diff --git a/docs/superpowers/plans/2026-04-17-persistent-login-unused-commands.md b/docs/superpowers/plans/2026-04-17-persistent-login-unused-commands.md
new file mode 100644
index 0000000..6d4e1fb
--- /dev/null
+++ b/docs/superpowers/plans/2026-04-17-persistent-login-unused-commands.md
@@ -0,0 +1,998 @@
+# Persistent Login + Unused Commands Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Persist the JWT session token across app launches so users sign in once per machine, and wire the three unused backend commands (`delete_message`, `update_profile`, `add_contact`) into the frontend UI.
+
+**Architecture:** The Rust backend gains `tauri-plugin-store` for token persistence; `signin`/`signup`/`signout` commands save/clear the token, and a new `restore_session` command re-authenticates on startup. Frontend UI adds a message delete option to the context menu, an inline profile-edit form in the sidebar footer, and an inline add-contact form in the sidebar contacts section.
+
+**Tech Stack:** Rust/Tauri 2, tauri-plugin-store 2, SurrealDB 3, Svelte 5, TypeScript
+
+---
+
+## File Map
+
+| File | Change |
+|------|--------|
+| `src-tauri/Cargo.toml` | Add `tauri-plugin-store = "2"` |
+| `src-tauri/src/lib.rs` | Register store plugin; add `restore_session` to invoke_handler |
+| `src-tauri/src/commands/user.rs` | Add `AppHandle` to `signin`/`signup`/`signout`; save/clear token in store; add `restore_session` command |
+| `src/routes/+page.svelte` | Replace `get_me` with `restore_session` in `init()`; add `deleteMessage`, `updateProfile`, `addContact` handlers; thread new props to components |
+| `src/lib/components/ChatMain.svelte` | Add `user` prop and `onDeleteMessage` prop; add delete item to message context menu |
+| `src/lib/components/Sidebar.svelte` | Add `onUpdateProfile` and `onAddContact` props; add inline profile-edit form; add inline add-contact form |
+
+---
+
+## Task 1: Add tauri-plugin-store dependency
+
+**Files:**
+- Modify: `src-tauri/Cargo.toml`
+- Modify: `src-tauri/src/lib.rs`
+
+- [ ] **Step 1: Add the crate to Cargo.toml**
+
+Open `src-tauri/Cargo.toml`. In the `[dependencies]` section, add after `tauri-plugin-opener`:
+
+```toml
+tauri-plugin-store = "2"
+```
+
+- [ ] **Step 2: Register the plugin in lib.rs**
+
+Open `src-tauri/src/lib.rs`. The current builder chain is:
+```rust
+tauri::Builder::default()
+    .plugin(tauri_plugin_opener::init())
+    .setup(|app| {
+```
+
+Change it to:
+```rust
+tauri::Builder::default()
+    .plugin(tauri_plugin_opener::init())
+    .plugin(tauri_plugin_store::Builder::default().build())
+    .setup(|app| {
+```
+
+- [ ] **Step 3: Verify it compiles**
+
+```bash
+cd src-tauri && cargo check 2>&1
+```
+
+Expected: no errors. You will see it downloading and compiling tauri-plugin-store. If you see "use of undeclared crate or module `tauri_plugin_store`", double-check the Cargo.toml spelling.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src-tauri/Cargo.toml src-tauri/Cargo.lock src-tauri/src/lib.rs
+git commit -m "feat: add tauri-plugin-store for session persistence"
+```
+
+---
+
+## Task 2: Update user commands for token persistence
+
+**Files:**
+- Modify: `src-tauri/src/commands/user.rs`
+- Modify: `src-tauri/src/lib.rs`
+
+This task updates `signin`, `signup`, `signout` to save/clear the token in the store, and adds the new `restore_session` command.
+
+- [ ] **Step 1: Replace the contents of commands/user.rs**
+
+Replace the entire file with:
+
+```rust
+use tauri::{AppHandle, State};
+use tauri_plugin_store::StoreExt;
+
+use crate::db::{AppState, SURREAL_ACCESS, SURREAL_DB, SURREAL_NS};
+use crate::error::{into_err, AppError};
+use crate::models::{Contact, User};
+
+const SESSION_STORE: &str = "session.json";
+const TOKEN_KEY: &str = "token";
+
+/// Create a new user account via SurrealDB Record Auth SIGNUP.
