v0.15.0 - MDK

Documentation

• Release notes: docs/release/0.15.0.md
• Integration guide (0.14.0 → 0.15.0): docs/integration/0.15.0.md

What's Changed

• Run the 1,600-message offline replay nightly instead of in the queue by @erskingardner in #2591
• Move master to 0.15.0-dev after the 0.14.0 release by @erskingardner in #2593
• Write account records and key-security markers owner-only by @erskingardner in #2575
• Add a connector-only wn-agent installer and a build-your-own-client guide by @erskingardner in #2580
• Adopt published relay lists and explain wn-agent startup failures (#2550) by @erskingardner in #2577
• Add read-only wn-agent doctor for standalone connector setup (#2570) by @erskingardner in #2581
• Adopt published relay lists before a KeyPackage publish by @erskingardner in #2594
• Move OpenMLS RustCrypto providers to elliptic-curve 0.14 and HPKE 0.8 by @erskingardner in #2597
• Trim overnight CI to what the nightly release does not cover by @erskingardner in #2596
• Cancel merge-group runs the queue has dropped by @erskingardner in #2595
• Open an issue when a scheduled nightly release fails by @erskingardner in #2598
• Add the step 5 lower-stack extraction brief by @erskingardner in #2599
• Record the lower-stack brief's decisions by @erskingardner in #2601
• Move the architecture review's plans into issues by @erskingardner in #2603
• Deliver attachment transfer state changes without the coalescing wait by @mubarakcoded in #2311
• Clear the engine's audit context when an operation is dropped by @erskingardner in #2606
• Classify lower-stack errors by kind, not by wrapper by @erskingardner in #2607
• Pad every push trigger gift wrap with a fresh random chunk by @erskingardner in #2608
• Push every sibling device leaf's token by @erskingardner in #2609
• Record app audit rows through a shared recorder handle by @erskingardner in #2612
• Re-share push tokens when a merged Commit adds a member by @erskingardner in #2613
• Keep account records on the session's own storage handle by @erskingardner in #2615
• Type stale-epoch media errors across UniFFI and C by @mubarakcoded in #2312
• Reach the lower stack only through the account runtime by @erskingardner in #2616
• Store relayable push tombstones and per-group gossip state by @erskingardner in #2617
• Let hosts reach the lower stack's types without naming the engine by @erskingardner in #2618
• Move the lower stack into marmot-session by @erskingardner in #2619
• Send a push snapshot after adding members by @erskingardner in #2620
• Make the account-device session private to marmot-session by @erskingardner in #2621
• Check push debug records against real leaves by @erskingardner in #2623
• Name the lower stack's tracing targets after their modules (#2602 PR 8) by @erskingardner in #2625
• Ban direct relay and HTTP clients in nostr-directory by @erskingardner in #2629
• Add step 6's observability crossing check by @erskingardner in #2630
• Bound the KeyPackage client tag and read it one way by @erskingardner in #2631
• Drop the withdrawn 0x800a component reservation by @erskingardner in #2632
• Join only through the Welcome delivery that names this device's KeyPackage by @erskingardner in #2633
• Group members by account, not by leaf by @erskingardner in #2634
• Keep the post-join history fetch running through commits by @erskingardner in #2635
• Give marmot-app one recording handle (#2627 PR 1) by @erskingardner in #2636
• Read only attachment state changes at the transfer read floor by @mubarakcoded in #2610
• Enforce the account-devices component rules in groups that require it by @erskingardner in #2637
• Reach the product collector's consent state through methods (#2627 PR 2) by @erskingardner in #2639
• Decide removal by this device's own leaf (#2628 1.5) by @erskingardner in #2640
• Give the audit upload's HTTP half its own module and error (#2627 PR 3) by @erskingardner in #2642
• Keep each device's KeyPackage slot fresh (#2628 1.2, publication) by @erskingardner in #2643
• Model account-devices support in the conformance simulator by @erskingardner in #2644
