Changelog

Phase 3 managed workspace honesty

• **P3.1** — `resolveManagedWorkspaceRelayGate` + `isManagedWorkspaceRelayGateBlocking`; management shell banner across tabs; blocks descriptor save, invite, member removal, room-key rotate, and share-invite when Managed Workspace lacks trusted/private relay baseline; governance voting on existing proposals still allowed.
• **P3.2** — `stewardPubkeys` on `GroupMetadata`; `resolveCommunityStewardPolicy` (solo / member_vote / designated_stewards); creator seeded as steward on managed create; stewards bypass governance for descriptor + expel when policy allows.
• **P3.3** — `resolveCommunityDirectoryMaterializationHonesty` + `CommunityDirectoryHonestyNotice` on group home hero, Participants bento, participant modal, and Members management tab.
• [v1.7.0 demo matrix](docs/assets/demo/v1.7.0/README.md); [2.0 program roadmap](docs/program/obscur-2.0-milestone-roadmap.md) and [manual verification environment](docs/program/manual-verification-environment.md).
• **Governance projection** — Stable empty snapshot; no React `getSnapshot` infinite loop on group home.
• **GroupManagementDialog** — Rules of Hooks: `stewardPolicy` `useMemo` runs before `isOpen` early return.

Phase 2 governance projection

• **G2.1** — `community-governance-projection` store + `useCommunityGovernanceProjection`; group home banner and management governance tab read projection; `use-sealed-community` ingests only.
• **G2.2** — `replayCommunityGovernanceEvents`; projection replay tests (tie → rejected, duplicate `resolved`, TTL expired, reordered votes); `toCommunityGovernanceProjection` `activeVotes` excludes expired proposals.
• **G2.3** — Ledger reasons `governance_descriptor_accepted` and `governance_member_expelled`; `community-governance-mutation-owner`; `governanceProposalId` on descriptor bus for governance-accepted renames.
• **G2.4** — [v1.6.0 manual matrix](docs/assets/demo/v1.6.0/README.md); multi-device quorum replay test; governance mutation tests in `pnpm test:community-invariants` and `pnpm release:test-pack`.

Phase 1 exit

• **U3** — Shared `formatRelayPublishFailureMessage` / `assertRelayPublishSuccess` for community publish paths (messages, governance, descriptor, join, leave, vote-kick); profile partial/degraded toasts use `formatRelayPublishPartialCoverageMessage`; group send in main shell and management dialog errors use mapped copy; attachment/avatar/vault upload failures use `getUploadFailureUserMessage`.
• **U4** — Desktop regression matrix: [docs/assets/demo/v1.5.8/README.md](docs/assets/demo/v1.5.8/README.md); release test pack includes governance + publish-copy unit tests.
• **Shell** — Appearance (`system` / light / dark) persists across cold start via scoped + last-known profile keys; startup overlay no longer blocks on account restore (identity + projection + relay gate; sync continues in background).
• **Community (MEM-001 baseline)** — Relay-inferred leave/expel and terminal cache writes gated to `steady_state`; participation includes persisted chat authors; discovery roster widen-only. **Park mode:** [community-membership-invariants.md](docs/program/community-membership-invariants.md) — no new roster features until R2 read owner.
• `pnpm test:community-invariants` / `pnpm test:shell-invariants` (PWA + root); both run in `pnpm release:test-pack`.
• **Desktop** — Native keychain session persistence (`native_keychain`); Android build uses cfg-gated stubs (no `keyring` on `aarch64-linux-android`).

Client Depth

• `relay-publish-user-copy` — user-facing publish failure strings from `reasonCode`; DM confirmation failure toasts.
• `RelayReadinessSettingsBanner` + Relays nav indicator when transport is not healthy.
• Vault progressive cursor batches + capped local media enrich (first 48, idle for rest).
• DM send stays `sending` until wire/relay evidence; no silent optimistic success (R1).
• Account projection re-bootstraps after relay recovery to `healthy` (R2).
• Vault first paint before full message-store scan (R3).
• Android APK on tag may remain unsigned without keystore secrets.
• Mobile production / device matrix deferred to a later milestone.

