#Amethst v1.15.0: Marmot Updates, a Advanced Search Box, and Books, DVM Updates Highlights: - Rebuilds **Marmot** onto the adopted spec — Amethyst groups now interoperate with White Noise, in both directions. - Makes the **search box's tokens real filters**, locally and on relays, and puts Android and Desktop on one pipeline. - Reads **publications, wikis, citations, library records and ratings**. - Adds **NIP-A3 payment targets** to the zap picker, and stops NWC failing in silence. - Shows which **DVMs are alive** before you pick one. - Brings **NIP-53 live streaming** to Desktop — discover, watch and chat. - Stops fresh installs **stranding on a Tor bootstrap**. ## New Features ### Marmot Groups Catch Up With the Spec Marmot deprecated the MIP documents in July and MDK followed, which left our implementation — shipped in v1.09.0 — no longer a valid Marmot client under either profile the current spec defines. This release moves it onto the adopted "current profile" and proves it against the reference. - Implements the MLS extensions draft's `app_data_dictionary`, the account identity proof v2 that makes a group classifiable at all, and the six group components that replace the single packed `marmot_group_data` blob. - Replaces the old same-epoch tie-break — lowest `created_at`, then event id, both of which a sender picks — with the spec's convergence: candidate branches derived by replaying MLS bytes, a bounded pass, and a six-step comparison over authenticated values only. - Enforces publish-before-apply. A local commit is prepared on a clone and becomes canonical only once a relay in the group's own scope acknowledges it, so a failed publish can no longer fork this client away from the group. - Fixes the defects that made us unaddressable: no account could mint a KeyPackage at all; KeyPackages were published as bare bytes instead of a framed MLSMessage; a Commit rebuilt our own leaf from defaults, silently demoting the group creator and making every invite we sent invisible; and a last-resort KeyPackage was discarded after one Welcome, so only the first invite anyone ever sent us worked. - Fixes two MLS defects that meant nobody but a group's creator could invite into a group of three or more: a joiner was never given its Welcome path secret, and an UpdatePath was decrypted at our own leaf rather than at the node we hold a key for. - Makes a departure actually take effect. A leaver's `SelfRemove` was committed and then dropped, so the group believed they were gone while they stayed in the tree holding its keys. - Adds group disbanding, with the whole Commit shape the spec fixes, and an admin-only action behind its own confirmation. - Sends attachments in the adopted encrypted-media v2 shape. Every image Amethyst sent into a group was invisible to every other implementation; an admin can now also switch a group over to encrypted attachments. - Honours disappearing messages, pinned to the epoch that delivered each message rather than to the current setting, with a retention picker at group creation. - Renders message edits and group system rows, and draws a system row only when this client derived it — a peer's assertion of "X removed Y" is no longer drawn as history. - Adds several members in one commit, the way MDK does, instead of one commit per invitee. - Adds a group avatar behind a plain https link, with the canonical URL rules the component requires and an SSRF guard at the renderer. - Adds push token gossip in the shape the spec adopted, with the kind-451 owner proof, so relaying someone's record cannot repoint, re-sign or restamp it. - Adds agent text stream previews over the repo's own QUIC stack, in both directions, with certificate pinning instead of blind trust. - Runs the reference implementation's own fixtures, its portable scenario vectors, and a headless interop harness against MDK 0.9.21 — 29 of 29, both directions, including media in both. ### Search - Ports the vespa-relay search field's token language: `from:`/`to:`, `since:`/`until:`, `#tag`, `label:`, `group:`, `kind:`, `lang:`, `domain:`, NIP-73 scopes, `-exclusions` and quoted phrases, drawn as chips over ordinary editable text. - Runs them. Android handed the raw box — chips and all — to both the relay's NIP-50 `search` and the local scan, so `from:… bitcoin` asked relays for the literal text of its own tokens and a `kind:` chip narrowed nothing. - Puts both front ends on one `SearchPipeline`, so a caller cannot skip post-filters or ranking. Android had never applied `-term` exclusions or the reply/media pseudo-kinds, and Relevance sorted by date. - Opens a picker under