Changelog

• **Obscur Full Release** — `workflow_dispatch` can rebuild without a new tag; optional `release_tag` for publish from `main`.
• **Preflight** — removed duplicate `release:test-pack` (already gated on `main` via `reliability-gates`).
• **Verify** — single step: artifact matrix + version parity (AAB binary fallback when bundle metadata rows missing).
• **P12** — Manual UX checklist + unlock smoke on emulator (see demo matrix).
• **`pnpm p12:android-smoke`** — prerequisites, optional `--build`, adb install + cold start; prints maintainer record block.
• **`pnpm dev:mobile-shell:online`** — hot-reload mobile shell in browser (avoid full APK loop for JS/relay fixes).
• **Demo matrix** — P12 UX checklist + record table in [v1.8.12 demo](docs/assets/demo/v1.8.12/README.md).
• **Relay primary selection** — runtime failover now uses the same reconcile path as health hints; 4s cooldown blocks non-emergency flip-flops that caused React #185 on emulator.
• **Bottom tab bar** — visible on mobile-shell chat list and secondary routes (Settings, Network, Search, Vault); hidden only inside an active DM/group thread.
• **Invite JSON previews** — sidebar shows human labels (`Community invite: …`, `Accepted community invite`) instead of raw `community-invite-response` JSON.
• **Post-build desktop verify** — each `build-desktop` matrix job runs `verify-desktop-bundle-filenames.mjs` before upload (rejects stale `Obscur_1.8.10_*` on a `1.8.12` tag).
• **Blocking full parity** — `verify-artifacts` runs desktop + Android `release:artifact-version-parity` (no `--skip-android`, no `continue-on-error`).

B1 outbound bot + desktop online

• **`botPubkeys`** on `GroupMetadata` — sealed descriptor updates + kind 39000 relay hints.
• **Policy** — `community-bot-policy`, `community-bot-message-policy` (managed-workspace ingest gate).
• **Steward UI** — Register bots under Manage → General (managed workspace).
• **CI** — `ci:community-bot-descriptor-smoke` in reliability-gates.
• **`scripts/community-outbound-bot.mjs`** — sidecar publish (kind 10105 / inner kind 9).
• **`pnpm community-outbound-bot`** — env-driven CLI with `--dry-run` and allowlist check.
• **CI reliability-gates** — `pnpm install` before B1 smokes; outbound bot crypto uses `@noble/curves/secp256k1` via apps/pwa (fixes `nostr-tools` missing + `ERR_REQUIRE_ESM` on `@noble/secp256k1`).
• **Release workflow** — desktop Cargo cache key includes `tauri.conf.json` / product version; stale `bundle/` cleared before `tauri build`; publish renames installers to tag semver.
• **Outbound bots UI** — visible on managed workspaces with member-vote governance; `botPubkeys` in governance proposals.
• **Desktop online reliability** — coordination directory refresh throttle; DM display-cache LRU + coalesced hydrate; relay primary failover + faster standby probes ([desktop-online-reliability-2026-05.md](docs/program/desktop-online-reliability-2026-05.md)).
• Automated: `test:community-bot-descriptor`, `test:community-outbound-bot`, maintainer `dev:desktop:online` soak.
• **Deferred:** Manual Test B1 (operator live bot announcement).

D2 compaction + Android install smoke

• **Relay-gateway** — Global hide registry with opt-in JSON persist (`OBSCUR_RELAY_HIDE_PERSIST`, `OBSCUR_RELAY_HIDE_REGISTRY_PATH`).
• **Compaction** — `scripts/operator-relay-storage-compact.mjs` + [operator-relay-compaction.md](infra/nostr/operator-relay-compaction.md).
• **CI** — D2 persist + SQL contract smokes in reliability-gates.
• Community home — clearer CTA hierarchy; governance banner opens Governance tab.
• Shared management-control primitives for community home + connection profile.
• Settings search — group + tab labels instead of raw tab ids.
• Android install + cold-start smoke — [demo matrix](docs/assets/demo/v1.8.10/README.md).

Operator-relay deletion + managed workspace ship

• **D1** — `community-relay-hide-suppress`: kind 5 hide index; suppresses hidden message `EVENT` frames on operator workspace relays ([`enhanced-relay-pool.ts`](apps/pwa/app/features/relays/hooks/enhanced-relay-pool.ts), [`apps/relay-gateway`](apps/relay-gateway/src/index.ts)).
• **D3** — “Remove from this workspace” in group message menu, batch mode, and toasts ([`strict-managed-workspace.ts`](apps/pwa/app/features/groups/services/strict-managed-workspace.ts)).
• **Docs** — [managed-workspace-relay-deletion.md](docs/messaging/managed-workspace-relay-deletion.md); optional `pnpm dev:relay:gateway:docker`.
• **CI** — `pnpm ci:community-relay-hide-smoke` in reliability-gates.

