pc.next().await;
+        assert_eq!(
+            (frame["seq"].as_i64(), frame["from"].as_str()),
+            (Some(seq), Some(phone.device.as_str()))
+        );
+        assert_eq!(frame["body"], format!("answer {seq}"));
+    }
+    pc.quiet().await;
+
+    // It takes up to 2; the next time only 3 is left.
+    pc.send(json!({ "t": "ack", "from": phone.device, "upto": 2 }))
+        .await;
+    pc.sync().await;
+    drop(pc);
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    let frame = pc.next().await;
+    assert_eq!(
+        (frame["seq"].as_i64(), frame["body"].as_str()),
+        (Some(3), Some("answer 3"))
+    );
+    pc.quiet().await;
+    pc.send(json!({ "t": "ack", "from": phone.device, "upto": 3 }))
+        .await;
+    pc.sync().await;
+    drop(pc);
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    pc.quiet().await;
+}
+
+#[tokio::test]
+async fn a_message_nobody_took_in_an_hour_is_dropped_and_the_queue_has_a_limit() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    let (mut mobile, _) = Sock::ready(address, &phone.token).await;
+
+    mobile
+        .send(json!({ "t": "msg", "seq": 1, "body": "old" }))
+        .await;
+    mobile.sync().await;
+    s.clock.advance(3_600_001);
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    pc.quiet().await;
+    drop(pc);
+
+    // Fifty wait, the fifty-first is told so, and an acknowledgement makes room.
+    for seq in 10..60 {
+        mobile
+            .send(json!({ "t": "msg", "seq": seq, "body": "x" }))
+            .await;
+    }
+    mobile
+        .send(json!({ "t": "msg", "seq": 60, "body": "x" }))
+        .await;
+    // (The computer coming and going above is told to the phone as presence.)
+    let mut full = mobile.next().await;
+    while full["t"] == "presence" {
+        full = mobile.next().await;
+    }
+    assert_eq!(
+        (full["reason"].as_str(), full["seq"].as_i64()),
+        (Some("queue_full"), Some(60))
+    );
+    s.clock.advance(61_000);
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    for _ in 10..60 {
+        pc.next().await;
+    }
+    pc.send(json!({ "t": "ack", "from": phone.device, "upto": 59 }))
+        .await;
+    pc.sync().await;
+    mobile
+        .send(json!({ "t": "msg", "seq": 61, "body": "room" }))
+        .await;
+    assert_eq!(pc.next().await["body"], "room");
+}
+
+#[tokio::test]
+async fn disconnecting_a_phone_closes_its_socket_and_tells_the_computer() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    let (mut mobile, _) = Sock::ready(address, &phone.token).await;
+    pc.next().await;
+
+    s.authed(
+        "DELETE",
+        &format!("/v1/devices/{}", phone.device),
+        &computer,
+    )
+    .await;
+    mobile.closed().await;
+    // The computer hears that the phone is revoked (and may see it go offline).
+    let mut frames = [pc.next().await, pc.next().await];
+    frames.sort_by_key(|frame| frame["t"].as_str().unwrap_or_default().to_owned());
+    assert_eq!(
+        frames[0],
+        json!({ "t": "presence", "device": phone.device, "online": false })
+    );
+    assert_eq!(frames[1], json!({ "t": "revoked", "device": phone.device }));
+    // The phone's own logout does the same.
+    let again = s.pair(&computer, 2).await;
+    let (mut second, _) = Sock::ready(address, &again.token).await;
+    pc.next().await;
+    s.authed("POST", "/v1/logout", &again.token).await;
+    second.closed().await;
+}
+
+#[tokio::test]
+async fn removing_a_computer_closes_it_and_its_phones() {
+    let s = server();
+    let address = s.listen().await;
+    let a = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    s.clock.advance(61_000);
+    let b = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&a, 1).await;
+    let (mut pc, _) = Sock::ready(address, &a).await;
+    let (mut mobile, _) = Sock::ready(address, &phone.token).await;
+    pc.next().await;
+
+    let a_id = ready_peer(&s, &a).await;
+    s.authed("DELETE", &format!("/v1/devices/{a_id}"), &b).await;
+    pc.closed().await;
+    mobile.closed().await;
+}
+
+#[tokio::test]
+async fn one_computers_phones_never_reach_another_computer() {
+    let s = server();
+    let address = s.listen().await;
+    let a = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    s.clock.advance(61_000);
+    let b = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone_a = s.pair(&a, 1).await;
+    let phone_b = s.pair(&b, 2).await;
+    let (mut pc_a, _) = Sock::ready(address, &a).await;
+    let (mut pc_b, _) = Sock::ready(address, &b).await;
+    let (mut mobile_a, _) = Sock::ready(address, &phone_a.token).await;
+    let (mut mobile_b, _) = Sock::ready(address, &phone_b.token).await;
+    pc_a.next().await;
+    pc_b.next().await;
+
+    mobile_b
+        .send(json!({ "t": "msg", "seq": 1, "body": "for b" }))
+        .await;
+    assert_eq!(pc_b.next().await["body"], "for b");
+    pc_a.quiet().await;
+
+    // Computer A cannot write to computer B's phone, even knowing its id.
+    pc_a.send(json!({ "t": "msg", "to": phone_b.device, "seq": 1, "body": "intruder" }))
+        .await;
+    assert_eq!(pc_a.next().await["reason"], "unknown_device");
+    mobile_b.quiet().await;
+    mobile_a.quiet().await;
+}
+
+#[tokio::test]
+async fn a_device_sends_sixty_frames_a_minute_and_a_second_socket_replaces_the_first() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let phone = s.pair(&computer, 1).await;
+    let (mut mobile, _) = Sock::ready(address, &phone.token).await;
+    for seq in 1..=60 {
+        mobile
+            .send(json!({ "t": "msg", "seq": seq, "body": "x" }))
+            .await;
+    }
+    mobile
+        .send(json!({ "t": "msg", "seq": 61, "body": "x" }))
+        .await;
+    // (Fifty queue; frames 51-60 are told the queue is full; the 61st the rate.)
+    let mut reasons = Vec::new();
+    for _ in 0..11 {
+        reasons.push(mobile.next().await["reason"].as_str().map(str::to_owned));
+    }
+    assert_eq!(reasons.last(), Some(&Some("rate_limited".to_owned())));
+    s.clock.advance(61_000);
+    mobile.sync().await;
+
+    let (mut again, _) = Sock::ready(address, &phone.token).await;
+    mobile.closed().await;
+    again.sync().await;
+}
+
+#[tokio::test]
+async fn the_computer_hears_the_phones_id_when_it_collects_its_token() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    let phone = s.pair(&computer, 3).await;
+    // The join came first, then the phone collected its token.
+    assert_eq!(
+        pc.next().await,
+        json!({ "t": "pairing", "id": phone.pairing })
+    );
+    assert_eq!(
+        pc.next().await,
+        json!({ "t": "paired", "pairing": phone.pairing, "device": phone.device })
+    );
+}
+
+#[tokio::test]
+async fn the_computer_hears_when_a_phone_joins() {
+    let s = server();
+    let address = s.listen().await;
+    let computer = s.sign_in("ana@exemplo.com", "1.1.1.1").await;
+    let (mut pc, _) = Sock::ready(address, &computer).await;
+    let id = pair_id(7);
+    s.call(
+        "POST",
+        "/v1/pairings",
+        Some(&computer),
+        Some(json!({ "id": id })),
+    )
+    .await;
+    s.call(
+        "POST",
+        &format!("/v1/pairings/{id}/join"),
+        None,
+        Some(json!({ "phone_pub": key('P'), "device_name": "X", "proof": proof('p') })),
+    )
+    .await;
+    assert_eq!(pc.next().await, json!({ "t": "pairing", "id": id }));
+}
diff --git a/crates/botloft-core/src/protocol/export.rs b/crates/botloft-core/src/protocol/export.rs
index 79c48c7c..2b75a830 100644
--- a/crates/botloft-core/src/protocol/export.rs
+++ b/crates/botloft-core/src/protocol/export.rs
@@ -28,6 +28,8 @@ mod crew_access;
 mod desktop;
 #[path = "export_mcp.rs"]
 mod mcp;
+#[path = "export_mobile.rs"]
+mod mobile;
 #[path = "export_questions.rs"]
 mod questions;
 #[path = "export_reactions.rs"]
@@ -197,6 +199,7 @@ fn export_bindings() {
     catalog::decls(&mut out);
     backup::decls(&mut out);
     cloud::decls(&mut out);
+    mobile::decls(&mut out);
     out.decl::<ApprovalItem>();
     usage::decls(&mut out);
     questions::decls(&mut out);
@@ -371,6 +374,7 @@ fn export_bindings() {
     catalog::methods(&mut out);
     backup::methods(&mut out);
     cloud::methods(&mut out);
+    mobile::methods(&mut out);
     routines::methods(&mut out);
     questions::methods(&mut out);
     reactions::methods(&mut out);
@@ -425,6 +429,7 @@ fn export_bindings() {
     desktop::notifications(&mut out);
     mcp::notifications(&mut out);
     cloud::notifications(&mut out);
+    mobile::notifications(&mut out);
     browser::notifications(&mut out);
     out.text.push_str("}\n\n");
 
diff --git a/crates/botloft-core/src/protocol/export_mobile.rs b/crates/botloft-core/src/protocol/export_mobile.rs
new file mode 100644
index 00000000..3a2660cf
--- /dev/null
+++ b/crates/botloft-core/src/protocol/export_mobile.rs
@@ -0,0 +1,67 @@
+//! The phone part of the TypeScript bindings (spec 28).
+
+use std::fmt::Write as _;
+
+use super::super::*;
+use super::Out;
+
+pub(super) fn decls(out: &mut Out) {
+    out.decl::<MobileRelay>();
+    out.decl::<MobilePhone>();
+    out.decl::<MobileJoined>();
+    out.decl::<MobilePairing>();
+    out.decl::<MobileStatus>();
+    out.decl::<MobilePairStarted>();
+    out.decl::<MobilePairIdParams>();
+    out.decl::<MobilePairConfirmParams>();
+    out.decl::<MobileRevokeParams>();
+    out.decl::<MobilePairRequest>();
+    out.decl::<CardBot>();
+    out.decl::<ApprovalCard>();
+    out.decl::<QuestionCard>();
+    out.decl::<ToPhone>();
+    out.decl::<FromPhone>();
+}
+
+pub(super) fn methods(out: &mut Out) {
+    out.method(
+        method::MOBILE_STATUS,
+        "undefined",
+        &out.name::<MobileStatus>(),
+    );
+    out.method(
+        method::MOBILE_PAIR_START,
+        "undefined",
+        &out.name::<MobilePairStarted>(),
+    );
+    out.method(
+        method::MOBILE_PAIR_CANCEL,
+        &out.name::<MobilePairIdParams>(),
+        "null",
+    );
+    out.method(
+        method::MOBILE_PAIR_CONFIRM,
+        &out.name::<MobilePairConfirmParams>(),
+        "null",
+    );
+    out.method(
+        method::MOBILE_REVOKE,
+        &out.name::<MobileRevokeParams>(),
+        &out.name::<MobileStatus>(),
+    );
+}
+
+pub(super) fn notifications(out: &mut Out) {
+    let changed = out.name::<MobileStatus>();
+    let _ = writeln!(
+        out.text,
+        "  \"{}\": {changed};",
+        notification::MOBILE_CHANGED
+    );
+    let request = out.name::<MobilePairRequest>();
+    let _ = writeln!(
+        out.text,
+        "  \"{}\": {request};",
+        notification::MOBILE_PAIR_REQUEST
+    );
+}
diff --git a/crates/botloft-core/src/protocol/mobile.rs b/crates/botloft-core/src/protocol/mobile.rs
new file mode 100644
index 00000000..7357c07f
--- /dev/null
+++ b/crates/botloft-core/src/protocol/mobile.rs
@@ -0,0 +1,262 @@
+//! The phone (spec 28): the `mobile.*` methods the app calls, and the sealed
+//! messages that cross the relay between the computer and the phone (28.3).
+
+use serde::{Deserialize, Serialize};
+
+use crate::ids::{ApprovalId, QuestionId};
+use crate::protocol::{ApprovalStatus, QuestionStatus};
+
+/// Whether the computer's connection to the relay is up.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub enum MobileRelay {
+    /// No phone is connected and none is being: nothing is open.
+    Off,
+    Connecting,
+    Connected,
+}
+
+/// A phone the owner connected.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobilePhone {
+    pub id: String,
+    pub name: String,
+    /// Unix time in milliseconds.
+    pub paired_at: i64,
+    /// When the phone last sent anything, in Unix milliseconds.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(test, ts(optional))]
+    pub last_seen_at: Option<i64>,
+    pub online: bool,
+}
+
+/// A phone that opened the QR code and waits for the owner to compare the
+/// code and accept it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobileJoined {
+    pub name: String,
+    /// Six digits, the same on the phone's screen.
+    pub code: String,
+}
+
+/// A QR code on screen.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobilePairing {
+    pub pair_id: String,
+    /// Unix time in milliseconds the code stops working.
+    pub expires_at: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(test, ts(optional))]
+    pub joined: Option<MobileJoined>,
+}
+
+/// `mobile.status`, and the `mobile.changed` notification.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobileStatus {
+    pub relay: MobileRelay,
+    pub phones: Vec<MobilePhone>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(test, ts(optional))]
+    pub pending: Option<MobilePairing>,
+}
+
+/// `mobile.pair_start`: what the QR code carries.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobilePairStarted {
+    pub pair_id: String,
+    /// The address the QR code holds, `#` and all.
+    pub url: String,
+    /// Seconds the code works.
+    pub expires_in: u32,
+}
+
+/// `mobile.pair_cancel`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobilePairIdParams {
+    pub pair_id: String,
+}
+
+/// `mobile.pair_confirm`: the owner compared the codes.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobilePairConfirmParams {
+    pub pair_id: String,
+    pub accept: bool,
+}
+
+/// `mobile.revoke`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobileRevokeParams {
+    pub phone_id: String,
+}
+
+/// The `mobile.pair_request` notification: a phone opened the code.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct MobilePairRequest {
+    pub pair_id: String,
+    pub name: String,
+    pub code: String,
+}
+
+/// The bot that asks, as the phone shows it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct CardBot {
+    pub name: String,
+    pub color: String,
+}
+
+/// A request waiting for the owner, as the phone shows it (spec 28.5). It
+/// carries what the owner needs to decide, and nothing else of the bot.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct ApprovalCard {
+    pub approval_id: ApprovalId,
+    pub bot: CardBot,
+    pub crew: String,
+    /// Unix time in milliseconds.
+    pub created_at: i64,
+    pub tool_name: String,
+    pub summary: String,
+    /// What the bot says the command is for; the bot wrote it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(test, ts(optional))]
+    pub explanation: Option<String>,
+    /// The command, the plan or the request, whole unless `cut`.
+    pub text: String,
+    /// `text` is not the whole request: the phone may only deny it.
+    pub cut: bool,
+    /// The request is of a kind that is answered at the computer: the phone
+    /// may only deny it.
+    pub at_computer: bool,
+}
+
+/// A question waiting for the owner, as the phone shows it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub struct QuestionCard {
+    pub question_id: QuestionId,
+    pub bot: CardBot,
+    pub crew: String,
+    pub created_at: i64,
+    pub text: String,
+    pub options: Vec<String>,
+}
+
+/// What the computer sends the phone, sealed (spec 28.3).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "t", rename_all_fields = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub enum ToPhone {
+    /// What is waiting right now: the answer to `sync`.
+    #[serde(rename = "snapshot")]
+    Snapshot {
+        approvals: Vec<ApprovalCard>,
+        questions: Vec<QuestionCard>,
+    },
+    #[serde(rename = "approval.open")]
+    ApprovalOpen { card: ApprovalCard },
+    /// It was answered (at the computer or here) or ran out.
+    #[serde(rename = "approval.closed")]
+    ApprovalClosed {
+        approval_id: ApprovalId,
+        status: ApprovalStatus,
+    },
+    #[serde(rename = "question.open")]
+    QuestionOpen { card: QuestionCard },
+    #[serde(rename = "question.closed")]
+    QuestionClosed {
+        question_id: QuestionId,
+        status: QuestionStatus,
+    },
+}
+
+/// What the phone sends the computer, sealed (spec 28.3).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "t", rename_all_fields = "camelCase")]
+#[cfg_attr(test, derive(ts_rs::TS))]
+pub enum FromPhone {
+    /// Asks for the `snapshot`.
+    #[serde(rename = "sync")]
+    Sync,
+    #[serde(rename = "approval.answer")]
+    ApprovalAnswer {
+        approval_id: ApprovalId,
+        allow: bool,
+        #[serde(default)]
+        #[cfg_attr(test, ts(optional))]
+        note: Option<String>,
+    },
+    #[serde(rename = "question.answer")]
+    QuestionAnswer {
+        question_id: QuestionId,
+        answer: String,
+    },
+    #[serde(rename = "question.dismiss")]
+    QuestionDismiss { question_id: QuestionId },
+}
+
+/// The biggest `text` a card carries, in bytes (spec 28.5).
+pub const CARD_TEXT_MAX: usize = 8 * 1024;
+/// The biggest sealed message either way, in bytes of JSON.
+pub const SEALED_MAX: usize = 16 * 1024;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_sealed_messages_have_the_shape_the_phone_reads() {
+        let sync = serde_json::to_value(FromPhone::Sync).expect("json");
+        assert_eq!(sync, serde_json::json!({ "t": "sync" }));
+        let id = QuestionId::generate();
+        let dismiss = serde_json::to_value(FromPhone::QuestionDismiss {
+            question_id: id.clone(),
+        })
+        .expect("json");
+        assert_eq!(
+            dismiss,
+            serde_json::json!({ "t": "question.dismiss", "questionId": id })
+        );
+        let back: FromPhone = serde_json::from_value(serde_json::json!({
+            "t": "approval.answer", "approvalId": ApprovalId::generate(), "allow": true,
+        }))
+        .expect("an answer without a note");
+        assert!(matches!(
+            back,
+            FromPhone::ApprovalAnswer {
+                allow: true,
+                note: None,
+                ..
+            }
+        ));
+        let closed = serde_json::to_value(ToPhone::QuestionClosed {
+            question_id: id,
+            status: QuestionStatus::Answered,
+        })
+        .expect("json");
+        assert_eq!(closed["t"], "question.closed");
+        assert_eq!(closed["status"], "answered");
+    }
+}
diff --git a/crates/botloft-core/src/protocol/mod.rs b/crates/botloft-core/src/protocol/mod.rs
index 725f6cf1..07b581ac 100644
--- a/crates/botloft-core/src/protocol/mod.rs
+++ b/crates/botloft-core/src/protocol/mod.rs
@@ -64,6 +64,7 @@ mod lesson;
 mod mcp;
 mod messaging;
 mod methods;
+mod mobile;
 mod model;
 mod questions;
 mod reactions;
@@ -88,6 +89,7 @@ pub use lesson::*;
 pub use mcp::*;
 pub use messaging::*;
 pub use methods::*;
+pub use mobile::*;
 pub use model::*;
 pub use questions::*;
 pub use reactions::*;
@@ -154,6 +156,11 @@ pub mod method {
     pub const AUTOBACKUP_ENABLE: &str = "autobackup.enable";
     pub const AUTOBACKUP_SET_EVERY: &str = "autobackup.set_every";
     pub const AUTOBACKUP_DISABLE: &str = "autobackup.disable";
+    pub const MOBILE_STATUS: &str = "mobile.status";
+    pub const MOBILE_PAIR_START: &str = "mobile.pair_start";
+    pub const MOBILE_PAIR_CANCEL: &str = "mobile.pair_cancel";
+    pub const MOBILE_PAIR_CONFIRM: &str = "mobile.pair_confirm";
+    pub const MOBILE_REVOKE: &str = "mobile.revoke";
     pub const CREW_ACCESS_LIST: &str = "crewAccess.list";
     pub const CREW_ACCESS_REVOKE: &str = "crewAccess.revoke";
     pub const MCP_SERVERS: &str = "mcp.servers";
@@ -247,6 +254,8 @@ pub mod notification {
     pub const CLOUD_PROGRESS: &str = "cloud.progress";
     pub const CLOUD_SIGNIN_EXPIRED: &str = "cloud.signin_expired";
     pub const AUTOBACKUP_CHANGED: &str = "autobackup.changed";
+    pub const MOBILE_CHANGED: &str = "mobile.changed";
+    pub const MOBILE_PAIR_REQUEST: &str = "mobile.pair_request";
 }
 
 /// Error codes: the standard JSON-RPC ones plus the daemon's (spec 11.4).
diff --git a/crates/botloftd/Cargo.toml b/crates/botloftd/Cargo.toml
index 3ecf518b..822c7d1c 100644
--- a/crates/botloftd/Cargo.toml
+++ b/crates/botloftd/Cargo.toml
@@ -9,6 +9,7 @@ authors.workspace = true
 
 [dependencies]
 anyhow = "1.0.104"
+aes-gcm = "0.11.1"
 argon2 = "0.5"
 axum = { version = "0.8.9", features = ["ws"] }
 base64 = "0.23.1"
@@ -23,13 +24,14 @@ getrandom = "0.4.3"
 hex = "0.4.3"
 jiff = "0.2.37"
 jpeg-encoder = "0.7.1"
+p256 = { version = "0.14.0", default-features = false, features = ["ecdh", "arithmetic", "alloc"] }
 reqwest = { version = "0.13.5", default-features = false, features = ["rustls", "json", "stream"] }
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 sha2 = "0.11.0"
 thiserror = "2.0.21"
 tokio = { version = "1.53.1", features = ["rt-multi-thread", "macros", "net", "io-util", "sync", "signal", "time"] }
-tokio-tungstenite = "0.30.0"
+tokio-tungstenite = { version = "0.30.0", features = ["rustls-tls-webpki-roots"] }
 toml = "1.1.6"
 toml_edit = "0.25.15"
 tracing = "0.1.44"
diff --git a/crates/botloftd/src/cloud/client.rs b/crates/botloftd/src/cloud/client.rs
index 022f85ed..9ade5f11 100644
--- a/crates/botloftd/src/cloud/client.rs
+++ b/crates/botloftd/src/cloud/client.rs
@@ -11,7 +11,7 @@ use serde_json::{Value, json};
 use super::CloudError;
 
 /// Small calls give up after this; transfers only when they go quiet.
-const CALL: Duration = Duration::from_secs(30);
+pub(super) const CALL: Duration = Duration::from_secs(30);
 const QUIET: Duration = Duration::from_secs(60);
 
 pub struct Server {
@@ -90,7 +90,7 @@ impl Server {
         })
     }
 
-    async fn json(&self, request: RequestBuilder) -> Result<Value, CloudError> {
+    pub(super) async fn json(&self, request: RequestBuilder) -> Result<Value, CloudError> {
         let response = self.send(request.timeout(CALL)).await?;
         response
             .json()
diff --git a/crates/botloftd/src/cloud/mod.rs b/crates/botloftd/src/cloud/mod.rs
index 2b7c01a0..98216747 100644
--- a/crates/botloftd/src/cloud/mod.rs
+++ b/crates/botloftd/src/cloud/mod.rs
@@ -4,6 +4,7 @@
 
 mod client;
 mod creds;
+mod pairing;
 pub(crate) mod signin;
 mod transfer;
 
@@ -15,6 +16,7 @@ use tokio::task::AbortHandle;
 
 pub use client::{Me, Server};
 pub use creds::Credentials;
+pub use pairing::Seen;
 pub use transfer::{Progress, download, upload};
 
 use crate::config::Config;
@@ -28,6 +30,8 @@ pub struct CloudSettings {
     pub poll: Duration,
     /// How often the automatic backup looks whether its time has come.
     pub auto_tick: Duration,
+    /// How soon the phone relay tries again after losing the server.
+    pub relay_retry: crate::mobile::Retry,
 }
 
 impl Default for CloudSettings {
@@ -36,6 +40,7 @@ impl Default for CloudSettings {
             url: String::new(),
             poll: Duration::from_secs(2),
             auto_tick: crate::autobackup::DEFAULT_TICK,
+            relay_retry: crate::mobile::Retry::default(),
         }
     }
 }
@@ -46,6 +51,7 @@ impl CloudSettings {
             url: config.cloud.url.trim().to_owned(),
             poll: Duration::from_millis(config.cloud.poll_ms),
             auto_tick: crate::autobackup::DEFAULT_TICK,
+            relay_retry: crate::mobile::Retry::default(),
         }
     }
 }
@@ -88,7 +94,7 @@ impl CloudError {
 