a half-written `kind:`, and gives the people picker the composer's own — NIP-05 resolution, relay lookups and follow ranking included. - Names what a chip stands for: a group's name instead of its opaque id, a city instead of a geohash. - Seeds the box with the filter of the screen it was opened from, across 17 more feeds, and remembers what you searched for on Android. - Says what it is waiting on: the spinner now turns while a relay still owes an EOSE, and tapping it lists the relays outstanding. - Answers with one kind window derived from Quartz instead of three hand-kept lists — the audit found fifteen searchable, renderable kinds the search had never asked for, pictures and every video kind among them. - Hides deletion (kind 5) and vanish (kind 62) events from results. ### Reading: Publications, Library, Wiki and Ratings - Gives a kind-30040 publication a table of contents you can read from, listing sections by `a` **and** `e` tag and naming each row from the index alone. - Renders kind-30041 sections: AsciiDoc converted to the same CommonMark renderer long-form uses, with wikilinks resolved to nevents and naddrs. - Gives a chapter a crumb back to its book and a pager through the book. - Parses and renders the library kinds — 31/32/33 citations, 30045 directories, 30142 learning resources and 32176 Blossom piece indexes — and shows a learning resource's attached PDF inline instead of as a blue link. - Parses and renders the NIP-54 wiki kinds (818 merge requests, 819 acceptances, 30819 redirects) and kind-17 external reactions. - Parses kind-34259 entity ratings and kind-31987 relay reviews, and rebuilds the rating card around cover art and stars that actually fill. - Renders kind 0 as a profile card, in the feed and in thread view, instead of raw JSON. - Links each Birdex species to its Wikidata entry. ### Payments and Zaps - Offers a NIP-A3 pay-to hand-off in the zap picker, gated on an installed app actually resolving the URI and wearing that app's own icon. - Hides on-chain zap amounts the wallet cannot fund, checked against the exact coin selection the send path uses. - Names the payee on outgoing NWC transactions (NWC-06), and only claims a binding for a zap request the provider accepted. - Never lets a NIP-47 refusal or timeout reach you as silence — a wallet answering `QUOTA_EXCEEDED` or `RESTRICTED` showed nothing at all. - Stops sending optional NIP-47 params as `null`, which some wallets refuse, and stops downgrading to NIP-04 encryption on a cold info cache. - Adds a Block Relay button to the relay NOTIFY payment prompt, so a paid relay asking on every reconnect can be answered once. ### DVM Liveness - Adds DVM heartbeats (kind 11998), hides DVMs whose last beat is older than 15 minutes from Discover, and marks the rest with an offline dot or banner. - Fetches beats from each DVM's own outbox relays, not only the discovery selection, so a live DVM your relays do not carry stops looking dead. ### Relay Login - Makes the prompt's "remember" switch mean the same thing for both answers. It was read only by the Log in button, so refusing with it on wrote nothing and the same dialog came back on the next reconnect. - Relabels the buttons to the answer they give, and adds "Never, all relays" opposite "Always, all relays", both behind one confirmation that names the consequence. - Stops an account-wide answer being swallowed when the confirmation outlives the prompt's 60-second window, and answers the prompts queued behind it. ### Everything Else - Shares your screen in a call, on Android. - Opens a real file picker for `` — it was a silent no-op in the in-app browser, in nSites and in napplets — and offers the camera where a mobile browser would. - Exposes NIP-44 encrypt and decrypt on the injected `window.nostr`, so a web app logging in with Amethyst can seal a NIP-59 gift wrap. - Emits the uppercase `D` day-index tags on kind 31923, so calendar events are discoverable by date. - Notifies on the rest of NIP-34: PR replies, merges, closes, reopens and drafts. A merged PR used to arrive on the device and go nowhere. - Remembers which side-menu sections you collapsed (#4010). - Leaves the always-on notification card at the bare relay count, with the per-relay breakdown behind a "Show details" action. - Lifts the 3-relay cap on Concord invite links, which blew up the invite button for any community with more. - Saves videos to `Movies/` instead of `Pictures/` (#4009). ## Performance - Draws Amethyst's own icons from a generated font rather than rasterising an ImageVector per card: frame duration P90 -10.7%, overrun P90 -17.4%. - Defers feed