• Accept own-account Welcomes into account-devices groups by @erskingardner in #2646
• Read member capabilities from every leaf of the tree (#2628 1.3 prerequisite) by @erskingardner in #2645
• Let a device commit its own account's adds and removes without admin by @erskingardner in #2650
• Announce what each device holds in push gossip (#2611 PR 3) by @erskingardner in #2648
• Hand the collector helper its proxy policy and move the exporter config (#2627 PR 4a) by @erskingardner in #2651
• Delete only this device's KeyPackage slot at sign-out (#2628 1.2, deletion) by @erskingardner in #2654
• Send same-account device adds and removes, and schedule them fairly (#2628 2.1e) by @erskingardner in #2655
• Add every device of an account when creating or inviting (#2628 1.3) by @erskingardner in #2649
• Repair what push announces lack (#2611 PR 4) by @erskingardner in #2658
• Require account-devices when every founder advertises it (#2628 2.3) by @erskingardner in #2656
• Record through Observer's views and a wiring module (#2627 PR 4b) by @erskingardner in #2653
• Advertise account-devices in KeyPackages and leaves (#2628 2.2) by @erskingardner in #2659
• Refuse host-supplied data for no-data app components at creation (#2628) by @erskingardner in #2662
• Automatically expire device audit logs after 30 days by @erskingardner in #2664
• Add the time-sliced resumable history sweep (#2660 phase 3) by @erskingardner in #2665
• Add the device roster component and its engine rules (#2628 3.1a) by @erskingardner in #2666
• Add the recovery coverage ledger in shadow mode (#2660 phase 2) by @erskingardner in #2667
• Add device pairing's code exchange (#2628 3.3a) by @erskingardner in #2670
• Stop cut recovery captures from retrying forever (#2660 phase 1) by @erskingardner in #2673
• Fetch each relay's NIP-11 caps behind the dial gate (#2660) by @erskingardner in #2669
• Let an admin turn on account-devices in an existing group (#2628) by @erskingardner in #2668
• Read NIP-67 more off the wire for the sweep; finish proves nothing (#2660) by @erskingardner in #2674
• Create and hide the account's device group (#2628 3.1b) by @erskingardner in #2675
• Fix authenticated own-commit checkpoint replay by @dannym-arx in #2671
• Add the phantom own-commit branch regression test by @erskingardner in #2677
• Subtract loss and released receipts that land mid-fetch from ledger coverage (#2660) by @erskingardner in #2678
• Store recovery retry state and staging (#2660 phase 4) by @erskingardner in #2682
• Pin the engine's late-input windows for one-relay release (#2660) by @erskingardner in #2686
• Stop the audit cursor test's seals from deferring under load (#2681) by @erskingardner in #2687
• Link a device into the device group in one Commit (#2628 3.3b) by @erskingardner in #2688
• List the account's linked devices (#2628 3.1c) by @erskingardner in #2689
• Un-cover only the routes queue loss dropped deliveries on (#2660 phase 4) by @erskingardner in #2691
• Drop the Matrix licence copy from marmot-pairing by @erskingardner in #2692
• Stop wn-cli tests from leaking wnd daemons by @erskingardner in #2695
• Settle live replay before recovery tests' first grant (#2693) by @erskingardner in #2697
• Announce each KeyPackage in the device roster before publishing it (#2628 3.4a) by @erskingardner in #2702
• Admit a device's Welcome only from the leaf its link confirmed (#2628 3.3b) by @erskingardner in #2704
• Report wn daemon start and stop only once they are true (#2696) by @erskingardner in #2709
• Warn when the device group holds a KeyPackage refresh back (#2628 3.4c) by @erskingardner in #2710
• Replace the device roster's leaf map with device tag keys by @erskingardner in #2706
• Settle Alice's live replay before the due-leave test's leave by @erskingardner in #2712
• Retire queued intents the settled state refuses (#2694) by @erskingardner in #2707
• Read device tags in the engine (#2628 3.1d) by @erskingardner in #2713
• Park overtaken coverage debt and start standing goals at the copy's Welcome (#2660 phase 4 PR 2c) by @erskingardner in #2715
• Produce device tags in the engine (#2628 3.1d) by @erskingardner in #2716
