v0.14.0 - MDK

Documentation

• Release notes: docs/release/0.14.0.md
• Integration guide (0.13.0 → 0.14.0): docs/integration/0.14.0.md

What's Changed

• Admit captured media without clearing a newer draft by @Datawav in #2229
• Browse account attachments with native cursors by @Datawav in #2233
• Hold group changes while the group is known to have moved on by @erskingardner in #2273
• Close leaked relay subscriptions and page relay-clamped replays by @erskingardner in #2274
• Park storage-blocked attachment downloads and bound receive memory by @mubarakcoded in #2249
• Record per-relay causes for adapter-stage publish failures by @agent-p1p in #2287
• Retry and audit every relay a self-update commit missed by @erskingardner in #2275
• Fix master: exercise per-relay publish failure causes through a legacy Welcome by @erskingardner in #2294
• Hold group changes while the last commit is owed to a group relay by @erskingardner in #2288
• Run macOS and iOS CI jobs on Blacksmith runners by @erskingardner in #2296
• Test per-relay failure causes on frozen self-update fanouts by @agent-p1p in #2295
• Accept final_sent for Hermes delete_message responses by @erskingardner in #2301
• Record why history recovery fails on each relay by @agent-p1p in #2289
• Bound terminal-backend JSONL and cumulative turn output by @agent-p1p in #2103
• Report obsolete-only KeyPackages as a MissingKeyPackage reason by @agent-p1p in #2305
• Fetch an epoch gap's newest events from relays that cannot compare it by @agent-p1p in #2298
• Cache verified public Nostr event previews by @erskingardner in #2304
• Report incomplete directory lookups as one typed, per-account outcome by @agent-p1p in #2308
• Run Apple CI on master, not on every pull request by @erskingardner in #2309
• Refuse edits recipients would ignore before publishing them by @erskingardner in #2299
• Let agents edit their own messages through wn-agent by @erskingardner in #2300
• Batch group routes into fewer live REQs by @erskingardner in #2310
• Keep OpenClaw deletes in the host-authorized conversation by @erskingardner in #2306
• Refresh stale own leaves so existing groups can adopt new components by @agent-p1p in #2292
• Give crash-recovery test children a bounded, overridable ready wait by @erskingardner in #2317
• Keep quarantined-group events from stalling account receives by @agent-p1p in #2327
• Add the media-store crate with its file format and device benchmark by @erskingardner in #2320
• Defer a quarantined group's retained projection instead of holding receives by @agent-p1p in #2328
• Add the media store lifecycle behind catalog traits by @erskingardner in #2322
• Add the architecture review's Pass 0 map and Pass 1 runtime and transport reviews by @erskingardner in #2325
• Roll back a failed convergence apply with a savepoint, not a ledger copy by @erskingardner in #2338
• Retain downloaded attachments in the encrypted media store by @erskingardner in #2329
• Run MarmotKit on its own multi-thread Tokio runtime by @erskingardner in #2340
• Select PR tests and make full candidate packaging opt-in by @erskingardner in #2337
• Leave delivered messages that cannot witness out of convergence passes by @erskingardner in #2342
• Update media-store's off-async rationale for the owned runtime by @erskingardner in #2347
• Close each account engine's connection before releasing the root lease by @erskingardner in #2341
• Run marmot-app runtime and relay-plane unit suites on multi-thread Tokio by @erskingardner in #2354
• Fix close_storage after the #2329/#2341 merge by @erskingardner in #2357
• Keep a live SQLite connection's POSIX locks when reopening its database by @erskingardner in #2355
• Prove a live reaction survives a close made right after it by @erskingardner in #2348
• Scope local verification and slim fast-ci by @erskingardner in #2358
• Make four multi-thread marmot-app tests independent of scheduling order by @erskingardner in #2361
• Rewind a reorg onto its anchor without rewriting the group's history by @erskingardner in #2350
• Arm epoch-stall detection from durable deferred rows on Advance open by @erskingardner in #2343
• Flush in-flight NEG frames before the NEG-cap test counts leftover sessions by @erskingardner in #2364
• Add the architecture review's core crate structure page and relay-plane brief by @erskingardner in #2346
• Run the remaining marmot-app lib suites on multi-thread Tokio by @erskingardner in #2365
• Pin the relay-plane brief's citations to the tree they were taken from by @erskingardner in #2368
• Leave a generated setup's relay lists to its bootstrap by @erskingardner in #2367
• Keep download checkpoints in media-store .wire files (mdk#2314 step 2b) by @erskingardner in #2349