animation transitions until there is something to animate: overrun P90 -19.4%. - Stops copying whole GIFs into RAM before decoding them. One 69.8 MB GIF cost 66 MB of heap plus 66 MB of native memory and ~700 ms of pure copying, on every scroll back into view. - Restores the `ImageDecoder` path for still images, which the same identity check had cost every network image in the app. - Makes the concurrent-fetch de-dupe actually work — it was rebuilt per request, so it never saw a second caller — rate-limits the cache reconciler to once a day, and reclaims cache files orphaned by a process death. - Stops blocking an OkHttp thread to sign Blossom read-auth, which could occupy every per-host slot on a gated host, and collapses a cold burst onto one signature. - Asks for many addresses in one relay filter instead of one filter each: opening a 240-section publication went from a black screen for ~2 minutes at 120% CPU to first paint at ~22s. - Rewrites Curve25519 field arithmetic on 10 limbs of radix 2^25.5 and runs the ladder without allocating: x25519 541us → 121us, and against MDK `create_group/1` goes from 4.7x slower to 1.5x while `send_app_message` is 6.5x faster. - Stops `FilterMatcher` allocating once per event — three separate ways, on a path that runs tens of thousands of times per keystroke during a search. - Adds an allocation-free read path for NIP-50 indexable text to all 133 searchable kinds, pinned byte-for-byte against the write path. - Shares one IME-inset holder per window instead of one per call site. - Prices the NIP-19 bracket peel and makes it free. - Defers log message construction to the lambda overload, including the loops the first sweep's line-anchored greps missed. - Bounds the route-text scan by the budget rather than the input. - Bounds in-flight on-device AI work and stops blocking IO threads on it. - Single-flights the LNURL endpoint resolver: a zap-receipt burst was making ~20 requests to one provider per user action. ## Improvements and Bug fixes - Stops a fresh install stranding on a Tor bootstrap. The watchdog fired once per `Connecting` span and a timeout produces no status change, so after exactly two attempts it went silent — permanently. Arti now bootstraps on demand instead of blocking the whole directory download behind its lifecycle lock. - Classifies the app's stand-in relays like the user's own until their lists arrive, so a new install stops routing everything over Tor by construction: first relay socket moved from login+5.9s to login+1.2s, and events ingested by the 20s census from 0–2,590 to 3,719–6,051. - Only substitutes default relays when there is no event, not when the list is empty — publishing an empty search or inbox list is a choice, and the app was overriding it. - Stops relay list updates wiping the public entries another client wrote (#4075). - Recovers IME padding when Compose's insets listener freezes. A back gesture could leave a keyboard-sized gap app-wide, permanently, until the activity was killed; the correction is now 120ms rather than 400ms. - Keeps `TextFieldState` writes on the UI thread, fixing a crash inside Compose's undo bookkeeping on the keyboard's own callback. - Follows the phone's light/dark setting on the launch splash, and carries a pinned LIGHT/DARK choice into it through the per-application night mode. - Uses the HLS master playlist and its full quality ladder, sizes the ladder to the player rather than to a fixed policy, caps it on metered connections, and fixes a picture-in-picture race. - Caps MediaSession artwork so the platform never re-scales it — a crash on ROMs that recycle the source bitmap. - Stops cancelling ML Kit GenAI inference futures, which killed the process from a thread the app does not own. The composer cancelled one on every keystroke. - Makes the full-screen viewer follow the system bars instead of reserving the strip they would occupy, and brings the PDF viewer's chrome to parity. - Caps navigation route text arguments. Sending a crash report to the developer crashed the app: ICU's regex stack overflows at ~100,000 characters and reports "no match" rather than an error. - Narrows the `FileProvider` external root to the app-specific directory. - Stops deleted lists showing their UUID in the feed filter picker (#3949). - Restores GIF insertion on the comment reply screens, where a keyboard GIF did nothing and a shared one threw away the reply in progress, and wires it into four more composers. - Keeps calls alive when the system destroys `MainActivity`, releases the screen-capture Surface instead of leaking one per session, and stops reopening the