• Bound retries of a convergence pass that fails after its decision (#2684) by @erskingardner in #2711
• Prove live boundaries above the oldest event seen (#2660 phase 4) by @erskingardner in #2714
• Reuse authenticated Welcome admission by @dannym-arx in #2679
• List new sign-ins on the account (#2628 3.2a) by @erskingardner in #2708
• Route notification-lag loss by each route's REQ floor (#2660 phase 4 PR 2b-ii) by @erskingardner in #2723
• Build the recovery runner's loop and sweep units (#2660 phase 4, PR 4a) by @erskingardner in #2720
• Tag from the trusted device group in the app (#2628 3.1d) by @erskingardner in #2721
• Stop the live-count streaming test depending on relay order by @erskingardner in #2724
• Invalidate shadow certificates by route and window (#2660 phase 4) by @erskingardner in #2725
• Drop removed device records after 30 days (#2628 3.1d) by @erskingardner in #2727
• Withdraw outbound Welcomes through one publish gate (#2628 3.5a-1a) by @erskingardner in #2728
• Compare and re-check history in the recovery runner (#2660 phase 4, PR 4c) by @erskingardner in #2730
• Hold a staged invite Welcome until its commit confirms (#2726) by @erskingardner in #2729
• Tag only from the entry at this device's slot (#2628 3.1d) by @erskingardner in #2731
• Rename devices and report each device's client and platform (#2628 3.6a) by @erskingardner in #2718
• Deliver owed Welcomes without waiting for the next open (#2628 3.5a-1b) by @erskingardner in #2733
• Interrupt cut recovery requests so their replies are charged (#2719) by @erskingardner in #2736
• Link a new device through pairing (#2628 3.3b) by @erskingardner in #2734
• Keep a worker-observed loss generation routed (#2660 phase 4) by @erskingardner in #2735
• Give a device link's Welcome its own delivery deadline (#2628 3.3b) by @erskingardner in #2743
• Hand siblings private KeyPackages inside the device group (#2628 3.4b) by @erskingardner in #2737
• Split the workspace test lane into fourteen slice shards by @erskingardner in #2746
• Replace a foreign publication in this device's KeyPackage slot (#2628 3.4, D63) by @erskingardner in #2748
• Move the diagnostics tests that need marmot-app out of the moving set (#2627 PR 5) by @erskingardner in #2749
• Admit staged recovery history below each group's frontier (#2660 phase 4, PR 4b) by @erskingardner in #2739
• Note every undelivered Welcome in one seam (#2628 3.5a-2) by @erskingardner in #2745
• feat(stickers): add Sonar-compatible sticker support by @vincenzopalazzo in #875
• Convert the old recovery owner's rows once, dormant (#2660 phase 4, PR 5d) by @erskingardner in #2740
• Write no pending Welcome row before an invite's commit is exposed (#2628 3.5a-2b) by @erskingardner in #2756
• Found the device group with only its creator, and bind the link's Welcome to its KeyPackage (#2628 3.3b, D41) by @erskingardner in #2747
• Hold a fenced group's live frames for the recovery runner (#2660 phase 4, PR 5c) by @erskingardner in #2750
• Ignore device-group kinds outside the device group (#2628) by @erskingardner in #2757
• Collapse marmot-app's _unobserved operation pairs (#2627 PR 8) by @erskingardner in #2755
• Let a device whose link failed link again into its device group (#2628 3.3b) by @erskingardner in #2763
• Move the diagnostics exporters into marmot-observability (#2627 PR 6) by @erskingardner in #2764
• Make a device rename lost in a fork again, by rename id (#2628 3.6a) by @erskingardner in #2742
• Let hosts list, answer and check new sign-ins (#2628 3.2b) by @erskingardner in #2732
• Count earlier roster announcements when classifying sign-ins (#2628 3.2d) by @erskingardner in #2766
• Cut the workspace test lane's per-database cost by two thirds by @erskingardner in #2767
• Settle live replay before the comparison-only test's first grant by @erskingardner in #2770
• Remove a linked device (#2628 3.6b-1a) by @erskingardner in #2759
• Give each device a history key in its roster entry (#2628 4.1) by @erskingardner in #2741
• Narrow marmot-observability to its root re-exports (#2627 PR 7) by @erskingardner in #2771