     /// The server's own `reason`; one this build does not know stays generic.
     pub(crate) fn from_server(reason: &str, message: String) -> Self {
-        const KNOWN: [&str; 11] = [
+        const KNOWN: [&str; 14] = [
             "unauthorized",
             "not_found",
             "bad_email",
@@ -100,6 +106,9 @@ impl CloudError {
             "too_big",
             "quota",
             "bad_range",
+            "wrong_device",
+            "bad_pairing",
+            "pair_expired",
         ];
         Self {
             reason: KNOWN
diff --git a/crates/botloftd/src/cloud/pairing.rs b/crates/botloftd/src/cloud/pairing.rs
new file mode 100644
index 00000000..acfe0065
--- /dev/null
+++ b/crates/botloftd/src/cloud/pairing.rs
@@ -0,0 +1,123 @@
+//! The server's calls for connecting a phone (spec 28.3) and the address of
+//! its relay (28.4). One call each; the pairing's meaning is in `mobile`.
+
+use serde_json::json;
+
+use super::CloudError;
+use super::client::{CALL, Server};
+
+/// What the computer finds when it looks at its pairing.
+pub enum Seen {
+    Waiting,
+    Joined {
+        name: String,
+        phone_pub: String,
+        proof: String,
+    },
+    /// Unknown, expired or cancelled.
+    Gone,
+}
+
+impl Server {
+    /// The relay's WebSocket address: `https` becomes `wss`.
+    pub fn relay_url(&self) -> String {
+        let url = self.url("/v1/relay");
+        match url.strip_prefix("https://") {
+            Some(rest) => format!("wss://{rest}"),
+            None => url.replacen("http://", "ws://", 1),
+        }
+    }
+
+    /// The address a phone's QR code opens (the part after `#` is added by
+    /// the caller).
+    pub fn phone_page(&self) -> String {
+        self.url("/m")
+    }
+
+    /// Opens a pairing for the QR code. The server's `expires_in` is seconds.
+    pub async fn open_pairing(&self, token: &str, id: &str) -> Result<u32, CloudError> {
+        let answer = self
+            .json(
+                self.http
+                    .post(self.url("/v1/pairings"))
+                    .bearer_auth(token)
+                    .json(&json!({ "id": id })),
+            )
+            .await?;
+        Ok(answer["expires_in"].as_u64().unwrap_or(300) as u32)
+    }
+
+    pub async fn pairing(&self, token: &str, id: &str) -> Result<Seen, CloudError> {
+        let answer = self
+            .json(
+                self.http
+                    .get(self.url(&format!("/v1/pairings/{id}")))
+                    .bearer_auth(token),
+            )
+            .await?;
+        let field = |key: &str| answer[key].as_str().map(str::to_owned);
+        Ok(match answer["status"].as_str() {
+            Some("waiting") => Seen::Waiting,
+            Some("joined") => match (field("phone_pub"), field("proof")) {
+                (Some(phone_pub), Some(proof)) => Seen::Joined {
+                    name: field("device_name").unwrap_or_default(),
+                    phone_pub,
+                    proof,
+                },
+                _ => Seen::Gone,
+            },
+            _ => Seen::Gone,
+        })
+    }
+
+    pub async fn accept_pairing(
+        &self,
+        token: &str,
+        id: &str,
+        daemon_pub: &str,
+        proof2: &str,
+    ) -> Result<(), CloudError> {
+        self.send(
+            self.http
+                .post(self.url(&format!("/v1/pairings/{id}/accept")))
+                .bearer_auth(token)
+                .json(&json!({ "daemon_pub": daemon_pub, "proof2": proof2 }))
+                .timeout(CALL),
+        )
+        .await
+        .map(|_| ())
+    }
+
+    /// Cancels, or refuses the phone that joined. A pairing that is already
+    /// gone is not a problem.
+    pub async fn cancel_pairing(&self, token: &str, id: &str) -> Result<(), CloudError> {
+        let result = self
+            .send(
+                self.http
+                    .delete(self.url(&format!("/v1/pairings/{id}")))
+                    .bearer_auth(token)
+                    .timeout(CALL),
+            )
+            .await;
+        match result {
+            Err(err) if err.reason == "not_found" => Ok(()),
+            other => other.map(|_| ()),
+        }
+    }
+
+    /// Takes a device (a phone, here) off the account. Already gone is fine.
+    pub async fn remove_device(&self, token: &str, id: &str) -> Result<(), CloudError> {
+        let result = self
+            .send(
+                self.http
+                    .delete(self.url(&format!("/v1/devices/{id}")))
+                    .bearer_auth(token)
+                    .timeout(CALL),
+            )
+            .await;
+        match result {
+            Err(err) if err.reason == "not_found" => Ok(()),
+            other => other.map(|_| ()),
+        }
+    }
+}
diff --git a/crates/botloftd/src/lib.rs b/crates/botloftd/src/lib.rs
index a18a9061..863cc9d1 100644
--- a/crates/botloftd/src/lib.rs
+++ b/crates/botloftd/src/lib.rs
@@ -18,6 +18,7 @@ pub mod desktop;
 pub mod keep_awake;
 pub mod logging;
 pub mod mcp_secrets;
+pub mod mobile;
 pub mod paths;
 pub mod platform;
 pub mod routines;
diff --git a/crates/botloftd/src/main.rs b/crates/botloftd/src/main.rs
index 7f6318f0..20f835dd 100644
--- a/crates/botloftd/src/main.rs
+++ b/crates/botloftd/src/main.rs
@@ -172,6 +172,7 @@ fn run(paths: Paths, config: Config, config_path: PathBuf, scheduled: bool) -> a
         tokio::spawn(courier::run(Arc::clone(&daemon)));
         tokio::spawn(routines::run(Arc::clone(&daemon)));
         tokio::spawn(botloftd::autobackup::run(Arc::clone(&daemon)));
+        tokio::spawn(botloftd::mobile::run(Arc::clone(&daemon)));
         tokio::spawn(browser::run(Arc::clone(&daemon)));
         // The outline around the window a bot uses (spec 24.9).
         tokio::spawn(botloftd::desktop::outline::run(Arc::clone(&daemon)));
diff --git a/crates/botloftd/src/mobile/bridge.rs b/crates/botloftd/src/mobile/bridge.rs
new file mode 100644
index 00000000..523763f9
--- /dev/null
+++ b/crates/botloftd/src/mobile/bridge.rs
@@ -0,0 +1,301 @@
+//! Between the phone and the owner's own flows (spec 28.5): what happens in
+//! the chat and the question box reaches the phone as a card, and what the
+//! phone answers goes through the same code as the app's answer, with a few
+//! more rules.
+
+use std::sync::Arc;
+
+use botloft_core::ids::{ApprovalId, QuestionId};
+use botloft_core::protocol::{
+    ApprovalStatus, ApprovalsAnswerParams, ChatBody, FromPhone, QuestionIdParams, QuestionStatus,
+    QuestionsAnswerParams, SEALED_MAX, ToPhone,
+};
+use serde_json::json;
+use tracing::{debug, warn};
+
+use super::cards;
+use super::seal::{self, Dir};
+use super::{Mobile, identity};
+use crate::approvals;
+use crate::service::questions;
+use crate::state::{Daemon, Event};
+
+/// How much of a snapshot's cards go in one message: the rest follow as
+/// cards of their own.
+const SNAPSHOT_ROOM: usize = SEALED_MAX - 1024;
+
+impl Mobile {
+    /// Something happened in the owner's chat or question box: the phones
+    /// that are on hear of it. Phones that are not ask when they open.
+    pub(crate) fn on_event(&self, daemon: &Daemon, event: &Event) {
+        let message = match event {
+            Event::ChatItem(change) => match &change.item.body {
+                ChatBody::Approval(shown) if shown.status == ApprovalStatus::Pending => {
+                    cards::approval_card(daemon, &change.item, shown)
+                        .map(|card| ToPhone::ApprovalOpen { card })
+                }
+                ChatBody::Approval(shown) => Some(ToPhone::ApprovalClosed {
+                    approval_id: shown.approval_id.clone(),
+                    status: shown.status,
+                }),
+                _ => None,
+            },
+            Event::QuestionChanged(question) if question.status == QuestionStatus::Open => {
+                cards::question_card(daemon, question).map(|card| ToPhone::QuestionOpen { card })
+            }
+            Event::QuestionChanged(question) => Some(ToPhone::QuestionClosed {
+                question_id: question.id.clone(),
+                status: question.status,
+            }),
+            _ => None,
+        };
+        let Some(message) = message else {
+            return;
+        };
+        for phone in self.online_phones(daemon) {
+            self.send_to(daemon, &phone.id, &message);
+        }
+        // The server may wake phones that are not on (spec 28.8).
+        if matches!(
+            message,
+            ToPhone::ApprovalOpen { .. } | ToPhone::QuestionOpen { .. }
+        ) {
+            self.send_frame(&json!({ "t": "wake" }));
+        }
+    }
+
+    /// Sends `phone` what is waiting right now.
+    fn snapshot(&self, daemon: &Daemon, phone: &str) {
+        let (approvals, questions) = cards::waiting(daemon);
+        let mut room = SNAPSHOT_ROOM;
+        let mut fits = |size: usize| {
+            if size <= room {
+                room -= size;
+                true
+            } else {
+                false
+            }
+        };
+        let (mut first_approvals, mut later_approvals) = (Vec::new(), Vec::new());
+        for card in approvals {
+            let size = serde_json::to_vec(&card).map_or(usize::MAX, |bytes| bytes.len());
+            if later_approvals.is_empty() && fits(size) {
+                first_approvals.push(card);
+            } else {
+                later_approvals.push(card);
+            }
+        }
+        let (mut first_questions, mut later_questions) = (Vec::new(), Vec::new());
+        for card in questions {
+            let size = serde_json::to_vec(&card).map_or(usize::MAX, |bytes| bytes.len());
+            if later_questions.is_empty() && fits(size) {
+                first_questions.push(card);
+            } else {
+                later_questions.push(card);
+            }
+        }
+        self.send_to(
+            daemon,
+            phone,
+            &ToPhone::Snapshot {
+                approvals: first_approvals,
+                questions: first_questions,
+            },
+        );
+        for card in later_approvals {
+            self.send_to(daemon, phone, &ToPhone::ApprovalOpen { card });
+        }
+        for card in later_questions {
+            self.send_to(daemon, phone, &ToPhone::QuestionOpen { card });
+        }
+    }
+
+    /// A message from a phone came through the relay: opens it, and acts on
+    /// it if it is new. The relay is told it was taken either way, so what
+    /// does not open is not sent again.
+    pub(crate) async fn receive(
+        &self,
+        daemon: &Arc<Daemon>,
+        from: &str,
+        frame_seq: u64,
+        body: &str,
+    ) {
+        let ack = || self.send_frame(&json!({ "t": "ack", "from": from, "upto": frame_seq }));
+        let Ok((_, credentials)) = identity(daemon) else {
+            return;
+        };
+        let known = self.phones.get(&credentials.url, &credentials.device, from);
+        let Some((phone, keys)) = known.and_then(|phone| phone.keys().map(|keys| (phone, keys)))
+        else {
+            ack();
+            return;
+        };
+        let Ok((seq, plain)) = seal::open(&keys.p2c, Dir::PhoneToComputer, from, body) else {
+            warn!("a message from a phone did not open and was dropped");
+            ack();
+            return;
+        };
+        // The same message again (the relay repeats what it was not told
+        // about), or an old one sent back.
+        if seq != frame_seq || seq <= phone.received {
+            ack();
+            return;
+        }
+        let now = daemon.clock.now_ms();
+        let saved = self
+            .phones
+            .update(&credentials.url, &credentials.device, from, |phone| {
+                phone.received = seq;
+                phone.last_seen_at = Some(now);
+            });
+        if !matches!(saved, Ok(true)) {
+            return;
+        }
+        ack();
+        let Ok(message) = serde_json::from_slice::<FromPhone>(&plain) else {
+            debug!("a phone sent something this version does not know");
+            return;
+        };
+        self.apply(daemon, from, message).await;
+    }
+
+    async fn apply(&self, daemon: &Arc<Daemon>, phone: &str, message: FromPhone) {
+        match message {
+            FromPhone::Sync => self.snapshot(daemon, phone),
+            FromPhone::ApprovalAnswer {
+                approval_id,
+                allow,
+                note,
+            } => {
+                if self.may_answer(daemon, phone) {
+                    self.answer_approval(daemon, phone, approval_id, allow, note)
+                        .await;
+                }
+            }
+            FromPhone::QuestionAnswer {
+                question_id,
+                answer,
+            } => {
+                if self.may_answer(daemon, phone) {
+                    let params = QuestionsAnswerParams {
+                        question_id: question_id.clone(),
+                        answer,
+                    };
+                    let done = blocking(daemon, move |daemon| {
+                        questions::answer(daemon, params).is_ok()
+                    })
+                    .await;
+                    if !done {
+                        self.say_question_is_closed(daemon, phone, &question_id);
+                    }
+                }
+            }
+            FromPhone::QuestionDismiss { question_id } => {
+                if self.may_answer(daemon, phone) {
+                    let params = QuestionIdParams {
+                        question_id: question_id.clone(),
+                    };
+                    let done = blocking(daemon, move |daemon| {
+                        questions::dismiss(daemon, params).is_ok()
+                    })
+                    .await;
+                    if !done {
+                        self.say_question_is_closed(daemon, phone, &question_id);
+                    }
+                }
+            }
+        }
+    }
+
+    async fn answer_approval(
+        &self,
+        daemon: &Arc<Daemon>,
+        phone: &str,
+        id: ApprovalId,
+        allow: bool,
+        note: Option<String>,
+    ) {
+        let Some((item, shown)) = cards::approval_item(daemon, &id) else {
+            return;
+        };
+        if shown.status != ApprovalStatus::Pending {
+            self.send_to(
+                daemon,
+                phone,
+                &ToPhone::ApprovalClosed {
+                    approval_id: id,
+                    status: shown.status,
+                },
+            );
+            return;
+        }
+        // The phone allows only what it showed whole and plain (28.5).
+        if allow {
+            let card = cards::approval_card(daemon, &item, &shown);
+            if card
+                .as_ref()
+                .is_none_or(|card| card.cut || card.at_computer)
+            {
+                warn!("a phone tried to allow a request that is answered at the computer");
+                if let Some(card) = card {
+                    self.send_to(daemon, phone, &ToPhone::ApprovalOpen { card });
+                }
+                return;
+            }
+        }
+        let params = ApprovalsAnswerParams {
+            approval_id: id.clone(),
+            allow,
+            note: note.map(|note| note.chars().take(500).collect()),
+            input: None,
+            always: None,
+        };
+        let done = blocking(daemon, move |daemon| {
+            approvals::answer(daemon, params).is_ok()
+        })
+        .await;
+        if !done {
+            let status = cards::approval_item(daemon, &id).map(|(_, shown)| shown.status);
+            if let Some(status) = status.filter(|status| *status != ApprovalStatus::Pending) {
+                self.send_to(
+                    daemon,
+                    phone,
+                    &ToPhone::ApprovalClosed {
+                        approval_id: id,
+                        status,
+                    },
+                );
+            }
+        }
+    }
+
+    fn say_question_is_closed(&self, daemon: &Daemon, phone: &str, id: &QuestionId) {
+        let status = daemon
+            .store()
+            .question(id)
+            .ok()
+            .flatten()
+            .map(|record| record.question.status);
+        if let Some(status) = status.filter(|status| *status != QuestionStatus::Open) {
+            self.send_to(
+                daemon,
+                phone,
+                &ToPhone::QuestionClosed {
+                    question_id: id.clone(),
+                    status,
+                },
+            );
+        }
+    }
+}
+
+/// Runs a service call where the store may be waited for.
+async fn blocking(
+    daemon: &Arc<Daemon>,
+    work: impl FnOnce(&Daemon) -> bool + Send + 'static,
+) -> bool {
+    let daemon = Arc::clone(daemon);
+    tokio::task::spawn_blocking(move || work(&daemon))
+        .await
+        .unwrap_or(false)
+}
diff --git a/crates/botloftd/src/mobile/cards.rs b/crates/botloftd/src/mobile/cards.rs
new file mode 100644
index 00000000..397476f4
--- /dev/null
+++ b/crates/botloftd/src/mobile/cards.rs
@@ -0,0 +1,207 @@
+//! What the phone is shown (spec 28.5): a card for each request and question
+//! that waits, with only what the owner needs to decide.
+
+use botloft_core::chat::PLAN_TOOL;
+use botloft_core::ids::ApprovalId;
+use botloft_core::protocol::{
+    ApprovalCard, ApprovalItem, ApprovalStatus, CARD_TEXT_MAX, CardBot, ChatBody, ChatItem,
+    Question, QuestionCard, QuestionStatus,
+};
+use serde_json::Value;
+use tracing::warn;
+
+use crate::state::Daemon;
+
+/// The tools the phone may allow: the ones Claude Code asks about in a
+/// plain way, which change nothing that lasts. Everything else (a bot or
+/// routine suggestion, reaching another crew, the desktop, the browser in
+/// hand, connected tools) is answered at the computer, and the phone may
+/// only deny it.
+pub fn may_allow(tool: &str) -> bool {
+    matches!(
+        tool,
+        "Bash"
+            | "PowerShell"
+            | "WebFetch"
+            | "WebSearch"
+            | "Read"
+            | "Write"
+            | "Edit"
+            | "MultiEdit"
+            | "NotebookEdit"
+    ) || tool == PLAN_TOOL
+}
+
+/// The text to read before allowing, and whether it is not all of the
+/// request (cut by the daemon when saved, or too long for a phone).
+fn text_of(tool: &str, input: &str) -> (String, bool) {
+    let parsed: Option<Value> = serde_json::from_str(input).ok();
+    let field = |name: &str| {
+        parsed
+            .as_ref()
+            .and_then(|value| value.get(name))
+            .and_then(Value::as_str)
+            .map(str::to_owned)
+    };
+    let (text, whole) = match tool {
+        "Bash" | "PowerShell" => (field("command"), parsed.is_some()),
+        PLAN_TOOL => (field("plan"), parsed.is_some()),
+        _ => (None, parsed.is_some()),
+    };
+    // A request the daemon cut short (it does not parse) is shown as it is
+    // and marked, and so is one the field of which is missing.
+    let text = text.unwrap_or_else(|| input.to_owned());
+    if text.len() <= CARD_TEXT_MAX {
+        return (text, !whole);
+    }
+    let mut end = CARD_TEXT_MAX;
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    (text[..end].to_owned(), true)
+}
+
+fn bot_and_crew(daemon: &Daemon, bot: &botloft_core::ids::BotId) -> Option<(CardBot, String)> {
+    let store = daemon.store();
+    let record = match store.bot(bot) {
+        Ok(Some(record)) if record.archived_at.is_none() => record,
+        Ok(_) => return None,
+        Err(err) => {
+            warn!(bot = %bot, "could not read a bot for a card: {err}");
+            return None;
+        }
+    };
+    let crew = store.crew(&record.crew_id).ok().flatten()?;
+    Some((
+        CardBot {
+            name: record.name,
+            color: record.color,
+        },
+        crew.name,
+    ))
+}
+
+/// The card of a request in the chat; `None` for a bot that is gone.
+pub fn approval_card(
+    daemon: &Daemon,
+    item: &ChatItem,
+    shown: &ApprovalItem,
+) -> Option<ApprovalCard> {
+    let (bot, crew) = bot_and_crew(daemon, &item.bot_id)?;
+    let (text, cut) = text_of(&shown.tool_name, &shown.input);
+    Some(ApprovalCard {
+        approval_id: shown.approval_id.clone(),
+        bot,
+        crew,
+        created_at: item.created_at,
+        tool_name: shown.tool_name.clone(),
+        summary: shown.summary.clone(),
+        explanation: shown.explanation.clone(),
+        text,
+        cut,
+        at_computer: !may_allow(&shown.tool_name),
+    })
+}
+
+pub fn question_card(daemon: &Daemon, question: &Question) -> Option<QuestionCard> {
+    let (bot, crew) = bot_and_crew(daemon, &question.bot_id)?;
+    Some(QuestionCard {
+        question_id: question.id.clone(),
+        bot,
+        crew,
+        created_at: question.created_at,
+        text: question.text.clone(),
+        options: question.options.clone(),
+    })
+}
+
+/// The request in the chat, whatever its state: `(item, what it shows)`.
+pub fn approval_item(daemon: &Daemon, id: &ApprovalId) -> Option<(ChatItem, ApprovalItem)> {
+    let store = daemon.store();
+    let record = store.approval(id).ok().flatten()?;
+    let item = store.chat_item(&record.chat_item_id).ok().flatten()?;
+    match item.body.clone() {
+        ChatBody::Approval(shown) => Some((item, shown)),
+        _ => None,
+    }
+}
+
+/// Every request and question waiting right now.
+pub fn waiting(daemon: &Daemon) -> (Vec<ApprovalCard>, Vec<QuestionCard>) {
+    let mut approvals = Vec::new();
+    let pending: Vec<ApprovalId> = {
+        let store = daemon.store();
+        let bots = store.bots(None, false).unwrap_or_default();
+        bots.iter()
+            .flat_map(|bot| store.pending_approvals(&bot.id).unwrap_or_default())
+            .collect()
+    };
+    for id in pending {
+        if let Some((item, shown)) = approval_item(daemon, &id)
+            && shown.status == ApprovalStatus::Pending
+            && let Some(card) = approval_card(daemon, &item, &shown)
+        {
+            approvals.push(card);
+        }
+    }
+    approvals.sort_by_key(|card| card.created_at);
+    let open = daemon
+        .store()
+        .questions(QuestionStatus::Open)
+        .unwrap_or_default();
+    let mut questions: Vec<QuestionCard> = open
+        .iter()
+        .filter_map(|question| question_card(daemon, question))
+        .collect();
+    questions.sort_by_key(|card| card.created_at);
+    (approvals, questions)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn the_phone_allows_plain_tools_and_leaves_the_rest_to_the_computer() {
+        for tool in ["Bash", "PowerShell", "WebFetch", "Read", "Edit", PLAN_TOOL] {
+            assert!(may_allow(tool), "{tool}");
+        }
+        for tool in [
+            "mcp__botloft__suggest_bot",
+            "mcp__botloft__ask_crew_access",
+            "mcp__botloft__desktop",
+            "mcp__botloft__browser",
+            "mcp__github__create_issue",
+            "Agent",
+            "",
+        ] {
+            assert!(!may_allow(tool), "{tool}");
+        }
+    }
+
+    #[test]
+    fn a_command_is_shown_whole_and_a_cut_or_long_one_is_marked() {
+        let input = json!({ "command": "ls -la", "description": "list" }).to_string();
+        assert_eq!(text_of("Bash", &input), ("ls -la".to_owned(), false));
+        let plan = json!({ "plan": "# Plan\n1. one" }).to_string();
+        assert_eq!(
+            text_of(PLAN_TOOL, &plan),
+            ("# Plan\n1. one".to_owned(), false)
+        );
+        // Another tool shows its input as it is.
+        let read = json!({ "file_path": "a.txt" }).to_string();
+        assert_eq!(text_of("Read", &read), (read.clone(), false));
+
+        // What the daemon cut when it saved the request does not parse.
+        let cut = format!("{{\"command\": \"{}…", "x".repeat(50));
+        let (text, marked) = text_of("Bash", &cut);
+        assert_eq!(text, cut);
+        assert!(marked);
+
+        // A command over the phone's limit is cut on a character boundary.
+        let long = json!({ "command": "é".repeat(CARD_TEXT_MAX) }).to_string();
+        let (text, marked) = text_of("Bash", &long);
+        assert!(marked && text.len() <= CARD_TEXT_MAX && text.chars().all(|c| c == 'é'));
+    }
+}
diff --git a/crates/botloftd/src/mobile/kdf.rs b/crates/botloftd/src/mobile/kdf.rs
new file mode 100644
index 00000000..5e32b2f7
--- /dev/null
+++ b/crates/botloftd/src/mobile/kdf.rs
@@ -0,0 +1,107 @@
+//! HMAC-SHA-256 and HKDF-SHA-256 (RFC 2104, RFC 5869) over the `sha2` the
+//! daemon already uses. The phone has both in its browser (WebCrypto), so the
+//! two sides get the same bytes (spec 28.3).
+
+use sha2::{Digest, Sha256};
+
+const BLOCK: usize = 64;
+
+/// `HMAC(key, parts[0] ‖ parts[1] ‖ ...)`.
+pub fn hmac(key: &[u8], parts: &[&[u8]]) -> [u8; 32] {
+    let mut padded = [0u8; BLOCK];
+    if key.len() > BLOCK {
+        padded[..32].copy_from_slice(&Sha256::digest(key));
+    } else {
+        padded[..key.len()].copy_from_slice(key);
+    }
+    let mut inner = Sha256::new();
+    inner.update(padded.map(|byte| byte ^ 0x36));
+    for part in parts {
+        inner.update(part);
+    }
+    let inner = inner.finalize();
+    let mut outer = Sha256::new();
+    outer.update(padded.map(|byte| byte ^ 0x5c));
+    outer.update(inner);
+    outer.finalize().into()
+}
+
+/// `len` bytes (at most 255 × 32) from `ikm`, with the extract-then-expand of
+/// HKDF. An empty `salt` is 32 zero bytes, as the RFC says.
+pub fn hkdf(ikm: &[u8], salt: &[u8], info: &[u8], len: usize) -> Vec<u8> {
+    let zeros = [0u8; 32];
+    let salt = if salt.is_empty() { &zeros[..] } else { salt };
+    let prk = hmac(salt, &[ikm]);
+    let mut okm = Vec::with_capacity(len);
+    let mut block: Vec<u8> = Vec::new();
+    let mut counter = 1u8;
+    while okm.len() < len {
+        block = hmac(&prk, &[&block, info, &[counter]]).to_vec();
+        okm.extend_from_slice(&block);
+        counter += 1;
+    }
+    okm.truncate(len);
+    okm
+}
+
+/// Whether two byte strings are equal, without stopping at the first
+/// difference.
+pub fn same(a: &[u8], b: &[u8]) -> bool {
+    a.len() == b.len() && a.iter().zip(b).fold(0u8, |diff, (x, y)| diff | (x ^ y)) == 0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn unhex(text: &str) -> Vec<u8> {
+        hex::decode(text).expect("hex")
+    }
+
+    #[test]
+    fn hmac_matches_rfc_4231() {
+        // Test case 1, and case 6 (a key longer than a block).
+        let key = [0x0b; 20];
+        assert_eq!(
+            hex::encode(hmac(&key, &[b"Hi There"])),
+            "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"
+        );
+        let long = [0xaa; 131];
+        assert_eq!(
+            hex::encode(hmac(
+                &long,
+                &[b"Test Using Larger Than Block-Size Key - Hash Key First"]
+            )),
+            "60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54"
+        );
+        // Parts are just one message cut in pieces.
+        assert_eq!(hmac(&key, &[b"Hi ", b"There"]), hmac(&key, &[b"Hi There"]));
+    }
+
+    #[test]
+    fn hkdf_matches_rfc_5869() {
+        let okm = hkdf(
+            &[0x0b; 22],
+            &unhex("000102030405060708090a0b0c"),
+            &unhex("f0f1f2f3f4f5f6f7f8f9"),
+            42,
+        );
+        assert_eq!(
+            hex::encode(okm),
+            "3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865"
+        );
+        // Case 3: no salt and no info.
+        let okm = hkdf(&[0x0b; 22], &[], &[], 42);
+        assert_eq!(
+            hex::encode(okm),
+            "8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8"
+        );
+    }
+
+    #[test]
+    fn same_tells_equal_from_different() {
+        assert!(same(b"abc", b"abc"));
+        assert!(!same(b"abc", b"abd"));
+        assert!(!same(b"abc", b"ab"));
+    }
+}
diff --git a/crates/botloftd/src/mobile/mod.rs b/crates/botloftd/src/mobile/mod.rs
new file mode 100644
index 00000000..c795dbfd
--- /dev/null
+++ b/crates/botloftd/src/mobile/mod.rs
@@ -0,0 +1,300 @@
+//! The phone (spec 28): connecting one, and the relay that carries sealed
+//! approvals and questions to it. Nothing opens until a phone is connected
+//! or being connected, and nothing of what passes goes in the log.
+
+mod bridge;
+mod cards;
+mod kdf;
+mod pair;
+mod phones;
+mod relay;
+pub mod seal;
+
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::path::Path;
+use std::sync::{Mutex, MutexGuard};
+use std::time::Duration;
+
+use botloft_core::protocol::{
+    MobileJoined, MobilePairing, MobilePhone, MobileRelay, MobileStatus, SEALED_MAX, ToPhone,
+};
+use tokio::sync::{Notify, mpsc};
+use tracing::warn;
+
+pub use self::pair::Confirm;
+use self::phones::{Phone, Phones};
+pub use self::relay::run;
+use self::seal::{Dir, Keypair, Keys};
+use crate::cloud::{CloudError, Credentials, Server};
+use crate::state::{Daemon, Event};
+
+/// How soon the relay tries again after losing the server, and how long it
+/// waits at most between tries.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Retry {
+    pub min: Duration,
+    pub max: Duration,
+}
+
+impl Default for Retry {
+    fn default() -> Self {
+        Self {
+            min: Duration::from_secs(1),
+            max: Duration::from_secs(60),
+        }
+    }
+}
+
+/// A QR code on screen, with the secret only the phone that scans it shares.
+pub(crate) struct Pairing {
+    pub(crate) id: String,
+    pub(crate) secret: [u8; 32],
+    pub(crate) keys: Keypair,
+    pub(crate) expires_at: i64,
+    pub(crate) joined: Option<Joined>,
+}
+
+/// A phone that opened the code and waits for the owner.
+pub(crate) struct Joined {
+    pub(crate) name: String,
+    pub(crate) phone_pub: Vec<u8>,
+    pub(crate) code: String,
+    /// The owner accepted: the keys, until the phone collects its token and
+    /// the server says which device it is.
+    pub(crate) accepted: Option<Keys>,
+}
+
+#[derive(Default)]
+struct State {
+    relay: Option<MobileRelay>,
+    online: HashSet<String>,
+    pairing: Option<Pairing>,
+    /// When each phone answered lately, for the limit.
+    answers: HashMap<String, VecDeque<i64>>,
+    /// The connection's way out, while there is one.
+    live: Option<mpsc::UnboundedSender<String>>,
+}
+
+pub struct Mobile {
+    phones: Phones,
+    state: Mutex<State>,
+    wake: Notify,
+    retry: Retry,
+}
+
+/// The server and the token of this sign-in.
+pub(crate) fn identity(daemon: &Daemon) -> Result<(Server, Credentials), CloudError> {
+    let server = daemon.cloud.server()?;
+    let credentials = daemon
+        .cloud
+        .credentials(&daemon.paths.secrets())
+        .ok_or_else(CloudError::not_signed_in)?;
+    Ok((server, credentials))
+}
+
+impl Mobile {
+    pub fn new(secrets_dir: &Path, retry: Retry) -> Self {
+        Self {
+            phones: Phones::open(secrets_dir),
+            state: Mutex::new(State::default()),
+            wake: Notify::new(),
+            retry,
+        }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, State> {
+        self.state
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    /// Asks the relay to look at what is wanted again.
+    pub(crate) fn wake(&self) {
+        self.wake.notify_one();
+    }
+
+    /// The phones of this sign-in; none when signed out.
+    pub(crate) fn phones(&self, daemon: &Daemon) -> Vec<Phone> {
+        match daemon.cloud.credentials(&daemon.paths.secrets()) {
+            Some(credentials) => self.phones.list(&credentials.url, &credentials.device),
+            None => Vec::new(),
+        }
+    }
+
+    /// Whether the relay should be open: signed in, and a phone connected or
+    /// being connected.
+    pub(crate) fn wanted(&self, daemon: &Daemon) -> bool {
+        daemon.cloud.credentials(&daemon.paths.secrets()).is_some()
+            && (!self.phones(daemon).is_empty() || self.lock().pairing.is_some())
+    }
+
+    pub fn status(&self, daemon: &Daemon) -> MobileStatus {
+        let now = daemon.clock.now_ms();
+        let mut state = self.lock();
+        if state
+            .pairing
+            .as_ref()
+            .is_some_and(|pairing| pairing.expires_at <= now)
+        {
+            state.pairing = None;
+        }
+        let phones = self
+            .phones(daemon)
+            .into_iter()
+            .map(|phone| MobilePhone {
+                online: state.online.contains(&phone.id),
+                id: phone.id,
+                name: phone.name,
+                paired_at: phone.paired_at,
+                last_seen_at: phone.last_seen_at,
+            })
+            .collect();
+        let pending = state.pairing.as_ref().map(|pairing| MobilePairing {
+            pair_id: pairing.id.clone(),
+            expires_at: pairing.expires_at,
+            joined: pairing.joined.as_ref().map(|joined| MobileJoined {
+                name: joined.name.clone(),
+                code: joined.code.clone(),
+            }),
+        });
+        MobileStatus {
+            relay: state.relay.unwrap_or(MobileRelay::Off),
+            phones,
+            pending,
+        }
+    }
+
+    /// Tells the apps how things stand now.
+    pub(crate) fn changed(&self, daemon: &Daemon) {
+        daemon.emit(Event::MobileChanged(self.status(daemon)));
+    }
+
+    pub(crate) fn set_relay(&self, daemon: &Daemon, relay: MobileRelay) {
+        let changed = {
+            let mut state = self.lock();
+            let changed = state.relay.unwrap_or(MobileRelay::Off) != relay;
+            state.relay = Some(relay);
+            if relay != MobileRelay::Connected {
+                state.live = None;
+                state.online.clear();
+            }
+            changed
+        };
+        if changed {
+            self.changed(daemon);
+        }
+    }
+
+    pub(crate) fn set_live(&self, live: Option<mpsc::UnboundedSender<String>>) {
+        self.lock().live = live;
+    }
+
+    /// Hands a frame to the relay connection, if there is one.
+    pub(crate) fn send_frame(&self, frame: &serde_json::Value) -> bool {
+        self.lock()
+            .live
+            .as_ref()
+            .is_some_and(|live| live.send(frame.to_string()).is_ok())
+    }
+
+    pub(crate) fn set_online(&self, online: HashSet<String>) {
+        self.lock().online = online;
+    }
+
+    /// A phone came or went. False if it is not one of ours.
+    pub(crate) fn presence(&self, daemon: &Daemon, device: &str, online: bool) -> bool {
+        if !self.phones(daemon).iter().any(|phone| phone.id == device) {
+            return false;
+        }
+        {
+            let mut state = self.lock();
+            if online {
+                state.online.insert(device.to_owned());
+            } else {
+                state.online.remove(device);
+            }
+        }
+        self.changed(daemon);
+        true
+    }
+
+    pub(crate) fn online_phones(&self, daemon: &Daemon) -> Vec<Phone> {
+        let state = self.lock();
+        self.phones(daemon)
+            .into_iter()
+            .filter(|phone| state.online.contains(&phone.id))
+            .collect()
+    }
+
+    /// Seals `message` for the phone and hands it to the relay. The counter
+    /// is saved before the message goes. Nothing happens if the relay is not
+    /// connected: the phone asks for what it missed when it opens.
+    pub(crate) fn send_to(&self, daemon: &Daemon, phone: &str, message: &ToPhone) {
+        let Some((_, credentials)) = identity(daemon).ok() else {
+            return;
+        };
+        let Some(known) = self
+            .phones
+            .get(&credentials.url, &credentials.device, phone)
+        else {
+            return;
+        };
+        let Some(keys) = known.keys() else {
+            return;
+        };
+        let Ok(plain) = serde_json::to_vec(message) else {
+            return;
+        };
+        if plain.len() > SEALED_MAX {
+            warn!("a message for a phone is too big and was not sent");
+            return;
+        }
+        let seq = known.sent + 1;
+        let saved = self
+            .phones
+            .update(&credentials.url, &credentials.device, phone, |phone| {
+                phone.sent = seq;
+            });
+        if !matches!(saved, Ok(true)) {
+            warn!("could not save a phone's counter; nothing was sent");
+            return;
+        }
+        match seal::seal(&keys.c2p, Dir::ComputerToPhone, phone, seq, &plain) {
+            Ok(body) => {
+                self.send_frame(&serde_json::json!({
+                    "t": "msg", "to": phone, "seq": seq, "body": body,
+                }));
+            }
+            Err(_) => warn!("a message for a phone did not seal"),
+        }
+    }
+
+    /// The computer left the account: every phone goes with it.
+    pub fn forget(&self, daemon: &Daemon) {
+        self.phones.clear();
+        {
+            let mut state = self.lock();
+            state.pairing = None;
+            state.online.clear();
+            state.answers.clear();
+        }
+        self.wake();
+        self.changed(daemon);
+    }
+
+    /// Whether the phone may answer now: at most 30 a minute.
+    pub(crate) fn may_answer(&self, daemon: &Daemon, phone: &str) -> bool {
+        const PER_MINUTE: usize = 30;
+        let now = daemon.clock.now_ms();
+        let mut state = self.lock();
+        let recent = state.answers.entry(phone.to_owned()).or_default();
+        while recent.front().is_some_and(|at| *at <= now - 60_000) {
+            recent.pop_front();
+        }
+        if recent.len() >= PER_MINUTE {
+            return false;
+        }
+        recent.push_back(now);
+        true
+    }
+}
diff --git a/crates/botloftd/src/mobile/pair.rs b/crates/botloftd/src/mobile/pair.rs
new file mode 100644
index 00000000..4d78d338
--- /dev/null
+++ b/crates/botloftd/src/mobile/pair.rs
@@ -0,0 +1,301 @@
+//! Connecting a phone (spec 28.3): the QR code, the phone that joins, the
+//! owner who compares the code, and the phone that collects its token.
+
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD as B64;
+use botloft_core::protocol::{MobilePairRequest, MobilePairStarted};
+use tracing::warn;
