diff --git a/migrations/0014_add_chat_message.sql b/migrations/0014_add_chat_message.sql
new file mode 100644
index 0000000..112d279
--- /dev/null
+++ b/migrations/0014_add_chat_message.sql
@@ -0,0 +1,14 @@
+-- Migration: 0014_add_chat_message
+-- Adds the chat_message table used by ChatDO for encrypted message persistence.
+-- Content is encrypted with AES-256-GCM before storage (via ChatDO._persist_message).
+
+CREATE TABLE IF NOT EXISTS chat_message (
+    id           TEXT PRIMARY KEY,
+    classroom_id TEXT NOT NULL,
+    user_id      TEXT NOT NULL,
+    display_name TEXT,
+    content      TEXT NOT NULL,
+    created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_chat_created   ON chat_message(classroom_id, created_at);
diff --git a/public/classroom_poc.html b/public/classroom_poc.html
index f29c021..b6c4889 100644
--- a/public/classroom_poc.html
+++ b/public/classroom_poc.html
@@ -167,7 +167,7 @@ <h1 class="text-3xl font-extrabold bg-gradient-to-r from-teal-400 to-emerald-300
 </div>
 
 <!--CLASSROOM SCREEN-->
-<div id="classroomScreen" class="flex-1 flex-col hidden">
+<div id="classroomScreen" class="flex-1 flex-col h-screen max-h-screen overflow-hidden hidden">
 
     <!-- Top Bar -->
     <header class="bg-gray-900/90 backdrop-blur-xl border-b border-gray-800 px-4 py-2.5 flex items-center justify-between shrink-0">
@@ -266,12 +266,12 @@ <h1 class="text-3xl font-extrabold bg-gradient-to-r from-teal-400 to-emerald-300
         </div>
 
         <!-- Chat Sidebar -->
-        <div id="chatPanel" class="w-full lg:w-80 h-64 lg:h-auto shrink-0 bg-gray-900/70 border-t lg:border-t-0 lg:border-l border-gray-800 flex flex-col">
+        <div id="chatPanel" class="w-full lg:w-80 h-72 lg:h-full max-h-[380px] lg:max-h-full min-h-0 shrink-0 bg-gray-900/70 border-t lg:border-t-0 lg:border-l border-gray-800 flex flex-col">
             <div class="px-4 py-3 border-b border-gray-800 flex items-center gap-2">
                 <i data-lucide="message-circle" class="w-4 h-4 text-teal-400"></i>
                 <h2 class="text-sm font-semibold text-gray-200">Room Chat</h2>
             </div>
-            <div id="chatMessages" class="flex-1 overflow-y-auto p-3 space-y-2">
+            <div id="chatMessages" role="log" aria-live="polite" aria-relevant="additions" class="flex-1 overflow-y-auto min-h-0 p-3 space-y-2">
                 <div class="text-center text-xs text-gray-600 py-6">No messages yet!</div>
             </div>
             <form id="chatForm" class="p-3 border-t border-gray-800 flex gap-2">
@@ -379,6 +379,9 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
     // State
     let ws = null;
     let presenceWs = null;
+    let chatWs = null;
+    let chatReconnectAttempts = 0;
+    let chatReconnectTimer = null;
     let roomId = '';
     let myParticipantId = '';
     let myDisplayName = '';
@@ -626,6 +629,7 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
         lobby.classList.add('hidden');
         classroomScreen.classList.remove('hidden');
         classroomScreen.classList.add('flex');
+        document.body.classList.add('overflow-hidden', 'h-screen');
 
         renderDesks();
         connectWS();
@@ -647,6 +651,7 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
         classroomScreen.classList.add('hidden');
         classroomScreen.classList.remove('flex');
         lobby.classList.remove('hidden');
+        document.body.classList.remove('overflow-hidden', 'h-screen');
         Object.keys(participants).forEach(k => delete participants[k]);
         Object.keys(presenceByUser).forEach(k => delete presenceByUser[k]);
         avatarLayer.innerHTML = '';
@@ -675,6 +680,7 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
             reconnectAttempts = 0;
             setConnStatus(true);
             connectPresenceWS();
+            connectChatWS();
             showToast(canInteract ? 'Connected to classroom' : 'Viewing classroom', 'success');
         };
 
@@ -698,8 +704,10 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
         intentionalDisconnect = true;
         if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
         if (presenceReconnectTimer) { clearTimeout(presenceReconnectTimer); presenceReconnectTimer = null; }
+        if (chatReconnectTimer) { clearTimeout(chatReconnectTimer); chatReconnectTimer = null; }
         if (ws) { ws.close(); ws = null; }
         if (presenceWs) { presenceWs.close(); presenceWs = null; }
+        if (chatWs) { chatWs.close(); chatWs = null; }
         setConnStatus(false);
     }
 
@@ -769,6 +777,79 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
         };
     }
 