• Check for sign-ins soon after a Welcome names another KeyPackage (#2628 3.2c) by @erskingardner in #2769
• Give the recovery runner a real host and lifecycle behind an off gate (#2660 phase 4, PR 5a) by @erskingardner in #2744
• Keep read positions, pins, mutes and archives the same across an account's devices (#2628 4.3a) by @erskingardner in #2754
• Name the diagnostics crate's tracing targets after their modules (#2627 PR 9) by @erskingardner in #2776
• Give the recovery runner its remaining inputs behind the off gate (#2660 phase 4, PR 5b) by @erskingardner in #2777
• Warn when the account key publishes where no device did, and let a new device start fresh (#2628 3.7a) by @erskingardner in #2768
• Heartbeats, last active and inactive siblings (#2628 3.6a-2) by @erskingardner in #2765
• Add a large-Welcome vector for NIP-44's extended length prefix by @erskingardner in #2781
• Refill this device's emptied KeyPackage slot (#2628 3.4) by @erskingardner in #2784
• Move a chat's history between devices as history bundles (#2628 4.2a) by @erskingardner in #2774
• Keep a chat its account stays in apart from a removal of the account (#2628 3.6b-1b-1) by @erskingardner in #2778
• Carry attachment keys in history bundles (#2628 4.2a) by @erskingardner in #2797
• Let the joiner's inbox replay admit before it reads the Welcome (#2783) by @erskingardner in #2798
• Warn of a KeyPackage in this device's slot that it didn't make (#2628 3.7b) by @erskingardner in #2800
• Inbox comparison and explicit repair through the recovery runner, behind the off gate (#2660 phase 4, PR 5e) by @erskingardner in #2801
• Back up an account's devices to a recovery key the roster holds (#2628 4.4a) by @erskingardner in #2802
• Receive sibling Welcomes in the device group (#2628 3.5b-1) by @erskingardner in #2803
• Send a chat's history to the sibling this device adds to it (#2628 4.2b) by @erskingardner in #2804
• Recover queued proposals from undecodable MessagePack rows by @erskingardner in #2806
• Copy test stores from a shared migrated template and relax storage-sqlite's unit tests by @erskingardner in #2807
• Wrap every Welcome before an Add writes anything by @erskingardner in #2809
• Unlink a device its device group removes (#2628 3.6b-1b-2) by @erskingardner in #2805
• Walk every migration body's rollback in one test and prune storage-sqlite's migration tests by @erskingardner in #2810
• Prune storage-sqlite's protocol-storage tests and prove their transactions by behavior by @erskingardner in #2814
• Send and fetch long chat histories through Blossom (#2628 4.2c) by @erskingardner in #2811
• Fold storage-sqlite's chat list tests into tables and test the paths nothing reached by @erskingardner in #2815
• Add a test-audit skill for gating, pruning and filling gaps in tests by @erskingardner in #2817
• Match storage-sqlite's attachment test failures to their guards and test the contracts nothing reached by @erskingardner in #2825
• Run the tracing audit and quick workspace tests in the PR pre-check by @erskingardner in #2823
• Fold storage-sqlite's timeline tests into keepers and test the contracts nothing reached by @erskingardner in #2824
• Pin an app message to its epoch's branch, not only its number by @erskingardner in #2819
• Keep a transaction SQLite rolled back by itself from latching the account by @erskingardner in #2826
• Split storage-sqlite's media conformance run per case and test the media and avatar paths nothing reached by @erskingardner in #2827
• Keep reopens and check review findings in the test-audit skill by @erskingardner in #2821
• Speed up storage-sqlite's recovery tests and test the contracts nothing reached by @erskingardner in #2822
• Prune storage-sqlite's device, transport and shared-store tests and test the contracts nothing reached by @erskingardner in #2828
• Send sibling Welcomes from a same-account Add (#2628 3.5b-2) by @erskingardner in #2830
• Keep the repository cache budget for CI's caches by @erskingardner in #2831
• Show hosts chat history from another device (#2628 4.2d) by @erskingardner in #2833
• Repair storage-sqlite's account projection tests and test the contracts nothing reached by @erskingardner in #2820