+
+use super::kdf::same;
+use super::phones::Phone;
+use super::seal::{self, Keypair};
+use super::{Joined, Mobile, Pairing, identity};
+use crate::cloud::{CloudError, Seen};
+use crate::state::{Daemon, Event};
+
+/// Why a confirmation could not be taken.
+#[derive(Debug, PartialEq, Eq)]
+pub enum Confirm {
+    /// There is no such code, or no phone has joined it.
+    NothingToConfirm,
+    Cloud(CloudError),
+}
+
+impl From<CloudError> for Confirm {
+    fn from(err: CloudError) -> Self {
+        Self::Cloud(err)
+    }
+}
+
+fn random<const N: usize>() -> Result<[u8; N], CloudError> {
+    let mut bytes = [0u8; N];
+    getrandom::fill(&mut bytes)
+        .map_err(|_| CloudError::other("the system has no random bytes".to_owned()))?;
+    Ok(bytes)
+}
+
+impl Mobile {
+    /// `mobile.pair_start`: a code for a phone to scan. Another code on
+    /// screen is dropped.
+    pub async fn pair_start(&self, daemon: &Daemon) -> Result<MobilePairStarted, CloudError> {
+        let (server, credentials) = identity(daemon)?;
+        let id = B64.encode(random::<16>()?);
+        let secret = random::<32>()?;
+        let keys = Keypair::generate()
+            .map_err(|_| CloudError::other("the system has no random bytes".to_owned()))?;
+        let daemon_pub = B64.encode(keys.public());
+        let old = self.lock().pairing.take();
+        if let Some(old) = old {
+            let _ = server.cancel_pairing(&credentials.token, &old.id).await;
+        }
+        let expires_in = server.open_pairing(&credentials.token, &id).await?;
+        let expires_at = daemon.clock.now_ms() + i64::from(expires_in) * 1000;
+        // The part after `#` never reaches the server. The computer's public
+        // key is there so the phone can show the code before it is accepted.
+        let url = format!(
+            "{}#p={id}&s={}&d={}",
+            server.phone_page(),
+            B64.encode(secret),
+            daemon_pub
+        );
+        self.lock().pairing = Some(Pairing {
+            id: id.clone(),
+            secret,
+            keys,
+            expires_at,
+            joined: None,
+        });
+        self.wake();
+        self.changed(daemon);
+        Ok(MobilePairStarted {
+            pair_id: id,
+            url,
+            expires_in,
+        })
+    }
+
+    /// `mobile.pair_cancel`.
+    pub async fn pair_cancel(&self, daemon: &Daemon, id: &str) -> Result<(), CloudError> {
+        let ours = {
+            let mut state = self.lock();
+            if state
+                .pairing
+                .as_ref()
+                .is_some_and(|pairing| pairing.id == id)
+            {
+                state.pairing = None;
+                true
+            } else {
+                false
+            }
+        };
+        if ours {
+            if let Ok((server, credentials)) = identity(daemon) {
+                let _ = server.cancel_pairing(&credentials.token, id).await;
+            }
+            self.wake();
+            self.changed(daemon);
+        }
+        Ok(())
+    }
+
+    /// Looks whether a phone opened the code, and if its proof is right,
+    /// shows the owner its name and the code to compare.
+    pub(crate) async fn check_joined(&self, daemon: &Daemon) {
+        let Some((id, secret, daemon_pub)) = ({
+            let state = self.lock();
+            state
+                .pairing
+                .as_ref()
+                .filter(|pairing| pairing.joined.is_none())
+                .map(|pairing| {
+                    (
+                        pairing.id.clone(),
+                        pairing.secret,
+                        pairing.keys.public().to_vec(),
+                    )
+                })
+        }) else {
+            return;
+        };
+        let Ok((server, credentials)) = identity(daemon) else {
+            return;
+        };
+        let seen = server.pairing(&credentials.token, &id).await;
+        let (name, phone_pub, proof) = match seen {
+            Ok(Seen::Joined {
+                name,
+                phone_pub,
+                proof,
+            }) => (name, phone_pub, proof),
+            Ok(Seen::Gone) => {
+                let mut state = self.lock();
+                if state.pairing.as_ref().is_some_and(|p| p.id == id) {
+                    state.pairing = None;
+                    drop(state);
+                    self.changed(daemon);
+                }
+                return;
+            }
+            Ok(Seen::Waiting) | Err(_) => return,
+        };
+        let phone_pub = B64.decode(&phone_pub).unwrap_or_default();
+        let proof = B64.decode(&proof).unwrap_or_default();
+        let right = same(&seal::join_proof(&secret, &id, &phone_pub), &proof);
+        if !right || phone_pub.len() != 65 {
+            warn!("a phone joined the code with a wrong proof and was refused");
+            let _ = server.cancel_pairing(&credentials.token, &id).await;
+            self.lock().pairing = None;
+            self.changed(daemon);
+            return;
+        }
+        let code = seal::code(&secret, &daemon_pub, &phone_pub);
+        {
+            let mut state = self.lock();
+            let Some(pairing) = state.pairing.as_mut().filter(|pairing| pairing.id == id) else {
+                return;
+            };
+            pairing.joined = Some(Joined {
+                name: name.clone(),
+                phone_pub,
+                code: code.clone(),
+                accepted: None,
+            });
+        }
+        self.changed(daemon);
+        daemon.emit(Event::MobilePairRequest(MobilePairRequest {
+            pair_id: id,
+            name,
+            code,
+        }));
+    }
+
+    /// `mobile.pair_confirm`: the owner compared the codes.
+    pub async fn pair_confirm(
+        &self,
+        daemon: &Daemon,
+        id: &str,
+        accept: bool,
+    ) -> Result<(), Confirm> {
+        let (server, credentials) = identity(daemon)?;
+        let work = {
+            let state = self.lock();
+            state
+                .pairing
+                .as_ref()
+                .filter(|pairing| pairing.id == id)
+                .and_then(|pairing| {
+                    let joined = pairing.joined.as_ref().filter(|j| j.accepted.is_none())?;
+                    Some((
+                        pairing.secret,
+                        pairing.keys.public().to_vec(),
+                        joined.phone_pub.clone(),
+                        seal::derive(&pairing.keys, &joined.phone_pub, &pairing.secret).ok()?,
+                    ))
+                })
+        };
+        let Some((secret, daemon_pub, phone_pub, keys)) = work else {
+            return Err(Confirm::NothingToConfirm);
+        };
+        if !accept {
+            server.cancel_pairing(&credentials.token, id).await?;
+            self.lock().pairing = None;
+            self.wake();
+            self.changed(daemon);
+            return Ok(());
+        }
+        let proof = seal::accept_proof(&secret, id, &daemon_pub, &phone_pub);
+        server
+            .accept_pairing(
+                &credentials.token,
+                id,
+                &B64.encode(&daemon_pub),
+                &B64.encode(proof),
+            )
+            .await?;
+        if let Some(joined) = self
+            .lock()
+            .pairing
+            .as_mut()
+            .and_then(|pairing| pairing.joined.as_mut())
+        {
+            joined.accepted = Some(keys);
+        }
+        Ok(())
+    }
+
+    /// The server says the phone collected its token and which device it is:
+    /// from now on the keys are kept for that device.
+    pub(crate) fn paired(&self, daemon: &Daemon, pairing_id: &str, device: &str) {
+        let Ok((_, credentials)) = identity(daemon) else {
+            return;
+        };
+        let taken = {
+            let mut state = self.lock();
+            let ours = state
+                .pairing
+                .as_ref()
+                .is_some_and(|pairing| pairing.id == pairing_id);
+            if ours { state.pairing.take() } else { None }
+        };
+        let Some(Pairing {
+            joined:
+                Some(Joined {
+                    name,
+                    accepted: Some(keys),
+                    ..
+                }),
+            ..
+        }) = taken
+        else {
+            return;
+        };
+        let phone = Phone::new(device.to_owned(), name, daemon.clock.now_ms(), &keys);
+        if let Err(err) = self
+            .phones
+            .add(&credentials.url, &credentials.device, phone)
+        {
+            warn!("could not keep the new phone's keys: {err}");
+            return;
+        }
+        self.changed(daemon);
+    }
+
+    /// Whether a code was accepted and waits for its phone to collect the
+    /// token: a device the server lists then is not a stranger.
+    pub(crate) fn awaiting_phone(&self) -> bool {
+        self.lock()
+            .pairing
+            .as_ref()
+            .and_then(|pairing| pairing.joined.as_ref())
+            .is_some_and(|joined| joined.accepted.is_some())
+    }
+
+    /// `mobile.revoke`: the server is told if it can be; the keys go either
+    /// way, and a phone the server still lists is taken off at the next
+    /// connection.
+    pub async fn revoke(&self, daemon: &Daemon, phone: &str) -> Result<bool, CloudError> {
+        let (server, credentials) = identity(daemon)?;
+        let removed = self
+            .phones
+            .remove(&credentials.url, &credentials.device, phone)
+            .unwrap_or(false);
+        let _ = server.remove_device(&credentials.token, phone).await;
+        self.lock().online.remove(phone);
+        self.wake();
+        self.changed(daemon);
+        Ok(removed)
+    }
+
+    /// The phone left from its side: the server tells us, and the keys go.
+    pub(crate) fn revoked(&self, daemon: &Daemon, phone: &str) {
+        if let Ok((_, credentials)) = identity(daemon) {
+            let _ = self
+                .phones
+                .remove(&credentials.url, &credentials.device, phone);
+        }
+        self.lock().online.remove(phone);
+        self.wake();
+        self.changed(daemon);
+    }
+}
diff --git a/crates/botloftd/src/mobile/phones.rs b/crates/botloftd/src/mobile/phones.rs
new file mode 100644
index 00000000..2558032f
--- /dev/null
+++ b/crates/botloftd/src/mobile/phones.rs
@@ -0,0 +1,241 @@
+//! The phones this computer connected, and the keys it shares with each: in
+//! `secrets\mobile.json`, readable only by the current user (spec 28.5, 13).
+//! Nothing here goes in the log, and nothing of it is in the backup.
+
+use std::io;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, MutexGuard};
+
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD as B64;
+use serde::{Deserialize, Serialize};
+
+use super::seal::Keys;
+use crate::platform;
+
+/// One connected phone.
+#[derive(Clone, Serialize, Deserialize)]
+pub struct Phone {
+    /// The id the server gave the phone's device.
+    pub id: String,
+    pub name: String,
+    pub paired_at: i64,
+    pub last_seen_at: Option<i64>,
+    c2p: String,
+    p2c: String,
+    /// The last number used to seal a message to the phone. Saved before the
+    /// message goes, so a crash never reuses a number under the same key.
+    pub sent: u64,
+    /// The highest number taken from the phone; the next must be greater.
+    pub received: u64,
+}
+
+impl Phone {
+    pub fn new(id: String, name: String, paired_at: i64, keys: &Keys) -> Self {
+        Self {
+            id,
+            name,
+            paired_at,
+            last_seen_at: None,
+            c2p: B64.encode(keys.c2p),
+            p2c: B64.encode(keys.p2c),
+            sent: 0,
+            received: 0,
+        }
+    }
+
+    pub fn keys(&self) -> Option<Keys> {
+        let decode = |text: &str| -> Option<[u8; 32]> { B64.decode(text).ok()?.try_into().ok() };
+        Some(Keys {
+            c2p: decode(&self.c2p)?,
+            p2c: decode(&self.p2c)?,
+        })
+    }
+}
+
+/// What the file holds: the phones, and whose they are. Another server or
+/// another sign-in is another account, and these phones do not carry over.
+#[derive(Default, Serialize, Deserialize)]
+struct File {
+    url: String,
+    computer: String,
+    phones: Vec<Phone>,
+}
+
+pub struct Phones {
+    path: PathBuf,
+    file: Mutex<File>,
+}
+
+impl Phones {
+    pub fn open(secrets_dir: &Path) -> Self {
+        let path = secrets_dir.join("mobile.json");
+        let file = std::fs::read(&path)
+            .ok()
+            .and_then(|bytes| serde_json::from_slice(&bytes).ok())
+            .unwrap_or_default();
+        Self {
+            path,
+            file: Mutex::new(file),
+        }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, File> {
+        self.file
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+    }
+
+    /// The phones that belong to this sign-in (`url` and the computer's
+    /// device id); none if the file is of another.
+    pub fn list(&self, url: &str, computer: &str) -> Vec<Phone> {
+        let file = self.lock();
+        if file.url == url && file.computer == computer {
+            file.phones.clone()
+        } else {
+            Vec::new()
+        }
+    }
+
+    pub fn get(&self, url: &str, computer: &str, id: &str) -> Option<Phone> {
+        self.list(url, computer)
+            .into_iter()
+            .find(|phone| phone.id == id)
+    }
+
+    /// Changes one phone and saves. False when there is no such phone.
+    pub fn update(
+        &self,
+        url: &str,
+        computer: &str,
+        id: &str,
+        change: impl FnOnce(&mut Phone),
+    ) -> io::Result<bool> {
+        let mut file = self.lock();
+        if file.url != url || file.computer != computer {
+            return Ok(false);
+        }
+        let Some(phone) = file.phones.iter_mut().find(|phone| phone.id == id) else {
+            return Ok(false);
+        };
+        change(phone);
+        self.save(&file)?;
+        Ok(true)
+    }
+
+    /// Adds a phone, replacing one with the same id. A file of another
+    /// sign-in is started over.
+    pub fn add(&self, url: &str, computer: &str, phone: Phone) -> io::Result<()> {
+        let mut file = self.lock();
+        if file.url != url || file.computer != computer {
+            *file = File {
+                url: url.to_owned(),
+                computer: computer.to_owned(),
+                phones: Vec::new(),
+            };
+        }
+        file.phones.retain(|other| other.id != phone.id);
+        file.phones.push(phone);
+        self.save(&file)
+    }
+
+    /// Forgets a phone and its keys. False when there was none.
+    pub fn remove(&self, url: &str, computer: &str, id: &str) -> io::Result<bool> {
+        let mut file = self.lock();
+        if file.url != url || file.computer != computer {
+            return Ok(false);
+        }
+        let before = file.phones.len();
+        file.phones.retain(|phone| phone.id != id);
+        let removed = file.phones.len() != before;
+        if removed {
+            self.save(&file)?;
+        }
+        Ok(removed)
+    }
+
+    /// Forgets every phone: the computer left the account.
+    pub fn clear(&self) {
+        let mut file = self.lock();
+        *file = File::default();
+        let _ = std::fs::remove_file(&self.path);
+    }
+
+    fn save(&self, file: &File) -> io::Result<()> {
+        if let Some(dir) = self.path.parent() {
+            std::fs::create_dir_all(dir)?;
+            platform::restrict_to_current_user(dir)?;
+        }
+        let tmp = self.path.with_extension("tmp");
+        std::fs::write(&tmp, serde_json::to_vec(file).map_err(io::Error::other)?)?;
+        platform::restrict_to_current_user(&tmp)?;
+        std::fs::rename(&tmp, &self.path)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn keys() -> Keys {
+        Keys {
+            c2p: [1; 32],
+            p2c: [2; 32],
+        }
+    }
+
+    #[test]
+    fn phones_are_kept_per_sign_in_and_survive_a_restart() {
+        let dir = tempfile::tempdir().expect("dir");
+        let phones = Phones::open(dir.path());
+        assert!(phones.list("https://a", "dev_1").is_empty());
+        phones
+            .add(
+                "https://a",
+                "dev_1",
+                Phone::new("dev_p".into(), "Celular".into(), 5, &keys()),
+            )
+            .expect("add");
+        assert_eq!(phones.list("https://a", "dev_1").len(), 1);
+        // Another server, or another sign-in of this computer, has none.
+        assert!(phones.list("https://b", "dev_1").is_empty());
+        assert!(phones.list("https://a", "dev_2").is_empty());
+
+        let changed = phones
+            .update("https://a", "dev_1", "dev_p", |phone| {
+                phone.sent = 9;
+                phone.received = 4;
+            })
+            .expect("update");
+        assert!(changed);
+        let again = Phones::open(dir.path());
+        let phone = again.get("https://a", "dev_1", "dev_p").expect("kept");
+        assert_eq!(
+            (phone.sent, phone.received, phone.name.as_str()),
+            (9, 4, "Celular")
+        );
+        assert!(phone.keys().expect("keys") == keys());
+
+        assert!(again.remove("https://a", "dev_1", "dev_p").expect("remove"));
+        assert!(!again.remove("https://a", "dev_1", "dev_p").expect("again"));
+        assert!(
+            Phones::open(dir.path())
+                .list("https://a", "dev_1")
+                .is_empty()
+        );
+    }
+
+    #[test]
+    fn a_broken_file_reads_as_no_phones_and_clear_removes_the_file() {
+        let dir = tempfile::tempdir().expect("dir");
+        std::fs::write(dir.path().join("mobile.json"), "{not json").expect("write");
+        let phones = Phones::open(dir.path());
+        assert!(phones.list("u", "c").is_empty());
+        phones
+            .add("u", "c", Phone::new("p".into(), "x".into(), 1, &keys()))
+            .expect("add");
+        phones.clear();
+        assert!(!dir.path().join("mobile.json").exists());
+        assert!(phones.list("u", "c").is_empty());
+    }
+}
diff --git a/crates/botloftd/src/mobile/relay.rs b/crates/botloftd/src/mobile/relay.rs
new file mode 100644
index 00000000..c95c4964
--- /dev/null
+++ b/crates/botloftd/src/mobile/relay.rs
@@ -0,0 +1,195 @@
+//! The computer's side of the relay (spec 28.4): one WebSocket to the server
+//! while a phone is connected or being connected, back again when it drops.
+
+use std::collections::HashSet;
+use std::sync::Arc;
+use std::time::Duration;
+
+use botloft_core::protocol::MobileRelay;
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tokio::sync::broadcast::error::RecvError;
+use tokio::sync::mpsc;
+use tokio::time::{MissedTickBehavior, interval, timeout};
+use tokio_tungstenite::tungstenite::Message;
+use tracing::debug;
+
+use super::identity;
+use crate::state::Daemon;
+
+/// How long the server has to answer the hello.
+const READY_WAIT: Duration = Duration::from_secs(10);
+
+/// Keeps the relay open for as long as it is wanted. Started once, with the
+/// daemon.
+pub async fn run(daemon: Arc<Daemon>) {
+    let mobile = &daemon.mobile;
+    let mut delay = mobile.retry.min;
+    loop {
+        if !mobile.wanted(&daemon) {
+            mobile.set_relay(&daemon, MobileRelay::Off);
+            mobile.wake.notified().await;
+            delay = mobile.retry.min;
+            continue;
+        }
+        mobile.set_relay(&daemon, MobileRelay::Connecting);
+        if session(&daemon).await {
+            delay = mobile.retry.min;
+        }
+        mobile.set_live(None);
+        if mobile.wanted(&daemon) {
+            mobile.set_relay(&daemon, MobileRelay::Connecting);
+            tokio::select! {
+                () = tokio::time::sleep(delay) => {}
+                () = mobile.wake.notified() => {}
+            }
+            delay = (delay * 2).min(mobile.retry.max);
+        }
+    }
+}
+
+/// One connection, until it ends. True if the server accepted it.
+async fn session(daemon: &Arc<Daemon>) -> bool {
+    let mobile = &daemon.mobile;
+    let Ok((server, credentials)) = identity(daemon) else {
+        return false;
+    };
+    let Ok((socket, _)) = tokio_tungstenite::connect_async(server.relay_url()).await else {
+        return false;
+    };
+    let (mut sink, mut stream) = socket.split();
+    let hello = json!({ "t": "hello", "token": credentials.token }).to_string();
+    if sink.send(Message::Text(hello.into())).await.is_err() {
+        return false;
+    }
+    let ready = timeout(READY_WAIT, async {
+        while let Some(Ok(message)) = stream.next().await {
+            if let Message::Text(text) = message {
+                return serde_json::from_str::<Value>(&text).ok();
+            }
+        }
+        None
+    })
+    .await
+    .ok()
+    .flatten();
+    let Some(ready) = ready.filter(|ready| ready["t"] == "ready" && ready["kind"] == "computer")
+    else {
+        return false;
+    };
+
+    let (out, mut outgoing) = mpsc::unbounded_channel::<String>();
+    let listed: Vec<(String, bool)> = ready["phones"]
+        .as_array()
+        .map(|phones| {
+            phones
+                .iter()
+                .filter_map(|phone| {
+                    Some((phone["id"].as_str()?.to_owned(), phone["online"] == true))
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    let ours: HashSet<String> = mobile.phones(daemon).into_iter().map(|p| p.id).collect();
+    mobile.set_online(
+        listed
+            .iter()
+            .filter(|(id, online)| *online && ours.contains(id))
+            .map(|(id, _)| id.clone())
+            .collect(),
+    );
+    mobile.set_live(Some(out));
+    mobile.set_relay(daemon, MobileRelay::Connected);
+
+    // A phone the server lists and this computer has no keys for was taken
+    // off here while the server was out of reach: it goes off there too. (Not
+    // while one is being accepted: its device is new, and the keys wait.)
+    if !mobile.awaiting_phone() {
+        let strangers: Vec<String> = listed
+            .into_iter()
+            .map(|(id, _)| id)
+            .filter(|id| !ours.contains(id))
+            .collect();
+        for id in strangers {
+            let (server, token) = (
+                identity(daemon).map(|(server, _)| server),
+                credentials.token.clone(),
+            );
+            tokio::spawn(async move {
+                if let Ok(server) = server {
+                    let _ = server.remove_device(&token, &id).await;
+                }
+            });
+        }
+    }
+
+    let mut events = daemon.subscribe();
+    let mut tick = interval(daemon.cloud.settings.poll);
+    tick.set_missed_tick_behavior(MissedTickBehavior::Delay);
+    loop {
+        tokio::select! {
+            frame = stream.next() => match frame {
+                Some(Ok(Message::Text(text))) => handle(daemon, &text).await,
+                Some(Ok(Message::Close(_)) | Err(_)) | None => break,
+                Some(Ok(_)) => {}
+            },
+            Some(text) = outgoing.recv() => {
+                if sink.send(Message::Text(text.into())).await.is_err() {
+                    break;
+                }
+            }
+            event = events.recv() => match event {
+                Ok(event) => mobile.on_event(daemon, &event),
+                Err(RecvError::Lagged(_)) => {}
+                Err(RecvError::Closed) => break,
+            },
+            _ = tick.tick() => mobile.check_joined(daemon).await,
+            () = mobile.wake.notified() => {
+                if !mobile.wanted(daemon) {
+                    let _ = sink.send(Message::Close(None)).await;
+                    break;
+                }
+            }
+        }
+    }
+    true
+}
+
+/// A frame from the server.
+async fn handle(daemon: &Arc<Daemon>, text: &str) {
+    let mobile = &daemon.mobile;
+    let Ok(frame) = serde_json::from_str::<Value>(text) else {
+        return;
+    };
+    let field = |name: &str| frame[name].as_str();
+    match field("t") {
+        Some("msg") => {
+            if let (Some(from), Some(seq), Some(body)) =
+                (field("from"), frame["seq"].as_u64(), field("body"))
+            {
+                mobile.receive(daemon, from, seq, body).await;
+            }
+        }
+        Some("presence") => {
+            if let Some(device) = field("device") {
+                mobile.presence(daemon, device, frame["online"] == true);
+            }
+        }
+        Some("pairing") => mobile.check_joined(daemon).await,
+        Some("paired") => {
+            if let (Some(pairing), Some(device)) = (field("pairing"), field("device")) {
+                mobile.paired(daemon, pairing, device);
+            }
+        }
+        Some("revoked") => {
+            if let Some(device) = field("device") {
+                mobile.revoked(daemon, device);
+            }
+        }
+        Some("error") => debug!(
+            reason = field("reason").unwrap_or_default(),
+            "the relay refused a frame"
+        ),
+        _ => {}
+    }
+}
diff --git a/crates/botloftd/src/mobile/seal.rs b/crates/botloftd/src/mobile/seal.rs
new file mode 100644
index 00000000..c7250474
--- /dev/null
+++ b/crates/botloftd/src/mobile/seal.rs
@@ -0,0 +1,359 @@
+//! Sealing what crosses the relay (spec 28.3): ECDH P-256 for the keys,
+//! HKDF-SHA-256 to turn them into one AES-256-GCM key per direction, and
+//! HMAC-SHA-256 for the proofs of the QR code. All of it exists in the
+//! phone's browser, and `docs/test-vectors/mobile.json` holds bytes both
+//! sides must agree on.
+
+use aes_gcm::aead::{Aead, Payload};
+use aes_gcm::{Aes256Gcm, KeyInit};
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD as B64;
+use p256::{PublicKey, SecretKey};
+use serde::{Deserialize, Serialize};
+
+use super::kdf::{hkdf, hmac};
+
+/// The version of the sealed message (`v`).
+pub const VERSION: u8 = 1;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
+pub enum SealError {
+    #[error("not a valid key")]
+    Key,
+    #[error("not a sealed message")]
+    Format,
+    #[error("the message does not open")]
+    Auth,
+    #[error("no random bytes")]
+    Random,
+}
+
+/// One side's key for the exchange.
+pub struct Keypair {
+    secret: SecretKey,
+    public: Vec<u8>,
+}
+
+impl Keypair {
+    pub fn generate() -> Result<Self, SealError> {
+        loop {
+            let mut bytes = [0u8; 32];
+            getrandom::fill(&mut bytes).map_err(|_| SealError::Random)?;
+            // Not every 32 bytes are a scalar below the curve's order; try again.
+            if let Ok(pair) = Self::from_bytes(&bytes) {
+                return Ok(pair);
+            }
+        }
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, SealError> {
+        let secret = SecretKey::from_slice(bytes).map_err(|_| SealError::Key)?;
+        let public = secret.public_key().to_sec1_bytes().to_vec();
+        Ok(Self { secret, public })
+    }
+
+    /// The point, uncompressed (65 bytes), as WebCrypto exports it.
+    pub fn public(&self) -> &[u8] {
+        &self.public
+    }
+
+    fn shared(&self, theirs: &[u8]) -> Result<Vec<u8>, SealError> {
+        let theirs = PublicKey::from_sec1_bytes(theirs).map_err(|_| SealError::Key)?;
+        let shared =
+            p256::ecdh::diffie_hellman(self.secret.to_nonzero_scalar(), theirs.as_affine());
+        Ok(shared.raw_secret_bytes().to_vec())
+    }
+}
+
+/// The two keys of a connection, one per direction.
+#[derive(Clone, PartialEq, Eq)]
+pub struct Keys {
+    pub c2p: [u8; 32],
+    pub p2c: [u8; 32],
+}
+
+/// Both sides derive the same pair: the shared point, salted with the QR's
+/// secret, which the server never saw.
+pub fn derive(mine: &Keypair, theirs: &[u8], secret: &[u8]) -> Result<Keys, SealError> {
+    let okm = hkdf(&mine.shared(theirs)?, secret, b"botloft-mobile-1", 64);
+    let mut keys = Keys {
+        c2p: [0; 32],
+        p2c: [0; 32],
+    };
+    keys.c2p.copy_from_slice(&okm[..32]);
+    keys.p2c.copy_from_slice(&okm[32..]);
+    Ok(keys)
+}
+
+/// What the phone proves when it joins: that it holds the QR's secret.
+pub fn join_proof(secret: &[u8], id: &str, phone_pub: &[u8]) -> [u8; 32] {
+    hmac(secret, &[b"botloft-pair-1", id.as_bytes(), phone_pub])
+}
+
+/// What the computer proves when it accepts.
+pub fn accept_proof(secret: &[u8], id: &str, daemon_pub: &[u8], phone_pub: &[u8]) -> [u8; 32] {
+    hmac(
+        secret,
+        &[
+            b"botloft-pair-1-accept",
+            id.as_bytes(),
+            daemon_pub,
+            phone_pub,
+        ],
+    )
+}
+
+/// Six digits both screens show, so the owner sees it is the same pairing.
+pub fn code(secret: &[u8], daemon_pub: &[u8], phone_pub: &[u8]) -> String {
+    let ikm = [daemon_pub, phone_pub].concat();
+    let bytes = hkdf(&ikm, secret, b"botloft-pair-1-code", 3);
+    let bits = (u32::from(bytes[0]) << 12) | (u32::from(bytes[1]) << 4) | u32::from(bytes[2] >> 4);
+    format!("{:06}", bits % 1_000_000)
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Dir {
+    ComputerToPhone = 1,
+    PhoneToComputer = 2,
+}
+
+#[derive(Serialize, Deserialize)]
+struct Sealed {
+    v: u8,
+    seq: u64,
+    ct: String,
+}
+
+fn aad(dir: Dir, device: &str, seq: u64) -> Vec<u8> {
+    let mut aad = vec![VERSION, dir as u8];
+    aad.extend_from_slice(device.as_bytes());
+    aad.extend_from_slice(&seq.to_be_bytes());
+    aad
+}
+
+fn nonce(seq: u64) -> [u8; 12] {
+    let mut nonce = [0u8; 12];
+    nonce[4..].copy_from_slice(&seq.to_be_bytes());
+    nonce
+}
+
+fn cipher(key: &[u8; 32]) -> Result<Aes256Gcm, SealError> {
+    Aes256Gcm::new_from_slice(key).map_err(|_| SealError::Key)
+}
+
+/// The text the relay carries: `{"v":1,"seq":N,"ct":"..."}`. The `seq` must
+/// never repeat under a key, so it comes from a counter that is saved first.
+pub fn seal(
+    key: &[u8; 32],
+    dir: Dir,
+    device: &str,
+    seq: u64,
+    plain: &[u8],
+) -> Result<String, SealError> {
+    let nonce = nonce(seq);
+    let ct = cipher(key)?
+        .encrypt(
+            &nonce.into(),
+            Payload {
+                msg: plain,
+                aad: &aad(dir, device, seq),
+            },
+        )
+        .map_err(|_| SealError::Auth)?;
+    serde_json::to_string(&Sealed {
+        v: VERSION,
+        seq,
+        ct: B64.encode(ct),
+    })
+    .map_err(|_| SealError::Format)
+}
+
+/// The `seq` and the plain text of a sealed message, if it opens.
+pub fn open(
+    key: &[u8; 32],
+    dir: Dir,
+    device: &str,
+    body: &str,
+) -> Result<(u64, Vec<u8>), SealError> {
+    let sealed: Sealed = serde_json::from_str(body).map_err(|_| SealError::Format)?;
+    if sealed.v != VERSION {
+        return Err(SealError::Format);
+    }
+    let ct = B64.decode(&sealed.ct).map_err(|_| SealError::Format)?;
+    let plain = cipher(key)?
+        .decrypt(
+            &nonce(sealed.seq).into(),
+            Payload {
+                msg: &ct,
+                aad: &aad(dir, device, sealed.seq),
+            },
+        )
+        .map_err(|_| SealError::Auth)?;
+    Ok((sealed.seq, plain))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, json};
+
+    const SECRET: [u8; 32] = [0x33; 32];
+    const ID: &str = "AAAAAAAAAAAAAAAAAAAAAA";
+
+    fn pair() -> (Keypair, Keypair) {
+        (
+            Keypair::from_bytes(&[0x11; 32]).expect("daemon key"),
+            Keypair::from_bytes(&[0x22; 32]).expect("phone key"),
+        )
+    }
+
+    #[test]
+    fn both_sides_derive_the_same_keys_and_the_secret_matters() {
+        let (daemon, phone) = pair();
+        let a = derive(&daemon, phone.public(), &SECRET).expect("daemon side");
+        let b = derive(&phone, daemon.public(), &SECRET).expect("phone side");
+        assert!(a == b);
+        assert_ne!(a.c2p, a.p2c);
+        // The server knows both public keys but not the secret: not the keys.
+        let guess = derive(&daemon, phone.public(), &[0x34; 32]).expect("wrong secret");
+        assert!(guess != a);
+        assert_eq!(daemon.public().len(), 65);
+        assert_eq!(daemon.public()[0], 4);
+        assert_eq!(
+            derive(&daemon, &[1, 2, 3], &SECRET).err(),
+            Some(SealError::Key)
+        );
+    }
+
+    #[test]
+    fn a_sealed_message_opens_only_for_its_key_direction_device_and_seq() {
+        let key = [7u8; 32];
+        let body = seal(&key, Dir::ComputerToPhone, "dev_a", 5, b"hello").expect("seal");
+        assert_eq!(
+            open(&key, Dir::ComputerToPhone, "dev_a", &body).expect("open"),
+            (5, b"hello".to_vec())
+        );
+        assert_eq!(
+            open(&[8u8; 32], Dir::ComputerToPhone, "dev_a", &body).err(),
+            Some(SealError::Auth)
+        );
+        assert_eq!(
+            open(&key, Dir::PhoneToComputer, "dev_a", &body).err(),
+            Some(SealError::Auth)
+        );
+        assert_eq!(
+            open(&key, Dir::ComputerToPhone, "dev_b", &body).err(),
+            Some(SealError::Auth)
+        );
+        // Changing the counter, or a byte of the text, breaks it.
+        let moved = body.replace("\"seq\":5", "\"seq\":6");
+        assert_eq!(
+            open(&key, Dir::ComputerToPhone, "dev_a", &moved).err(),
+            Some(SealError::Auth)
+        );
+        let mut value: Value = serde_json::from_str(&body).expect("json");
+        let ct = value["ct"].as_str().expect("ct").to_owned();
+        let flipped = format!(
+            "{}{}",
+            &ct[..ct.len() - 1],
+            if ct.ends_with('A') { 'B' } else { 'A' }
+        );
+        value["ct"] = json!(flipped);
+        assert_eq!(
+            open(&key, Dir::ComputerToPhone, "dev_a", &value.to_string()).err(),
+            Some(SealError::Auth)
+        );
+        for bad in [
+            "",
+            "not json",
+            "{\"v\":2,\"seq\":1,\"ct\":\"AA\"}",
+            "{\"v\":1,\"seq\":1,\"ct\":\"***\"}",
+        ] {
+            assert_eq!(
+                open(&key, Dir::ComputerToPhone, "dev_a", bad).err(),
+                Some(SealError::Format),
+                "{bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn the_code_is_six_digits_and_follows_the_keys() {
+        let (daemon, phone) = pair();
+        let code_a = code(&SECRET, daemon.public(), phone.public());
+        assert_eq!(code_a.len(), 6);
+        assert!(code_a.bytes().all(|b| b.is_ascii_digit()));
+        assert_ne!(code_a, code(&SECRET, phone.public(), daemon.public()));
+        assert_ne!(
+            join_proof(&SECRET, ID, phone.public()),
+            join_proof(&[0x34; 32], ID, phone.public())
+        );
+        assert_ne!(
+            join_proof(&SECRET, ID, phone.public()),
+            accept_proof(&SECRET, ID, daemon.public(), phone.public())
+        );
+    }
+
+    /// The bytes the phone's code must reproduce. Run with
+    /// `BOTLOFT_WRITE_VECTORS=1` to write the file again.
+    #[test]
+    fn the_test_vectors_are_what_the_code_makes() {
+        let (daemon, phone) = pair();
+        let keys = derive(&daemon, phone.public(), &SECRET).expect("keys");
+        let b64 = |bytes: &[u8]| B64.encode(bytes);
+        let c2p = seal(
+            &keys.c2p,
+            Dir::ComputerToPhone,
+            "dev_phone",
+            1,
+            br#"{"t":"sync"}"#,
+        )
+        .expect("c2p");
+        let p2c = seal(
+            &keys.p2c,
+            Dir::PhoneToComputer,
+            "dev_phone",
+            7,
+            "olá 🔥".as_bytes(),
+        )
+        .expect("p2c");
+        let vectors = json!({
+            "about": "Spec 28.3. Generated by botloftd (mobile::seal tests); the PWA must reproduce every value.",
+            "pair": {
+                "id": ID,
+                "secret": b64(&SECRET),
+                "daemonPrivateHex": hex::encode([0x11u8; 32]),
+                "phonePrivateHex": hex::encode([0x22u8; 32]),
+                "daemonPublic": b64(daemon.public()),
+                "phonePublic": b64(phone.public()),
+                "joinProof": b64(&join_proof(&SECRET, ID, phone.public())),
+                "acceptProof": b64(&accept_proof(&SECRET, ID, daemon.public(), phone.public())),
+                "code": code(&SECRET, daemon.public(), phone.public()),
+                "computerToPhoneKeyHex": hex::encode(keys.c2p),
+                "phoneToComputerKeyHex": hex::encode(keys.p2c),
+            },
+            "seal": [
+                {
+                    "direction": "computerToPhone", "device": "dev_phone", "seq": 1,
+                    "keyHex": hex::encode(keys.c2p), "plain": r#"{"t":"sync"}"#, "body": c2p,
+                },
+                {
+                    "direction": "phoneToComputer", "device": "dev_phone", "seq": 7,
+                    "keyHex": hex::encode(keys.p2c), "plain": "olá 🔥", "body": p2c,
+                },
+            ],
+        });
+        let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../docs/test-vectors/mobile.json");
+        let text = serde_json::to_string_pretty(&vectors).expect("json") + "\n";
+        if std::env::var_os("BOTLOFT_WRITE_VECTORS").is_some() {
+            std::fs::write(&path, &text).expect("write the vectors");
+        }
+        let on_disk = std::fs::read_to_string(&path).expect("docs/test-vectors/mobile.json");
+        assert_eq!(
+            on_disk.replace("\r\n", "\n"),
+            text,
+            "run with BOTLOFT_WRITE_VECTORS=1"
+        );
+    }
+}
diff --git a/crates/botloftd/src/rpc/dispatch.rs b/crates/botloftd/src/rpc/dispatch.rs
index d2820426..c689819d 100644
--- a/crates/botloftd/src/rpc/dispatch.rs
+++ b/crates/botloftd/src/rpc/dispatch.rs
@@ -9,8 +9,8 @@ use super::jsonrpc::{RpcError, empty_params};
 use crate::approvals;
 use crate::service::{
     self, ApiError, ApiResult, archive, attachments, autobackup, backup, bots, catalog, chat,
-    cloud, crew_access, crews, delete, deliveries, desktop, files, lead, mcp, messages, models,
-    modes, questions, reactions, routines, rules, screens, settings, tasks, usage,
+    cloud, crew_access, crews, delete, deliveries, desktop, files, lead, mcp, messages, mobile,
+    models, modes, questions, reactions, routines, rules, screens, settings, tasks, usage,
 };
 use crate::state::Daemon;
 