+/// Returns the created User record. Persists the JWT token to disk.
+#[tauri::command]
+pub async fn signup(
+    state: State<'_, AppState>,
+    app_handle: AppHandle,
+    email: String,
+    username: String,
+    password: String,
+) -> Result<User, String> {
+    let credentials = surrealdb::opt::auth::Record {
+        access: SURREAL_ACCESS.to_string(),
+        namespace: SURREAL_NS.to_string(),
+        database: SURREAL_DB.to_string(),
+        params: serde_json::json!({
+            "email": email,
+            "username": username,
+            "password": password,
+        }),
+    };
+    let token = state.db.signup(credentials).await.map_err(into_err)?;
+    let token_str = token.access.into_insecure_token();
+    *state.token.lock().unwrap() = Some(token_str.clone());
+    save_token(&app_handle, &token_str)?;
+
+    let mut result: Vec<User> = state
+        .db
+        .query("SELECT * FROM $auth")
+        .await
+        .map_err(into_err)?
+        .take(0)
+        .map_err(into_err)?;
+
+    result.pop().ok_or_else(|| into_err(AppError::Auth("signup succeeded but $auth not set".into())))
+}
+
+/// Authenticate an existing user via SurrealDB Record Auth SIGNIN.
+/// Returns the JWT token string. Persists the token to disk.
+#[tauri::command]
+pub async fn signin(
+    state: State<'_, AppState>,
+    app_handle: AppHandle,
+    email: String,
+    password: String,
+) -> Result<String, String> {
+    let credentials = surrealdb::opt::auth::Record {
+        access: SURREAL_ACCESS.to_string(),
+        namespace: SURREAL_NS.to_string(),
+        database: SURREAL_DB.to_string(),
+        params: serde_json::json!({
+            "email": email,
+            "password": password,
+        }),
+    };
+    let token_str = state.db.signin(credentials).await.map_err(into_err)?.access.into_insecure_token();
+    *state.token.lock().unwrap() = Some(token_str.clone());
+    save_token(&app_handle, &token_str)?;
+    Ok(token_str)
+}
+
+/// Clear the current session. Invalidates the token in state and removes it from disk.
+#[tauri::command]
+pub async fn signout(
+    state: State<'_, AppState>,
+    app_handle: AppHandle,
+) -> Result<(), String> {
+    state.db.invalidate().await.map_err(into_err)?;
+    *state.token.lock().unwrap() = None;
+    clear_token(&app_handle)?;
+    Ok(())
+}
+
+/// Attempt to restore a previous session from the persisted token on disk.
+/// Authenticates the DB connection with the stored JWT.
+/// Returns the authenticated User on success, or an error if no token exists
+/// or the token is expired/invalid (in which case the stored token is also cleared).
+#[tauri::command]
+pub async fn restore_session(
+    state: State<'_, AppState>,
+    app_handle: AppHandle,
+) -> Result<User, String> {
+    let token_str = load_token(&app_handle)?.ok_or_else(|| {
+        AppError::Auth("no saved session".into()).to_string()
+    })?;
+
+    match state.db.authenticate(surrealdb::opt::auth::Jwt::from(token_str.clone())).await {
+        Ok(_) => {
+            *state.token.lock().unwrap() = Some(token_str);
+
+            let mut result: Vec<User> = state
+                .db
+                .query("SELECT * FROM $auth")
+                .await
+                .map_err(into_err)?
+                .take(0)
+                .map_err(into_err)?;
+
+            result.pop().ok_or_else(|| into_err(AppError::Auth("session restored but $auth not set".into())))
+        }
+        Err(_) => {
+            // Token expired or invalid — purge it so next launch shows auth screen.
+            let _ = clear_token(&app_handle);
+            *state.token.lock().unwrap() = None;
+            Err(AppError::Auth("session expired, please sign in again".into()).to_string())
+        }
+    }
+}
+
+/// Fetch the currently authenticated user record.