• Prune storage-sqlite's base-layer tests and prove their wait, close and rollback contracts without timing by @erskingardner in #2829
• Sign out through the account's other devices (#2628 3.6b-1c) by @erskingardner in #2837
• Keep one damaged app_events tag blob from blocking erasure, withdrawals and reads by @erskingardner in #2845
• Remove storage-sqlite methods nothing but their own tests call by @erskingardner in #2844
• Audit fs-private's tests and cover its unproven guards by @erskingardner in #2848
• Never let a send overtake a queued one in the same group (mdk#2842) by @erskingardner in #2849
• Clean up after every device the device group's roster stops listing (mdk#2761) by @erskingardner in #2855
• Write account backups under the recovery key (mdk#2628 4.4b) by @erskingardner in #2854
• Add a newly linked device to the approving device's chats (#2628 3.5c) by @erskingardner in #2856
• Add no device a roster this device applied held as removed (mdk#2628 3.5c-2) by @erskingardner in #2859
• Strengthen observability contract tests and run exporter checks in CI by @erskingardner in #2846
• Drop unused announced-KeyPackage history by @erskingardner in #2866
• Keep sends working after a late losing removal branch by @erskingardner in #2864
• Publish every offline-queued send after reconnect (#2762) by @mubarakcoded in #2860
• Seed recovery goals on account open and route changes by @erskingardner in #2867
• Stabilize four asynchronous CI tests by @erskingardner in #2868
• Tighten branch reconstruction and replay contract tests by @erskingardner in #2873
• Keep direct message receive and delivery output atomic by @erskingardner in #2874
• Include linked siblings when creating chats by @erskingardner in #2875
• Refuse duplicate sibling Adds against the selected chat tree by @erskingardner in #2870
• Cut redundant nightly simulator build output by @erskingardner in #2878
• Gate invitation requirements on group liveness by @erskingardner in #2880
• Audit engine lifecycle contracts and persisted exporters by @erskingardner in #2881
• Make orphan pending recovery atomic by @erskingardner in #2882
• fix(ci): prevent runner disk exhaustion and preserve failure evidence by @erskingardner in #2879
• Select compatible private stock and claim the validated allocation by @erskingardner in #2884
• Record stored-message audit transitions after commit by @erskingardner in #2887
• Strengthen engine profile and capability test contracts by @erskingardner in #2886
• Fix flaky relay accounting and history deadline tests by @erskingardner in #2890
• test(engine): audit inbound and deferred processing contracts by @erskingardner in #2888
• Bind uploaded media and custom reaction sends to their encryption branch by @erskingardner in #2891
• Retire the blanket multi-device onboarding finding by @erskingardner in #2894
• Make custom reaction artwork acquirable by hosts by @erskingardner in #2893
• test(engine): audit outbound publication and membership contracts by @erskingardner in #2898
• test(engine): strengthen convergence runtime contracts by @erskingardner in #2901
• test(engine): strengthen account-device regression contracts by @erskingardner in #2900
• Fill missing sibling chat memberships with private stock by @erskingardner in #2889
• Preserve directory components across concurrent updates by @erskingardner in #2902
• Edit linked-device settings with existing edit recovery by @erskingardner in #2903
• test(engine): tighten recovery and rewind contracts by @erskingardner in #2904
• Prove hybrid recovery across forced restart and stalled-relay cases by @erskingardner in #2907
• Reduce Session test fixture storage setup cost by @erskingardner in #2908
• Repair lost sibling Welcomes and restore backup history by @erskingardner in #2905
• Reduce app fixture setup cost and mixed-process allocator contention by @erskingardner in #2909
• Expose backup setup and restore controls to native hosts by @erskingardner in #2910
• Reduce storage overhead in relay runtime fixtures by @erskingardner in #2911