Managed workspace — Test 8

• **Group chat header** — Member count, online count (presence evidence), and last activity under the group title ([`chat-header.tsx`](apps/pwa/app/features/messaging/components/chat-header.tsx)).
• **Group message hydration** — `loadPersistedSealedGroupMessages` on community chat open (Tauri SQLite when available, else scoped `chatStateStore` per profile) ([`sealed-group-message-persistence.ts`](apps/pwa/app/features/groups/services/sealed-group-message-persistence.ts), [`use-sealed-community.ts`](apps/pwa/app/features/groups/hooks/use-sealed-community.ts)).
• **Post-release roadmap** — [v1.8.9+ managed workspace](docs/program/v1.8.9-plus-managed-workspace-roadmap.md): operator-relay end-to-end deletion, group bots.
• **Relay dev genesis** — Open relay in `infra/nostr/nostr-rs-relay.toml` (empty `pubkey_whitelist` blocks all publishes on `nostr-rs-relay`).
• **Tauri loopback relay** — Browser WebSocket for localhost relays; alias-aware pool; ephemeral publish fallback; socket-open publish fallback.
• **Coordination CORS** — OPTIONS preflight no longer returns body on 204 (wrangler 500).
• **Create/join copy** — No false “relay optional / coordination-only” when `localhost:7000` is configured; genesis-required banner instead.
• **Leave / member count** — Terminal membership cache events; header uses live CRDT minus left/expelled; `group-provider` stops stale `Math.max` member count after leave.
• **Build** — `sealed-group-message-persistence.ts` generic close typo (`}>): void`).
• **Community workspace activation** — Richer publish errors in toasts; ephemeral WebSocket fallback in publisher.
• **Participants vs header** — Terminal LEFT/EXCLUDED in modal; chat header reacts to `COMMUNITY_TERMINAL_MEMBERSHIP_UPDATED_EVENT`.
• v1.8.8 scope, gate, demo matrix, release notes, handoff, and release-train synced.

Transport-hard evidence + membership consistency

• **T7-1** — Expanded `community-invite-relay-join.test.ts`: transient retry success, manual retry terminal transitions, retry visibility guards.
• **T7-2** — Membership surface consistency tests: `invite-to-group-dialog`, `network-dashboard`, `chat-view` → `chat-header` member-count forwarding.
• Release confidence docs explicitly separate **proven automation** vs **environment-bound manual soak**.
• Full staging/public-relay two-client soak remains environment-bound ([v1.8.8 demo](docs/assets/demo/v1.8.8/README.md) closes local managed-workspace lane).

Relay-join owner + membership read-model

• **T6-1/T6-2** — `community-invite-relay-join.ts` + invite-card retry owner (`handleRelayJoinRetry`); deterministic terminal states (`joined`, `retry_scheduled`, `terminal_failed`) and honest user copy.
• **T6-3/T6-4** — `use-community-membership-read-model-index` as canonical owner for participants, network summary, invite gating, chat header member count.
• **T6-5** — `scripts/relay-runtime-smoke.mjs`; reliability/release workflows include relay runtime smoke against `nostr-rs-relay` container.
• Parallel fallback read paths removed from modal/network/invite summary consumers.
• Manual invite→accept→relay-join matrix pending staging evidence at tag time ([v1.8.8](docs/assets/demo/v1.8.8/README.md) supersedes for local infra).

Mobile Preview + desktop shared kernel

• **M1** — Mobile shell DM-first navigation: full-screen conversation list, thread header with back, shared `ChatView` / `dmController` (no parallel send path); `AppShell` `mobileDmMode` hides bottom tab bar.
• M2 — Safe areas and tab bar polish in emulator (**paused** until signing/install).
• Optional unsigned APK on tag for preview (**paused**).
• **R4** — Settings storage-tab health/path probes and Search recent-history hydration defer via `scheduleIdleWork` (closes v1.5.3 idle deferral gap).
• **U1** — Community invite status banners: direction-aware title/subtitle copy and stronger light/dark contrast.
• **Themed selects** — `@dweb/ui-kit` `SelectField` replaces native `<select>` across invites, network filters, and dev tools (gradient/popover styling).
• **R5 (MEM-005)** — Terminal invite decline/cancel no longer backfills declined peers into inviter roster evidence.
• **MEM-002 (partial)** — Community home/management participant list and invite gate use **active** membership (`leftMembers` / `expelledMembers` applied) instead of widen-only discovery roster; display names prefer persisted `createdGroups.displayName` over relay hex group ids.
• **SelectField** — Body-portaled menu for reliable dropdowns inside stacked modals (Add Connection expiration).
• **Community Phase 1 (desktop)** — Sealed descriptor updates (`community.descriptor_updated`) with `persistCommunityDescriptorUpdate` and `descriptor_updated` ledger reason; Network `resolveCommunityDisplayName`; sealed governance propose / vote / resolve (accept, rejection-quorum reject, TTL `expired`); Governance tab + home banner; session governance cache; **expel** via governance when member count > 2 else legacy `vote-kick`; multi-member rename propose path.
• Lane M emulator smoke — no device/signing path on desktop. **Desktop `v1.5.6` tag** may still ship with end-to-end gate **A1–A4** (plus community Track D desktop slice) per [v1.5.6-gate.md](docs/releases/v1.5.6-gate.md). Lane M remains optional.
• Store signing and device matrix production gates remain optional.