+#[tauri::command]
+pub async fn get_me(state: State<'_, AppState>) -> Result<User, String> {
+    let mut result: Vec<User> = state
+        .db
+        .query("SELECT * FROM $auth")
+        .await
+        .map_err(into_err)?
+        .take(0)
+        .map_err(into_err)?;
+
+    result.pop().ok_or_else(|| into_err(AppError::Auth("not authenticated".into())))
+}
+
+/// Update mutable profile fields. Only provided fields are changed.
+#[tauri::command]
+pub async fn update_profile(
+    state: State<'_, AppState>,
+    username: Option<String>,
+    avatar: Option<String>,
+) -> Result<User, String> {
+    let mut result: Vec<User> = state
+        .db
+        .query(
+            "UPDATE $auth SET
+                username = $username ?? username,
+                avatar   = $avatar   ?? avatar
+             RETURN AFTER",
+        )
+        .bind(("username", username))
+        .bind(("avatar", avatar))
+        .await
+        .map_err(into_err)?
+        .take(0)
+        .map_err(into_err)?;
+
+    result.pop().ok_or_else(|| into_err(AppError::NotFound("user".into())))
+}
+
+/// Return the contacts list for the current user.
+#[tauri::command]
+pub async fn get_contacts(state: State<'_, AppState>) -> Result<Vec<User>, String> {
+    let result: Vec<User> = state
+        .db
+        .query("SELECT target.* FROM contact WHERE owner = $auth")
+        .await
+        .map_err(into_err)?
+        .take(0)
+        .map_err(into_err)?;
+
+    Ok(result)
+}
+
+/// Add a user to the current user's contact list.
+#[tauri::command]
+pub async fn add_contact(
+    state: State<'_, AppState>,
+    user_id: String,
+) -> Result<Contact, String> {
+    let mut result: Vec<Contact> = state
+        .db
+        .query("CREATE contact SET owner = $auth, target = type::record('user', $uid)")
+        .bind(("uid", user_id))
+        .await
+        .map_err(into_err)?
+        .take(0)
+        .map_err(into_err)?;
+
+    result.pop().ok_or_else(|| into_err(AppError::NotFound("contact after create".into())))
+}
+
+// ── Private helpers ───────────────────────────────────────────────────────────
+
+fn save_token(app: &AppHandle, token: &str) -> Result<(), String> {
+    let store = app.store(SESSION_STORE).map_err(|e| e.to_string())?;
+    store.set(TOKEN_KEY, serde_json::json!(token));
+    store.save().map_err(|e| e.to_string())
+}
+
+fn load_token(app: &AppHandle) -> Result<Option<String>, String> {
+    let store = app.store(SESSION_STORE).map_err(|e| e.to_string())?;
+    Ok(store.get(TOKEN_KEY).and_then(|v| v.as_str().map(String::from)))
+}
+
+fn clear_token(app: &AppHandle) -> Result<(), String> {
+    let store = app.store(SESSION_STORE).map_err(|e| e.to_string())?;
+    store.delete(TOKEN_KEY);
+    store.save().map_err(|e| e.to_string())
+}
+```
+
+- [ ] **Step 2: Add restore_session to the invoke_handler in lib.rs**
+
+Open `src-tauri/src/lib.rs`. The invoke_handler currently lists the commands. Add `commands::user::restore_session` so the handler looks like:
+
+```rust
+.invoke_handler(tauri::generate_handler![
+    commands::user::signup,
+    commands::user::signin,
+    commands::user::signout,
+    commands::user::get_me,
+    commands::user::restore_session,
+    commands::user::update_profile,
+    commands::user::get_contacts,
+    commands::user::add_contact,
+    commands::chat::create_room,
+    commands::chat::get_rooms,
+    commands::chat::send_message,
+    commands::chat::get_messages,
+    commands::chat::delete_message,
+    commands::chat::subscribe_room,
+    commands::chat::unsubscribe_room,
+])
+```
+
+- [ ] **Step 3: Verify it compiles**
+
+```bash
+cd src-tauri && cargo check 2>&1
+```
+
+Expected: no errors. Common failure:
+- `"method not found in surrealdb::Surreal<Client>"` for `authenticate` — check that `surrealdb::opt::auth::Jwt` is the right type for your surrealdb 3.x version. If `Jwt::from(string)` fails, try `token_str.as_str().parse().unwrap_or_default()` or consult `cargo doc --open` for the `authenticate` signature.