• Add event and address vectors to the shared identity-reference corpus by @thepurpose-npub in #2717
• Recover historical attachments through native acquisition and leases by @tidley in #2614
• fix(transport): pin Nostr verification-cache security fixes by @erskingardner in #2912
• Strengthen account runtime test contracts and retire copied collector by @erskingardner in #2913
• Expose founding admin selection to app and agent clients by @tidley in #2587
• Reduce relay restart and discovery fixture overhead by @erskingardner in #2915
• Check commit signatures before running PR builds by @erskingardner in #2916
• test(session): cover facade contracts and share Nostr chaos harness by @erskingardner in #2917
• fix(directory): verify events before forwarding and persistence by @erskingardner in #2918
• test(app): remove wall-clock dependence from attachment timing proofs by @erskingardner in #2919
• Patch vulnerable Rust and OpenClaw dependencies by @erskingardner in #2920
• test(app): prove invite responses while catch-up stays held by @erskingardner in #2921
• Enable device linking in dev wn builds by @erskingardner in #2922
• Update Marmot connector to OpenClaw 2026.10.10 by @erskingardner in #2924
• Sync invitation decisions between linked devices by @erskingardner in #2914
• test(adapter): audit history sweep and comparison contracts by @erskingardner in #2926
• Strengthen SDK transport boundary tests by @erskingardner in #2929
• test(adapter): strengthen replay and publication contracts by @erskingardner in #2930
• Add authenticated rejoin contracts and journal by @dannym-arx in #2680
• Replace deprecated telemetry atomic update by @dannym-arx in #2579
• Make explicit chat Leave account-wide across linked devices by @erskingardner in #2925
• Preserve approved host aggregate analytics events by @erskingardner in #2934
• Clean up SDK publications cancelled outside Tokio by @erskingardner in #2933
• Settle a failed send when a peer reacts to it by @mubarakcoded in #2899
• Simplify sibling Welcome repair with heartbeats by @erskingardner in #2936
• test(observability): strengthen performance and relay contracts by @erskingardner in #2937
• Reuse validated account identity proofs across account-device reopen by @Datawav in #2703
• Add a Nix dev shell flake for x86-64 Linux by @dannym-arx in #2940
• Add MDK verification, change-impact, and plain-language skills by @erskingardner in #2935
• Replace recovery leaves atomically by @dannym-arx in #2683
• test: cover product diagnostics consent and window boundaries by @erskingardner in #2942
• fix(observability): honor initial relay telemetry shutdown by @erskingardner in #2943
• Strengthen audit delivery and collector safety tests by @erskingardner in #2949
• feat: move a device between device groups by @erskingardner in #2948
• feat: report runtime backup conditions and await due attempts by @erskingardner in #2951
• docs: state the legacy sibling Welcome upgrade limit by @erskingardner in #2953
• feat: add explicit experimental device-group host entry points by @erskingardner in #2954
• test(cli): strengthen command and JSON contract checks by @erskingardner in #2960
• test(cli): tighten daemon stream regression coverage by @erskingardner in #2961
• test(cli): audit terminal and TUI contracts by @erskingardner in #2962
• fix(cli): bound existing socket readiness probes by @erskingardner in #2963
• fix(cli): mask login secrets and route padded imports through stdin by @erskingardner in #2958
• fix(cli): align Leave controls with core admin handling by @erskingardner in #2964
• fix(c): erase returned recovery words before freeing them by @erskingardner in #2965
• Skip incompatible sibling KeyPackages during chat creation by @erskingardner in #2966
• fix(app): retry eligible worker starts before sibling sign-out fallback by @erskingardner in #2967
• fix(cli): keep delayed TUI results with their account by @erskingardner in #2969
• docs(engine): state the unrecoverable sibling-Welcome limit by @erskingardner in #2970
• docs(hosts): state the post-link and gap-fill overlap limit by @erskingardner in #2971
• Distinguish already-present siblings from unsuitable KeyPackages by @erskingardner in #2972
