v0.9.4

Calls

The in-call screen stopped being decorative — every control on it now does something.

• Mute and speakerphone actually work, wired through to the voice backend rather than just lighting up
• An in-call keypad with real DTMF tones, so phone trees and automated lines can be navigated mid-call
• A contacts overlay during a call, to look someone up without dropping the line
• Calls now surface as an island with a peek — the ongoing call stays visible and one-tap returnable while you use the rest of the phone

Mail

• Saved emails: addresses you send to can be saved and reused, with compose autofill, a picker sheet, and a prompt offering to save the address the first time you mail it (#105)
• Document attachments: attach a document from Files to an email. The attachment is snapshotted server-side at send time, so it stays exactly what you sent even if the original changes later, and the recipient can download it straight into their own Files
• The detail action bar no longer disappears while the page slides in (#103)

Files & documents

The signature system grew a second half: originals that come back countersigned.

• Signature requests — hand your document to a nearby player through AirShare and get it back with their signature on your original, rather than on a copy
• Counter-signing gates on the viewer's own signature, so a document you have already signed asks the other party, not you
• An inline-image block editor for player-authored documents, so a document can be written with pictures in place instead of raw URLs
• Owners can now delete any file they hold, with a deletable = false opt-out for issuing resources that need a document to stick
• A visual pass: grey document view, badge pills, a larger signature counter and sign button, and the create dialog now blurs the tab bar behind it
• Fixed: documents created with a numeric locked = 0 were stored as locked, because 0 is truthy in Lua. Affected rows unlock themselves on first boot

Birdy

• The hand-drawn Birdy mark replaces the borrowed Lucide feather across every brand surface — icon, splash, empty states (#102)
• Real trending hashtags, computed server-side from recent posts, plus hashtag search that actually returns posts (#104)
• Photo and GIF replies, with a GIF picker in the reply composer
• A legibility pass: larger avatars, post text and action icons, so the feed no longer reads smaller than the rest of the phone. Edit Profile was rebuilt to match the iOS forms elsewhere, and New Message now pushes in like every other drill-in (#120)
• Notification rows put the avatar and text on one line (#114)

AirShare

• The share prompt now expands out of the dynamic island the way iOS does, and the nearby-player picker resolves names through your contacts instead of showing raw identifiers

Security

Two ways to mint money were found and closed (#115). Both were reachable by a modified client, and both ended in real bank funds:

• The stock market filled buy and sell orders at the price quoted before the order's own market impact was applied, so a round trip could pocket the difference
• Blackjack credited a winning hand's payout before clearing the hand, so a hand could be settled more than once against a single wager

Updating is recommended for any server running the Stocks or Casino apps.

Performance

A full audit of the Lua side, with the fixes landing across five changes. Nothing here changes behaviour — it changes how much the server does to produce it.

• Player identity resolution is now O(1) (#119). Resolving a citizenid to a connected player used to scan every player on the server and ask the framework for each one; it is now an indexed lookup, invalidated on connect, disconnect and character switch. On a 200-slot server this takes a busy second from ~5,000 framework calls and 12,000 list iterations to none
• Notification fan-outs resolve recipients once instead of once per recipient, and Birdy writes its follower notifications in a single statement rather than one per follower (#117)
• Badge pushes carry only the app that changed (#118). A new post used to recompute all seven unread counts for every recipient, including an unindexable scan of the mail table that a post cannot affect
• Pages and Marketplace feed updates go only to players with the app open (#122). Every classified post previously pushed a message to every connected player, which the vast majority received and discarded
• Eleven smaller wins (#116): stock price broadcasts scoped to open apps, the settings screen built from one query instead of sixteen, the friends live-location loop no longer re-reading the roster every tick, missing indexes on the game leaderboards and Cherry matches, phone-number lookups made index-seekable, and a boot-time full-table update that ran on every start now running once

Settings

• Screen brightness persists across restarts and reconnects — it had never been saved, and reset to full every time the phone reloaded (#121)

Configuration

configs/homescreen.lua is now configs/apps.lua, and every app carries explicit flags:

• base = true — ships installed and cannot be removed; never appears in the App Store
• enabled = false — the app does not exist on this server: hidden from the home screen and the App Store, uninstallable, and removed from phones that already had it. Server modules keep running; only the app's presence on the phone is gated

Upgrading

If you customized configs/homescreen.lua, copy your changes over before restarting. That file is gone in this release, replaced by configs/apps.lua — your dock, wallpaper and app list will fall back to the defaults otherwise. It is the only manual step.

Everything else is drop-in. New columns, indexes and the two one-time data repairs create and run themselves on first boot; the repairs record themselves in phone_migrations so they never run twice. The first start after updating may take slightly longer than usual while indexes build.

As always, the attached sd-phone.zip ships the built UI.