+- `"cannot find value TOKEN_KEY"` — make sure the constant is defined at module level, not inside a function.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src-tauri/src/commands/user.rs src-tauri/src/lib.rs
+git commit -m "feat: persist session token across app restarts"
+```
+
+---
+
+## Task 3: Update frontend init() to use restore_session
+
+**Files:**
+- Modify: `src/routes/+page.svelte`
+
+- [ ] **Step 1: Replace the init() function**
+
+In `src/routes/+page.svelte`, find the `init()` function (lines 37–46):
+
+```typescript
+  async function init() {
+    try {
+      user = await cmd<User>('get_me');
+      view = 'app';
+      await loadRooms();
+      contacts = await cmd<User[]>('get_contacts').catch(() => []);
+    } catch {
+      view = 'auth';
+    }
+  }
+```
+
+Replace with:
+
+```typescript
+  async function init() {
+    try {
+      user = await cmd<User>('restore_session');
+      view = 'app';
+      await loadRooms();
+      contacts = await cmd<User[]>('get_contacts').catch(() => []);
+    } catch {
+      view = 'auth';
+    }
+  }
+```
+
+Only the `cmd` call changes — `'get_me'` → `'restore_session'`. Everything else stays the same.
+
+- [ ] **Step 2: Verify TypeScript types**
+
+```bash
+pnpm check 2>&1
+```
+
+Expected: no errors.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/routes/+page.svelte
+git commit -m "feat: restore session on app launch instead of failing to login screen"
+```
+
+---
+
+## Task 4: Wire delete_message into the UI
+
+**Files:**
+- Modify: `src/routes/+page.svelte`
+- Modify: `src/lib/components/ChatMain.svelte`
+
+- [ ] **Step 1: Add deleteMessage handler in +page.svelte**
+
+In `src/routes/+page.svelte`, find the `sendMessage()` function (around line 111). Add the new function directly after it, before `onMount`:
+
+```typescript
+  async function deleteMessage(msgId: string) {
+    err = '';
+    try {
+      await cmd('delete_message', { messageId: msgId });
+      messages = messages.filter(m => full(m.id) !== msgId);
+    } catch (e) { err = String(e); }
+  }
+```
+
+- [ ] **Step 2: Pass onDeleteMessage and user to ChatMain**
+
+In the same file, find the `<ChatMain ... />` block in the template (around line 156):
+
+```svelte
+    <ChatMain
+      {activeRoom}
+      {messages}
+      {err}
+      bind:fMsg
+      onSendMessage={sendMessage}
+      onShowMenu={showMenu}
+    />
+```
+
+Replace with:
+
+```svelte
+    <ChatMain
+      {activeRoom}
+      {messages}
+      {user}
+      {err}
+      bind:fMsg
+      onSendMessage={sendMessage}
+      onDeleteMessage={deleteMessage}
+      onShowMenu={showMenu}
+    />
+```
+
+- [ ] **Step 3: Update ChatMain.svelte to accept user and onDeleteMessage props**
+
+Open `src/lib/components/ChatMain.svelte`. Find the `interface Props` block (lines 6–13):
+
+```typescript
+  interface Props {
+    activeRoom: Room | null;
+    messages: Message[];
+    err: string;
+    fMsg: string;
+    onSendMessage: () => void;
+    onShowMenu: (e: MouseEvent, items: ContextMenuItem[]) => void;
+  }
+```
+
+Replace with:
+
+```typescript
+  interface Props {
+    activeRoom: Room | null;
+    messages: Message[];
+    user: User | null;
+    err: string;
+    fMsg: string;
+    onSendMessage: () => void;
+    onDeleteMessage: (msgId: string) => void;
+    onShowMenu: (e: MouseEvent, items: ContextMenuItem[]) => void;
+  }
+```
+
+- [ ] **Step 4: Update destructuring in ChatMain.svelte**
+
+Find the destructuring block (lines 16–23):
+
+```typescript
+  let {
+    activeRoom,
+    messages,
+    err,
+    fMsg      = $bindable(),