+    // Chat WebSocket (ChatDO — /ws/chat/:id)
+    function connectChatWS() {
+        if (chatWs && (chatWs.readyState === WebSocket.OPEN || chatWs.readyState === WebSocket.CONNECTING)) return;
+        const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const params = new URLSearchParams();
+        const token = localStorage.getItem('auth_token') || localStorage.getItem('edu_token');
+        if (token) {
+            // Prefer authenticated token so the server derives identity server-side.
+            params.set('token', token);
+        } else {
+            // Fallback to anonymous identity only when explicitly enabled server-side.
+            params.set('user_id', myParticipantId);
+            params.set('display_name', myDisplayName);
+        }
+        const qs = params.toString();
+        const url = qs
+            ? `${proto}//${location.host}/ws/chat/${encodeURIComponent(roomId)}?${qs}`
+            : `${proto}//${location.host}/ws/chat/${encodeURIComponent(roomId)}`;
+        chatWs = new WebSocket(url);
+        chatWs.onopen = () => {
+            chatReconnectAttempts = 0;
+            if (chatReconnectTimer) { clearTimeout(chatReconnectTimer); chatReconnectTimer = null; }
+        };
+        chatWs.onmessage = (ev) => {
+            try {
+                const data = JSON.parse(ev.data);
+                if (data.type === 'chat_history') {
+                    // Always clear the placeholder, even if history is empty
+                    chatMessages.innerHTML = '';
+                    chatFirstMessage = false;
+                    (data.messages || []).forEach((msg) => appendChatMessage(
+                        msg.display_name || msg.user_id,
+                        msg.text,
+                        msg.user_id === myParticipantId
+                    ));
+                } else if (data.type === 'chat_error') {
+                    showToast(data.message || 'Failed to send chat message', 'error');
+                } else if (data.type === 'chat_message') {
+                    appendChatMessage(
+                        data.display_name || data.user_id,
+                        data.text,
+                        data.user_id === myParticipantId
+                    );
+                }
+            } catch (err) {
+                console.warn('[chat] dropped malformed ws frame', err, ev.data);
+            }
+        };
+        chatWs.onerror = () => {
+            console.warn('[chat] WebSocket error');
+        };
+        chatWs.onclose = () => {
+            if (intentionalDisconnect) return;
+            if (chatReconnectAttempts >= MAX_RECONNECT) {
+                showToast('Lost connection to chat — please rejoin.', 'warning');
+                return;
+            }
+            const delay = Math.min(BASE_DELAY * Math.pow(2, chatReconnectAttempts), 30000);
+            chatReconnectAttempts++;
+            chatReconnectTimer = setTimeout(() => {
+                if (!chatWs || chatWs.readyState === WebSocket.CLOSED) connectChatWS();
+            }, delay);
+        };
+    }
+
+    function chatSend(obj) {
+        if (chatWs && chatWs.readyState === WebSocket.OPEN) {
+            chatWs.send(JSON.stringify(obj));
+            return true;
+        }
+        return false;
+    }
+
     function presenceSend(obj) {
         if (!canInteract) return;
         if (presenceWs && presenceWs.readyState === WebSocket.OPEN) {
@@ -920,10 +1001,6 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
                 }
                 break;
 
-            case 'chat_message':
-                appendChatMessage(data.display_name, data.text, data.participant_id === myParticipantId);
-                break;
-
             case 'seat_updated':
                 if (!participants[data.participant_id] && data.participant_id !== myParticipantId) {
                     participants[data.participant_id] = {
@@ -1164,14 +1241,18 @@ <h2 class="text-sm font-semibold flex items-center gap-2">
         presenceSend({ type: 'presence', hand_raised: nextHandRaised });
     });
 
-    // Chat
+    // Chat 
     chatForm.addEventListener('submit', (e) => {
         e.preventDefault();
         if (!canInteract) { loginForInteraction(); return; }
         const text = chatInput.value.trim();
         if (!text) return;
-        wsSend({ type: 'chat_message', text, timestamp: new Date().toISOString() });
-        chatInput.value = '';
+        const ok = chatSend({ type: 'chat_message', text });
+        if (ok) {
+            chatInput.value = '';
+        } else {
+            showToast('Chat is not connected. Retry in a moment…', 'warning');
+        }
     });
 