One Mark

• `pnpm icons:regenerate` — regen Tauri + Android icons from `obscur-logo-dark.svg`.
• Relay pool: skip duplicate WebSocket opens when URL is already `OPEN` or `CONNECTING` (WS-C).
• Chat relay readiness banner + sidebar **Degraded** state when publish path is partial/offline.
• `NEXT_PUBLIC_APP_VERSION` injected at PWA shell build; composer footer shows real version.
• Android `versionName` / `versionCode` synced via `pnpm version:sync` → `tauri.properties`.
• Mobile/desktop version policy documented ([mobile-desktop-version-policy.md](docs/program/mobile-desktop-version-policy.md)).
• Release APKs remain unsigned until Android keystore GitHub secrets are configured.
• Mobile production (signed APK, device matrix) deferred to v1.5.5.

Stay Smooth

• **Vault cursor scan** — `forEachInStore` + `vault-message-scan.ts` (bounded IndexedDB iteration instead of full `getAll`).
• **Deferred heavy pages** — Settings storage health and Search share/suggestions via `scheduleIdleWork`.
• **Mobile shell CI** — `TAURI_SHELL_TARGET=mobile`, manual `mobile-preview` APK lane, release workflow collects nested Gradle APK/AAB into tag assets.
• **Community invite capsule UI** — status banner, response card, and dark-theme contrast pass.
• Regression tests in `release:test-pack` for vault scan, idle scheduling, projection bootstrap, and invite UI.
• **Account projection bootstrap (WS-B)** — active account projection starts immediately after stale snapshot scope reset (no extra render stall).
• **Release CI** — `build-android` required for tag releases; PWA mobile shell built before `tauri android build` with `SKIP_TAURI_BEFORE_BUILD`.
• Mobile UI remains responsive WebView shell + tab bar until v1.5.4 dedicated layouts.
• iOS lane remains optional when signing secrets are absent.
• Device smoke (M1–M3) should be recorded in `docs/assets/demo/v1.5.3/mobile-verification.md`.

Feel Fast

• **Route navigation warmup** — `route-navigation-warmup.ts`, expanded prefetch policy, idle preload for community home from Network.
• **Relay standby probe schedule** — deferred first probe, capped concurrency, visibility-aware cadence (`relay-standby-probe-schedule.ts`).
• **Vault two-phase media load** — sync index aggregation first, bounded async local URL resolve (`vault-media-aggregator.ts`).
• **Community confirmation routes** — `/groups/block`, `/groups/purge` (with leave/block/purge dedicated pages).
• Regression tests in `release:test-pack` for nav warmup, relay schedule, vault aggregator, and group action routes.
• App shell page transitions shortened (150ms) with `motion-reduce` respect.
• Network dashboard: `startTransition` tab switches; `GroupDiscovery` lazy-loaded behind `Suspense`.
• Vault grid skeleton only when empty; 8 placeholders instead of 15.
• Desktop updater uses GitHub Releases API for artifact checks (avoids dev WebView CORS noise).
• First install still pays one-time chunk download per route.
• Vault IndexedDB full-message scan remains; local file verification is deferred, not removed.
• Cooperative recall / delete-for-everyone UI remains off.

Honest Hide

• **Hide on this device** — durable suppression across refresh/restore; **Show again on this device** reversal.
• Dedicated routes: `/groups/leave`, `/groups/block`, `/groups/purge` for destructive community actions.
• Sidebar/route **navigation warmup** (prefetch + dynamic chunk preload, including community home when Network warms).
• Regression tests in `pnpm release:test-pack` for hide flags, blocklist safety, group action routes, and nav warmup.
• Removed **Recall for everyone** from product UI (`DM_RECALL_FOR_EVERYONE_UI_ENABLED === false`); cooperative delete UI remains off.
• Network dashboard tab switches use `startTransition`; reduced tab panel animation duration.
• Desktop updater checks streaming artifacts via GitHub Releases API (avoids CORS-noisy direct download fetches in dev WebView).
• Community block flow uses `useNetwork().blocklist` (profile-scoped) instead of the DM blocklist hook.
• Hide is **local/device-scoped**; not network erasure — see `docs/messaging/deletion-roster-limitations.md`.
• Streaming update policy manifest still requires native or same-origin fetch for full parsing in desktop shell.