+    onSendMessage,
+    onShowMenu,
+  }: Props = $props();
+```
+
+Replace with:
+
+```typescript
+  let {
+    activeRoom,
+    messages,
+    user,
+    err,
+    fMsg      = $bindable(),
+    onSendMessage,
+    onDeleteMessage,
+    onShowMenu,
+  }: Props = $props();
+```
+
+- [ ] **Step 5: Add User import to ChatMain.svelte**
+
+Find the import line at the top of the script block:
+
+```typescript
+  import type { Room, Message, ContextMenuItem } from '$lib/types';
+```
+
+Replace with:
+
+```typescript
+  import type { User, Room, Message, ContextMenuItem } from '$lib/types';
+```
+
+- [ ] **Step 6: Add delete option to message context menu**
+
+Find the `oncontextmenu` handler on the message `<div>` (around line 82 of ChatMain.svelte):
+
+```svelte
+          oncontextmenu={(e) => onShowMenu(e, [{ label: 'Copy message', action: () => navigator.clipboard.writeText(msg.body) }])}
+```
+
+Replace with:
+
+```svelte
+          oncontextmenu={(e) => {
+            const items: ContextMenuItem[] = [
+              { label: 'Copy message', action: () => navigator.clipboard.writeText(msg.body) },
+            ];
+            if (user && full(msg.author) === full(user.id)) {
+              items.push({ label: 'Delete message', action: () => onDeleteMessage(full(msg.id)) });
+            }
+            onShowMenu(e, items);
+          }}
+```
+
+- [ ] **Step 7: Verify TypeScript types**
+
+```bash
+pnpm check 2>&1
+```
+
+Expected: no errors.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add src/routes/+page.svelte src/lib/components/ChatMain.svelte
+git commit -m "feat: add delete message to context menu"
+```
+
+---
+
+## Task 5: Wire update_profile into the sidebar
+
+**Files:**
+- Modify: `src/routes/+page.svelte`
+- Modify: `src/lib/components/Sidebar.svelte`
+
+- [ ] **Step 1: Add updateProfile handler in +page.svelte**
+
+In `src/routes/+page.svelte`, add after `deleteMessage()`:
+
+```typescript
+  async function updateProfile(fields: { username?: string; avatar?: string }) {
+    user = await cmd<User>('update_profile', fields);
+  }
+```
+
+- [ ] **Step 2: Pass onUpdateProfile to Sidebar**
+
+Find the `<Sidebar ... />` block in the template:
+
+```svelte
+    <Sidebar
+      {user}
+      {rooms}
+      {contacts}
+      {activeRoom}
+      bind:showNewRoom
+      bind:fRoom
+      onSelectRoom={selectRoom}
+      onCreateRoom={createRoom}
+      onSignout={signout}
+      onShowMenu={showMenu}
+    />
+```
+
+Replace with:
+
+```svelte
+    <Sidebar
+      {user}
+      {rooms}
+      {contacts}
+      {activeRoom}
+      bind:showNewRoom
+      bind:fRoom
+      onSelectRoom={selectRoom}
+      onCreateRoom={createRoom}
+      onSignout={signout}
+      onShowMenu={showMenu}
+      onUpdateProfile={updateProfile}
+    />
+```
+
+- [ ] **Step 3: Add onUpdateProfile prop and profile edit form to Sidebar.svelte**
+
+Open `src/lib/components/Sidebar.svelte`. Make the following changes:
+
+**3a — Add `onUpdateProfile` to the `interface Props` block:**
+
+Find:
+```typescript
+  interface Props {
+    user: User | null;
+    rooms: Room[];
+    contacts: User[];
+    activeRoom: Room | null;
+    showNewRoom: boolean;
+    fRoom: string;
+    onSelectRoom: (room: Room) => void;
+    onCreateRoom: () => void;
+    onSignout: () => void;
+    onShowMenu: (e: MouseEvent, items: ContextMenuItem[]) => void;
+  }
+```
+
+Replace with:
+```typescript
+  interface Props {
+    user: User | null;
+    rooms: Room[];
+    contacts: User[];
+    activeRoom: Room | null;
+    showNewRoom: boolean;
+    fRoom: string;