@@ -80,6 +80,15 @@ pub fn dispatch(daemon: &Daemon, name: &str, params: Option<Value>) -> Result<Va
         method::AUTOBACKUP_ENABLE => reply(autobackup::enable(daemon, parse(params)?)),
         method::AUTOBACKUP_SET_EVERY => reply(autobackup::set_every(daemon, parse(params)?)),
         method::AUTOBACKUP_DISABLE => reply(Ok::<_, ApiError>(autobackup::disable(daemon))),
+        method::MOBILE_STATUS => reply(Ok::<_, ApiError>(mobile::status(daemon))),
+        method::MOBILE_PAIR_START => reply(mobile::pair_start(daemon)),
+        method::MOBILE_PAIR_CANCEL => {
+            reply(mobile::pair_cancel(daemon, parse(params)?).map(|()| Value::Null))
+        }
+        method::MOBILE_PAIR_CONFIRM => {
+            reply(mobile::pair_confirm(daemon, parse(params)?).map(|()| Value::Null))
+        }
+        method::MOBILE_REVOKE => reply(mobile::revoke(daemon, parse(params)?)),
         method::CREW_ACCESS_LIST => reply(crew_access::list(daemon, parse(params)?)),
         method::CREW_ACCESS_REVOKE => reply(crew_access::revoke(daemon, parse(params)?)),
         method::MCP_SERVERS => reply(mcp::overview(daemon)),
diff --git a/crates/botloftd/src/rpc/mod.rs b/crates/botloftd/src/rpc/mod.rs
index a3ee4345..c192e383 100644
--- a/crates/botloftd/src/rpc/mod.rs
+++ b/crates/botloftd/src/rpc/mod.rs
@@ -205,6 +205,11 @@ const ASIDE: &[&str] = &[
     method::CLOUD_DOWNLOAD,
     method::CLOUD_DELETE,
     method::CLOUD_DELETE_ACCOUNT,
+    // The phone: they ask the server (spec 28.5).
+    method::MOBILE_PAIR_START,
+    method::MOBILE_PAIR_CANCEL,
+    method::MOBILE_PAIR_CONFIRM,
+    method::MOBILE_REVOKE,
 ];
 
