v0.9.11 — Phase A (relayer) + Phase B (event scrub) live

What's new

Network privacy (Phase A) — V3 shield/unshield/transfer now route through the on-chain p01_relayer program with a hosted off-chain worker on Railway. Hides the user's RPC submission IP and uses an ephemeral fee-payer for the outer wrapper tx (closes leaks L19 + partial L17).

• New Settings → Privacy → RELAY ROUTING toggle (default ON).
• Universal fallback: if the relayer hiccups, falls back to direct on-chain submit so the user UX never breaks.
• Critical fix: rent-exempt minimum pre-funded on the ephemeral submitter.

On-chain event scrubbing (Phase B) — zk_shielded no longer emits ShieldDenominatedV3Event / UnshieldDenominatedStarkV3Event / TransferDenominatedStarkV3Event. These were leaking depositor, recipient, denomination, etc. directly to any indexer parsing program logs. The universal LeafInserted event + on-chain NullifierRecord PDA suffice for clients.

• Devnet program upgrade: 4dVAbEkMqmFkb8VcSmsbR6FYw9sbktx3yUr4EnjQbHUkUvnbZ1CZN1zw7orrt6dMB4gQBkeo1EN3bRsTTzFc9Fam
• Validated live: inner unshield txs now show zero Program data: lines.

Honest scope

What's closed:

• L19 (RPC IP) — hosted relayer
• L17 partial (outer fee-payer = ephemeral)
• Event-level L1 / L5 / L7 (depositor / recipient / nullifier no longer in events)

What's still leaky (deferred):

• Tx-account-level L1 / L5 (depositor/recipient still appear as accounts in the inner tx) — needs Phase A.5 (feeder pool) + B.2 (stealth recipient).
• L2 (pre-fund tx from main wallet to ephemeral) — same Phase A.5 territory.

Phase A.5 is deferred until either TEE attestation or N≥3 distinct relayers exist; a single-relayer feeder pool would be trust-shifting, not privacy-gaining.

Install

• Devnet only.
• Re-installing over an existing v0.9.x debug build will wipe AsyncStorage/SecureStore (signature mismatch). Re-install over v0.9.11 release will preserve notes.