camera during teardown. - Stops reporting coroutine cancellation as a signer failure, which surfaced as a "signer not found" toast on essentially every fast settings toggle. - Stops a picker's scrolling from dragging the top and bottom bars with it. - Tints the un-boosted repost icon like the rest of the action row, and fixes the liked and reposted colours. - Stops labelling the mixed media feed "Shorts" — two different destinations in the bottom-bar picker carried the same label. - Converts Android string escaping to Compose escaping inside the Crowdin sync, and gates it in CI, after three syncs in a row reintroduced ~2,900 escaped apostrophes that render with a visible backslash. ## Desktop - Adds NIP-53 live streaming: a "Live now" section in Discover with ranking and search, a per-column live bar on the Following and Global feeds, and a watch overlay with player, live chat and live-mode controls, openable from anywhere. - Routes kinds 30311 and 1311 into the desktop cache, which had no channel store at all, with a 500-message chat cap. - Shares the unified search pipeline, and gives the spotlight the same people picker — typing `from:` there opened nothing. - Surfaces macOS notification-permission errors and times the request out, rather than parking forever on a banner the user missed. ## Cli - Redesigns `amy status` around who is signed in and what they saved, adding relay config, follows, Marmot messages, Concord communities and the operator key — and fixing a store report that read 0 events on the default backend. - Drives the Marmot work end to end: current-profile group creation, retention, media policy and transfer, disband, and `amy marmot stream`. ## Quartz - Adds the adopted Marmot profile: the app-data dictionary carrier, account identity proof v2, the six group components, the lifecycle state machine, branch selection, the bounded convergence pass, the candidate-graph builder, encrypted media v2, the kind-451 push owner proof and the agent-text-stream codecs. - Replaces `org.json` with `kotlinx.serialization` across the remaining sources. - Backs linuxX64's `LargeCache` with a striped-lock hash table instead of copy-on-write, which was O(n) per put and not thread-safe. Filling 100k entries goes from 70ms to 15ms with 1 GC instead of 24 — and the whole linuxX64 suite now passes (3,495 tests, from 78 failures), so the CI leg runs all of it. - Matches `java.net.URLEncoder` on native and drops the `urlencoder` dependency. The two implemented different specifications, so Android and iOS emitted different bytes for the same magnet link or NWC deep link. - Routes the roles the NIP-50 search extractor was stranding in the body tier: 19 kinds gain a branch, including the marketplace and Podcasting 2.0 families whose titles could never reach a title band. - Gives the Trusted List member score a 0–100 scale, reads the generic Trusted List entry in a NIP-85 Treasure Map, carries Map entries in both halves of the 10040, and indexes Trusted List titles for NIP-50 search. - Holds a transport failure as provisional for one retry when a relay drops the socket between our EVENT and its OK, and restores pool membership first so the retry dials something. - Waits out the second instead of stamping `created_at` in the future when superseding a replaceable event. - Adds `DvmHeartbeatEvent` (kind 11998) and the publication, library, wiki and rating parsers. ## Build & Documentation - Bumps Kotlin to 2.4.20, Compose Multiplatform to 1.12.0 and AGP to 9.4.0, plus the rest of the version catalog. - Executes the commons migration sweep: 38 relayClient files, the OkHttp client stack, 37 model and service singles, the top-nav feed datasource layer and the search history move to `commons`; the 12 typealias shims are deleted and their 1,165 imports repointed; 25 files are promoted from `jvmAndroid` to `commonMain` after a per-file concurrency review. - Migrates 2,565 string keys — about 105,800 locale entries — to the shared Compose resource catalog, and gates the orphaned-translation and escaping traps pre-push and in CI. - Publishes desktop test reports when the desktop job fails, which was the only test-running job with none. - Renames the `geode` Homebrew formula to `geode-relay`, since `geode` is permanently reserved for Apache Geode, and fixes a style violation in both formulae. - Adds `marmotBench`, a head-to-head against MDK's own benchmark, reporting bytes allocated per operation alongside latency. ## Contributors - - - - - - - ## Translations - Dutch by - Hindi by - Hungarian by - Polish by - Slovenian by