     function appendChatMessage(name, text, isSelf) {
diff --git a/schema.sql b/schema.sql
index 95ff25d..3f713b1 100644
--- a/schema.sql
+++ b/schema.sql
@@ -171,3 +171,15 @@ CREATE TABLE IF NOT EXISTS message_requests (
 CREATE INDEX IF NOT EXISTS idx_message_requests_to_user ON message_requests(to_user_id, status);
 CREATE INDEX IF NOT EXISTS idx_message_requests_from_user ON message_requests(from_user_id);
 CREATE INDEX IF NOT EXISTS idx_message_requests_activity ON message_requests(activity_id);
+
+-- Chat messages table (virtual classroom chat persistence)
+CREATE TABLE IF NOT EXISTS chat_message (
+    id           TEXT PRIMARY KEY,
+    classroom_id TEXT NOT NULL,
+    user_id      TEXT NOT NULL,
+    display_name TEXT,
+    content      TEXT NOT NULL,
+    created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_chat_created   ON chat_message(classroom_id, created_at);
diff --git a/src/chat_do.py b/src/chat_do.py
new file mode 100644
index 0000000..0258d2a
--- /dev/null
+++ b/src/chat_do.py
@@ -0,0 +1,403 @@
+import base64
+import datetime
+import json
+import os
+import re
+import uuid
+from urllib.parse import urlparse, parse_qs
+
+from workers import Response, DurableObject
+
+import js
+from pyodide.ffi import to_js
+from js import WebSocketPair, WebSocketRequestResponsePair
+
+
+# Minimal local helpers to avoid circular imports with worker.py
+
+def _derive_key(secret: str) -> bytes:
+    import hashlib
+    return hashlib.sha256(secret.encode("utf-8")).digest()
+
+
+def _decrypt_xor(ciphertext: str, secret: str) -> str:
+    if not ciphertext:
+        return ""
+    try:
+        key = _derive_key(secret)
+        raw = base64.b64decode(ciphertext)
+        ks = (key * (len(raw) // len(key) + 1))[: len(raw)]
+        return bytes(a ^ b for a, b in zip(raw, ks)).decode("utf-8")
+    except Exception:
+        return "[decryption error]"
+
+
+def _pbkdf2_key(secret: str) -> bytes:
+    import hashlib
+    salt = hashlib.sha256(b"aol-edu-aes-salt-v1" + secret.encode()).digest()
+    return hashlib.pbkdf2_hmac("sha256", secret.encode("utf-8"), salt, 100_000)
+
+
+async def _import_aes_key(key_bytes: bytes) -> object:
+    key_buf = to_js(key_bytes, create_pyproxies=False)
+    algo = to_js({"name": "AES-GCM"}, dict_converter=js.Object.fromEntries)
+    usages = to_js(["encrypt", "decrypt"])
+    return await js.crypto.subtle.importKey("raw", key_buf, algo, False, usages)
+
+
+async def encrypt_aes(plaintext: str, secret: str) -> str:
+    if not plaintext:
+        return ""
+    key_bytes = _pbkdf2_key(secret)
+    crypto_key = await _import_aes_key(key_bytes)
+    iv_array = js.Uint8Array.new(12)
+    js.crypto.getRandomValues(iv_array)
+    algo = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
+    data = to_js(plaintext.encode("utf-8"), create_pyproxies=False)
+    ct_buf = await js.crypto.subtle.encrypt(algo, crypto_key, data)
+    ct = bytes(js.Uint8Array.new(ct_buf))
+    return "v1:" + base64.b64encode(bytes(iv_array) + ct).decode("ascii")
+
+
+async def decrypt_aes(ciphertext: str, secret: str) -> str:
+    if not ciphertext:
+        return ""
+    if not ciphertext.startswith("v1:"):
+        return _decrypt_xor(ciphertext, secret)
+    try:
+        raw = base64.b64decode(ciphertext[3:])
+        iv, ct = raw[:12], raw[12:]
+    except Exception:
+        return "[decryption error]"
+    try:
+        key_bytes = _pbkdf2_key(secret)
+        crypto_key = await _import_aes_key(key_bytes)
+        iv_array = to_js(iv, create_pyproxies=False)
+        algo = to_js({"name": "AES-GCM", "iv": iv_array}, dict_converter=js.Object.fromEntries)
+        data = to_js(ct, create_pyproxies=False)
+        pt_buf = await js.crypto.subtle.decrypt(algo, crypto_key, data)
+        return bytes(js.Uint8Array.new(pt_buf)).decode("utf-8")
+    except Exception:
+        return "[decryption error]"
+
+
+def new_id() -> str:
+    b = bytearray(os.urandom(16))
+    b[6] = (b[6] & 0x0F) | 0x40
+    b[8] = (b[8] & 0x3F) | 0x80
+    h = b.hex()
+    return f"{h[:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:]}"
+
+
+def verify_token(raw: str, secret: str):
+    import hashlib, hmac as _hmac
+    if not raw:
+        return None
+    try:
+        token = raw.removeprefix("Bearer ").strip()
+        dot = token.rfind(".")
+        if dot == -1:
+            return None
+        p, sig = token[:dot], token[dot + 1 :]
+        exp = _hmac.new(secret.encode("utf-8"), p.encode("utf-8"), hashlib.sha256).hexdigest()
+        if not _hmac.compare_digest(sig, exp):
+            return None
+        padding = (4 - len(p) % 4) % 4
+        return json.loads(base64.b64decode(p + "=" * padding).decode("utf-8"))
+    except Exception:
+        return None
+
+
+def _get_field(row, field):
+    if hasattr(row, field):
+        return getattr(row, field)
+    if isinstance(row, dict):
+        return row.get(field)
+    return None
+
+
+class ChatDO(DurableObject):
+    """Room-scoped real-time chat Durable Object."""
+
+    _MAX_BUFFER = 200
+
+    def __init__(self, ctx, env):
+        super().__init__(ctx, env)
+        self.sessions = {}
+        self.messages = []
+        self._history_loaded = False
+        self._room_id = getattr(self, "_room_id", "")
+
+        for ws in self.ctx.getWebSockets():
+            try:
+                attachment = ws.deserializeAttachment()
+                if not attachment:
+                    continue
+                data = json.loads(attachment) if isinstance(attachment, str) else attachment
+                session_id = data.get("session_id", str(uuid.uuid4()))
+                user_id = str(data.get("user_id", ""))[:64]
+                display_name = str(data.get("display_name", user_id or "Unknown"))[:64]
+                if not self._room_id:
+                    rid = str(data.get("classroom_id", ""))
