Changelog

Clearnet ship · Tor silo · dialect research pause

• Tor gateway app + desktop co-start / Ready-gate dial policy (TI lifecycle) — **opt-in**, not Verified.
• Community production un-pause charter + CU-P1 soak stamp; Vault LES packaged soak stamp.
• Release-without-Tor / transport sovereignty charter; Tor Verified marked infeasible under solo + blocked-net.
• Public release no longer gated on Tor Verified; clearnet DM/Vault/Community are the ship claims.
• Product dialect/feature progress **PAUSED** pending research of communication methods outside Nostr / operator-VPS / Tor.
• Do not claim Tor Verified or production Tor-ready in this tag.
• Tor OFF remains the supported demo path on blocked networks.

Path honesty + DM delivery restore

• **DM send / media** — removed warm/`forceReconnectAll` from the publish path (NativeRelay dial storm cancelled Rust OK waiters); mesh `reconnectAll` re-dials closed sockets via `setRelayUrls` only
• Voice OS notification layout (circular avatar, Accept/Reject); message toast hygiene when chat is visible
• Call-card honesty: sqlite `ended` no longer paints CALL COMPLETED with a synthetic duration

Connection pool + transport presets

• **Transport presets (P14-S)** — preset catalog, active/partial badges, apply confirm, Tor inline gate, template pre-fill
• **Pool health UI (P14-P)** — readable pool / degraded connectivity signals (L3 soak optional for EXIT)
• Honest client-crypto copy: networks carry ciphertext; encryption stays on the client
• Settings transport surface aligned with Conduit Mesh pool owner (subtract dual-truth where touched)

Vault LES cutover

• **Local Encrypted Store (LES)** — desktop Vault data plane: encrypt-on-write, encrypted catalog, profile-scoped layout
• **Chat Save → LES** + Secure Upload into one catalog
• **Remove from Vault** — LES hard delete (V13-5)
• **Preview stability** — Vault grid / lightbox after decrypt · close · reopen (R6b maintainer soak)
• Legacy chat→vault flag path **superseded** by LES (do not re-enable old `VAULT_SAVE_FROM_CHAT` owner)
• Vault UI reads LES catalog only on desktop shell

Conduit Mesh + trust gates

• Conduit Mesh C0–C14 (HTTP pull, mesh wire, long-poll, SSE, Tor SOCKS L1)
• Dual-window L3 soaks: C7 WS, C10 HTTP, C14 SSE **PASS**; C13 Tor **BLOCKED** (env)
• Trust link/export confirmation gates; voice-note player/waveform
• Vault chat→save remains **disabled** (deferred to 1.9.13)

Vault encryption sandbox Phases 1–5

• **Phase 1 — Encrypt-on-write** — `encryptVaultBytesForWrite`, `VaultWriteEncryptionRequiredError`; refuse vault writes when PDK session absent.
• **Phase 2 — Legacy migration** — migrate pre-v1.9.8 plaintext vault files to ciphertext on unlock.
• **Phase 3 — Encrypted index** — vault metadata index in encrypted SQLite (replaces plaintext localStorage index for new layout).
• **Phase 4 — Controlled decrypt surface** — export labeling, folder-only reveal, `vault-media-blob-lifecycle.ts` revoke on lock/preview close.
• **Phase 5 — Per-profile layout** — `profiles/{profileId}/vault/` writes; layout migration; `data_root.rs` ensures profile vault dir.
• **L3 runbook** — [vault-sandbox-l3-verification-2026-07.md](specs/backend/vault-sandbox-l3-verification-2026-07.md).
• **Chat→vault save** — remains **disabled** (`VAULT_SAVE_FROM_CHAT_ENABLED = false`); Phase 6 investigation complete, no flag flip until G8.
• **CodaCtrl lane D** — Obscur-side EXIT; download page `data-codactrl-sha256` hooks + agent runbook.
• **Release gate** — Node 22 for Vitest 4.1 in CI.
• **Vitest 4.1** — ESM config via `.mts`; transport parity + auth K4 mock stability.

AUTH-SESSION-1 cancellation + version truth

• **Desktop session policy** — `NATIVE_SECURE_SESSION_RESTORE_ENABLED` and `NATIVE_DEVICE_SESSION_CONSENT_ENABLED` disabled on desktop shell builds; manual unlock after F5/restart/lock is intentional product behavior.
• **Consent gates** — `isDeviceSessionRestoreAllowed` and `resolveStaySignedIn` respect cancelled restore policy.
• **UI honesty** — auth session policy notice, profile manager lock copy, device session settings panel hidden on desktop when restore is off.
• **Version sync** — monorepo manifests, `version.json`, and program docs aligned to **1.9.10** (recovered bands 1.9.4–1.9.9 that shipped on `main` without semver bump).

Storage resilience

• **Data root health probe** — detect missing/slow/unreachable custom data roots without infinite hang.
• **Recovery UX** — reconnect folder, choose new folder, offline webview recovery gate.
• **Junction bind resilience** — dead junction heal; bind to alternate path after USB disconnect.