+    onSelectRoom: (room: Room) => void;
+    onCreateRoom: () => void;
+    onSignout: () => void;
+    onShowMenu: (e: MouseEvent, items: ContextMenuItem[]) => void;
+    onUpdateProfile: (fields: { username?: string; avatar?: string }) => Promise<void>;
+  }
+```
+
+**3b — Add `onUpdateProfile` to the destructuring block:**
+
+Find:
+```typescript
+  let {
+    user,
+    rooms,
+    contacts,
+    activeRoom,
+    showNewRoom = $bindable(),
+    fRoom       = $bindable(),
+    onSelectRoom,
+    onCreateRoom,
+    onSignout,
+    onShowMenu,
+  }: Props = $props();
+```
+
+Replace with:
+```typescript
+  let {
+    user,
+    rooms,
+    contacts,
+    activeRoom,
+    showNewRoom = $bindable(),
+    fRoom       = $bindable(),
+    onSelectRoom,
+    onCreateRoom,
+    onSignout,
+    onShowMenu,
+    onUpdateProfile,
+  }: Props = $props();
+```
+
+**3c — Add local state and submit handler for the profile form. Add after the destructuring block:**
+
+```typescript
+  let showEditProfile = $state(false);
+  let fProfileUsername = $state('');
+  let fProfileAvatar   = $state('');
+  let profileErr       = $state('');
+
+  function openEditProfile() {
+    fProfileUsername = user?.username ?? '';
+    fProfileAvatar   = user?.avatar   ?? '';
+    profileErr = '';
+    showEditProfile = true;
+  }
+
+  async function submitProfile() {
+    profileErr = '';
+    try {
+      await onUpdateProfile({
+        username: fProfileUsername.trim() || undefined,
+        avatar:   fProfileAvatar.trim()   || undefined,
+      });
+      showEditProfile = false;
+    } catch (e) { profileErr = String(e); }
+  }
+```
+
+**3d — Update the user footer in the template.** Find the `<!-- User footer -->` section:
+
+```svelte
+  <!-- User footer -->
+  <div class="user-footer">
+    <div class="user-pill">
+      <span class="avatar">{user?.username?.[0]?.toUpperCase() ?? '?'}</span>
+      <span class="user-name">{user?.username ?? ''}</span>
+    </div>
+    <button class="icon-btn signout" title="Sign out" onclick={onSignout}>
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
+        <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/>
+        <polyline points="16 17 21 12 16 7"/>
+        <line x1="21" y1="12" x2="9" y2="12"/>
+      </svg>
+    </button>
+  </div>
+```
+
+Replace with:
+
+```svelte
+  <!-- User footer -->
+  {#if showEditProfile}
+    <div class="edit-profile-form">
+      <input class="field-sm" placeholder="username" bind:value={fProfileUsername}
+        onkeydown={(e) => e.key === 'Enter' && submitProfile()}
+        onkeyup={(e) => e.key === 'Escape' && (showEditProfile = false)} />
+      <input class="field-sm" placeholder="avatar url (optional)" bind:value={fProfileAvatar}
+        onkeydown={(e) => e.key === 'Enter' && submitProfile()}
+        onkeyup={(e) => e.key === 'Escape' && (showEditProfile = false)} />
+      {#if profileErr}<p class="form-err">{profileErr}</p>{/if}
+      <div class="form-row">
+        <button class="btn-xs" onclick={submitProfile}>save</button>
+        <button class="btn-xs btn-ghost" onclick={() => showEditProfile = false}>cancel</button>
+      </div>
+    </div>
+  {/if}
+  <div class="user-footer">
+    <button class="user-pill" title="Edit profile" onclick={openEditProfile}>
+      <span class="avatar">{user?.username?.[0]?.toUpperCase() ?? '?'}</span>
+      <span class="user-name">{user?.username ?? ''}</span>
+    </button>
+    <button class="icon-btn signout" title="Sign out" onclick={onSignout}>
+      <svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