+                    if rid:
+                        self._room_id = rid
+                if not user_id:
+                    continue
+                self.sessions[session_id] = {
+                    "ws": ws,
+                    "user_id": user_id,
+                    "display_name": display_name,
+                }
+            except Exception as exc:
+                print(f"[ChatDO.__init__.restore] error={exc!r}")
+
+        self.ctx.setWebSocketAutoResponse(
+            WebSocketRequestResponsePair.new("ping", "pong")
+        )
+
+    def _session_for_ws(self, ws):
+        for s_id, s_info in self.sessions.items():
+            try:
+                if s_info["ws"] is ws or s_info["ws"] == ws:
+                    return s_id, s_info
+            except Exception:
+                pass
+        try:
+            raw_att = ws.deserializeAttachment()
+            if raw_att:
+                att = json.loads(raw_att) if isinstance(raw_att, str) else raw_att
+                sid = att.get("session_id")
+                info = self.sessions.get(sid)
+                if info:
+                    return sid, info
+        except Exception:
+            pass
+        return None, None
+
+    async def _load_history(self, classroom_id: str):
+        if self._history_loaded:
+            return
+        try:
+            raw_key = getattr(self.env, "CHAT_ENCRYPTION_KEY", None) or getattr(self.env, "ENCRYPTION_KEY", None)
+            enc_key = raw_key.strip() if isinstance(raw_key, str) and raw_key.strip() else ""
+            rows = await self.env.DB.prepare(
+                "SELECT id, user_id, display_name, content, created_at FROM chat_message WHERE classroom_id = ? ORDER BY created_at DESC LIMIT ?"
+            ).bind(classroom_id, self._MAX_BUFFER).all()
+            loaded = []
+            for row in (rows.results or []):
+                r_content = _get_field(row, "content") or ""
+                r_user_id = _get_field(row, "user_id") or ""
+                r_display_name = _get_field(row, "display_name") or r_user_id
+                r_id = _get_field(row, "id") or ""
+                r_created_at = _get_field(row, "created_at") or ""
+
+                text = await decrypt_aes(r_content, enc_key) if (enc_key and r_content) else r_content
+                loaded.append({
+                    "id": r_id,
+                    "user_id": r_user_id,
+                    "display_name": r_display_name,
+                    "text": text,
+                    "timestamp": r_created_at,
+                })
+            # reverse to chronological order for playback
+            self.messages = list(reversed(loaded))
+            self._history_loaded = True
+        except Exception as exc:
+            if "no such table" in str(exc).lower():
+                await self._ensure_table()
+            else:
+                print(f"[ChatDO._load_history] error={exc!r}")
+
+    async def on_fetch(self, request):
+        upgrade = request.headers.get("Upgrade") or ""
+        if upgrade.lower() != "websocket":
+            return Response(json.dumps({"error": "Expected WebSocket upgrade"}), status=426, headers={"Content-Type": "application/json"})
+
+        parsed = urlparse(request.url)
+        qs = parse_qs(parsed.query)
+        token_param = (qs.get("token") or [None])[0]
+        user_param = (qs.get("user_id") or [None])[0]
+        display_param = (qs.get("display_name") or [None])[0]
+        # Derive classroom_id from path segment /ws/chat/:id
+        m = re.fullmatch(r"/ws/chat/([A-Za-z0-9_-]+)", parsed.path or "")
+        classroom_id = m.group(1) if m else ""
+        if not classroom_id:
+            return Response(json.dumps({"error": "Invalid classroom_id"}), status=400, headers={"Content-Type": "application/json"})
+
+        authenticated_user = verify_token(token_param or "", self.env.JWT_SECRET) if token_param else None
+        if authenticated_user:
+            user_id = str(authenticated_user.get("id", ""))
+            display_name = str(authenticated_user.get("username") or user_id)
+        else:
+            allow_anon = str(getattr(self.env, "ALLOW_ANON_CLASSROOM_POC", "")).lower() in {"1", "true", "yes"}
+            if token_param or not allow_anon or not user_param:
+                return Response(json.dumps({"error": "Authentication required"}), status=401, headers={"Content-Type": "application/json"})
+            user_id = str(user_param)
+            display_name = str(display_param or user_id)
+
+        user_id = user_id[:64]
+        display_name = display_name[:64]
+        if not user_id:
+            return Response(json.dumps({"error": "Invalid user_id"}), status=400, headers={"Content-Type": "application/json"})
+
+        client, server = WebSocketPair.new().object_values()
+        self.ctx.acceptWebSocket(server)
+
+        session_id = str(uuid.uuid4())
+        # Include classroom_id in server-side attachment to support hibernation resume
+        self._room_id = classroom_id
+        attachment = json.dumps({
+            "session_id": session_id,
+            "user_id": user_id,
+            "display_name": display_name,
+            "classroom_id": classroom_id,
+        })
+        server.serializeAttachment(attachment)
+
+        self.sessions[session_id] = {
+            "ws": server,
+            "user_id": user_id,
+            "display_name": display_name,
+        }
+
+        await self._load_history(classroom_id)
+        try:
+            server.send(json.dumps({"type": "chat_history", "messages": list(self.messages)}))
+        except Exception as exc:
+            print(f"[ChatDO.on_fetch.send_history] error={exc!r}")
+
+        return Response(None, status=101, web_socket=client)
+
+    async def on_webSocketMessage(self, ws, message):
+        try:
+            raw = message if isinstance(message, str) else message.decode("utf-8")
+            if len(raw) > 4096:
+                return
+            data = json.loads(raw)
+        except Exception:
+            return
+        if not isinstance(data, dict):
+            return
+
+        sid, info = self._session_for_ws(ws)
+        if not info:
+            return
+
+        if data.get("type") != "chat_message":
+            return
+
+        raw_text = data.get("text", "")
+        if not isinstance(raw_text, str):
+            return
+        text = raw_text.strip()[:500]
+        if not text:
+            return
+
+        classroom_id = getattr(self, "_room_id", "")
+        if not classroom_id:
+            try:
+                raw_att = ws.deserializeAttachment()
+                if raw_att:
+                    att = json.loads(raw_att) if isinstance(raw_att, str) else raw_att
+                    classroom_id = str(att.get("classroom_id", ""))
+                    if classroom_id:
+                        self._room_id = classroom_id
+            except Exception:
+                pass
+
+        if not classroom_id:
+            try:
+                ws.send(json.dumps({"type": "chat_error", "message": "Invalid classroom_id"}))
+            except Exception:
+                pass
+            return
+
+        timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+        msg_id = new_id()
+        entry = {
+            "id": msg_id,
+            "user_id": info["user_id"],
+            "display_name": info["display_name"],
+            "text": text,
+            "timestamp": timestamp,
+        }
+        # Persist first; only broadcast if durable
+        ok = await self._persist_message(msg_id, classroom_id, info["user_id"], info["display_name"], text, timestamp)
+        if not ok:
+            try:
+                ws.send(json.dumps({"type": "chat_error", "message": "Failed to persist message"}))
+            except Exception:
+                pass
+            return
+
+        self.messages.append(entry)
+        if len(self.messages) > self._MAX_BUFFER:
+            self.messages = self.messages[-self._MAX_BUFFER :]
+
+        self._broadcast(json.dumps({
+            "type": "chat_message",
+            "id": msg_id,
+            "user_id": info["user_id"],
+            "display_name": info["display_name"],
+            "text": text,
+            "timestamp": timestamp,
+        }))
+
+    async def on_webSocketClose(self, ws, _code, _reason, _was_clean):
+        sid, _info = self._session_for_ws(ws)
+        if sid:
+            self.sessions.pop(sid, None)
+
+    async def on_webSocketError(self, _ws, error):
+        print(f"[ChatDO.on_webSocketError] error={error!r}")
+
+    def _broadcast(self, payload, exclude_session_id=None):
+        for sid, info in self.sessions.items():
+            if sid == exclude_session_id:
+                continue
+            try:
+                info["ws"].send(payload)
+            except Exception as exc:
+                print(f"[ChatDO._broadcast] sid={sid} user_id={info.get('user_id')} error={exc!r}")
+
+    async def _ensure_table(self):
+        try:
+            await self.env.DB.prepare(
+                """CREATE TABLE IF NOT EXISTS chat_message (
+                    id           TEXT PRIMARY KEY,
+                    classroom_id TEXT NOT NULL,
+                    user_id      TEXT NOT NULL,
+                    display_name TEXT,
+                    content      TEXT NOT NULL,
+                    created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+                )"""
+            ).run()
+            await self.env.DB.prepare("CREATE INDEX IF NOT EXISTS idx_chat_created ON chat_message(classroom_id, created_at)").run()
+        except Exception as exc:
+            print(f"[ChatDO._ensure_table] error={exc!r}")
+
+    async def _persist_message(self, msg_id: str, classroom_id: str, user_id: str, display_name: str, text: str, timestamp: str = "") -> bool:
+        try:
+            raw_key = getattr(self.env, "CHAT_ENCRYPTION_KEY", None) or getattr(self.env, "ENCRYPTION_KEY", None)
+            enc_key = raw_key.strip() if isinstance(raw_key, str) and raw_key.strip() else ""
+            stored_content = await encrypt_aes(text, enc_key) if enc_key else text
+            created_at = timestamp or datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+            await self.env.DB.prepare(
+                "INSERT INTO chat_message (id, classroom_id, user_id, display_name, content, created_at) VALUES (?, ?, ?, ?, ?, ?)"
+            ).bind(msg_id, classroom_id, user_id, display_name, stored_content, created_at).run()
+            return True
+        except Exception as exc:
+            if "no such table" in str(exc).lower():
+                await self._ensure_table()
+                try:
+                    created_at = timestamp or datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+                    await self.env.DB.prepare(
+                        "INSERT INTO chat_message (id, classroom_id, user_id, display_name, content, created_at) VALUES (?, ?, ?, ?, ?, ?)"
+                    ).bind(msg_id, classroom_id, user_id, display_name, stored_content, created_at).run()
+                    return True
+                except Exception as retry_exc:
+                    print(f"[ChatDO._persist_message.retry] error={retry_exc!r}")
+            else:
+                print(f"[ChatDO._persist_message] error={exc!r}")
+            return False
+
diff --git a/src/worker.py b/src/worker.py
index bf344bf..ca5dad5 100644
--- a/src/worker.py
+++ b/src/worker.py
@@ -52,6 +52,10 @@
 from pyodide.ffi import to_js
 from js import WebSocketPair, WebSocketRequestResponsePair
 import uuid
+try:
+    from chat_do import ChatDO
+except ImportError:
+    from src.chat_do import ChatDO as ChatDO
 
