v3.0.0

Stands on its own

v3.0.0 · a milestone, not a migration — soft & additive.

Why 3.0: this is the release where Chama stops needing a village around it. You
can open the app cold, hold your own keys, pick your flag and currency, trade on
Bitcoin rails, recover your whole account from a single key — and now be tapped
on the shoulder the moment a trade needs you — without a local arbiter, and
without a Chama yet existing in your country. The major-version bump marks that
line being crossed, not a breaking change.

Compatibility: SOFT — additive only. No wire-format, trade-protocol, or
vote-acceptance change. Notifications are entirely client-side; the wrong-chama
fix is create-time labeling. Existing trades, balances, listings, and
communities are untouched — ship it and forget it.

🔔 Chama can reach you now

The gap that made Chama feel like a page you had to babysit is closed. It now
buzzes you when — and only when — a trade actually needs you:

• Your counterparty locked the sats. The other side funded; your move.
• Your payout is ready to claim. The trade resolved your way — come get it.
• A dispute needs your ruling. (arbiters) Both sides voted and disagreed —
  you're up.
• Settled, or timed out. The trade completed, or expired and refunded — so
  you can stop checking.

One switch in Me turns it all on or off. It asks for notification permission
only when you flip it on — no cold permission wall on first launch — and it
can't double-buzz: each moment fires once, and only after the app actually has
your state (no alert-storm when it reloads your history). Works on Android, in
the desktop app, and in the browser.

🛑 The wrong-chama guardrail now actually fires

The amber "you're off your home route" warning on Browse is a safety rail — it's
what stops you acting in a federation that isn't the listing's. It had a blind
spot: visiting a foreign listing could stamp a new listing with one chama's
LABEL but another chama's actual federation, so the chip read (say) "GBF" while
the off-route tint — which tracks the real fed — never lit up. Create-time now
keeps the label honest with the fed the sats are actually minted on, so the
guardrail fires every time it should. (#103)

🪟 Desktop, honestly labeled

• Windows and Linux bundles are attached to the release, under
  plain-language, ordered names. Windows is unsigned for now, so it shows a
  one-time SmartScreen "unrecognized app" notice — click More info → Run
  anyway. Linux (deb / AppImage) runs clean.
• The macOS dmg is held back on purpose. An unsigned, un-notarized Mac app
  hits Gatekeeper's "damaged" dead-end with no click-through for a normal user,
  so shipping it would just mislead people. It still builds every release as a
  validation gate, and goes public the moment it's signed + notarized. Until
  then, mobile (Zapstore) and the web app are the real surfaces.

✨ Two things that were bugging us

• Toasts don't ghost anymore. The little confirmations — switching chama
  especially — were ~13% opaque and blended into whatever was behind them.
  They're solid now: an opaque card with a colored outline and a soft shadow,
  readable over anything.
• Returning sign-in reads right. Pressing "I'm a returning Chama citizen"
  used to leave "Chama creates a private recovery key on this device…" sitting
  above the paste box — create-talk over a recover action. It now swaps to
  "Paste the recovery key you saved when you first set up Chama," and keeps the
  original line for people actually creating an account.

✅ Numbers

2,335 tests green (19 new, covering the notification core's role-aware
transitions and its fire-once dedup); typecheck clean; production build clean.