#Amethyst v1.14.0: New Share Intents, Relay Login, and a Much Faster Start Highlights: - Improves **NIP-84 Highlights** — composer, feed, and share intent. - Redesigns **relay login (NIP-42)** and ends the per-relay prompt storm. - Adds Share targets to **Pictures, Videos, Shorts and Torrents** feeds. - Adds a screen that explains **why every relay subscription exists**. - Fixes the cold-start **out-of-memory kill** and cuts time to first paint. - Brings **Desktop** to parity on profiles, DMs, settings and key backup. - Adds **Trusted Lists** (kinds 30392–30395) to Quartz. ## New Features ### Highlights (NIP-84) - Adds a Highlight composer, with an annotation field, a passage editor, and a source reference that can be a Nostr event or a web URL. - Adds a Highlights feed, filterable by authors, follows, hashtags and geohashes. - Accepts shared text from any app as a new highlight. ### Feeds and Composing - Adds four home feed content types: Pictures (NIP-68), Videos and Shorts (NIP-71), and Torrents (NIP-35), each with its own toggle. - Adds "New Picture", "New Short" and "New Video" share targets, so media shared into Amethyst opens the matching composer instead of a text note with a link. - Adds a bulk audience picker to the short-note composer: search people lists and follow packs, review the members, then add them all at once. - Adds a poll results page with per-option vote counts and a filterable voter list, replacing the feed card's four-avatar preview. - Shows rich previews for comments scoped to external content (NIP-73), both in the "replying to" line and as the thread's title. - Offers a "Copy Original / Copy Translated" chooser when copying a note that has been translated. - Opens the edit screen when a draft reply is tapped in a thread. ### Relay Login (NIP-42) - Redesigns the relay login permissions screen. Explicit exceptions, relays blocked by your block list, and recent logins are now three separate sections. - Starts new accounts on "always log in" instead of deciding per relay. - Remembers a login for the rest of the session when you answer without ticking "remember", so a reconnect stops asking again. - Honors "always log in" for relays your own account does not publish to. - Makes the "reading someone I follow" toggle reachable — it sat behind a first-party gate that could never be true. - Counts NIP-29 groups and Concord communities as rooms you joined, so their host relays authenticate under "my relays and venues". - Waits for an auth challenge to resolve rather than letting the fetch time out. ### Relay Traffic, Explained - Records why every relay-bound filter exists — its purpose, the entities it serves and the account that asked — and renders that back on a new screen. - Fixes the multi-account subscriptions that screen exposed as never running. - Breaks the resource ledger down by cause, so it reports *why* relay data was spent, not just how much. - Stops the automatic "High resource usage detected" dialog on app open. The ledger keeps recording and Settings still shows the report. ### Chats, Groups and Communities - Mutes a public chat from a long press in Messages or from the channel menu. - Deletes (kind 9008) and archives NIP-29 channels, with the Buzz community UI to match. - Keeps a channel invite's replies, reactions and zaps inside the relay that sent the invite, instead of broadcasting them to your outbox. - Derives Buzz channel invites from cached membership notices, so they stop appearing and disappearing. - Redesigns channel invite cards as feed rows, with the person who added you as the row's author. - Shows the hosting relay's name chip on relay group message headers. - Splits the Concord Control Plane's stream key so a staff-held `control_root` write-gates it (CORD-02 §2). - Closes the Concord CORD-05/06 invite lifecycle: an Invite List, a re-mint on Refounding, and revocation. - Stops pinning Concord entities whose chain crosses a Refounding, which was discarding their newer state on every refold. - Closes seven Concord soft-ban holes — a banned member kept `control_root`, half the Control Plane never read the banlist, and the invite button still worked. ### Everything Else - Makes the left drawer configurable, so entries you don't use can be hidden. - Adds ngit-specific search to the Git Repositories screen. - Supports IPv6 overlay relays (Yggdrasil) with RFC 5952 canonical addresses, fixing one relay counting as two and Tor-proxying an unreachable overlay. - Adds a Nostr badge watermark to the notification icons, reshapes the mention icon, and adds dedicated reply and mark-as-read action icons. - Runs verified NIP-5D artifacts in an opaque `srcdoc` sandbox