 _SENTRY_INITIALIZED = False
 _SENTRY_DSN: str = ""
@@ -1058,7 +1062,7 @@ async def send_password_reset_email(to_email: str, _username: str, token: str, e
         updated_at        TEXT NOT NULL DEFAULT (datetime('now')),
         FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )""",
-    # Email verification tokens (token_hash = SHA-256 of plaintext token)
+    # Email verification tokens
     """CREATE TABLE IF NOT EXISTS email_verification_tokens (
         id         TEXT PRIMARY KEY,
         user_id    TEXT NOT NULL,
@@ -1068,7 +1072,7 @@ async def send_password_reset_email(to_email: str, _username: str, token: str, e
         FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )""",
     "CREATE INDEX IF NOT EXISTS idx_evtoken_user ON email_verification_tokens(user_id)",
-    # Password reset tokens (token_hash = SHA-256 of plaintext token)
+    # Password reset tokens
     """CREATE TABLE IF NOT EXISTS password_reset_tokens (
         id         TEXT PRIMARY KEY,
         user_id    TEXT NOT NULL,
@@ -1093,6 +1097,16 @@ async def send_password_reset_email(to_email: str, _username: str, token: str, e
     "CREATE INDEX IF NOT EXISTS idx_message_requests_to_user ON message_requests(to_user_id, status)",
     "CREATE INDEX IF NOT EXISTS idx_message_requests_from_user ON message_requests(from_user_id)",
     "CREATE INDEX IF NOT EXISTS idx_message_requests_activity ON message_requests(activity_id)",
+    # Chat messages
+    """CREATE TABLE IF NOT EXISTS chat_message (
+        id           TEXT PRIMARY KEY,
+        classroom_id TEXT NOT NULL,
+        user_id      TEXT NOT NULL,
+        display_name TEXT,
+        content      TEXT NOT NULL,
+        created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+    )""",
+    "CREATE INDEX IF NOT EXISTS idx_chat_created   ON chat_message(classroom_id, created_at)",
 ]
 