• Run marmot-app's composed and hand-built test runtimes on multi-thread Tokio by @erskingardner in #2369
• Attribute process-action relay publications across the relay quorum by @erskingardner in #2370
• Keep a consumed KeyPackage's private key for 24 hours after replacement by @erskingardner in #2352
• Stream file downloads through the wire checkpoint (mdk#2314 step 2b-2) by @erskingardner in #2353
• Update negentropy to 0.5.2 for RUSTSEC-2026-0365 by @erskingardner in #2377
• Cut the relay plane's inbound edges in place (relay-plane brief PR 1) by @erskingardner in #2374
• Stage outgoing attachment bodies in the media store (mdk#2314 step 3a) by @erskingardner in #2380
• Settle the profile-edit race only after a re-queued edit lands by @erskingardner in #2382
• Keep Hermes adapter teardown from hanging on a dropped cancel by @erskingardner in #2383
• Move the relay plane's whole-app tests into the app (relay-plane brief PR 2) by @erskingardner in #2376
• Add the step 4 storage-boundaries brief and record the owner decisions by @erskingardner in #2378
• Stage sends in the media store and stream uploads from staged files (mdk#2314 step 3b) by @erskingardner in #2384
• Move storage-sqlite's modules into protocol, app and base folders (storage brief PR 1) by @erskingardner in #2385
• Move the relay plane into a new transport-nostr crate (relay-plane brief PR 3) by @erskingardner in #2387
• Repoint marmot-app at transport_nostr and drop the relay_plane shim (relay-plane brief PR 4) by @erskingardner in #2388
• Describe processed_bytes with the media-store upload phases by @erskingardner in #2394
• Check storage-sqlite's protocol/app boundary against an allow-list (storage brief PR 2) by @erskingardner in #2386
• Move the per-account publish clients onto the relay plane (relay-plane brief PR 5) by @erskingardner in #2393
• Share one SDK notification dispatch between the plane and the adapter (relay-plane brief PR 6) by @erskingardner in #2395
• Route storage-sqlite's protocol/app crossings through cross/ (storage brief PR 3) by @erskingardner in #2392
• Give app storage its own handle, starting with the transport-specific modules (storage brief PR 4a) by @erskingardner in #2399
• Brief: host-supplied deployment configuration by @erskingardner in #2403
• Move the remaining app storage methods onto SqliteAppStorage (storage brief PR 4b) by @erskingardner in #2400
• Move SqliteAccountStorage into protocol/ (storage brief PR 4c) by @erskingardner in #2401
• Name storage-sqlite's tracing targets after their module paths (storage brief PR 5) by @erskingardner in #2402
• Make the merge queue the one full CI gate by @erskingardner in #2397
• Lend retained attachments to OS surfaces under handoff leases (mdk#2314 step 4) by @erskingardner in #2398
• Land changes through local review and the merge queue by @erskingardner in #2396
• Put deployment services on one MarmotDeployment record (host-config brief PR 1) by @erskingardner in #2406
• Wait for the PR's CI run before enqueueing in land-change by @erskingardner in #2409
• Let binding hosts pass their deployment (host-config brief PR 2a) by @erskingardner in #2408
• Remove CI's path-based test selection now that the merge queue runs everything by @erskingardner in #2407
• Add Manage storage queries and bulk removal (mdk#2314 step 5a) by @erskingardner in #2410
• Delete 41 wiring-only tests from #2413 by @dannym-arx in #2414
• Name White Noise's configuration explicitly in hosts and tests (host-config brief PR 2b) by @erskingardner in #2411
• Expose Manage storage in the UniFFI and C bindings (mdk#2314 step 5b) by @erskingardner in #2424
• Move legacy attachment bodies into the media store in the background (mdk#2314 step 6a) by @agent-p1p in #2467
• Support OpenBSD pledge and unveil sandboxes by @dannym-arx in #2468
• Move master to 0.14.0-dev between releases by @agent-p1p in #2458
• Fix retention sweep pruning unread messages by @dannym-arx in #2469
• Make the neutral deployment the default and require one at construction (host-config brief PR 3) by @erskingardner in #2493
• Publish dated nightly MarmotKit, Marmot C and WN Agent pre-releases by @agent-p1p in #2494
• Keep bounded reconciliation moving by @dannym-arx in #2490
• Return the account database's freed space to the disk (mdk#2314 step 6b) by @agent-p1p in #2496
• Add the step 3 directory extraction brief by @erskingardner in #2495
• Wait on the resubscribe, not a poll window, in the Hermes reconnect test by @erskingardner in #2499
• Wait on delivery signals, not poll windows, in Hermes spool tests by @erskingardner in #2502
• Give spool-backed Hermes test waits a 30 s regression bound by @erskingardner in #2505