behind a first-head CSP, and advertises only the NAP domains actually implemented. ## Performance - Scans NIP-19 entities, hashtags and legacy `#[n]` references without ICU. On Android, `Regex.matchAt` copied the whole note content into native memory per candidate, which grew a cold start to ~1.9 GB and got the app killed. - Scans note content by literal instead of restarting the regex engine at every position in every note. - AOT-compiles the relay ingest path with a baseline profile. Release cold-start ingest was spending 36× more CPU interpreting bytecode than verifying signatures. - Demotes the ~650 relay and ingest worker threads below the UI thread, so the connect storm cannot starve the first frames (~40% faster first paint). - Reclaims memory under heap pressure and stops leaking sandboxed WebView Activities. - Bounds the duplicate-frame decoder cache in both size and age. - Stops blocking coroutine workers on synchronous OkHttp calls, which released their CPU permits and starved the dispatcher. - Stops the outbox getting slower with every publish — it rebuilt an immutable map per send, copying every pending entry. - Stripes the subscription-state lock per relay, ending the ANR convoy that had 37 of 52 workers spinning on one lock. - Memoizes Concord guestbook envelope opens, so the fold stops re-decrypting the whole buffer on every arrival. - Caches the painter on its first miss in `painterRes`. - Optimizes the proof-of-work mining hot loop for the Android runtime. - Skips the ~220 ms system call when the app locale has not actually changed. - Confines the Blossom cache probe and server resolver to the IO dispatcher, and re-probes it when the toggle flips. - Releases dead subscription rows, so connect and disconnect stop scanning every subscription ever created. - Prefetches NIP-73 external-content preview URLs so those cards stop popping in mid-scroll. - Adds fixed-size hex codecs for 32- and 64-byte values. ## Improvements and Bug fixes - Settles the keyboard inside navigation, so leaving a screen mid-animation stops stranding `imePadding` across the whole app. - Routes the draft-saving editors through `KeyboardAwareBackHandler`, so a predictive back gesture no longer races the IME close. - Raises the keyboard again when you tap a field in an embedded tab that was already focused. - Pads for the soft keyboard in full-screen napplet hosts on Android 15+. - Fixes the crash when switching between two pinned web-app tabs. - Stops drawing a blank parent card above a top-level community post. - Fixes Cashu wallet balances reading low: proofs are now backfilled past the relay's page cap and history is paged. - Keeps PDF previews stable — the page ratio is cached, so scrolling back no longer collapses the card and replays the grow-in animation. - Stops rendering non-media NIP-94 files as video. - Repairs `imeta` MIME types written as a bare subtype, so those images can be shared again. - Works around a fatal media3 crash on Low-Latency HLS streams. - Drives the "Can't reach this relay over Tor" banner from live socket state instead of a bare six-second timer. - Stops a lone repost from being bundled into the always-on service notification, where it inherited the ongoing flag and refused to swipe away. - Fails push registration loudly on an HTTP error, instead of caching a token for a device that will never receive anything. - Listens for location only while foregrounded, and fixes the meter that reported 7 hours of listening against 9 seconds of foreground. - Excludes quote characters from parsed URLs. - Fixes the OpenGraph meta parser losing every tag after an apostrophe inside a comment or script, which broke link previews on some sites. - Requests the follower-count provider's kind 30382 cards, so the count stops rendering as `--`. - Gives the invite roster line's member count its unit, so a bare number no longer reads as counting the avatars beside it. - Removes the recent-poster facepile from Concord and Buzz channel rows. - Renders every NIP-71 video subtype through the shared interface. - Reworks the chat bubble reply swipe on lower-level pointer APIs, so it only claims the gesture once the motion is clearly horizontal. - Turns the default log into a boot narrative instead of a firehose. - Converts the drawer's hidden-count to a plural, fills the untranslated backlog for Czech, German, Swedish and Brazilian Portuguese, restores placeholders dropped from German and Polish plurals, and drops an unused plural. ## Desktop - Enriches the DM composer and message list: emoji picker with custom emoji, @mentions, reply-quoting with