 
@@ -6183,75 +6197,9 @@ def _valid_norm_position(value):
             }), exclude_session_id=sid)
 
         elif msg_type == "chat_message":
-            raw_text = data.get("text", "")
-            if not isinstance(raw_text, str):
-                return
-            text = raw_text.strip()[:500]
-            if not text:
-                return
-            raw_timestamp = data.get("timestamp", "")
-            timestamp = raw_timestamp[:64] if isinstance(raw_timestamp, str) else ""
-            self._broadcast(json.dumps({
-                "type":           "chat_message",
-                "participant_id": info["participant_id"],
-                "display_name":   info["display_name"],
-                "text":           text,
-                "timestamp":      timestamp,
-            }))
-
-        elif msg_type == "whiteboard_event":
-            event = self._sanitize_whiteboard_event(data.get("event") if isinstance(data.get("event"), dict) else data)
-            if not event:
-                return
-            event["participant_id"] = info["participant_id"]
-            event["display_name"] = info["display_name"]
-            event["timestamp"] = datetime.datetime.now(datetime.timezone.utc).isoformat()
-            try:
-                events = await self.ctx.storage.get("whiteboard_events")
-                if not isinstance(events, list):
-                    events = []
-                events.append(event)
-                events = events[-1000:]
-                await self.ctx.storage.put("whiteboard_events", events)
-            except Exception as exc:
-                await capture_exception(exc, None, self.env, "classroom.whiteboard_event.persist")
-            self._broadcast(json.dumps({
-                "type": "whiteboard_event",
-                "event": event,
-            }))
-
-        elif msg_type == "whiteboard_clear":
-            try:
-                await self.ctx.storage.put("whiteboard_events", [])
-            except Exception as exc:
-                await capture_exception(exc, None, self.env, "classroom.whiteboard_clear.persist")
-            self._broadcast(json.dumps({
-                "type": "whiteboard_clear",
-                "participant_id": info["participant_id"],
-                "display_name": info["display_name"],
-            }))
-
-        elif msg_type == "whiteboard_undo":
-            try:
-                events = await self.ctx.storage.get("whiteboard_events")
-                if not isinstance(events, list):
-                    events = []
-                for idx in range(len(events) - 1, -1, -1):
-                    event = events[idx]
-                    if isinstance(event, dict) and event.get("participant_id") == info["participant_id"]:
-                        events.pop(idx)
-                        break
-                await self.ctx.storage.put("whiteboard_events", events)
-                self._broadcast(json.dumps({
-                    "type": "whiteboard_state",
-                    "events": events[-1000:],
-                    "participant_id": info["participant_id"],
-                    "display_name": info["display_name"],
-                }))
-            except Exception as exc:
-                await capture_exception(exc, None, self.env, "classroom.whiteboard_undo")
+            # chat_message is handled by ChatDO (/ws/chat/:id).
+            pass
 
-        
         elif msg_type == "update_seat":
             # Classroom layout, keep in sync with DESK_ROWS/DESK_COLS in classroom_poc.html
             DESK_ROWS = 3
@@ -6534,7 +6482,8 @@ async def on_fetch(self, request):
             user_id = str(authenticated_user.get("id", ""))
             display_name = str(authenticated_user.get("username") or user_id)
         else:
-            if token_param or not user_param:
+            allow_anon = str(getattr(self.env, "ALLOW_ANON_PRESENCE", None) or getattr(self.env, "ALLOW_ANON_CLASSROOM_POC", "")).lower() in {"1", "true", "yes"}
+            if token_param or not allow_anon or not user_param:
                 return Response(
                     json.dumps({"error": "Authentication required"}),
                     status=401,
@@ -6557,15 +6506,7 @@ async def on_fetch(self, request):
 
         session_id = str(uuid.uuid4())
         existing = self.presence.get(user_id)
-        if not can_interact:
-            existing = {
-                "x": 0.5,
-                "y": 0.5,
-                "emoji": "",
-                "hand_raised": False,
-                "display_name": display_name,
-            }
-        elif existing is None:
+        if existing is None:
             existing = {
                 "x": 0.5,
                 "y": 0.5,
@@ -6586,7 +6527,7 @@ async def on_fetch(self, request):
             "y": existing["y"],
             "emoji": existing["emoji"],
             "hand_raised": existing["hand_raised"],
-            "can_interact": can_interact,
+            "can_interact": True,
         })
         server.serializeAttachment(attachment)
 
@@ -6594,23 +6535,22 @@ async def on_fetch(self, request):
             "ws": server,
             "user_id": user_id,
             "display_name": display_name,
-            "can_interact": can_interact,
+            "can_interact": True,
         }
 
         self._send_welcome(server, session_id, user_id)
-        if can_interact:
-            self._broadcast(
-                json.dumps({
-                    "type": "delta",
-                    "user_id": user_id,
-                    "display_name": display_name,
-                    "x": existing["x"],
-                    "y": existing["y"],
-                    "emoji": existing["emoji"],
-                    "hand_raised": existing["hand_raised"],
-                }),
-                exclude_session_id=session_id,
-            )
+        self._broadcast(
+            json.dumps({
+                "type": "delta",
+                "user_id": user_id,
+                "display_name": display_name,
+                "x": existing["x"],
+                "y": existing["y"],
+                "emoji": existing["emoji"],
+                "hand_raised": existing["hand_raised"],
+            }),
+            exclude_session_id=session_id,
+        )
 
         return Response(None, status=101, web_socket=client)
 
@@ -7493,6 +7433,17 @@ async def _dispatch(request, env):
             await capture_exception(e, request, env, "presence_do_dispatch")
             return err("Failed to connect to presence channel", 500)
 
