v2.8.0

v2.8.0 — Your Chama has your back (and now takes applications)

Compatibility: SOFT — UI behavior, theming, build tooling, and two NEW
additive event kinds (38120 roster, 38121 application) that old clients
simply never query. No trade-protocol change. Existing trades, listings,
and communities are untouched.

Dark, light, or follow your phone

• Me grew an Appearance row: Dark (the Chama you know), Light (paper mode,
  contrast-tuned so the small bold mono survives sunlight), or Auto (follows
  your device, live). Your pick persists, and light users don't get a dark
  flash at boot. QR codes stay black-on-white in BOTH modes — a backup QR's
  job is to scan, not to match the wallpaper.

Live trades anchor you — the switch finally knows

• Switching Chamas is free between trades and blocked during one. The old
  guard only watched your balance — which reads ZERO mid-trade (your sats are
  locked into escrow shares), so it went blind exactly when you were most
  committed. Now any live trade you're in (buyer or seller) blocks the switch
  with honest copy: finish or resolve it, then go. Same-Chama taps are never
  blocked — staying is always safe.
• The same anchor guards listing taps: a listing on another route would
  silently move your wallet's federation, so during a live trade those taps
  tell you why instead of moving you. Same-route listings stay tappable.

Visits snap back home

• Tapping a listing on another route switches you in to view it — and now,
  when you back out without committing, Chama quietly returns your wallet to
  your home federation ("Back home on Kibera."). If you funded or joined the
  trade, you stay — your commitment is there now, and the anchor above takes
  over until it resolves.

The arbiter on-ramp — rosters you can verify, a door you can knock on

• Every community's recognized arbiters can now live in a SIGNED roster
  (kind:38120) published by the community's steward — the registry-pinned
  key for curated communities, the creator's key for permissionless country
  shells. Clients fetch and verify it automatically when you land on a
  community, and it becomes the strongest provenance source behind the
  arbiter badge: trust you can replay, not trust baked into the app.
• Want the seat? Me grew "⚖ Become a community arbiter" — a plain-language
  FAQ (you vote only when buyer and seller disagree; the 1.5% dispute fee is
  your duty pay) and a signed application (kind:38121) straight from the
  form. The steward reviews applications inside their roster surface and adds
  accepted keys with one tap. Honest fine print: community-wide admission
  VOTING comes in a later release — today the steward decides, and the roster
  they sign is public and replayable, so the decision is at least legible.

Publishing feels instant again

• Pressing Publish used to wait for EVERY relay to answer — one half-dead
  relay held the whole thing hostage for 8 seconds even after healthy relays
  accepted in milliseconds. Now the event still goes to all relays at once,
  but the app returns the moment the first relay accepts; stragglers settle
  in the background. Same durability bar, none of the waiting. (Ghost-trade
  healing got the same speedup, multiplied by every event in the chain.)

Desktop, all three at once

• Pushing a release tag now builds the desktop app in CI for macOS (Apple
  Silicon), Linux (deb + AppImage), AND Windows (NSIS installer) — the
  Windows leg validated end-to-end by a real probe run (the fedimint bridge
  compiles, spawns, and bundles on stock runners). Bundles land on a draft
  GitHub release; nothing ships half-baked. Desktop version numbers now flow
  from one source of truth, so they can never drift from the app again.

Under the hood

• Arbiter v3 design locked into DECISIONS.md + the economy doc: presence is
  measured by a bond (slash-to-cover, k-of-n community custody, post-hoc —
  no trade ever waits on it), fairness is measured by reputation — never
  auto-slashed. Implementation lands with the ratings + roster track.

Under the hood (governance wire)

• Kinds 38120 (roster) + 38121 (application) live in a deliberate governance
  neighborhood past the trade band — 38122 is reserved for admission votes.
  Earlier design notes said "38104" for the roster; that's RESOLVE on the
  escrow wire, so the docs were corrected when code met reality. Roster
  caches re-verify signature + authority on every read — a poisoned cache
  buys an attacker nothing.

Numbers

• 2,255 tests green (24 new: trade-anchor rules, first-ACK publish, signed
  roster, applications); typecheck clean; both palettes verified; every new
  guard and governance rule is pure and replayable.