Changelog

Portable storage + encryption at rest

• **Custom data root** — junction bind, migration, conflict/overwrite dialogs, `obscur.json` manifest.
• **Encryption at rest** — PDK from device password; SQLite `.obscur-enc` envelope; vault ciphertext; encrypted removal archives (`.obscur-profile.enc.json`).
• **UX-3** — honest lock-screen and Settings → Storage copy while locked.

Auth subtraction

• **Withdrawn local login assist** — removed Chrome-style autofill/save-prompt path (LLA charter withdrawn).
• **Password-only return login** — device password unlock without username field on return visits.
• **Device session diagnostics** — Settings panel for stay-signed-in / keychain status (mobile/native builds with restore enabled).
• **Profile picker integration** — locked title bar switcher and auth gateway routing fixes.

Profile picker + session persistence

• **Chrome-style profile picker** — `/profiles` public on desktop; card grid; show-on-startup preference; `pnpm verify:profile-picker`.
• **Stay signed in (native)** — OS keychain consent flag, Lock vs Log out semantics, native session persist feedback.
• Cold-boot / F5 keychain restore — **cancelled on desktop** in v1.9.10 (feasibility gate).

Trust, abuse resistance, security validation

• **SEC-F** — recipient-local DM trust assessment port; financial/cold-contact rule pack; thread banner; trust settings copy.
• **SEC-B** — B2 keyword flood rate limits; spam-shape signals; steward bot pause UX.
• **SEC-R** — operator trust bundle audit; relay trust scorer; stack hardening doc; publish honesty gate.
• **SEC-V** — programmatic security validation gates (`pnpm verify:sec-v1.9.5`, `pnpm verify:trust-v1.9.5`, `pnpm verify:relay-v1.9.5`).

Platform + community verification

• **Phase C exit** — client community verification Pass; programmatic platform kernels green.
• **SQLite owner matrix** — documented in [obscur-native-sqlite-policy.md](docs/program/obscur-native-sqlite-policy.md).
• **Shell stability** — STAB-R @ `2a1badf7`; `pnpm verify:stability`.

P3d: community SQLite authority

• **P3d** — Native group list + sealed messages authority in SQLite.
• **`group-list-authority.ts`** — SQLite resolves group list on native runtime.
• **`community-group-sqlite-store.ts`** — Hydrate merge from SQLite seeds.
• **`sealed-group-message-persistence.ts`** — Native read/write without chat-state mirror.

Lane X: experience polish

• **X1** — Route warm-up skeleton with surface-aware stagger.
• **X2** — Page transition loading shell during sidebar navigation.
• **X3** — Voice call dock elapsed timer + ring pulse.
• **X4–X6** — Accepted via existing lightbox and media players.

post-K trust convergence

• **REL-001** — Terminal membership rows beat stale `joined` on restore merge.
• **MEM-004** — Invite-response-only rows downgraded to `historical`.
• **MEM-006** — Re-hydrate when `createdGroups` empty but scope matches.
• **MEM-002 / MEM-003** — Cross-surface roster input builder + invite member pubkeys.
• **MED-001** — Restore media CAS relink after chat-state replace.
• **MED-002** — Ghost voice replay quarantine on restored signal rows.
• **REL-003** — Profile-scoped invite cache, sync state, and read-model listeners.