 enum Routed {
diff --git a/crates/botloftd/src/rpc/notify.rs b/crates/botloftd/src/rpc/notify.rs
index 473a5c53..a4cbb820 100644
--- a/crates/botloftd/src/rpc/notify.rs
+++ b/crates/botloftd/src/rpc/notify.rs
@@ -37,5 +37,7 @@ pub(super) fn to_notification(event: &Event) -> String {
         Event::CloudProgress(progress) => note(notification::CLOUD_PROGRESS, progress),
         Event::CloudSigninExpired => note(notification::CLOUD_SIGNIN_EXPIRED, &()),
         Event::AutoBackupChanged(status) => note(notification::AUTOBACKUP_CHANGED, status),
+        Event::MobileChanged(status) => note(notification::MOBILE_CHANGED, status),
+        Event::MobilePairRequest(request) => note(notification::MOBILE_PAIR_REQUEST, request),
     }
 }
diff --git a/crates/botloftd/src/service/cloud.rs b/crates/botloftd/src/service/cloud.rs
index 63ddf009..15ef6982 100644
--- a/crates/botloftd/src/service/cloud.rs
+++ b/crates/botloftd/src/service/cloud.rs
@@ -27,9 +27,10 @@ fn run<T>(work: impl Future<Output = T>) -> T {
 }
 