+        <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/>
+        <polyline points="16 17 21 12 16 7"/>
+        <line x1="21" y1="12" x2="9" y2="12"/>
+      </svg>
+    </button>
+  </div>
+```
+
+**3e — Add styles for the new elements.** In the `<style>` block, add before the final `</style>`:
+
+```css
+  .edit-profile-form {
+    display: flex; flex-direction: column; gap: 6px;
+    padding: 10px 12px;
+    border-top: 1px solid var(--border-subtle);
+    animation: rise 0.15s ease;
+  }
+  .form-row {
+    display: flex; gap: 6px;
+  }
+  .btn-ghost {
+    background: transparent;
+    border: 1px solid var(--border);
+    color: var(--muted);
+  }
+  .btn-ghost:hover { opacity: 0.8; border-color: var(--muted); }
+  .form-err {
+    font-size: 10px; color: var(--danger);
+    overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  .user-pill {
+    display: flex; align-items: center; gap: 8px; min-width: 0;
+    background: none; border: none; cursor: pointer; padding: 0;
+    font-family: inherit; text-align: left;
+  }
+  .user-pill:hover .user-name { color: var(--text); }
+```
+
+Note: the existing `.user-pill` in the style block is a `div` style with no cursor. We are replacing the `<div class="user-pill">` with a `<button class="user-pill">` — the new CSS above supersedes any existing `.user-pill` rule. If there's a conflicting rule already in the file, remove the old one.
+
+- [ ] **Step 4: Verify TypeScript types**
+
+```bash
+pnpm check 2>&1
+```
+
+Expected: no errors.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/routes/+page.svelte src/lib/components/Sidebar.svelte
+git commit -m "feat: add inline profile editor to sidebar footer"
+```
+
+---
+
+## Task 6: Wire add_contact into the sidebar
+
+**Files:**
+- Modify: `src/routes/+page.svelte`
+- Modify: `src/lib/components/Sidebar.svelte`
+
+- [ ] **Step 1: Add addContact handler in +page.svelte**
+
+In `src/routes/+page.svelte`, add after `updateProfile()`:
+
+```typescript
+  async function addContact(userId: string) {
+    await cmd('add_contact', { userId });
+    contacts = await cmd<User[]>('get_contacts').catch(() => []);
+  }
+```
+
+- [ ] **Step 2: Pass onAddContact to Sidebar**
+
+Find the `<Sidebar ... />` block and add `onAddContact`:
+
+```svelte
+    <Sidebar
+      {user}
+      {rooms}
+      {contacts}
+      {activeRoom}
+      bind:showNewRoom
+      bind:fRoom
+      onSelectRoom={selectRoom}
+      onCreateRoom={createRoom}
+      onSignout={signout}
+      onShowMenu={showMenu}
+      onUpdateProfile={updateProfile}
+      onAddContact={addContact}
+    />
+```
+
+- [ ] **Step 3: Add onAddContact prop and add-contact form to Sidebar.svelte**
+
+**3a — Add `onAddContact` to the `interface Props` block:**
+
+Find in Sidebar.svelte:
+```typescript
+    onUpdateProfile: (fields: { username?: string; avatar?: string }) => Promise<void>;
+  }
+```
+
+Replace with:
+```typescript
+    onUpdateProfile: (fields: { username?: string; avatar?: string }) => Promise<void>;
+    onAddContact: (userId: string) => Promise<void>;
+  }
+```
+
+**3b — Add `onAddContact` to the destructuring block:**
+
+Find:
+```typescript
+    onUpdateProfile,
+  }: Props = $props();
+```
+
+Replace with:
+```typescript
+    onUpdateProfile,
+    onAddContact,
+  }: Props = $props();
+```
+
+**3c — Add local state and handler for the add-contact form. Add after the profile form state (after `submitProfile()`):**
+
+```typescript
+  let showAddContact = $state(false);
+  let fContactId     = $state('');
+  let contactErr     = $state('');
+