+    m_chat = re.fullmatch(r"/ws/chat/([A-Za-z0-9_-]+)", path)
+    if m_chat:
+        room_id = m_chat.group(1)
+        try:
+            do_id = env.CHAT_DO.idFromName(room_id)
+            stub = env.CHAT_DO.get(do_id)
+            return await stub.fetch(request)
+        except Exception as e:
+            await capture_exception(e, request, env, "chat_do_dispatch")
+            return err("Failed to connect to chat channel", 500)
+
     if path.startswith("/api/"):
         if path == "/api/init" and method == "POST":
             try:
diff --git a/tests/test_chat_do.py b/tests/test_chat_do.py
new file mode 100644
index 0000000..b324cf1
--- /dev/null
+++ b/tests/test_chat_do.py
@@ -0,0 +1,173 @@
+"""
+Unit tests for ChatDO and /ws/chat/:id routing.
+"""
+
+import json
+import pytest
+from unittest.mock import MagicMock, AsyncMock
+
+from tests.helpers import load_worker, make_env, MockDB, make_stmt, MockRequest
+
+worker = load_worker()
+ChatDO = worker.ChatDO
+
+
+def _make_ctx(sockets: list | None = None) -> MagicMock:
+    ctx = MagicMock()
+    ctx.getWebSockets.return_value = sockets or []
+    ctx.setWebSocketAutoResponse.return_value = None
+    ctx.acceptWebSocket.return_value = None
+    return ctx
+
+
+def _make_chat_env(*, allow_anon: str = "true", jwt_secret: str = "test-jwt-secret", enc_key: str = "") -> MagicMock:
+    env = make_env(jwt_secret=jwt_secret)
+    env.ALLOW_ANON_CLASSROOM_POC = allow_anon
+    if enc_key:
+        env.CHAT_ENCRYPTION_KEY = enc_key
+    return env
+
+
+def _make_request(path: str = "ws://localhost/ws/chat/room1",
+                  upgrade: str = "websocket",
+                  token: str | None = None,
+                  user_id: str | None = None,
+                  display_name: str | None = None,
+                  classroom_id: str = "room1") -> MockRequest:
+    qs_parts = []
+    if token:
+        qs_parts.append(f"token={token}")
+    if user_id:
+        qs_parts.append(f"user_id={user_id}")
+    if display_name:
+        qs_parts.append(f"display_name={display_name}")
+    if classroom_id:
+        qs_parts.append(f"classroom_id={classroom_id}")
+    qs = "&".join(qs_parts)
+    url = f"{path}{'?' + qs if qs else ''}"
+    headers = {}
+    if upgrade:
+        headers["Upgrade"] = upgrade
+    return MockRequest(method="GET", url=url, headers=headers)
+
+
+@pytest.mark.asyncio
+class TestChatDOFetch:
+    async def test_rejects_non_websocket_upgrade(self):
+        ctx = _make_ctx()
+        env = _make_chat_env()
+        do = ChatDO(ctx, env)
+        req = MockRequest(method="GET", url="http://localhost/ws/chat/room1")
+        resp = await do.on_fetch(req)
+        assert resp.status == 426
+
+    async def test_accepts_valid_chat_ws_connection(self):
+        ctx = _make_ctx()
+        env = _make_chat_env()
+        do = ChatDO(ctx, env)
+        req = _make_request(user_id="user1", display_name="User One")
+        resp = await do.on_fetch(req)
+        assert resp.status == 101
+        assert len(do.sessions) == 1
+
+    async def test_rejects_anon_when_disabled(self):
+        ctx = _make_ctx()
+        env = _make_chat_env(allow_anon="false")
+        do = ChatDO(ctx, env)
+        req = _make_request(user_id="user1", display_name="User One")
+        resp = await do.on_fetch(req)
+        assert resp.status == 401
+
+    async def test_authenticated_jwt_token_overrides_query_params(self):
+        ctx = _make_ctx()
+        env = _make_chat_env(jwt_secret="test-jwt-secret")
+        token = worker.create_token("uid-verified", "verified_user", "member", "test-jwt-secret")
+        do = ChatDO(ctx, env)
+        req = _make_request(token=token, user_id="imposter", display_name="Imposter")
+        resp = await do.on_fetch(req)
+        assert resp.status == 101
+        sid = next(iter(do.sessions))
+        assert do.sessions[sid]["user_id"] == "uid-verified"
+        assert do.sessions[sid]["display_name"] == "verified_user"
+
+    async def test_hibernation_restores_sessions(self):
+        mock_ws = MagicMock()
+        mock_ws.deserializeAttachment.return_value = json.dumps({
+            "session_id": "restored-sess-1",
+            "user_id": "alice",
+            "display_name": "Alice",
+            "classroom_id": "room1",
+        })
+        ctx = _make_ctx(sockets=[mock_ws])
+        env = _make_chat_env()
+        do = ChatDO(ctx, env)
+        assert "restored-sess-1" in do.sessions
+        assert do.sessions["restored-sess-1"]["user_id"] == "alice"
+        assert do.sessions["restored-sess-1"]["display_name"] == "Alice"
+
+    async def test_loads_and_sends_chat_history(self):
+        ctx = _make_ctx()
+        env = _make_chat_env()
+        rows = [
+            {"id": "msg-1", "user_id": "u1", "display_name": "U1", "content": "Hello", "created_at": "2026-01-01T00:00:00Z"}
+        ]
+        mock_stmt = make_stmt(all_results=rows)
+        env.DB = MockDB([mock_stmt])
+        do = ChatDO(ctx, env)
+        req = _make_request(user_id="u1", display_name="U1")
+        resp = await do.on_fetch(req)
+        assert resp.status == 101
+        assert len(do.messages) == 1
+        assert do.messages[0]["text"] == "Hello"
+        sid = next(iter(do.sessions))
+        ws = do.sessions[sid]["ws"]
+        history_frame = json.loads(ws.send.call_args[0][0])
+        assert history_frame["type"] == "chat_history"
+        assert len(history_frame["messages"]) == 1
+
+@pytest.mark.asyncio
+class TestChatDOMessage:
+    async def test_broadcasts_and_persists_chat_message(self):
+        ctx = _make_ctx()
+        env = _make_chat_env()
+        env.DB = MockDB()
+        do = ChatDO(ctx, env)
+
+        req1 = _make_request(user_id="u1", display_name="User1")
+        await do.on_fetch(req1)
+        req2 = _make_request(user_id="u2", display_name="User2")
+        await do.on_fetch(req2)
+
+        sids = list(do.sessions.keys())
+        ws1 = do.sessions[sids[0]]["ws"]
+        ws2 = do.sessions[sids[1]]["ws"]
+        ws1.deserializeAttachment.return_value = json.dumps({
+            "session_id": sids[0], "user_id": "u1", "display_name": "User1", "classroom_id": "room1"
+        })
+
+        msg_payload = json.dumps({"type": "chat_message", "text": "Hello world!"})
+        await do.on_webSocketMessage(ws1, msg_payload)
+
+        assert len(do.messages) == 1
+        assert do.messages[0]["text"] == "Hello world!"
+        broadcast_frame = json.loads(ws2.send.call_args[0][0])
+        assert broadcast_frame["type"] == "chat_message"
+        assert broadcast_frame["text"] == "Hello world!"
+        assert do.messages[0]["text"] == "Hello world!"
+
+
+@pytest.mark.asyncio
+class TestChatDORouting:
+    async def test_worker_routes_ws_chat_to_chat_do(self):
+        env = make_env()
+        mock_stub = MagicMock()
+        mock_stub.fetch = AsyncMock(return_value=worker.Response(None, status=101))
+        mock_do_ns = MagicMock()
+        mock_do_ns.idFromName.return_value = "chat-do-id"
+        mock_do_ns.get.return_value = mock_stub
+        env.CHAT_DO = mock_do_ns
+
+        req = MockRequest(method="GET", url="http://localhost/ws/chat/room1", headers={"Upgrade": "websocket"})
+        resp = await worker.on_fetch(req, env)
+        assert resp.status == 101
+        mock_do_ns.idFromName.assert_called_with("room1")
diff --git a/wrangler.toml b/wrangler.toml
index 0782506..eec9aba 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -6,7 +6,7 @@ compatibility_flags = ["python_workers"]
 [assets]
 directory = "./public"
 binding = "ASSETS"
-run_worker_first = ["/api/*", "/media/*", "/admin", "/admin/*", "/admin-*", "/ref/*", "/activity/*", "/blog/*", "/en/*", "/es/*", "/fr/*", "/de/*", "/zh/*", "/*.html", "/", "/activity", "/classes-map", "/requests", "/waiting-rooms", "/cart", "/checkout-success", "/dashboard", "/donate", "/feedback", "/forgot-password", "/login", "/notification-preferences", "/notifications", "/profile", "/users", "/public-profile", "/referral-leaderboard", "/reset-password", "/status", "/teach", "/verify-email", "/virtual-classroom", "/whiteboard", "/calculator", "/contributors", "/gsoc", "/about", "/terms", "/privacy", "/cookies", "/429", "/500", "/features", "/legacy-features", "/forum", "/blog", "/study-groups", "/quizzes", "/surveys", "/challenges", "/progress", "/grade-links", "/calendar", "/memes", "/success-stories", "/feature-votes", "/messages"]
+run_worker_first = ["/api/*", "/ws/*", "/media/*", "/admin", "/admin/*", "/admin-*", "/ref/*", "/activity/*", "/blog/*", "/en/*", "/es/*", "/fr/*", "/de/*", "/zh/*", "/*.html", "/", "/activity", "/classes-map", "/requests", "/waiting-rooms", "/cart", "/checkout-success", "/dashboard", "/donate", "/feedback", "/forgot-password", "/login", "/notification-preferences", "/notifications", "/profile", "/users", "/public-profile", "/referral-leaderboard", "/reset-password", "/status", "/teach", "/verify-email", "/virtual-classroom", "/whiteboard", "/calculator", "/contributors", "/gsoc", "/about", "/terms", "/privacy", "/cookies", "/429", "/500", "/features", "/legacy-features", "/forum", "/blog", "/study-groups", "/quizzes", "/surveys", "/challenges", "/progress", "/grade-links", "/calendar", "/memes", "/success-stories", "/feature-votes", "/messages"]
 html_handling = "auto-trailing-slash"
 not_found_handling = "404-page"
 
@@ -39,6 +39,10 @@ class_name = "ClassroomDO"
 name = "PRESENCE_DO"
 class_name = "PresenceDO"
 
+[[durable_objects.bindings]]
+name = "CHAT_DO"
+class_name = "ChatDO"
+
 [[migrations]]
 tag = "v1"
 new_sqlite_classes = ["ClassroomDO"]
@@ -47,6 +51,10 @@ new_sqlite_classes = ["ClassroomDO"]
 tag = "v2"
 new_sqlite_classes = ["PresenceDO"]
 
+[[migrations]]
+tag = "v3"
+new_sqlite_classes = ["ChatDO"]
+
 [[r2_buckets]]
 binding = "MY_BUCKET"
 bucket_name = "alphaonelabs-production"