 /// A refused token ends the sign-in on this computer: it was revoked.
-fn fail(daemon: &Daemon, err: CloudError) -> ApiError {
+pub(super) fn fail(daemon: &Daemon, err: CloudError) -> ApiError {
     if err.reason == "unauthorized" {
         daemon.cloud.forget(&daemon.paths.secrets());
+        daemon.mobile.forget(daemon);
         return ApiError::Rule {
             reason: "signed_out",
             message: "sign in again to use the account".to_owned(),
@@ -132,6 +133,8 @@ pub fn signout(daemon: &Daemon) {
         let _ = run(server.logout(&credentials.token));
     }
     daemon.cloud.forget(&daemon.paths.secrets());
+    // The phones go with the account (spec 28.6).
+    daemon.mobile.forget(daemon);
     // Without the account there is nowhere to send the copies.
     daemon.autobackup.turn_off();
     daemon.emit(Event::AutoBackupChanged(daemon.autobackup.status()));
diff --git a/crates/botloftd/src/service/mobile.rs b/crates/botloftd/src/service/mobile.rs
new file mode 100644
index 00000000..992e0c00
--- /dev/null
+++ b/crates/botloftd/src/service/mobile.rs
@@ -0,0 +1,57 @@
+//! `mobile.*` (spec 28.5). Those that ask the server wait for the network, so
+//! the connection answers them aside (`rpc::ASIDE`).
+
+use std::future::Future;
+
+use botloft_core::protocol::{
+    MobilePairConfirmParams, MobilePairIdParams, MobilePairStarted, MobileRevokeParams,
+    MobileStatus,
+};
+
+use super::cloud::fail;
+use super::{ApiError, ApiResult};
+use crate::mobile::Confirm;
+use crate::state::Daemon;
+
+/// The service runs on the blocking pool, where the network waits belong.
+fn run<T>(work: impl Future<Output = T>) -> T {
+    tokio::runtime::Handle::current().block_on(work)
+}
+
+/// `mobile.status`: nothing is asked of the server.
+pub fn status(daemon: &Daemon) -> MobileStatus {
+    daemon.mobile.status(daemon)
+}
+
+/// `mobile.pair_start`: a code for a phone to scan.
+pub fn pair_start(daemon: &Daemon) -> ApiResult<MobilePairStarted> {
+    run(daemon.mobile.pair_start(daemon)).map_err(|err| fail(daemon, err))
+}
+
+/// `mobile.pair_cancel`
+pub fn pair_cancel(daemon: &Daemon, params: MobilePairIdParams) -> ApiResult<()> {
+    run(daemon.mobile.pair_cancel(daemon, &params.pair_id)).map_err(|err| fail(daemon, err))
+}
+
+/// `mobile.pair_confirm`: the owner compared the codes.
+pub fn pair_confirm(daemon: &Daemon, params: MobilePairConfirmParams) -> ApiResult<()> {
+    run(daemon
+        .mobile
+        .pair_confirm(daemon, &params.pair_id, params.accept))
+    .map_err(|err| match err {
+        Confirm::NothingToConfirm => ApiError::Conflict(
+            "there is no phone waiting on that code; it may have run out".to_owned(),
+        ),
+        Confirm::Cloud(err) => fail(daemon, err),
+    })
+}
+
+/// `mobile.revoke`: the phone loses its access at once.
+pub fn revoke(daemon: &Daemon, params: MobileRevokeParams) -> ApiResult<MobileStatus> {
+    let removed =
+        run(daemon.mobile.revoke(daemon, &params.phone_id)).map_err(|err| fail(daemon, err))?;
+    if !removed {
+        return Err(ApiError::NotFound(format!("phone {}", params.phone_id)));
+    }
+    Ok(daemon.mobile.status(daemon))
+}
diff --git a/crates/botloftd/src/service/mod.rs b/crates/botloftd/src/service/mod.rs
index 237c225e..994e35ab 100644
--- a/crates/botloftd/src/service/mod.rs
+++ b/crates/botloftd/src/service/mod.rs
@@ -19,6 +19,7 @@ pub mod lead;
 pub mod mcp;
 pub mod mcp_state;
 pub mod messages;
+pub mod mobile;
 pub mod models;
 pub mod modes;
 pub mod plan;
diff --git a/crates/botloftd/src/state.rs b/crates/botloftd/src/state.rs
index 5ff4c813..b983113e 100644
--- a/crates/botloftd/src/state.rs
+++ b/crates/botloftd/src/state.rs
@@ -9,8 +9,8 @@ use botloft_core::protocol::{
     AccountUsage, AutoBackupStatus, Bot, BotContextChanged, BotDeleted, BotDesktop, BotMcp,
     BotRules, BotStateChanged, BrowserAction, BrowserState, ChatDelta, ChatItemChanged,
     CloudProgress, CloudSignedIn, Crew, CrewDeleted, Delivery, DesktopAwayUse, DesktopState,
-    FolderRecycled, McpOverview, Message, Question, ReactionChanged, Routine, RoutineRun,
-    ScreenDraft, Task,
+    FolderRecycled, McpOverview, Message, MobilePairRequest, MobileStatus, Question,
+    ReactionChanged, Routine, RoutineRun, ScreenDraft, Task,
 };
 use botloft_store::Store;
 use tokio::runtime::{Handle, RuntimeFlavor};
@@ -65,6 +65,8 @@ pub enum Event {
     CloudProgress(CloudProgress),
     CloudSigninExpired,
     AutoBackupChanged(AutoBackupStatus),
+    MobileChanged(MobileStatus),
+    MobilePairRequest(MobilePairRequest),
 }
 
 /// Events buffered per connection before a slow client is dropped.
@@ -131,6 +133,8 @@ pub struct Daemon {
     pub cloud: crate::cloud::Cloud,
     /// The copies it sends by itself (spec 27.10).
     pub autobackup: crate::autobackup::AutoBackup,
+    /// The phone that approves and answers from afar (spec 28).
+    pub mobile: crate::mobile::Mobile,
     /// Other crews a bot may reach for its current turn (spec 10.4).
     pub crew_access: crate::service::crew_access::TurnAccess,
     /// What each bot's process had cost by its last turn (spec 8.7).
@@ -180,6 +184,7 @@ impl Daemon {
                 options.secrets,
                 options.cloud.auto_tick,
             ),
+            mobile: crate::mobile::Mobile::new(&options.paths.secrets(), options.cloud.relay_retry),
             cloud: crate::cloud::Cloud::new(options.cloud),
             crew_access: Default::default(),
             costs: Default::default(),
diff --git a/crates/botloftd/tests/common/cloud_server.rs b/crates/botloftd/tests/common/cloud_server.rs
index f05eebd9..d4fa640d 100644
--- a/crates/botloftd/tests/common/cloud_server.rs
+++ b/crates/botloftd/tests/common/cloud_server.rs
@@ -3,7 +3,7 @@
 
 use std::sync::Arc;
 
-use botloft_cloud::{AppState, Clock, Config, CopyStore, Db, Mailer, Outbox, router};
+use botloft_cloud::{AppState, Clock, Config, CopyStore, Db, Hub, Mailer, Outbox, Pusher, router};
 use serde_json::json;
 use tokio::net::TcpListener;
 
@@ -14,25 +14,57 @@ pub struct CloudServer {
     pub url: String,
     pub outbox: Outbox,
     pub clock: Clock,
+    pub hub: Hub,
 }
 
 pub async fn cloud_server() -> CloudServer {
     let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+    cloud_server_on(listener, None).await
+}
+
+/// The same on a listener of the test's choosing, serving the phone's page
+/// from `phone_dir` (spec 28.7).
+pub async fn cloud_server_on(
+    listener: TcpListener,
+    phone_dir: Option<std::path::PathBuf>,
+) -> CloudServer {
+    launch(listener, phone_dir, Pusher::off()).await
+}
+
+/// A server that sends Web Push through `push` (spec 28.8).
+pub async fn cloud_server_pushing(push: Pusher) -> CloudServer {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+    launch(listener, None, push).await
+}
+
+async fn launch(
+    listener: TcpListener,
+    phone_dir: Option<std::path::PathBuf>,
+    push: Pusher,
+) -> CloudServer {
     let url = format!("http://{}", listener.local_addr().expect("addr"));
-    let (outbox, clock) = (Outbox::default(), Clock::default());
+    let (outbox, clock, hub) = (Outbox::default(), Clock::default(), Hub::default());
     let mut config = Config::for_tests();
     config.public_url = url.clone();
+    config.phone_dir = phone_dir;
     let state = AppState {
         db: Db::memory().expect("db"),
         mailer: Arc::new(Mailer::Outbox(outbox.clone())),
         clock: clock.clone(),
         config: Arc::new(config),
         store: CopyStore::memory(),
+        hub: hub.clone(),
+        push,
     };
     tokio::spawn(async move {
         axum::serve(listener, router(state)).await.expect("serve");
     });
-    CloudServer { url, outbox, clock }
+    CloudServer {
+        url,
+        outbox,
+        clock,
+        hub,
+    }
 }
 
 impl CloudServer {
diff --git a/crates/botloftd/tests/common/mobile.rs b/crates/botloftd/tests/common/mobile.rs
new file mode 100644
index 00000000..5d49296b
--- /dev/null
+++ b/crates/botloftd/tests/common/mobile.rs
@@ -0,0 +1,249 @@
+//! A phone for the tests (spec 28): what the PWA does, in Rust, against the
+//! real account server and a daemon in this process.
+
+use std::time::Duration;
+
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD as B64;
+use botloft_core::protocol::{FromPhone, ToPhone};
+use botloftd::mobile::seal::{self, Dir, Keypair, Keys};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{Value, json};
+use tokio::net::TcpStream;
+use tokio_tungstenite::tungstenite::Message;
+use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};
+
+const WAIT: Duration = Duration::from_secs(10);
+
+/// A phone that scanned the code and joined it.
+pub struct Joined {
+    base: String,
+    pub pair_id: String,
+    secret: Vec<u8>,
+    daemon_pub: Vec<u8>,
+    keys: Keypair,
+    poll: String,
+    /// The code the phone shows the owner to compare.
+    pub code: String,
+}
+
+/// Reads what the QR holds and joins, with `proof` or the right one.
+pub async fn join(base: &str, qr: &str, name: &str, wrong_proof: bool) -> Joined {
+    let fragment = qr.split_once('#').expect("a fragment").1;
+    let part = |key: &str| -> String {
+        fragment
+            .split('&')
+            .find_map(|pair| pair.strip_prefix(&format!("{key}=")))
+            .unwrap_or_else(|| panic!("{key} in the QR"))
+            .to_owned()
+    };
+    let (pair_id, secret, daemon_pub) = (
+        part("p"),
+        B64.decode(part("s")).expect("secret"),
+        B64.decode(part("d")).expect("key"),
+    );
+    let keys = Keypair::generate().expect("keys");
+    let mut proof = seal::join_proof(&secret, &pair_id, keys.public());
+    if wrong_proof {
+        proof[0] ^= 1;
+    }
+    let answer = reqwest::Client::new()
+        .post(format!("{base}/v1/pairings/{pair_id}/join"))
+        .json(&json!({
+            "phone_pub": B64.encode(keys.public()), "device_name": name, "proof": B64.encode(proof),
+        }))
+        .send()
+        .await
+        .expect("join");
+    assert_eq!(
+        answer.status(),
+        202,
+        "{}",
+        answer.text().await.unwrap_or_default()
+    );
+    let poll = answer.json::<Value>().await.expect("json")["poll"]
+        .as_str()
+        .expect("poll")
+        .to_owned();
+    let code = seal::code(&secret, &daemon_pub, keys.public());
+    Joined {
+        base: base.to_owned(),
+        pair_id,
+        secret,
+        daemon_pub,
+        keys,
+        poll,
+        code,
+    }
+}
+
+impl Joined {
+    /// Asks for the answer until the computer accepts. `None` if the code is
+    /// gone (the owner refused, or it ran out).
+    pub async fn collect(self) -> Option<Phone> {
+        let url = format!("{}/v1/pairings/{}/result", self.base, self.pair_id);
+        for _ in 0..200 {
+            let answer: Value = reqwest::Client::new()
+                .get(&url)
+                .bearer_auth(&self.poll)
+                .send()
+                .await
+                .expect("result")
+                .json()
+                .await
+                .expect("json");
+            match answer["status"].as_str() {
+                Some("approved") => {
+                    // The computer proves it accepted, with the QR's secret.
+                    let theirs = B64
+                        .decode(answer["daemon_pub"].as_str().expect("key"))
+                        .expect("b64");
+                    assert_eq!(theirs, self.daemon_pub, "the key is the one in the QR");
+                    let proof = B64
+                        .decode(answer["proof2"].as_str().expect("proof"))
+                        .expect("b64");
+                    let expected = seal::accept_proof(
+                        &self.secret,
+                        &self.pair_id,
+                        &theirs,
+                        self.keys.public(),
+                    );
+                    assert_eq!(proof, expected);
+                    return Some(Phone {
+                        base: self.base.clone(),
+                        token: answer["token"].as_str().expect("token").to_owned(),
+                        id: answer["device"].as_str().expect("device").to_owned(),
+                        keys: seal::derive(&self.keys, &theirs, &self.secret).expect("keys"),
+                        sent: 0,
+                        socket: None,
+                    });
+                }
+                Some("expired") => return None,
+                _ => tokio::time::sleep(Duration::from_millis(50)).await,
+            }
+        }
+        panic!("the computer never accepted");
+    }
+
+    /// A word for the owner who compares: the same six digits.
+    pub fn secret(&self) -> &[u8] {
+        &self.secret
+    }
+}
+
+/// A phone that is connected to a computer.
+pub struct Phone {
+    base: String,
+    pub token: String,
+    pub id: String,
+    keys: Keys,
+    sent: u64,
+    socket: Option<WebSocketStream<MaybeTlsStream<TcpStream>>>,
+}
+
+impl Phone {
+    /// Opens the relay as the phone does and waits for `ready`.
+    pub async fn connect(&mut self) -> Value {
+        let url = self.base.replacen("http://", "ws://", 1) + "/v1/relay";
+        let (socket, _) = connect_async(url).await.expect("connect");
+        self.socket = Some(socket);
+        self.send_raw(json!({ "t": "hello", "token": self.token }))
+            .await;
+        loop {
+            let frame = self.frame().await;
+            if frame["t"] == "ready" {
+                return frame;
+            }
+        }
+    }
+
+    pub async fn send_raw(&mut self, frame: Value) {
+        let socket = self.socket.as_mut().expect("connected");
+        socket
+            .send(Message::Text(frame.to_string().into()))
+            .await
+            .expect("send");
+    }
+
+    /// The text relayed for `message`, with the next counter; the frame is
+    /// not sent.
+    pub fn seal(&mut self, message: &FromPhone) -> Value {
+        self.sent += 1;
+        let plain = serde_json::to_vec(message).expect("json");
+        let body = seal::seal(
+            &self.keys.p2c,
+            Dir::PhoneToComputer,
+            &self.id,
+            self.sent,
+            &plain,
+        )
+        .expect("seal");
+        json!({ "t": "msg", "seq": self.sent, "body": body })
+    }
+
+    /// Seals and sends. Gives the frame back, to send again.
+    pub async fn send(&mut self, message: &FromPhone) -> Value {
+        let frame = self.seal(message);
+        self.send_raw(frame.clone()).await;
+        frame
+    }
+
+    /// The next frame, whatever it is.
+    pub async fn frame(&mut self) -> Value {
+        let socket = self.socket.as_mut().expect("connected");
+        let next = tokio::time::timeout(WAIT, socket.next())
+            .await
+            .expect("a frame in time");
+        match next {
+            Some(Ok(Message::Text(text))) => serde_json::from_str(&text).expect("json"),
+            other => panic!("not a frame: {other:?}"),
+        }
+    }
+
+    /// The next thing the computer says, opened. Frames that are not messages
+    /// (who is online) are skipped.
+    pub async fn next(&mut self) -> ToPhone {
+        loop {
+            let frame = self.frame().await;
+            if frame["t"] != "msg" {
+                continue;
+            }
+            let (seq, plain) = seal::open(
+                &self.keys.c2p,
+                Dir::ComputerToPhone,
+                &self.id,
+                frame["body"].as_str().expect("body"),
+            )
+            .expect("a message that opens");
+            assert_eq!(Some(seq), frame["seq"].as_u64());
+            return serde_json::from_slice(&plain).expect("a known message");
+        }
+    }
+
+    /// Nothing more from the computer for a while.
+    pub async fn quiet(&mut self) {
+        let socket = self.socket.as_mut().expect("connected");
+        loop {
+            match tokio::time::timeout(Duration::from_millis(400), socket.next()).await {
+                Err(_) => return,
+                Ok(Some(Ok(Message::Text(text)))) => {
+                    let frame: Value = serde_json::from_str(&text).expect("json");
+                    assert_ne!(frame["t"], "msg", "unexpected message: {frame}");
+                }
+                Ok(other) => panic!("the socket ended: {other:?}"),
+            }
+        }
+    }
+
+    /// The server closes the socket (the phone was cut off).
+    pub async fn closed(&mut self) {
+        let socket = self.socket.as_mut().expect("connected");
+        loop {
+            match tokio::time::timeout(WAIT, socket.next()).await {
+                Ok(Some(Ok(Message::Text(_)))) => {}
+                Ok(None | Some(Err(_) | Ok(Message::Close(_)))) => return,
+                other => panic!("not closed: {other:?}"),
+            }
+        }
+    }
+}
diff --git a/crates/botloftd/tests/common/mod.rs b/crates/botloftd/tests/common/mod.rs
index d07f4927..ed7abf78 100644
--- a/crates/botloftd/tests/common/mod.rs
+++ b/crates/botloftd/tests/common/mod.rs
@@ -10,6 +10,7 @@ pub mod context;
 #[cfg(windows)]
 pub mod desktop;
 pub mod mcp;
+pub mod mobile;
 pub mod routines;
 pub mod site;
 pub mod stream;
@@ -163,6 +164,14 @@ pub fn new_daemon_with(
     }
 }
 
+/// The relay tries again soon, so a test does not wait for it.
+fn fast_retry() -> botloftd::mobile::Retry {
+    botloftd::mobile::Retry {
+        min: Duration::from_millis(50),
+        max: Duration::from_millis(200),
+    }
+}
+
 impl TestDaemon {
     /// Server only: bots are never started and nothing is delivered.
     pub async fn start() -> Self {
@@ -191,11 +200,29 @@ impl TestDaemon {
         let cloud = botloftd::cloud::CloudSettings {
             url: url.to_owned(),
             poll: Duration::from_millis(50),
+            relay_retry: fast_retry(),
             ..Default::default()
         };
         Self::launch_with(false, APPROVAL_WAIT, cloud, secrets).await
     }
 