jump-to-original, Nostr-native GIF search, rich message rendering, per-message image quality, and encrypted file uploads. - Redesigns Settings as a searchable accordion of labeled cards, with expand/collapse-all and a filter over titles and keywords. - Brings the profile screen to parity: banner, rich-text bio, a CLINK offer field, six new tabs (Followers, Following, Relays, Bookmarks, Yours, Zaps received) and header actions. - Adds a guided "save your keys" step on first run and a key backup in Settings. Android gets a soft nudge after signup. - Loads metadata and reactions only for what is on screen, through the shared finders in `commons`, and unsubscribes when it leaves. - Enables the master notification switch when the OS permission is already granted. - Publishes Windows arm64 and Linux arm64 desktop builds. ## Cli - Gives `amy` the Concord key lifecycle it was missing: accept a promotion, follow a Refounding, perform one, and recover when left out of it. - Publishes Windows and Linux arm64 assets for `amy` and `geode`. - Reports "no relays" only when there really were none, and pins the buzz wrapper copies against the argument surface they call. ## Quartz - Adds Trusted Lists (kinds 30392–30395), the aggregate counterpart to NIP-85 Trusted Assertions, and indexes their labels for NIP-50 search. - Fixes a `SharedKeyCache` collision that could return one peer's shared secret for another peer's message, and compares MACs in constant time. - Measures NIP-66 relay health from traffic the client already makes, streams probe verdicts as relays answer, checks read and write separately, lets a monitor publish what it learned without dialling, and merges verdicts into the record they replace instead of overwriting it. - Measures `rtt-open` as the transport handshake, not the time the call spent queued in the dispatcher. - Records sync coverage per kind rather than one interval per filter, keys its persistence with a typed band, closes a drained leg, and terminates a paged walk against a relay that ignores `until`. - Strikes a host out and tracks its unreachability with publish-safe semantics, so a dead host stops being retried at the same rate as a live one. - Sizes negentropy reconcile windows from the caller's own index, states the relay's cap, and lets a caller decline an id before its body crosses the wire. - Normalizes every accessory timeout to an idle window, drops the `maxTotalMs` ceiling that cut healthy fetches, and stops `fetchAllPages` cropping a streaming page. - Stops COUNT inheriting the REQ page size, which capped a count at 500. - Suspends the incoming-message chain down to `SubscriptionListener.onEvent`, so a consumer that cannot keep up no longer blocks every shared worker. - Compares every filter in `FiltersChanged`, not just the first. - Fixes an `InProcessWebSocket` race that delivered a connect-time AUTH challenge before `onOpen`. - Adds `StoreQueryContext`, carrying the NIP-42-authenticated caller identity into observer-relative stores. - Adds a NIP-50 search grammar (quoted phrases, negation) with weighted field extraction, and shares the store-semantics rules across implementations. - Parses metadata leniently everywhere, and recovers blank, single-element and malformed kind-0 content instead of dropping the profile. - Parses `ServiceType` without splitting on a separator that may not be there. - Declares pointer hints on Report, ChatMessage, Classifieds and ChannelCreate. - Refreshes `created_at` while mining, so a post that takes minutes to mine does not publish stale. - Decouples the `LocalCache` and `Account` god classes into single-purpose collaborators, 3,800 lines lighter, with no behavior change. ## Build & Documentation - Adds a `:baselineprofile` module that records a real startup journey, replacing the hand-authored profile's wildcards. - Notarizes the macOS DMG and verifies it, adds `libegl1` to the arm64 `.deb` dependencies, and moves the Homebrew and Winget bumps onto a maintainer machine. - Shrinks the mirror-sync throughput corpus on CI, which had been timing out the `test-geode` job for weeks. - Confines the QUIC stream drainer to the producer's event loop, deflaking it under parallel test load. - Hardens `workflow-ship.sh` and pins it with a regression harness. - Adds three store-implementer skills: event store semantics, NIP-85 trusted assertions and searchable events. - Bumps 30+ dependencies plus Gradle, Compose, Firebase, Media3, Ktor and OkHttp. ## Contributors - - - - - - - ## Translations - Czech by - Dutch by - German by - Hindi by - Hungarian by - Latvian by - Polish by - Brazilian Portuguese by - Swedish by