• Add the directory crossing check (directory brief PR 1) by @erskingardner in #2501
• Document how the production QUIC broker runs and how to check its ALPN by @erskingardner in #2339
• Bound the Hermes tests' inbound-queue drains so a stall fails, not hangs by @erskingardner in #2510
• Keep stalled recovery routes retryable by @dannym-arx in #2503
• Verify QUIC brokers against bundled roots so Android previews stop crashing by @erskingardner in #2331
• Move what stays in marmot-app out of directory/ (directory brief PR 2) by @erskingardner in #2511
• Update WebPKI crates past TLS trust advisories by @dannym-arx in #2516
• Store avatars and group images as media store cache files (mdk#2314 step 9a) by @erskingardner in #2504
• Split the workspace test lane into seven shards by @erskingardner in #2517
• Pull what the directory owns into directory/ (directory brief PR 3) by @erskingardner in #2518
• Page epoch-gap fallback history backwards by @dannym-arx in #2500
• Give the directory its own error type (directory brief PR 4) by @erskingardner in #2519
• Stop resending events a relay rejected terminally by @erskingardner in #2523
• Cap the avatar bytes migration 0114 copies at open (mdk#2314 step 9) by @erskingardner in #2524
• Split strict directory fetches into REQs of at most three filters by @erskingardner in #2525
• Give the directory its own clock and settings types (directory brief PR 5, slice 1) by @erskingardner in #2522
• Fetch, read and migrate avatars through the media store cache (mdk#2314 step 9b) by @erskingardner in #2527
• Add the Directory service and convert cached search to it (directory brief PR 5, slice 2) by @erskingardner in #2526
• Convert public event previews to the Directory service (directory brief PR 5, slice 3) by @erskingardner in #2528
• Move the directory store onto the Directory service (directory brief PR 5, slice 4) by @erskingardner in #2530
• Clarify terminal connector first-install steps by @Datawav in #2532
• Convert member KeyPackage resolution to the Directory service (directory brief PR 5, slice 5) by @erskingardner in #2531
• Convert search and Open Ranking to the Directory service (directory brief PR 5, slice 6) by @erskingardner in #2533
• Convert the directory's fetches and public API to the Directory service (directory brief PR 5, slice 7) by @erskingardner in #2534
• Move the directory sync worker onto the service and empty the crossing list (directory brief PR 5, slice 8) by @erskingardner in #2535
• Keep kind-3 tags and refuse follow edits on capped lists (mdk#2268) by @erskingardner in #2529
• Fix ordered offline message catch-up by @dannym-arx in #2513
• Move the directory's app-backed tests into marmot-app (directory brief PR 6a) by @erskingardner in #2539
• Move the user directory into the nostr-directory crate (directory brief PR 6b) by @erskingardner in #2540
• Call the directory through app.directory() and narrow nostr-directory's surface (directory brief PR 7) by @erskingardner in #2542
• Add the opt-in "Keep media" setting (mdk#2314 step 10) by @erskingardner in #2541
• Require every onboarding source to be fresh by @dannym-arx in #2545
• Remove redundant tests and compiler-only witnesses by @dannym-arx in #2544
• Filter and combine outbound Welcome scans by @dannym-arx in #2548
• Use raw SQLCipher keys for app databases by @dannym-arx in #2549
• Avoid redundant inbound Nostr event work by @dannym-arx in #2547
• Name the directory's tracing targets after their modules (directory brief PR 8) by @erskingardner in #2560
• Fail CI artifact downloads that stall instead of truncating them by @erskingardner in #2564
• Bump ctutils to 0.4.5 for RUSTSEC-2026-0385 by @erskingardner in #2576
• Keep an unreachable relay's REQ owed instead of failing activation by @erskingardner in #2572
• Give Rust test shards separate download and test budgets by @erskingardner in #2573
• Fix the terminal-harness connector E2E fakes for connector control instructions by @erskingardner in #2582
• Keep sends going when the pre-send subscription refresh fails by @erskingardner in #2567
• Put the replay-budget fixture's witness above the pass's witness floor by @erskingardner in #2566
• Expose contextual onboarding relay diagnostics by @dannym-arx in #2574
• Repack only the group batch families a sync changes by @erskingardner in #2583
• Export activation and group-sync outcome counters in relay telemetry by @erskingardner in #2584
• Stop recompiling the timeline's modifier lookups on every call by @erskingardner in #2585
• Stop a merge-group CI run at its first failed job by @erskingardner in #2589
• Release MDK 0.14.0 by @erskingardner in #2561

Full Changelog: v0.13.0...v0.14.0