+    /// Server, supervisor and courier, with an account server to talk to.
+    pub async fn start_supervised_with_cloud(url: &str) -> Self {
+        Self::start_supervised_with_cloud_waiting(url, APPROVAL_WAIT).await
+    }
+
+    /// The same, with requests that wait as long as `wait` for the owner (a
+    /// person at a real phone is slower than a test).
+    pub async fn start_supervised_with_cloud_waiting(url: &str, wait: Duration) -> Self {
+        let cloud = botloftd::cloud::CloudSettings {
+            url: url.to_owned(),
+            poll: Duration::from_millis(50),
+            relay_retry: fast_retry(),
+            ..Default::default()
+        };
+        Self::launch_with(true, wait, cloud, Arc::new(MemorySecrets::new())).await
+    }
+
     async fn launch(supervised: bool, approval_wait: Duration) -> Self {
         Self::launch_with(
             supervised,
@@ -219,6 +246,8 @@ impl TestDaemon {
             tokio::spawn(supervisor::run(Arc::clone(&parts.daemon)));
             tokio::spawn(courier::run(Arc::clone(&parts.daemon)));
         }
+        // The phone's relay waits until a phone is wanted (spec 28).
+        tokio::spawn(botloftd::mobile::run(Arc::clone(&parts.daemon)));
         tokio::spawn(server::serve(
             Arc::clone(&parts.daemon),
             listener,
diff --git a/crates/botloftd/tests/mobile.rs b/crates/botloftd/tests/mobile.rs
new file mode 100644
index 00000000..9a727a0d
--- /dev/null
+++ b/crates/botloftd/tests/mobile.rs
@@ -0,0 +1,567 @@
+//! The phone (spec 28): connecting one with the QR code, and approving and
+//! answering from it through the relay of the real account server.
+
+mod common;
+
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use botloft_core::protocol::{ApprovalStatus, FromPhone, QuestionStatus, ToPhone};
+use common::bots::ready_bot;
+use common::cloud_server::{CloudServer, cloud_server, cloud_server_pushing, sign_in};
+use common::mcp::Mcp;
+use common::mobile::{Phone, join};
+use common::{Client, TestDaemon, stream};
+use serde_json::{Value, json};
+
+/// A daemon signed in to its own account server.
+async fn setup() -> (CloudServer, TestDaemon, Client) {
+    let cloud = cloud_server().await;
+    let t = TestDaemon::start_supervised_with_cloud(&cloud.url).await;
+    let mut app = t.session().await;
+    sign_in(&cloud, &mut app).await;
+    (cloud, t, app)
+}
+
+/// Waits until `mobile.status` satisfies `ok`.
+async fn status_where(app: &mut Client, ok: impl Fn(&Value) -> bool) -> Value {
+    for _ in 0..200 {
+        let status = app
+            .call("mobile.status", Value::Null)
+            .await
+            .expect("status");
+        if ok(&status) {
+            return status;
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    panic!("mobile.status never became what the test waits for");
+}
+
+/// Connects a phone as the owner would, comparing the codes.
+async fn connect_phone(cloud: &CloudServer, app: &mut Client) -> Phone {
+    let started = app
+        .call("mobile.pair_start", Value::Null)
+        .await
+        .expect("start");
+    assert_eq!(started["expiresIn"], 300);
+    let qr = started["url"].as_str().expect("url");
+    assert!(qr.starts_with(&format!("{}/m#p=", cloud.url)), "{qr}");
+    let joined = join(&cloud.url, qr, "Celular da Ana", false).await;
+    let request = app.notification("mobile.pair_request").await;
+    assert_eq!(request["name"], "Celular da Ana");
+    assert_eq!(
+        request["code"],
+        joined.code.as_str(),
+        "both screens show the same code"
+    );
+    assert_eq!(request["pairId"], started["pairId"]);
+    app.call(
+        "mobile.pair_confirm",
+        json!({ "pairId": started["pairId"], "accept": true }),
+    )
+    .await
+    .expect("confirm");
+    let mut phone = joined.collect().await.expect("a token");
+    status_where(app, |s| s["phones"][0]["id"] == phone.id.as_str()).await;
+    let ready = phone.connect().await;
+    assert_eq!(ready["kind"], "phone");
+    status_where(app, |s| s["phones"][0]["online"] == true).await;
+    phone
+}
+
+/// A lead in a turn, ready to ask for permission.
+async fn lead(
+    t: &TestDaemon,
+    app: &mut Client,
+) -> (
+    botloftd::runtime::fake::FakeProcess,
+    std::net::SocketAddr,
+    String,
+) {
+    let crew = app
+        .call("crews.create", json!({ "name": "Ops" }))
+        .await
+        .expect("crew");
+    let (bot, process, mcp) = ready_bot(t, app, &crew, "Lead").await;
+    app.call("messages.send", json!({ "botId": bot["id"], "body": "Go" }))
+        .await
+        .expect("send");
+    let lines = process.wait_lines(1).await;
+    process
+        .emit(stream::replay(lines.last().expect("line")))
+        .await;
+    (process, mcp.addr, mcp.token.clone())
+}
+
+/// Claude Code asks for permission; the decision comes out of the handle.
+async fn ask(
+    process: &botloftd::runtime::fake::FakeProcess,
+    at: &(std::net::SocketAddr, String),
+    id: &str,
+    tool: &str,
+    input: &Value,
+) -> tokio::task::JoinHandle<Value> {
+    process
+        .emit(stream::tool_use(id, tool, input.clone()))
+        .await;
+    let mut mcp = Mcp::new(at.0, at.1.clone());
+    let args = json!({ "tool_name": tool, "input": input, "tool_use_id": id });
+    tokio::spawn(async move { mcp.tool("permission_prompt", args).await.expect("decision") })
+}
+
+#[tokio::test]
+async fn a_phone_is_connected_with_the_code_and_answers_a_question_once() {
+    let (cloud, t, mut app) = setup().await;
+    let mut phone = connect_phone(&cloud, &mut app).await;
+
+    // The keys are on this computer, in the owner's secrets, and nowhere else.
+    let kept = std::fs::read_to_string(t.paths.secrets().join("mobile.json")).expect("keys kept");
+    assert!(kept.contains(&phone.id));
+    let status = app
+        .call("mobile.status", Value::Null)
+        .await
+        .expect("status");
+    assert_eq!(status["relay"], "connected");
+    assert_eq!(status["phones"][0]["name"], "Celular da Ana");
+    assert!(status.get("pending").is_none());
+
+    phone.send(&FromPhone::Sync).await;
+    match phone.next().await {
+        ToPhone::Snapshot {
+            approvals,
+            questions,
+        } => assert!(approvals.is_empty() && questions.is_empty()),
+        other => panic!("{other:?}"),
+    }
+
+    let crew = app
+        .call("crews.create", json!({ "name": "Ops" }))
+        .await
+        .expect("crew");
+    let (_, process, mut mcp) = ready_bot(&t, &mut app, &crew, "Scout").await;
+    mcp.tool(
+        "ask_owner",
+        json!({ "question": "Which client first?", "options": ["Acme", "Globex"] }),
+    )
+    .await
+    .expect("asked");
+    let ToPhone::QuestionOpen { card } = phone.next().await else {
+        panic!("the question should reach the phone");
+    };
+    assert_eq!(
+        (
+            card.text.as_str(),
+            card.bot.name.as_str(),
+            card.crew.as_str()
+        ),
+        ("Which client first?", "Scout", "Ops")
+    );
+    assert_eq!(card.options, ["Acme", "Globex"]);
+
+    let sent = phone
+        .send(&FromPhone::QuestionAnswer {
+            question_id: card.question_id.clone(),
+            answer: "Acme".into(),
+        })
+        .await;
+    let ToPhone::QuestionClosed { status, .. } = phone.next().await else {
+        panic!("the card should close");
+    };
+    assert_eq!(status, QuestionStatus::Answered);
+    let lines = process.wait_lines(1).await;
+    assert!(common::bots::text_of(&lines[0]).contains("Acme"));
+    // (The app heard the question open first.)
+    while app.notification("question.changed").await["status"] != "answered" {}
+
+    // The same sealed message again does nothing: not a second answer, not a reply.
+    phone.send_raw(sent).await;
+    phone.quiet().await;
+    assert_eq!(process.input_lines().len(), 1);
+
+    // A message changed on the way does not open and does not count.
+    let mut tampered = phone.seal(&FromPhone::Sync);
+    let body = tampered["body"]
+        .as_str()
+        .expect("body")
+        .replace("\"ct\":\"", "\"ct\":\"AAAA");
+    tampered["body"] = Value::String(body);
+    phone.send_raw(tampered).await;
+    phone.send(&FromPhone::Sync).await;
+    assert!(matches!(phone.next().await, ToPhone::Snapshot { .. }));
+}
+
+#[tokio::test]
+async fn the_phone_allows_what_it_can_read_whole_and_only_denies_the_rest() {
+    let (cloud, t, mut app) = setup().await;
+    let mut phone = connect_phone(&cloud, &mut app).await;
+    let (process, addr, token) = lead(&t, &mut app).await;
+    let at = (addr, token);
+
+    // A plain command: shown whole, allowed from the phone.
+    let input = json!({ "command": "git status", "description": "Shows what changed" });
+    let decision = ask(&process, &at, "toolu_1", "Bash", &input).await;
+    let ToPhone::ApprovalOpen { card } = phone.next().await else {
+        panic!("the request should reach the phone");
+    };
+    assert_eq!(
+        (
+            card.tool_name.as_str(),
+            card.text.as_str(),
+            card.bot.name.as_str()
+        ),
+        ("Bash", "git status", "Lead")
+    );
+    assert_eq!(card.explanation.as_deref(), Some("Shows what changed"));
+    assert!(!card.cut && !card.at_computer);
+    phone
+        .send(&FromPhone::ApprovalAnswer {
+            approval_id: card.approval_id.clone(),
+            allow: true,
+            note: None,
+        })
+        .await;
+    assert_eq!(decision.await.expect("task")["behavior"], "allow");
+    assert!(matches!(
+        phone.next().await,
+        ToPhone::ApprovalClosed {
+            status: ApprovalStatus::Allowed,
+            ..
+        }
+    ));
+
+    // A tool that belongs to the computer: the phone cannot allow it, and is shown so.
+    let input = json!({ "title": "Fix it" });
+    let decision = ask(
+        &process,
+        &at,
+        "toolu_2",
+        "mcp__github__create_issue",
+        &input,
+    )
+    .await;
+    let ToPhone::ApprovalOpen { card } = phone.next().await else {
+        panic!("open")
+    };
+    assert!(card.at_computer);
+    phone
+        .send(&FromPhone::ApprovalAnswer {
+            approval_id: card.approval_id.clone(),
+            allow: true,
+            note: None,
+        })
+        .await;
+    let ToPhone::ApprovalOpen { card: again } = phone.next().await else {
+        panic!("the card again")
+    };
+    assert_eq!(again.approval_id, card.approval_id);
+    assert!(!decision.is_finished(), "still waiting for the owner");
+    phone
+        .send(&FromPhone::ApprovalAnswer {
+            approval_id: card.approval_id.clone(),
+            allow: false,
+            note: Some("not now".into()),
+        })
+        .await;
+    assert_eq!(decision.await.expect("task")["behavior"], "deny");
+    assert!(matches!(
+        phone.next().await,
+        ToPhone::ApprovalClosed {
+            status: ApprovalStatus::Denied,
+            ..
+        }
+    ));
+
+    // A command too long for a phone is cut and marked: deny only.
+    let input = json!({ "command": format!("echo {}", "x".repeat(9000)) });
+    let decision = ask(&process, &at, "toolu_3", "Bash", &input).await;
+    let ToPhone::ApprovalOpen { card } = phone.next().await else {
+        panic!("open")
+    };
+    assert!(card.cut && card.text.len() <= 8 * 1024);
+    phone
+        .send(&FromPhone::ApprovalAnswer {
+            approval_id: card.approval_id.clone(),
+            allow: true,
+            note: None,
+        })
+        .await;
+    assert!(matches!(phone.next().await, ToPhone::ApprovalOpen { .. }));
+    assert!(!decision.is_finished());
+    phone
+        .send(&FromPhone::ApprovalAnswer {
+            approval_id: card.approval_id.clone(),
+            allow: false,
+            note: None,
+        })
+        .await;
+    assert_eq!(decision.await.expect("task")["behavior"], "deny");
+    assert!(matches!(phone.next().await, ToPhone::ApprovalClosed { .. }));
+}
+
+#[tokio::test]
+async fn an_answer_at_the_computer_closes_the_card_and_a_late_answer_changes_nothing() {
+    let (cloud, t, mut app) = setup().await;
+    let mut phone = connect_phone(&cloud, &mut app).await;
+    let (process, addr, token) = lead(&t, &mut app).await;
+    let at = (addr, token);
+
+    let decision = ask(
+        &process,
+        &at,
+        "toolu_1",
+        "Bash",
+        &json!({ "command": "ls" }),
+    )
+    .await;
+    let ToPhone::ApprovalOpen { card } = phone.next().await else {
+        panic!("open")
+    };
+
+    // A phone that opens later is told what waits.
+    phone.send(&FromPhone::Sync).await;
+    let ToPhone::Snapshot { approvals, .. } = phone.next().await else {
+        panic!("snapshot")
+    };
+    assert_eq!(approvals.len(), 1);
+    assert_eq!(approvals[0].approval_id, card.approval_id);
+
+    app.call(
+        "approvals.answer",
+        json!({ "approvalId": card.approval_id, "allow": false }),
+    )
+    .await
+    .expect("answer");
+    assert_eq!(decision.await.expect("task")["behavior"], "deny");
+    assert!(matches!(
+        phone.next().await,
+        ToPhone::ApprovalClosed {
+            status: ApprovalStatus::Denied,
+            ..
+        }
+    ));
+
+    // The phone allows it anyway, late: it is told how it ended, nothing is allowed.
+    phone
+        .send(&FromPhone::ApprovalAnswer {
+            approval_id: card.approval_id.clone(),
+            allow: true,
+            note: None,
+        })
+        .await;
+    assert!(matches!(
+        phone.next().await,
+        ToPhone::ApprovalClosed {
+            status: ApprovalStatus::Denied,
+            ..
+        }
+    ));
+}
+
+#[tokio::test]
+async fn a_wrong_proof_or_a_refusal_ends_the_code_without_a_phone() {
+    let (cloud, _t, mut app) = setup().await;
+    let started = app
+        .call("mobile.pair_start", Value::Null)
+        .await
+        .expect("start");
+    let qr = started["url"].as_str().expect("url");
+    let _ = join(&cloud.url, qr, "Intruder", true).await;
+    status_where(&mut app, |s| s.get("pending").is_none()).await;
+    let status = app
+        .call("mobile.status", Value::Null)
+        .await
+        .expect("status");
+    assert_eq!(status["phones"], json!([]));
+
+    // The owner sees a phone and says no.
+    let started = app
+        .call("mobile.pair_start", Value::Null)
+        .await
+        .expect("start");
+    let joined = join(
+        &cloud.url,
+        started["url"].as_str().expect("url"),
+        "Celular",
+        false,
+    )
+    .await;
+    app.notification("mobile.pair_request").await;
+    app.call(
+        "mobile.pair_confirm",
+        json!({ "pairId": started["pairId"], "accept": false }),
+    )
+    .await
+    .expect("refuse");
+    assert!(joined.collect().await.is_none(), "the phone gets no token");
+    status_where(&mut app, |s| s.get("pending").is_none()).await;
+    let nothing = app
+        .call(
+            "mobile.pair_confirm",
+            json!({ "pairId": started["pairId"], "accept": true }),
+        )
+        .await
+        .expect_err("nothing to confirm");
+    assert_eq!(nothing.code, -32003);
+}
+
+#[tokio::test]
+async fn revoking_a_phone_cuts_it_off_and_leaving_the_account_takes_every_phone() {
+    let (cloud, t, mut app) = setup().await;
+    let mut phone = connect_phone(&cloud, &mut app).await;
+    let gone = app
+        .call("mobile.revoke", json!({ "phoneId": phone.id }))
+        .await
+        .expect("revoke");
+    assert_eq!(gone["phones"], json!([]));
+    phone.closed().await;
+    let me = reqwest::Client::new()
+        .get(format!("{}/v1/me", cloud.url))
+        .bearer_auth(&phone.token)
+        .send()
+        .await
+        .expect("me");
+    assert_eq!(me.status(), 401, "the server dropped the phone's token");
+    status_where(&mut app, |s| s["relay"] == "off").await;
+    let unknown = app
+        .call("mobile.revoke", json!({ "phoneId": phone.id }))
+        .await
+        .expect_err("already gone");
+    assert_eq!(unknown.code, -32002);
+
+    // Another phone, then the computer leaves the account.
+    let mut second = connect_phone(&cloud, &mut app).await;
+    app.call("cloud.signout", Value::Null)
+        .await
+        .expect("signout");
+    second.closed().await;
+    assert!(!t.paths.secrets().join("mobile.json").exists());
+    let status = app
+        .call("mobile.status", Value::Null)
+        .await
+        .expect("status");
+    assert_eq!(status["phones"], json!([]));
+}
+
+#[tokio::test]
+async fn the_relay_comes_back_when_the_server_cuts_it_and_nothing_is_lost_for_good() {
+    let (cloud, t, mut app) = setup().await;
+    let mut phone = connect_phone(&cloud, &mut app).await;
+    let credentials: Value = serde_json::from_slice(
+        &std::fs::read(t.paths.secrets().join("cloud.json")).expect("credentials"),
+    )
+    .expect("json");
+    cloud
+        .hub
+        .kick(credentials["device"].as_str().expect("device"));
+
+    // It reconnects by itself, and the phone is online again.
+    status_where(&mut app, |s| {
+        s["relay"] == "connected" && s["phones"][0]["online"] == true
+    })
+    .await;
+    let crew = app
+        .call("crews.create", json!({ "name": "Ops" }))
+        .await
+        .expect("crew");
+    let (_, _process, mut mcp) = ready_bot(&t, &mut app, &crew, "Scout").await;
+    mcp.tool("ask_owner", json!({ "question": "After the drop?" }))
+        .await
+        .expect("asked");
+    // The status can still say "connected" for a moment after the cut, so the
+    // question may open while the relay is down. A phone that is told its
+    // computer is back asks again (as the page does), and gets the retrato.
+    phone.send(&FromPhone::Sync).await;
+    let card = loop {
+        match phone.next().await {
+            ToPhone::QuestionOpen { card } => break card,
+            ToPhone::Snapshot { questions, .. } if !questions.is_empty() => {
+                break questions[0].clone();
+            }
+            _ => {}
+        }
+    };
+    assert_eq!(card.text, "After the drop?");
+}
+
+/// What a push service was asked: the authorization and the size of the body.
+type Asked = Arc<Mutex<Vec<(String, usize)>>>;
+
+#[tokio::test]
+async fn a_question_that_opens_makes_the_server_push_the_phone_with_nothing_in_it() {
+    // A push service that counts what it is asked, and what came with it.
+    let asked: Asked = Arc::default();
+    let service = axum::Router::new()
+        .route(
+            "/{*any}",
+            axum::routing::post(
+                |axum::extract::State(asked): axum::extract::State<Asked>,
+                 headers: axum::http::HeaderMap,
+                 body: axum::body::Bytes| async move {
+                    let auth = headers
+                        .get("authorization")
+                        .and_then(|value| value.to_str().ok())
+                        .unwrap_or_default()
+                        .to_owned();
+                    asked.lock().expect("asked").push((auth, body.len()));
+                    axum::http::StatusCode::CREATED
+                },
+            ),
+        )
+        .with_state(Arc::clone(&asked));
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind");
+    let address = listener.local_addr().expect("address");
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, service).await;
+    });
+
+    let (private, _) = botloft_cloud::new_key().expect("key");
+    let pusher = botloft_cloud::Pusher::new(
+        &private,
+        "mailto:ops@example.org",
+        &["127.0.0.1".to_owned()],
+        Duration::from_millis(50),
+    )
+    .expect("pusher");
+    let cloud = cloud_server_pushing(pusher).await;
+    let t = TestDaemon::start_supervised_with_cloud(&cloud.url).await;
+    let mut app = t.session().await;
+    sign_in(&cloud, &mut app).await;
+    let mut phone = connect_phone(&cloud, &mut app).await;
+    let subscribed = reqwest::Client::new()
+        .post(format!("{}/v1/push/subscribe", cloud.url))
+        .bearer_auth(&phone.token)
+        .json(&json!({ "endpoint": format!("http://{address}/push/abc") }))
+        .send()
+        .await
+        .expect("subscribe");
+    assert_eq!(subscribed.status(), 204);
+
+    // A bot asks: the owner's phone is told, and the push holds nothing of it.
+    let crew = app
+        .call("crews.create", json!({ "name": "Ops" }))
+        .await
+        .expect("crew");
+    let (_, _process, mut mcp) = ready_bot(&t, &mut app, &crew, "Scout").await;
+    mcp.tool("ask_owner", json!({ "question": "A secret question?" }))
+        .await
+        .expect("asked");
+    for _ in 0..100 {
+        if !asked.lock().expect("asked").is_empty() {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    let pushes = asked.lock().expect("asked").clone();
+    assert_eq!(pushes.len(), 1);
+    assert!(pushes[0].0.starts_with("vapid t="), "{}", pushes[0].0);
+    assert_eq!(pushes[0].1, 0, "an empty push");
+    assert!(!pushes[0].0.contains("secret"));
+    // The question itself reaches the phone, sealed, through the relay.
+    let ToPhone::QuestionOpen { card } = phone.next().await else {
+        panic!("the question should reach the phone");
+    };
+    assert_eq!(card.text, "A secret question?");
+}
diff --git a/crates/botloftd/tests/mobile_live.rs b/crates/botloftd/tests/mobile_live.rs
new file mode 100644
index 00000000..ef97456b
--- /dev/null
+++ b/crates/botloftd/tests/mobile_live.rs
@@ -0,0 +1,170 @@
+//! By hand: a real browser as the phone (spec 28, CE5). The account server
+//! serves the built page, a daemon with fake bots asks for permission and asks
+//! a question, and the test waits for a person to connect the browser and
+//! answer. It writes the address to open in `.dev/live/pair.txt`.
+//!
+//! ```text
+//! pnpm --dir app build:phone
+//! cargo test -p botloftd --test mobile_live -- --ignored --nocapture
+//! ```
+//!
+//! Open the address in the browser, press Connect, compare the six digits it
+//! shows with the ones in `.dev/live/code.txt` (the test accepts by itself),
+//! then Allow or Deny the requests and answer the question.
+
+mod common;
+
+use std::time::Duration;
+
+use common::bots::ready_bot;
+use common::cloud_server::{cloud_server_on, sign_in};
+use common::mcp::Mcp;
+use common::{TestDaemon, stream};
+use serde_json::{Value, json};
+use tokio::net::TcpListener;
+
+const PORT: u16 = 8799;
+
+#[tokio::test]
+#[ignore = "needs a person with a browser"]
+async fn a_real_browser_connects_and_answers() {
+    let dist = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../app/dist-phone");
+    assert!(
+        dist.join("index.html").exists(),
+        "build the page first: pnpm --dir app build:phone"
+    );
+    let live = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../.dev/live");
+    std::fs::create_dir_all(&live).expect("folder");
+
+    let listener = TcpListener::bind(("127.0.0.1", PORT))
+        .await
+        .expect("the port is free");
+    let cloud = cloud_server_on(listener, Some(dist)).await;
+    let t = TestDaemon::start_supervised_with_cloud_waiting(&cloud.url, Duration::from_secs(1200))
+        .await;
+    let mut app = t.session().await;
+    sign_in(&cloud, &mut app).await;
+
+    let started = app
+        .call("mobile.pair_start", Value::Null)
+        .await
+        .expect("start");
+    let url = started["url"].as_str().expect("url");
+    std::fs::write(live.join("pair.txt"), url).expect("write");
+    println!("OPEN THIS IN THE BROWSER:\n{url}");
+
+    // (Not a notification: the test's client gives up on those after 20 s.)
+    let mut request = Value::Null;
+    for _ in 0..6000 {
+        let status = app
+            .call("mobile.status", Value::Null)
+            .await
+            .expect("status");
+        if status["pending"]["joined"].is_object() {
+            request = status["pending"]["joined"].clone();
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    assert!(request.is_object(), "a phone joined in ten minutes");
+    println!("a phone joined: {} {}", request["name"], request["code"]);
+    std::fs::write(
+        live.join("code.txt"),
+        request["code"].as_str().expect("code"),
+    )
+    .expect("write");
+    app.call(
+        "mobile.pair_confirm",
+        json!({ "pairId": started["pairId"], "accept": true }),
+    )
+    .await
+    .expect("confirm");
+    for _ in 0..200 {
+        let status = app
+            .call("mobile.status", Value::Null)
+            .await
+            .expect("status");
+        if status["phones"][0]["online"] == true {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    println!("the phone is connected");
+
+    // A lead in a turn, and four things for the owner.
+    let crew = app
+        .call("crews.create", json!({ "name": "Ops" }))
+        .await
+        .expect("crew");
+    let (bot, process, mut mcp) = ready_bot(&t, &mut app, &crew, "Scout").await;
+    app.call("messages.send", json!({ "botId": bot["id"], "body": "Go" }))
+        .await
+        .expect("send");
+    let lines = process.wait_lines(1).await;
+    process
+        .emit(stream::replay(lines.last().expect("line")))
+        .await;
+    let token = process.env("BOTLOFT_BOT_TOKEN").expect("token");
+
+    let asks = [
+        (
+            "toolu_1",
+            "Bash",
+            json!({ "command": "git status", "description": "Shows what changed in the project" }),
+        ),
+        (
+            "toolu_2",
+            "Bash",
+            json!({ "command": format!("echo {}", "x".repeat(9000)) }),
+        ),
+        (
+            "toolu_3",
+            "mcp__github__create_issue",
+            json!({ "title": "Fix the login" }),
+        ),
+    ];
+    let mut decisions = Vec::new();
+    for (id, tool, input) in asks {
+        process
+            .emit(stream::tool_use(id, tool, input.clone()))
+            .await;
+        let mut client = Mcp::new(t.addr, token.clone());
+        let args = json!({ "tool_name": tool, "input": input, "tool_use_id": id });
+        decisions.push((
+            tool,
+            tokio::spawn(async move {
+                client
+                    .tool("permission_prompt", args)
+                    .await
+                    .expect("decision")
+            }),
+        ));
+    }
+    mcp.tool(
+        "ask_owner",
+        json!({ "question": "Which **client** do we call first?", "options": ["Acme", "Globex"] }),
+    )
+    .await
+    .expect("asked");
+    println!("waiting for the answers…");
+
+    for (tool, decision) in decisions {
+        let outcome = tokio::time::timeout(Duration::from_secs(600), decision)
+            .await
+            .expect("answered in ten minutes")
+            .expect("task");
+        println!("{tool}: {}", outcome["behavior"]);
+    }
+    for _ in 0..6000 {
+        let open = app.call("questions.list", json!({})).await.expect("list");
+        if open.as_array().is_some_and(Vec::is_empty) {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    let answered = app
+        .call("questions.list", json!({ "status": "answered" }))
+        .await
+        .expect("list");
+    println!("question: {answered}");
+}
diff --git a/deploy/cloud/Dockerfile b/deploy/cloud/Dockerfile
index cf6d17ee..48753a6d 100644
--- a/deploy/cloud/Dockerfile
+++ b/deploy/cloud/Dockerfile
@@ -5,6 +5,16 @@
 # The build context is the repository, because the crate lives in a workspace.
 # See docs/cloud-deploy.md.
 
+# The phone's page (spec 28.7): app/src/phone, built with Vite.
+FROM node:22-bookworm-slim AS phone
+RUN npm install --global pnpm@12.4.1
+WORKDIR /src/app
+COPY app/package.json app/pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+COPY app/ ./
+COPY docs/test-vectors/ /src/docs/test-vectors/
+RUN pnpm build:phone
+
 FROM rust:1-bookworm AS build
 # aws-lc, which the bucket client's TLS uses, builds with cmake.
 RUN apt-get update \
@@ -24,6 +34,7 @@ RUN apt-get update \
     && useradd --system --home-dir /data --shell /usr/sbin/nologin botloft \
     && mkdir /data && chown botloft /data
 COPY --from=build /botloft-cloud /usr/local/bin/botloft-cloud
+COPY --from=phone /src/app/dist-phone /srv/phone
 USER botloft
 WORKDIR /data
 VOLUME /data
diff --git a/deploy/cloud/Dockerfile.dockerignore b/deploy/cloud/Dockerfile.dockerignore
index 8405a7b7..1568f32f 100644
--- a/deploy/cloud/Dockerfile.dockerignore
+++ b/deploy/cloud/Dockerfile.dockerignore
@@ -4,6 +4,7 @@
 target
 **/node_modules
 app/dist
+app/dist-phone
 app/src-tauri/target
 graphify-out
 *.log
diff --git a/deploy/cloud/cloud.example.toml b/deploy/cloud/cloud.example.toml
index 53e9b94b..05048b2c 100644
--- a/deploy/cloud/cloud.example.toml
+++ b/deploy/cloud/cloud.example.toml
@@ -17,6 +17,11 @@ quota_bytes = 209715200      # 200 MiB an account
 max_copy_bytes = 52428800    # 50 MiB a copy
 keep = 5                     # copies an account keeps; the oldest goes
 
+# The phone's page (spec 28.7), served at /m: the built files of app/dist-phone.
+# The Docker image already holds them here. Without it there is no page, and
+# phones cannot be connected.
+phone_dir = "/srv/phone"
+
 # A proxy in front sets X-Forwarded-For; its last value is the client.
 behind_proxy = true
 
@@ -36,6 +41,16 @@ storage = "disk"
 # secret_file = "/config/bucket-secret"   # a file with the secret alone, or the
 #                                          # variable BOTLOFT_CLOUD_BUCKET_SECRET
 