+  async function submitContact() {
+    if (!fContactId.trim()) return;
+    contactErr = '';
+    try {
+      await onAddContact(fContactId.trim());
+      fContactId = '';
+      showAddContact = false;
+    } catch (e) { contactErr = String(e); }
+  }
+```
+
+**3d — Update the CONTACTS section header and add the form.** Find:
+
+```svelte
+  <!-- Contacts -->
+  {#if contacts.length > 0}
+    <div class="section-label">CONTACTS</div>
+    <div class="contact-list">
+```
+
+Replace with:
+
+```svelte
+  <!-- Contacts -->
+  <div class="section-label-row">
+    <span class="section-label">CONTACTS</span>
+    <button class="icon-btn" title="Add contact" onclick={() => { showAddContact = !showAddContact; }}>
+      {showAddContact ? '×' : '+'}
+    </button>
+  </div>
+  {#if showAddContact}
+    <div class="new-room-form">
+      <input class="field-sm" placeholder="user id" bind:value={fContactId}
+        onkeydown={(e) => e.key === 'Enter' && submitContact()} />
+      <button class="btn-xs" onclick={submitContact}>add</button>
+    </div>
+    {#if contactErr}<p class="form-err" style="padding: 0 12px 6px">{contactErr}</p>{/if}
+  {/if}
+  {#if contacts.length > 0}
+    <div class="contact-list">
+```
+
+The original code has `{#if contacts.length > 0}` wrapping both the label and list. We are moving the label outside that condition so the "+" button is always visible. The list itself stays inside `{#if contacts.length > 0}`.
+
+- [ ] **Step 4: Add section-label-row style to Sidebar.svelte**
+
+In the `<style>` block, add:
+
+```css
+  .section-label-row {
+    display: flex; align-items: center; justify-content: space-between;
+    padding: 14px 14px 5px 14px;
+  }
+  .section-label-row .section-label {
+    padding: 0;
+  }
+```
+
+Also update the original `.section-label` rule if needed — the existing rule has `padding: 14px 14px 5px`. Since `.section-label-row` handles padding for the row, the `.section-label` inside it needs `padding: 0`. The `section-label-row .section-label` override above handles this.
+
+- [ ] **Step 5: Verify TypeScript types**
+
+```bash
+pnpm check 2>&1
+```
+
+Expected: no errors.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/routes/+page.svelte src/lib/components/Sidebar.svelte
+git commit -m "feat: add contact by user ID from sidebar"
+```
+
+---
+
+## Task 7: Final build verification
+
+- [ ] **Step 1: Full Rust build**
+
+```bash
+cd src-tauri && cargo build 2>&1
+```
+
+Expected: compiles successfully. If you see linker errors on Linux, ensure `libwebkit2gtk-4.1-dev` and related Tauri system deps are installed.
+
+- [ ] **Step 2: Full frontend type check**
+
+```bash
+pnpm check 2>&1
+```
+
+Expected: no errors.
+
+- [ ] **Step 3: Manual functional test checklist**
+
+Start the app with `pnpm tauri dev`, then verify:
+
+- [ ] Sign in → close app → reopen → lands on app view (not auth screen)
+- [ ] Sign in → close app → reopen → username shown in sidebar footer
+- [ ] Sign out → close app → reopen → lands on auth screen
+- [ ] Send a message as User A → right-click own message → "Delete message" appears → click it → message disappears
+- [ ] Send a message as User A → right-click someone else's message → "Delete message" does NOT appear
+- [ ] Click username pill in sidebar footer → profile edit form expands → edit username → save → sidebar shows new username
+- [ ] Press Escape in profile edit form → form closes without saving
+- [ ] Click "+" next to CONTACTS → input appears → type a user ID → click add → contacts list refreshes
+- [ ] Invalid user ID in add-contact → error shown in form