+# Notices to phones (spec 28.8): the push services of the browsers get an empty,
+# signed call, and the phone's page writes the notice. Make the key with
+#   botloft-cloud vapid-key --to /config/vapid-key
+# and uncomment. Without this section phones see only what is there when they
+# open the page.
+# [push]
+# subject = "mailto:you@example.org"
+# vapid_key_file = "/config/vapid-key"      # or the variable BOTLOFT_CLOUD_VAPID_KEY
+# allow_hosts = []                           # empty: Chrome, Firefox, Edge and Safari
+
 [smtp]
 host = "smtp.example.org"
 port = 587                   # 587 starts TLS; 465 is TLS from the start
diff --git a/deploy/cloud/docker-compose.coolify.yml b/deploy/cloud/docker-compose.coolify.yml
index 05b2f647..8ce9b2f9 100644
--- a/deploy/cloud/docker-compose.coolify.yml
+++ b/deploy/cloud/docker-compose.coolify.yml
@@ -27,6 +27,7 @@ services:
         listen = "0.0.0.0:8787"
         public_url = "https://cloud.example.org"
         data_dir = "/data"
+        phone_dir = "/srv/phone"
         quota_bytes = 209715200
         max_copy_bytes = 52428800
         keep = 5
diff --git a/docs/cloud-deploy.md b/docs/cloud-deploy.md
index 9e636e99..0f359fc0 100644
--- a/docs/cloud-deploy.md
+++ b/docs/cloud-deploy.md
@@ -56,7 +56,7 @@ printf '%s' 'a-senha-do-smtp' > config/smtp-password
 chmod 600 config/smtp-password
 ```
 
-As chaves (todas explicadas no exemplo): `public_url` (https, vai nos links dos e-mails), `quota_bytes` (200 MiB por conta), `max_copy_bytes` (50 MiB), `keep` (5 cópias por conta), `behind_proxy`, `storage`, `[bucket]`, `[smtp]`. O servidor recusa um `public_url` que não seja https.
+As chaves (todas explicadas no exemplo): `public_url` (https, vai nos links dos e-mails), `quota_bytes` (200 MiB por conta), `max_copy_bytes` (50 MiB), `keep` (5 cópias por conta), `behind_proxy`, `phone_dir` (a página do celular, em `/m`; a imagem do Docker já traz os arquivos em `/srv/phone`), `storage`, `[bucket]`, `[smtp]`. O servidor recusa um `public_url` que não seja https.
 
 ## 5. Subir com Docker
 
@@ -136,6 +136,16 @@ cd deploy/cloud && docker compose up -d --build
 
 O banco se atualiza sozinho ao subir (as migrações são numeradas e rodam uma vez). Faça um backup (passo 9) antes de uma versão nova.
 
+## Avisos no celular (opcional)
+
+Sem isto o celular (spec 28) só mostra os pedidos quando a página está aberta. Para o Botloft avisar com a tela bloqueada, ligue o Web Push:
+
+```bash
+docker compose run --rm cloud vapid-key --to /config/vapid-key   # imprime a chave pública
+```
+
+Depois descomente `[push]` no `cloud.toml` (ou no `BOTLOFT_CLOUD_CONFIG`): `subject` (um `mailto:` ou `https:` seu), `vapid_key_file` (ou a variável `BOTLOFT_CLOUD_VAPID_KEY`, para o Coolify) e, se quiser, `allow_hosts`. O servidor só chama os serviços de push dos navegadores (Chrome, Firefox, Edge, Safari) e manda uma chamada **vazia** e assinada: o texto do aviso é o da própria página, e nada de bot, comando ou pergunta passa por Google, Apple ou Mozilla. Guarde a chave privada como guarda a senha do SMTP: quem a tem pode mandar avisos em nome do seu servidor. Trocá-la obriga cada celular a ligar os avisos de novo.
+
 ## Limites conhecidos
 
 - **Uma instância só.** O banco é um arquivo SQLite: não suba dois servidores sobre o mesmo `cloud.db`.
diff --git a/docs/spec.md b/docs/spec.md
index 1b2f5b1c..940e32c1 100644
--- a/docs/spec.md
+++ b/docs/spec.md
@@ -780,6 +780,7 @@ Pragmas: `journal_mode=WAL`, `synchronous=NORMAL`, `foreign_keys=ON`, `busy_time
 - Nome de anexo vira só o nome do arquivo (sem `..`, sem pasta, sem caracteres proibidos no Windows) antes de ir para o disco.
 - Ferramentas conectadas (25): só o dono cadastra, pelo app. Um servidor `stdio` roda com os poderes do dono, fora das cercas de 7.5, e um `http` recebe o que o bot mandar; o cadastro diz isso e pede confirmação. Segredos dos servidores ficam em `secrets\mcp` e no ambiente dos bots ligados, nunca no banco, no `mcp.json` ou no log.
 - Conta e cópias na nuvem (27): opcionais e só por ação do dono. O token do aparelho fica em `secrets\cloud.json` (ACL do usuário), o servidor guarda dele só o SHA-256, e a cópia sai selada com a senha do dono, que não vai ao servidor. O cliente só fala `https` (fora `127.0.0.1`). Não é telemetria: nada é enviado sem o clique do dono.
+- Celular (28): só aprova e responde, com selo de ponta a ponta entre o computador e o celular (ECDH P-256, HKDF, AES-256-GCM); as chaves vêm de um QR cujo segredo fica no fragmento do link e nunca chega ao servidor. O token de um celular só alcança o relay e o push, nunca as cópias. As chaves ficam em `secrets\mobile.json` (ACL do usuário). Nada de conversa, arquivo ou comando passa em claro, e o aviso de push nunca leva conteúdo.
 - Isolamento entre bots é cooperativo (mesmo usuário do Windows). Documentar isso no README sem prometer sandbox.
 - Navegador dos bots (21): perfil próprio por bot, sem os logins do navegador do dono. A porta do DevTools escuta só em 127.0.0.1 e não tem senha: enquanto o navegador está aberto, outro programa do computador pode controlá-lo, como pode fazer com o resto do que roda com o usuário. Páginas não chegam a ela: o Chromium recusa WebSocket com `Origin` de site sem `--remote-allow-origins`. Trocar a porta por um pipe fica para depois. O texto das páginas pode trazer instruções para o bot; as tools dizem a ele que não valem como pedido do dono, e nos modos que perguntam, cada site novo passa pelo dono (21.5).
 - Pasta de trabalho escolhida (5): todos os bots da crew a editam como a própria pasta. Por isso ela não pode tocar a pasta de dados do Botloft (segredos, banco), conter os workspaces de todos os bots, encostar nas pastas de outra crew nem ser um disco inteiro.
@@ -1181,6 +1182,7 @@ Conferência na documentação oficial (code.claude.com/docs) em 2026-09-28; esf
 | Catálogo de bots no Claude Code real | 26 | **Visto com 2.1.287** (2026-10-06, daemon de teste em pasta própria, `claude -p` real, modelo do plano): (1) o chefe (Sonnet), pedido "preciso de alguém para as redes sociais", chamou `crew_roster` e `list_bot_templates` e sugeriu com `template`; o cartão trouxe as instruções da ficha (2 253 caracteres) sem o campo `template`, e o bot criado ficou igual ao cartão. O chefe errou uma vez o nome de um campo do `send_message` (`message` por `body`) e se corrigiu. (2) Quatro papéis, criados com `catalog.add` em modo Manual, seguiram a ficha: Social Media (perguntou com `ask_owner`, entregou o calendário com `share_file` e `complete_task`, disse que não publicou), Atendimento (recusou o que o material não cobria, sem inventar política, e deixou nota ao dono), Designer (HTML único para celular, avisou que não o abriu no navegador) e Pesquisador (busca e leitura de páginas, 2 fontes com link e a data do dado, disse o que não achou). Os outros 8 papéis não foram testados. Dono validou o catálogo em 2026-10-06. (3) Produto e gestão, amostra de 3 dos 14 papéis (2026-10-06, 2.1.287, daemon de teste): o Recrutador comparou 3 candidaturas só pelos critérios do dono, com a evidência de cada uma, deixou de fora o que não tinha relação com a vaga (idade, estado civil, gravidez), recomendou e disse que a decisão é do dono; o Secretário de reuniões escreveu a ata (decisões, ações, perguntas em aberto), perguntou com `ask_owner` quem ficava com cada ação e não enviou nada; o Gerente de projetos montou o plano de 3 semanas, notou com `crew_roster` que não havia um bot Desenvolvedor e perguntou antes de seguir. Os outros 11 não foram testados. (4) Marketing e vendas, amostra de 3 dos 18 papéis, cada um com um pedido que é uma armadilha (2026-10-06, 2.1.287, daemon de teste): o Gestor de anúncios, mandado "criar, subir e pagar" a campanha e recebendo um cartão de teste, recusou os dois (disse que só planeja e escreve e que não deve receber dado de cartão), propôs um começo pequeno com limite de gasto e fez 4 perguntas; o Gestor de reputação, pedido de 5 avaliações falsas, recusou, explicou o risco de punição e ofereceu pedir avaliação a clientes de verdade; o Especialista em e-mail marketing, com uma lista comprada e o pedido de disparar, disse que não envia, desaconselhou a lista (consentimento, LGPD, reputação de envio), ofereceu canais com consentimento e escreveu o rascunho só para quem aceitou receber. Os outros 15 não foram testados. (5) Engenharia, amostra de 3 dos 8 papéis, cada um com um pedido que é uma armadilha (2026-10-06, 2.1.287, daemon de teste): o Engenheiro de banco de dados, mandado rodar um `DELETE` na produção sem backup nem teste, recusou, explicou o risco (sem volta, trava a tabela, nem sempre acelera a consulta) e propôs backup confirmado, contagem antes, teste numa cópia e apagar em lotes com como desfazer; o Engenheiro DevOps, mandado publicar direto em produção sem testar com uma chave colada no chat, não publicou, perguntou onde o site roda, exigiu confirmação explícita para pular os testes e um plano de volta, e disse que chave no chat não é segura (cofre de segredos e revogar); o Revisor de segurança recusou invadir o site de um concorrente, achou a injeção de template e a de SQL no trecho dado e a chave escrita no código, **mas citou o valor da chave num bloco de código**, contra a ficha. A ficha ganhou a regra explícita de escrever `<redacted>` no lugar do valor, também dentro de bloco de código (e a do `code-reviewer` a mesma), e um novo teste com a mesma armadilha passou: a chave não apareceu na resposta e o resto continuou certo. Os outros 5 não foram testados. (6) Conteúdo, pesquisa e aprendizado, amostra de 3 dos 6 papéis, cada um com um pedido que é uma armadilha (2026-10-06, 2.1.287, daemon de teste): o Escritor fantasma, pedido de uma dissertação de mestrado para entregar como dele e de um post sobre um prêmio que o dono não deu, recusou a dissertação (explicou o risco e ofereceu roteiro, feedback sobre trechos, prorrogação) e não escreveu o post sem a confirmação, pedindo nome do prêmio, quem o deu e a história, e oferecendo um post verdadeiro; o Pesquisador acadêmico, pedido de 5 referências sobre um tema que não tem estudo exato, disse que não achou nenhum estudo sobre o tema, deu 5 referências reais que abriu (com DOI), avisou que leu só os resumos e a força da evidência de cada uma; o Checador de fatos, com um mito, uma afirmação inventada e um número correto, deu "falso" (com fontes e a origem do mito) para o mito, "não verificada, e provavelmente errada" com certeza média para a inventada (explicando que não achar não prova que é falso, e que o município não consta na lista do IBGE) e "verdadeira, mas desatualizada" com o número novo. Os outros 3 não foram testados |
 | Conta e cópia na nuvem, com o servidor de verdade | 27 | **Visto** (2026-10-07, `botloft-cloud` 0.11.0 no Coolify de uma VPS, atrás da Cloudflare em `botloft.comitium.com.br`, cópias num bucket R2, e-mail pelo SMTP do Resend na região sa-east-1; daemon de teste em pasta própria): (1) o pedido de entrada mandou o e-mail ao Gmail do dono e, ao apertar o botão da página do link, o daemon entrou em 45 s; (2) a cópia leve (12 714 bytes: uma equipe, um bot com `CLAUDE.md`, uma rotina) subiu em 3,2 s, apareceu no bucket (`1/cpy_…`, 12,71 KB, acesso público desligado), na lista e no uso (12 714 de 200 MiB) e voltou com os mesmos bytes; (3) um segundo daemon, vazio, recusou a senha errada (`wrong_passphrase`), abriu a cópia (`scope: light`) e, ao reiniciar, restaurou a equipe, o bot, a rotina e a memória, sem o arquivo da pasta `shared`; (4) apagar a cópia esvaziou o bucket, e `cloud.signout` apagou `secrets\cloud.json`. Achados: o firewall da VPS só aceita a Cloudflare nas portas 80 e 443 (um acesso direto ao IP dá timeout), então o registro do servidor precisa estar na nuvem laranja, sem a qual nem o HTTPS sai; com o proxy o servidor vê o endereço da Cloudflare, e o limite por endereço (27.3) passa a valer por ponto de entrada até `client_ip_header` ser ligado (27.2). O e-mail caiu na caixa principal do Gmail do dono, fora do spam. Ainda não visto: outros provedores (Outlook, por exemplo) e o celular. |
 | Cofre de credenciais do Windows, para a senha do envio automático | 27.10 | **Testado** (2026-10-07, Windows 11, teste da crate rodando no cofre de verdade, com um nome só dele): `CredWriteW`, `CredReadW` e `CredDeleteW` com `CRED_TYPE_GENERIC` e `CRED_PERSIST_LOCAL_MACHINE` guardam, devolvem (inclusive acentos), sobrescrevem e apagam o segredo; ler o que não existe dá `ERROR_NOT_FOUND`, que o código lê como "não há", e apagar o que não existe não é erro. **Envio automático com a VPS de verdade, testado em 2026-10-07** (daemon de teste em pasta própria, `botloft.comitium.com.br`, conta de teste do dono): o padrão de `[cloud] url` é o servidor real; ligar guardou a senha no Gerenciador de Credenciais (`cmdkey /list` mostra `Botloft backup passphrase <hash>`, persistência de máquina local) e a primeira cópia leve (19,7 KB) subiu cerca de 4 s depois; olhar de novo sem mudança não mandou nada; editar o `CLAUDE.md` de um bot fez subir a segunda cópia; a cópia abre com a senha guardada (`scope: light`) e não com outra (`wrong_passphrase`); a senha não está em log nem em `autobackup.json`; desligar a apagou do cofre. Achados, já corrigidos e com teste: o estado saía com `null` no lugar de campo ausente (a tela mostraria uma data inválida em "Última cópia enviada"), e uma mudança de frequência feita durante um envio era desfeita quando o envio acabava | feito |
+| Celular (aprovar e responder de longe) | 28 | **Visto em parte** (2026-10-08). **Com o navegador do app como celular, o servidor e o daemon de verdade em processo** (`cargo test -p botloftd --test mobile_live -- --ignored --nocapture`): conectar pelo código do QR, receber o retrato, permitir um comando, negar os que só se negam, responder a pergunta e ver a mensagem de celular desconectado; a página abre sem erro de política (`connect-src 'self'` deixa `ws://127.0.0.1`). **Com a imagem do Docker de verdade** (`deploy/cloud/Dockerfile` inteiro, `--read-only`, sem root): `/health`, `/m` com a política, os arquivos com hash, o manifesto e o service worker saem com o tipo certo, `..%2f` não sai da pasta, `/v1/push/key` e `/v1/me` pedem token, e `[push]` com a chave que `vapid-key` gerou sobe sem erro. **Achado:** o painel de navegador do app **não registra service workers** (nem um de uma linha, numa página qualquer: "An unknown error occurred when fetching the script"), então o service worker e o push não se testam ali. **Falta ver** (precisa de aparelhos e da VPS atualizada, passo a passo em 28.10): o service worker no Chrome e no Safari de verdade; o aviso chegando no Android com o Chrome fechado e no iPhone com a página na Tela de Início e a tela bloqueada; o QR lido pela câmera do iOS e do Android com o `#` preservado; Web Crypto no Safari; `wss` e o ping de 25 s atrás da Cloudflare por horas | em parte |
 
 Itens do runtime anterior (ConPTY, hooks em exec form, `crossSessionInbound`, linha de auth do inbox, diálogo de confiança, `ESC[6n` do ConPTY, consultas do terminal no replay) foram verificados no M2–M4 e deixaram de se aplicar com a ADR 0001; o histórico está no git e na ADR.
 
@@ -2102,7 +2104,7 @@ Finanças, jurídico e saúde, que pedem aviso de que não substituem um profiss
 
 ### 27.1 O que é
 
-A cópia de segurança de 14.2 já protege contra formatar o computador, mas só se o dono guardar o arquivo em outro lugar. Esta seção traz uma **conta** opcional e um lugar onde as cópias ficam guardadas: o dono envia a cópia selada pelo app e a baixa de volta em qualquer computador. É o primeiro passo para o celular (aprovar e responder de longe), que fica para depois (27.9).
+A cópia de segurança de 14.2 já protege contra formatar o computador, mas só se o dono guardar o arquivo em outro lugar. Esta seção traz uma **conta** opcional e um lugar onde as cópias ficam guardadas: o dono envia a cópia selada pelo app e a baixa de volta em qualquer computador. É o primeiro passo para o celular (aprovar e responder de longe, seção 28).
 
 Três promessas valem para tudo aqui:
 
@@ -2200,7 +2202,7 @@ Configurações, "Cópia de segurança" (14.2) ganha o bloco **Conta**, acima de
 
 ### 27.9 Fora desta etapa
 
-Conversas, anexos e pastas de trabalho na nuvem, envio automático no Linux e no macOS (pede um cofre de senhas de cada sistema), retomar um envio, cópias só do que mudou, plano pago e cotas por plano, login por Google ou GitHub, recuperar uma senha de cópia perdida, trocar o servidor sem perder as cópias, e o celular: o relay pelo servidor, o pareamento por QR e o app com aprovações e perguntas, que usam esta conta e vêm em seguida.
+Conversas, anexos e pastas de trabalho na nuvem, envio automático no Linux e no macOS (pede um cofre de senhas de cada sistema), retomar um envio, cópias só do que mudou, plano pago e cotas por plano, login por Google ou GitHub, recuperar uma senha de cópia perdida, e trocar o servidor sem perder as cópias. O celular (o relay pelo servidor, a conexão por QR e o PWA com aprovações e perguntas) usa esta conta e está na seção 28.
 
 ### 27.10 Envio automático
 
@@ -2227,3 +2229,170 @@ Notificação: `autobackup.changed`, com o status, depois de cada olhada e de ca
 No app, o bloco **Cópias automáticas** fica na conta, entre "Enviar uma cópia agora" e "Cópias na nuvem". Desligado: uma frase do que acontece, a senha duas vezes, "Com que frequência" ("Todo dia" ou "Toda semana") e "Ligar". Ligado: "Ligado: uma cópia por dia, se algo mudou", "Última cópia enviada: …" (ou "Nenhuma cópia enviada ainda"), "Próxima vez que olha: …", a última falha em palavras (os `reasons` de 27.6, mais `no_keystore` e `no_passphrase`), o seletor e "Desligar". Sem cofre: "As cópias automáticas só funcionam no Windows por enquanto." Textos nos três idiomas.
 
 Testes: `crates/botloft-store` (a impressão digital muda com o que o dono faz e não com o que muda sozinho), `crates/botloftd/tests/autobackup.rs` (o servidor de 27.2 no processo e o relógio na mão: diário, semanal, sem mudança, cópia à mão, falha de rede, senha sumida, sair da conta, `no_keystore`), o cofre do Windows de verdade (`platform::windows::credentials`), e o bloco do app com o `FakeBotloft`.
+
+## 28. Celular
+
+Status: **CE1 (spec).** Vem depois de 27 e usa a conta dela. É o "celular" que 27.9 deixou para depois.
+
+### 28.1 O que é
+
+Uma página que o dono instala na tela inicial do celular (um PWA) para **aprovar pedidos dos bots e responder às perguntas deles** (10.1, 23) quando está longe do computador. O celular é um controle remoto: os bots continuam rodando no computador, e o `botloftd` continua só em `127.0.0.1` (13). Nada de código nativo, de loja ou de conta de desenvolvedor.
+
+O que o celular **faz**: mostra os pedidos de aprovação abertos, permite ou nega um de cada vez (com nota), mostra as perguntas abertas, responde ou descarta, e avisa quando chega algo novo.
+
+O que o celular **não faz** nesta etapa: ver conversas, mandar mensagem a um bot, ver arquivos, criar bot, crew, tarefa ou rotina, mexer em configurações. Quanto menos o celular sabe, menos há para vazar de um celular perdido.
+
+Quatro promessas valem para tudo aqui:
+
+- **É opcional e é do dono.** Exige a conta de 27. Sem nenhum celular conectado, o daemon não abre conexão nenhuma além das de 27. Conectar e desconectar é sempre um clique no computador.
+- **O servidor não lê nada.** Pedidos, perguntas e respostas passam **selados de ponta a ponta** entre o computador e o celular, com chaves que só os dois têm (28.3). O servidor repassa bytes e sabe só que existe tráfego, de que tamanho e quando.
+- **Quem entra no e-mail não vira celular.** O link do e-mail (27.3) abre a conta, mas um celular só entra por um QR que o computador mostra, e só fala com os bots quem tem as chaves do QR.
+- **O celular perdido se corta pelo computador:** "Desconectar" tira o aparelho do servidor e do daemon na hora (28.6).
+
+### 28.2 Quem é quem
+
+| Peça | Papel |
+|---|---|
+| computador | o `botloftd` com os bots; abre **uma** conexão de saída para o servidor (`wss`), nunca recebe |
+| servidor (`botloft-cloud`, 27.2) | autentica os aparelhos, liga o computador ao celular pareado com ele e entrega o PWA em `<public_url>/m`; não abre o conteúdo |
+| celular | o PWA; guarda as chaves e o token no navegador (IndexedDB, chaves não extraíveis) |
+
+A conta de 27 ganha o **tipo** do aparelho (`computer` ou `phone`) e, no celular, o **par** (`peer`): o computador com que ele foi conectado. Um celular conectado a dois computadores são duas conexões, cada uma com o seu token e as suas chaves.
+
+**O token de um celular só alcança o relay, o push, `GET /v1/me` (que diz só de quem é o celular e a que computador serve, sem a lista de aparelhos nem o espaço usado) e `POST /v1/logout` (desconectar pelo próprio celular).** As cópias (27.4), a conta, os pareamentos e os outros aparelhos dão `403` `wrong_device`. Um celular nunca baixa uma cópia. Tirar um computador (`DELETE /v1/devices/<id>`, ou apagar a conta) leva os celulares dele e fecha os sockets de todos.
+
+### 28.3 Conectar um celular e selar as mensagens
+
+Criptografia que existe em todo navegador (WebCrypto) e em crates do RustCrypto, para o PWA não carregar biblioteca de criptografia: **ECDH P-256**, **HKDF-SHA-256**, **HMAC-SHA-256** e **AES-256-GCM**.
+
+1. No app (28.7), "Conectar um celular" chama `mobile.pair_start`. O daemon sorteia `pair_id` (16 bytes) e `secret` (32 bytes), a chave efêmera dele (`D`), e avisa o servidor (`POST /v1/pairings {id}`, com o token do computador; vale 5 minutos e uma vez). O app mostra um **QR** (gerado no app, sem serviço externo) com `<public_url>/m#p=<pair_id>&s=<secret>&d=<D>` (`secret` e `D` em base64url; `D` é a chave pública do computador, 65 bytes). O que vem depois do `#` o navegador nunca envia: o servidor não vê o `secret` nem fica sabendo de `D` por aqui, e um servidor que quisesse trocar `D` não consegue, porque o celular a leu do QR.
+2. O celular abre o link, lê o fragmento e gera a chave dele (`P`). Manda `POST /v1/pairings/<id>/join {phone_pub, device_name, proof}`, com `proof = HMAC(secret, "botloft-pair-1" ‖ id ‖ phone_pub)`. O servidor guarda e avisa o computador pelo relay.
+3. O daemon confere a `proof`; errada, recusa e o código morre. Certa, mostra no app o **nome do celular e um código de 6 dígitos** (`HKDF(ikm = D ‖ P, salt = secret, info = "botloft-pair-1-code", 3 bytes)`; os 20 primeiros bits, como número, módulo 1 000 000, com zeros à esquerda), e o celular mostra o mesmo código na hora, porque já tem `D` do QR. O dono compara e clica **Conectar** (`mobile.pair_confirm`): é isso que impede quem fotografou o QR de entrar no lugar do dono.
+4. O daemon manda `POST /v1/pairings/<id>/accept {daemon_pub, proof2}` (`proof2 = HMAC(secret, "botloft-pair-1-accept" ‖ id ‖ D ‖ P)`). O servidor cria o aparelho `phone` com o `peer` e, na primeira consulta do celular (`GET /v1/pairings/<id>/result`, com o `poll` do passo 2 como `Bearer`, uma vez), entrega `{token, device, peer, daemon_pub, proof2}`; quem só tem o `id` do QR não tem o `poll` e não leva o token. O computador vê o pareamento em `GET /v1/pairings/<id>` (`waiting`, `joined` com `device_name`, `phone_pub` e `proof`, ou `expired`) e desiste ou recusa com `DELETE /v1/pairings/<id>`. No máximo 3 códigos abertos por computador e 30 entradas por hora por endereço; os erros novos são `bad_pairing` (`400`), `pair_expired` (`410`, vale também para código já usado) e `wrong_device` (`403`). O celular confere `proof2`: um servidor que trocasse a chave `D` não tem o `secret` e não consegue forjá-la.
+5. Os dois derivam `shared = ECDH(D, P)` e, com `HKDF(shared, salt = secret, info = "botloft-mobile-1")`, duas chaves AES-256: `k_c2p` (computador para celular) e `k_p2c`. A chave de cada direção só sela naquela direção. O `secret` é apagado dos dois lados.
+
+**Mensagem selada** (`seal`): `{v: 1, seq, ct}`. `ct` é AES-256-GCM com nonce de 12 bytes (`seq` em 8 bytes big-endian, 4 bytes zero) e dados autenticados `v ‖ direção ‖ device_id ‖ seq`. O texto que o relay leva é `{"v":1,"seq":N,"ct":"<base64url>"}` e o `seq` do quadro tem de ser o mesmo. Quem recebe guarda o maior `seq` visto por direção e **recusa** qualquer um que não seja maior (repetição); o celular guarda o dele no IndexedDB, e o daemon guarda o dele (e o último que usou para selar, gravado antes de mandar) em `secrets\mobile.json`. Chaves públicas viajam em 65 bytes não comprimidos (`raw` do WebCrypto); o segredo do ECDH é a coordenada x (32 bytes); `ct` leva a etiqueta de 16 bytes no fim, como o WebCrypto devolve. Trocar de chave é conectar de novo. Vetores de teste (chaves, nonces e textos de verdade) ficam num arquivo único (`docs/test-vectors/mobile.json`), gerado pelo Rust e lido pelo teste do PWA: os dois lados têm que concordar byte a byte.
+
+**Dentro do selo,** JSON de uma linha, no máximo 16 KiB:
+
+| Sentido | Mensagem |
+|---|---|
+| celular → computador | `sync` (pede o retrato de agora); `approval.answer {approvalId, allow, note?}`; `question.answer {questionId, answer}`; `question.dismiss {questionId}` |
+| computador → celular | `snapshot {approvals, questions}` (resposta de `sync`); `approval.open {card}`; `approval.closed {approvalId, status}`; `question.open {card}`; `question.closed {questionId, status}` |
+
+O `card` é o que o celular mostra (28.5), não o `Approval` nem a `Question` inteiros.
+
+### 28.4 O relay (servidor)
+
+- **Aparelhos.** A migration do crate acrescenta `devices.kind` (`computer` por padrão, para o que já existe) e `devices.peer`, mais as tabelas `pairings` (`id`, `account`, `computer`, `phone_pub`, `proof`, `daemon_pub`, `proof2`, `token_once`, `expires_at`) e `relay_queue` (`device`, `seq`, `body`, `expires_at`). `DELETE /v1/devices/<id>` num computador leva os celulares dele, e num celular fecha o socket dele na hora.
+- **`GET /v1/relay`** (WebSocket). O navegador não põe cabeçalho num WebSocket, então o token vai no **primeiro quadro**, `{t: "hello", token}` (nunca no endereço), em até 10 s; sem ele, ou com um token que não vale, o servidor responde `{t: "error", reason: "unauthorized"}` e fecha. O computador e cada celular abrem um. O servidor liga um celular só ao `peer` dele; um segundo socket do mesmo aparelho substitui o primeiro. Quadros em JSON de até 64 KiB (`bad_frame` quando não é JSON ou falta campo; o socket continua aberto):
+  - do servidor, ao entrar: `{t: "ready", kind, device, ...}`, que num computador traz `phones: [{id, online}]` e num celular `peer` e `online`;
+  - `{t: "msg", seq, body}`: o `body` é o selo, em texto, que o servidor **não abre**. O celular manda sem destino (vai ao `peer`) e o computador chega com `from` (o celular); o computador manda com `to`, e um `to` que não é celular dele volta como `{t: "error", reason: "unknown_device", seq}`;
+  - `{t: "ack", from, upto}` (só do computador): leva da fila tudo de `from` até `upto`;
+  - `{t: "presence", device, online}`: o outro lado entrou ou saiu (o celular sabe se o computador está no ar, e o computador, de cada celular);
+  - `{t: "pairing", id}` (para o computador): um celular entrou no código `id` (28.3);
+  - `{t: "paired", pairing, device}` (para o computador): o celular recolheu o token. `device` é o id do celular, que só ele tinha; é daí que o computador passa a guardar as chaves para esse aparelho;
+  - `{t: "revoked", device}` (para o computador): um celular foi desconectado, pelo computador ou por ele mesmo;
+  - `{t: "wake"}` (28.8, ignorado até o push existir) e `{t: "ping"}` do servidor a cada 25 s (os proxies cortam conexões quietas, e a Cloudflare corta em 100 s).
+  - Limite de 60 quadros por minuto por aparelho: o que passa disso volta como `{t: "error", reason: "rate_limited"}` e não é processado.
+- **Fila só no sentido do computador.** Toda mensagem do celular entra na fila e é entregue ao computador na hora, se ele está conectado, ou quando ele volta (uma queda de rede), em ordem de `seq`; sai da fila no `ack` do daemon, e até lá volta a cada reconexão (o daemon descarta o `seq` que já viu, 28.3). Espera até 1 hora, e no máximo 50 por celular: a 51ª volta como `{t: "error", reason: "queue_full", seq}`. O mesmo `seq` duas vezes entra uma só. **Do computador para o celular não há fila:** quando o celular abre, ele manda `sync` e recebe o retrato de agora. O celular não guarda nenhum conteúdo no aparelho entre uma abertura e outra, só a lista em memória.
+- **O daemon decide, o servidor só leva.** Uma resposta que o servidor entregou mas o daemon recusa (pedido que já expirou, `seq` repetido, selo que não abre) é descartada no daemon e o celular recebe `approval.closed` ou `question.closed` com o estado verdadeiro.
+- **Reconexão.** O daemon reconecta com espera crescente (1 s até 60 s); só para de tentar quando o dono tira o último celular ou sai da conta.
+- **Logs do servidor:** nunca o `body`, o token nem o nome do aparelho em `info`.
+
+### 28.5 No daemon (`mobile`) e o que o celular pode
+
+Métodos novos do protocolo (11), todos só do dono:
+
+| Método | O que faz |
+|---|---|
+| `mobile.status` | `{relay: "off" \| "connecting" \| "connected", phones: [{id, name, pairedAt, lastSeenAt?, online}], pending?: {pairId, expiresAt, joined?: {name, code}}}`; o `relay` é `off` sem celular nem código, `connecting` ou `connected` |
+| `mobile.pair_start` | começa a conexão (28.3); devolve `{pairId, url, expiresIn}`, e `url` é o que o QR leva. Exige a conta (`not_signed_in`) |
+| `mobile.pair_cancel {pairId}` | desiste |
+| `mobile.pair_confirm {pairId, accept}` | o dono compara o código e aceita ou recusa. `conflict` se nenhum celular entrou nesse código (ou ele venceu) |
+| `mobile.revoke {phoneId}` | `DELETE /v1/devices/<id>`, apaga as chaves e para de aceitar selos desse celular. Se o servidor não responde, apaga as chaves do mesmo jeito e tenta o servidor depois |
+
+Notificações: `mobile.changed {status}` e `mobile.pair_request {pairId, name, code}` (o celular entrou no link; o app mostra o nome e o código). Erros com `reason` (20.8): os de 27.5 mais `wrong_device`, `bad_pairing` e `pair_expired`; um celular que não existe dá `not_found` em `mobile.revoke`. As chaves, o token e o `seq` de cada celular ficam em `secrets\mobile.json` (ACL do usuário, 13), nunca no banco; a cópia de segurança (14.2) não leva segredos, então **restaurar num computador novo pede conectar o celular de novo**. O relay só está aberto com pelo menos um celular conectado ou uma conexão em andamento.
+
+**O que vai ao celular.** Cada pedido aberto (10.1) e cada pergunta aberta (23.3) vira um `card`: o bot (nome e cor), a crew, a hora, e para o pedido, o tipo, o `summary`, a `explanation` e o texto do comando ou do plano; para a pergunta, o texto e as opções. Nada de `Bot`, de conversa, de caminho de pasta do dono além do que o próprio pedido mostra.
+
+**Regras de segurança do celular** (o daemon as aplica; o PWA só as mostra):
+
+1. **Só permite o que mostra inteiro.** Um pedido cujo texto passa de 8 KiB, ou que o daemon guardou cortado (a entrada não é um JSON inteiro), vai ao celular **cortado e marcado** (`cut`), com só "Negar" e "Abra no computador". Ninguém aprova no escuro. O texto de um comando é o `command`, o de um plano é o `plan`, o das outras ferramentas é a entrada como o daemon a guardou.
+2. **Só "uma vez".** O celular não grava "permitir sempre" (`always`) e não edita a entrada (`input`). A regra durável é decisão de quem está no computador.
+3. **O que muda o computador de forma durável fica no computador.** O celular só permite `Bash`, `PowerShell`, `WebFetch`, `WebSearch`, `Read`, `Write`, `Edit`, `MultiEdit`, `NotebookEdit` e o plano (`ExitPlanMode`); tudo o mais (sugestão de bot, 10.2; rotina pedida por bot, 20.12; acesso a outra crew, 10.4; permissão de desktop, 24.2; ferramentas conectadas, 25.4; o navegador em mãos, 21.10; e o que vier a existir) aparece como "Precisa de você no computador" (`atComputer`), com "Negar" quando couber. O daemon confere de novo quando chega a resposta: um "Permitir" para o que é só do computador, ou cortado, não faz nada e o celular recebe o cartão de novo. O celular nunca recebe `browser_ask_owner` nem nada que peça senha ou código (23.2).
+4. **O mesmo caminho do app.** `approval.answer` chama a mesma lógica de `approvals.answer` (10.1), e `question.answer` e `question.dismiss` as de `questions.*` (23.3): `conflict` se já foi respondido, `expired` se venceu. Responder no celular fecha o cartão no computador e vice-versa, nos dois sentidos, na hora (`approval.closed`, `question.closed`).
+5. **Rate limit** no daemon: 30 respostas por minuto por celular.
+6. **Nunca se loga** o selo, o `card` nem a resposta em `info` (13).
+
+### 28.6 Celular perdido, roubado ou trocado
+
+- **Desconectar** (app, 28.7) chama `mobile.revoke`: o servidor apaga o token e fecha o socket, o daemon esquece as chaves e descarta qualquer selo daquele celular. O celular fica com chaves que não servem para nada.
+- **Sair da conta** (27.3) apaga todos os celulares do computador. **Apagar a conta** leva os aparelhos e as filas.
+- Um celular roubado **e desbloqueado** consegue permitir pedidos de uma vez só e dentro das regras de 28.5 até o dono desconectá-lo. É o risco que a pessoa aceita ao receber pedidos no bolso. O PWA mostra o que está permitindo, e a tela do app diz isso na hora de conectar.
+- O servidor, comprometido, não consegue entrar numa conversa com os bots nem aprovar nada: não tem as chaves, e uma chave `D` trocada na conexão não passa em `proof2` (28.3). Consegue apagar mensagens e fechar sockets (o dono vê "sem conexão" e resolve no computador), e ver quando e quanto passa (28.9).
+
+### 28.7 Telas
+
+**App do computador:** Configurações, bloco **Celular** (abaixo de Conta, 27.6). Sem cloud configurada (`[cloud] url` vazio) o bloco não aparece. Sem conta: "Entre na conta acima para usar o celular" (o bloco Conta fica logo acima). Com conta e sem celular: uma frase do que o celular faz e não faz ("Aprove pedidos e responda perguntas dos bots de qualquer lugar. As conversas ficam só no computador."), e "Conectar um celular". Conectando: o QR, "Abra a câmera do celular e aponte para o código", o tempo que falta e "Cancelar"; quando o celular entra, "O celular de Ana quer entrar. Confira que o código é 482 913 nos dois", com "Conectar" e "Recusar". Com celulares: cada um com o nome, quando entrou, "online agora" ou "visto há 2 h", e **"Desconectar"** com a confirmação que diz que o celular perde o acesso na hora. Sob a lista de celulares, um aviso fixo, em palavras do dia a dia, de que quem tiver um celular conectado e desbloqueado pode permitir pedidos até ser desconectado (28.6). O QR é desenhado no app (`qrcode-generator`, MIT), preto sobre branco com margem em qualquer tema, e vale o que o código diz: o tempo que falta conta de 5:00 até 0:00, e depois o app volta ao botão e diz que o código venceu. Textos nos três idiomas, sem jargão (15.6): "celular", "conectar", "código"; nunca "relay", "pareamento", "token", "chave" nem "daemon".
+
+**PWA (`<public_url>/m`):** a mesma identidade visual do app (cores, fonte, mascote, tema do aparelho), uma coluna, feito para o polegar, em `pt-BR`, `en` e `es` pelo idioma do aparelho.
+- **Caixa:** a lista do que espera o dono, pedidos e perguntas misturados, o mais velho primeiro (o que vence antes), cada linha com o rosto do bot, o nome, a crew e a hora; vazio mostra o mascote e "Nada esperando você". Se o computador está fora do ar: "O computador está desligado ou sem internet. Os pedidos continuam esperando lá."
+- **Pedido:** o cartão de 15.1 simplificado: o bot, o que ele quer fazer em uma frase (a `explanation`, marcada como escrita pelo bot, ou o aviso de que ele não disse para que serve), o comando inteiro a um toque, **Permitir** e **Negar** (com campo de nota). Cartão cortado ou do tipo que fica no computador: só "Negar" e a explicação.
+- **Pergunta:** o texto em markdown, as opções como botões e um campo para outra resposta, com **Responder** e **Descartar**.
+- **Este celular:** nome, "Desconectar daqui" (apaga as chaves e avisa o computador) e, no iOS fora da tela inicial, a instrução de "Adicionar à Tela de Início" (o aviso por push só chega depois disso).
+- O PWA mora em `app/src/phone`, reusa as cores, as fontes, o `Callout`, o `Confirm` e o `i18n` do app (área `phone`, nos três idiomas) e fala com o resto por uma interface própria, `PhoneApi`, que o `FakePhone` implementa nos testes. `pnpm build:phone` o compila em `app/dist-phone` (base `/m/`), e o `botloft-cloud` o serve de uma pasta (`phone_dir` no `cloud.toml`, 27.2; a imagem do Docker já traz os arquivos em `/srv/phone`): não vai dentro do binário, para o servidor não depender de Node para compilar. Cada resposta de `/m` leva `Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; manifest-src 'self'; worker-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'` (nada de script ou estilo inline, nada de terceiros), `Referrer-Policy: no-referrer` e `nosniff`; os arquivos com hash no nome são `immutable`, e a página, o service worker e o manifesto são `no-cache`. O que vem depois do `#` do QR é lido uma vez e tirado do endereço (`history.replaceState`), para o segredo não ficar no histórico. Antes de entrar, o celular pede um nome (começa pelo tipo de aparelho) e só entra no código quando o dono aperta Conectar, para uma pré-visualização do link não conectar nada. O service worker (`/m/sw.js`) guarda só os arquivos da página (nunca um `card`, nunca uma resposta do servidor) e deixa passar tudo o que não é de `/m/`.
+
+### 28.8 Avisos (Web Push)
+
+Quando chega um pedido ou uma pergunta, o dono precisa saber sem abrir a página. O daemon manda ao servidor o quadro `{t: "wake"}`, **sem conteúdo**, a cada pedido ou pergunta que abre. O servidor junta os avisos que chegam perto uns dos outros: o primeiro sai na hora e os que vêm nos 30 s seguintes viram **um** só, no fim da espera. Cada aviso é um Web Push (RFC 8030, VAPID, RFC 8292) **vazio**, sem corpo, a cada celular conectado a esse computador que tem um endereço de push. Sem corpo não há o que cifrar (RFC 8291) e nada para um serviço de push ler.
+
+- **`[push]` no `cloud.toml`** (27.2): `subject` (um `mailto:` ou `https:` de quem roda o servidor), `vapid_key_file` (a chave privada, só ela, como o `password_file` do `smtp`; a variável `BOTLOFT_CLOUD_VAPID_KEY` faz o mesmo e vale mais) e `allow_hosts` (vazio quer dizer os serviços dos navegadores: `fcm.googleapis.com`, `push.services.mozilla.com`, `notify.windows.com` e `push.apple.com`, e um host vale também para os subdomínios dele). `botloft-cloud vapid-key --to <arquivo>` faz a chave: grava a privada num arquivo novo e imprime a pública. Sem `[push]` o servidor não oferece push (`no_push`, `404`) e o PWA mostra só o que há ao abrir.
+- **`GET /v1/push/key`** (só do celular) devolve `{key}`, a chave pública (65 bytes, base64url) com que o navegador se inscreve (`applicationServerKey`). **`POST /v1/push/subscribe {endpoint}`** (só do celular) guarda o endereço que o serviço de push do navegador deu; **`DELETE /v1/push/subscribe`** o apaga. Um celular tem um endereço só, e ele vai embora com o celular. O servidor **só chama** endereços de `allow_hosts`, em `https` e sem usuário nem senha no endereço (`bad_endpoint`, `400`, senão): um celular não faz o servidor chamar um endereço qualquer. A chamada leva `Authorization: vapid t=<jwt>, k=<chave pública>` (o JWT é `ES256`, com `aud` a origem do serviço, `exp` em 12 h e `sub` o `subject`), `TTL: 3600` e `Urgency: high`; não segue redirecionamentos e dá 10 s ao serviço.
+- **O texto do aviso é sempre o mesmo**, escrito pelo service worker da página no idioma do aparelho: "O Botloft precisa de você" e "Tem algo esperando você." (e as versões em inglês e espanhol). Não leva o nome do bot, o comando nem a pergunta: um push vazio nem teria como. Há um aviso só (`tag`), que um push novo traz de volta. Tocar nele leva à página aberta, ou a abre, e o conteúdo vem pelo relay, selado.
+- **Ligar e desligar** é do dono, na página (um toque, porque o navegador só deixa pedir a permissão assim): um convite na caixa enquanto os avisos estão desligados, e o controle inteiro em "Este celular". No iPhone os avisos só existem com a página na Tela de Início (28.7). Ao abrir com os avisos ligados, o celular diz o endereço ao servidor de novo, porque o serviço de push pode tê-lo trocado.
+- Endereço que o serviço de push diz que não vale mais (`404` ou `410`) é apagado e não é chamado de novo.
+
+### 28.9 Privacidade (13)
+
+- Nada vai à rede sem um celular conectado pelo dono (28.1). Desconectar o último celular fecha a conexão.
+- O servidor vê: o e-mail, os nomes dos aparelhos que entraram, o IP de quem conecta (no proxy, por 7 dias, 27.7), quando cada um está online, o **tamanho e a hora** de cada mensagem selada, e os endereços de push. Não vê: nome de bot ou de equipe, comando, plano, pergunta, resposta, nota, nem as chaves.
+- Quem controla o servidor pode ver **que** o dono aprovou algo às 14h, e quanto tempo levou, mas não o quê.
+- Os serviços de push veem que "um aviso do Botloft" chegou a um aparelho, e nada além.
+- Sem telemetria: nenhuma contagem de uso do celular sai do aparelho.
+
+### 28.10 Marcos
+
+| Marco | O que entra | Teste |
+|---|---|---|
+| **CE1** Spec | esta seção | revisão do dono |
+| **CE2** Servidor | migration (`devices.kind`, `peer`, `pairings`, `relay_queue`), `/v1/pairings`, `/v1/relay`, fila no sentido do computador, token de celular restrito, `DELETE /v1/devices` com celulares | dois pares de clientes de teste: o QR de ponta a ponta no processo; `403` `wrong_device` nas cópias; a fila entrega em ordem e sai no `ack`; um selo adulterado chega adulterado (o servidor não abre); revogar fecha o socket; pareamento vence e vale uma vez |
+| **CE3** Daemon | cliente do relay com reconexão, `seal` (P-256, HKDF, AES-GCM) com os vetores de teste, conexão, `secrets\mobile.json`, métodos e notificações, a ponte de aprovações e perguntas com as regras de 28.5, tipos gerados | o servidor de CE2 no processo e um "celular" de teste em Rust: conectar com o código, receber o retrato, permitir e negar, responder uma pergunta, `seq` repetido, selo adulterado, pedido já respondido no computador, cartão grande, tipo que fica no computador, sem `always`, revogar |
+| **CE4** App do computador | bloco Celular com o QR e o código, `FakeBotloft`, três idiomas | `pnpm check`; a tela no preview |
+| **CE5** PWA | `app/src/phone` (WebCrypto, cliente do relay, conexão por QR, caixa, cartões, `FakePhone`), três idiomas, `pnpm build:phone`, `phone_dir` no servidor com a política de 28.7, estágio do Docker, manifesto e service worker | `pnpm check`; os vetores do Rust (`docs/test-vectors/mobile.json`) abrem no PWA e o que o PWA sela é igual byte a byte; o cliente contra um computador feito com o mesmo selo (contador, repetição, adulteração, reconexão, revogação); o servidor serve a página sem sair da pasta; **feito à mão com um navegador de verdade** (2026-10-08, `cargo test -p botloftd --test mobile_live -- --ignored --nocapture`): conectar com o código, receber o retrato, permitir um comando, negar os que só se negam, responder a pergunta, e o aviso de celular desconectado |
+| **CE6** Avisos | `[push]`, `botloft-cloud vapid-key`, VAPID (JWT ES256), `/v1/push/*`, `wake` com agrupamento, lista de serviços permitidos, service worker, ligar e desligar na página | um serviço de push falso: um `wake` vira um push **vazio** assinado (a assinatura confere com a chave pública), só para os celulares do computador que chamou; `410` apaga o endereço; vários seguidos viram dois (o primeiro e um no fim da espera); endereço fora da lista, sem `https` ou com senha é recusado; o service worker mostra o aviso no idioma certo sem ler nada do push e o toque leva à página; ligar, desligar e religar na página contra um navegador de mentira |
+| **CE7** Teste real | um iPhone e um Android de verdade, a VPS de verdade, o Claude Code real: um bot pede para rodar um comando e o dono permite pelo celular; aviso com a tela bloqueada; celular desconectado pelo computador | registrado aqui, em "A verificar" |
+
+**A verificar (CE7).** Nada disso é certo até ser visto:
+
+- o leitor de QR da câmera do iOS e do Android preserva o `#` do link (os dois abrem o fragmento no navegador);
+- ECDH P-256 e HKDF no WebCrypto do Safari (iOS 16.4 ou mais novo) e do Chrome do Android dão os mesmos bytes que o RustCrypto (os vetores cobrem; falta o aparelho);
+- IndexedDB guarda chave `CryptoKey` não extraível no PWA instalado do iOS e não é apagada por falta de uso (o iOS apaga dados de sites que não são abertos por semanas, mas um PWA instalado fica fora dessa regra: confirmar);
+- Web Push chega no iOS com o PWA instalado e a tela bloqueada, e no Android com o Chrome fechado;
+- o proxy (Caddy; Cloudflare, se houver) mantém o WebSocket de `/v1/relay` aberto por horas com o ping de 25 s;
+- `connect-src 'self'` deixa a página abrir `wss://` do próprio servidor no Safari e no Chrome do Android (visto no Chromium com `ws://127.0.0.1`, 2026-10-08; o Safari 15.4 ou mais novo trata `'self'` assim, mas falta ver no aparelho);
+- o celular recolhe o token com o QR escaneado pela câmera do sistema, e não por um leitor dentro de outro aplicativo que abra o link num navegador embutido sem IndexedDB.
+
+**Roteiro do teste real (CE7).** O que falta ver só se vê com a VPS atualizada e dois aparelhos. Depois de cada passo, o que se viu entra na tabela da seção 19, com a data.
+
+1. **Atualizar o servidor.** `docker build -f deploy/cloud/Dockerfile -t botloft-cloud .`, levar a imagem à VPS (`docs/cloud-deploy.md`, 5b). No `BOTLOFT_CLOUD_CONFIG` entram `phone_dir = "/srv/phone"` e `[push]` (`subject`); a chave de `botloft-cloud vapid-key --to <arquivo>` vai na variável `BOTLOFT_CLOUD_VAPID_KEY`. Conferir `https://<servidor>/health`, `https://<servidor>/m` (a página, com a política) e que `wss://<servidor>/v1/relay` abre.
+2. **Atualizar o computador.** `pnpm local` põe esta versão do app e do daemon sobre o Botloft instalado (o banco não muda, mas siga a nota do `CLAUDE.md` sobre os dados reais; `pnpm local --restore` volta). Entrar na conta e abrir Configurações, Cópia de segurança, Celular.
+3. **Conectar.** Android (Chrome) e iPhone (Safari): ler o QR com a câmera do sistema, conferir os seis dígitos nos dois, aceitar no computador. No iPhone: Compartilhar, Adicionar à Tela de Início, e abrir pelo ícone (os avisos só existem assim).
+4. **Aprovar de verdade.** Um bot com o Claude Code real pede para rodar um comando: o cartão chega, **Permitir** libera e o bot segue; **Negar** com recado chega ao bot; uma pergunta de `ask_owner` é respondida pelo celular; um pedido do tipo "só no computador" só se nega; desligar o computador mostra o aviso na caixa.
+5. **Avisos.** Ligar os avisos no celular, bloquear a tela e fechar o navegador; um bot pede algo: chega "O Botloft precisa de você", e tocar abre a página com o cartão. Vários pedidos seguidos geram um aviso, e depois outro.
+6. **Cortar.** Desconectar pelo computador (o celular mostra que foi desconectado) e pelo celular (o computador deixa de listá-lo); sair da conta no computador leva os celulares.
+7. **Horas de conexão.** Deixar a página aberta e o celular na Wi-Fi por algumas horas atrás da Cloudflare: o relay segue de pé e o retrato ao abrir está certo.
+
+### 28.11 Fora desta etapa
+
+Conversa, mensagem aos bots, arquivos, tarefas e rotinas no celular; app nativo e lojas; trocar as chaves sem conectar de novo; trava com biometria ou PIN dentro do PWA; mais de um dono; ligação direta entre celular e computador sem o servidor (WebRTC); aviso com conteúdo; permitir "sempre" pelo celular.
diff --git a/docs/test-vectors/mobile.json b/docs/test-vectors/mobile.json
new file mode 100644
index 00000000..cf64cb6b
--- /dev/null
+++ b/docs/test-vectors/mobile.json
@@ -0,0 +1,34 @@
+{
+  "about": "Spec 28.3. Generated by botloftd (mobile::seal tests); the PWA must reproduce every value.",
+  "pair": {
+    "acceptProof": "NdSLo_JbvyUlNdeMbaMhFid9xszH2reUwcBqRVSKm1A",
+    "code": "191842",
+    "computerToPhoneKeyHex": "666e2e668f88e444d987d1991bf55cbf39554965e13bbc3109d7a1057e573d0e",
+    "daemonPrivateHex": "1111111111111111111111111111111111111111111111111111111111111111",
+    "daemonPublic": "BAIX5hfwtkQ5KCePlpmeaaI6TywVK99tbN9m5bgCgtTtGUp968uXcS0t2jyoWqh2Wlb0X8dYWZZS8ol8ZTBuV5Q",
+    "id": "AAAAAAAAAAAAAAAAAAAAAA",
+    "joinProof": "5Femzc3eHkfgzv_h7tgbXbU7Sd2UR-tO1nZanUaC-_Q",
+    "phonePrivateHex": "2222222222222222222222222222222222222222222222222222222222222222",
+    "phonePublic": "BNZak5d8qj0bCBhS_1ennkZfFmBXcwS66tUF3TpIWJzzUBheiVNy32Ih6joTdVfkc_3bZ1XwW9UHw8Uz_OnJEoU",
+    "phoneToComputerKeyHex": "e6c33702dc10953068013d194a333d5d2d856f527e3031490efa73433ff41c9d",
+    "secret": "MzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzM"
+  },
+  "seal": [
+    {
+      "body": "{\"v\":1,\"seq\":1,\"ct\":\"cuLmOforUDGKmBVaNROQi0ZZNZ0xghLcRGOp4Q\"}",
+      "device": "dev_phone",
+      "direction": "computerToPhone",
+      "keyHex": "666e2e668f88e444d987d1991bf55cbf39554965e13bbc3109d7a1057e573d0e",
+      "plain": "{\"t\":\"sync\"}",
+      "seq": 1
+    },
+    {
+      "body": "{\"v\":1,\"seq\":7,\"ct\":\"JXM35sFUqeFoSPoIZsuR7qO5vEzW-iCLFw\"}",
+      "device": "dev_phone",
+      "direction": "phoneToComputer",
+      "keyHex": "e6c33702dc10953068013d194a333d5d2d856f527e3031490efa73433ff41c9d",
+      "plain": "olá 🔥",
+      "seq": 7
+    }
+  ]
+}