• fix(session): distinguish invalid device roster edits by @erskingardner in #2973
• fix(app): isolate linked-device settings read failures by @erskingardner in #2975
• Format the migration 0171 settings assertions by @erskingardner in #2977
• test(uniffi): verify active backup forwarding by @erskingardner in #2978
• Remove unused private KeyPackage convenience methods by @erskingardner in #2976
• fix(app): settle accepted invitation work after disband by @erskingardner in #2981
• fix(app): isolate sibling Welcome carrier settlement by @erskingardner in #2979
• docs(hosts): correct experimental device-group gate guidance by @erskingardner in #2982
• fix(app): preserve Blossom server base paths by @erskingardner in #2984
• Make an idle maintenance tick cheaper and measurable by @mubarakcoded in #2952
• Strengthen UniFFI conversion contract tests by @erskingardner in #2985
• test(app): retain history deliveries after import failures by @erskingardner in #2987
• docs(hosts): explain terminal removal and bounded cleanup by @erskingardner in #2988
• docs(hosts): explain retired device-edit recovery limit by @erskingardner in #2986
• docs(hosts): explain admin sign-out limits and partial results by @erskingardner in #2989
• fix(app): skip ineligible history upload endpoints by @erskingardner in #2991
• fix(app): recover imported device names after local refresh errors by @erskingardner in #2990
• fix(transport): expose conclusive event-size refusals to hosts by @erskingardner in #2993
• Document the current compatible sibling stock wait by @erskingardner in #2994
• test(uniffi): audit host boundary regression tests by @erskingardner in #2996
• feat(chat-list): select all over whole native views by @erskingardner in #2997
• fix(nostr): preserve publication uncertainty across retry boundaries by @erskingardner in #2998
• Explain pending Welcome size refusals to hosts by @erskingardner in #2999
• test(c): strengthen shared ABI contract coverage by @erskingardner in #3001
• feat(chat-list): filter windows and select all with one typed query by @erskingardner in #3000
• Add prior-link context and explicit local device-group reset by @erskingardner in #3002
• docs(app): describe current device-group availability by @erskingardner in #3003
• Clarify cancellation outcomes when linking a device by @erskingardner in #3005
• docs: clarify device-link failure outcomes by @erskingardner in #3006
• docs(app): clarify backup availability refusals by @erskingardner in #3007
• Recovery runner owns account history by default (#2660 phase 4) by @erskingardner in #2950
• refactor(chat-list): remove cross-read chat-list cursors by @erskingardner in #3008
• fix(cli): recover live account feeds after a background relist by @erskingardner in #3009
• test(pairing): cover generated confirmation and cancellation schedules by @erskingardner in #3018
• Record failed maintenance phases as failures by @mubarakcoded in #3015
• Verify device-pairing confirmation and Welcome authentication by @erskingardner in #3023
• test(formal): model bounded device linking and recovery by @erskingardner in #3026
• fix(app): a failed link's late undo no longer unlinks the new device by @erskingardner in #3027
• feat(chat-list): conversation kind and mute as filter leaves (#2983) by @erskingardner in #3028
• test(relay-plane): scripted relays answer REQs through the plane's own dispatch by @erskingardner in #3030
• fix(pairing): refuse Link for a sign-in this device rejected itself by @erskingardner in #3025
• test(app): compose three linked devices across a fork and reopen by @erskingardner in #3020
• fix(app): refuse an ordinary open of an account that holds or is joining a device group by @erskingardner in #3034
• Write recovery admission inventory once per command (#2660) by @erskingardner in #3029
• test(app): plane-backed test fakes answer their REQs with EOSE by @erskingardner in #3037
• Add NIP-51 emoji sets with pinned local installs by @erskingardner in #3022
• fix(app): wait for backup admission through startup by @erskingardner in #3041
• Delete the old recovery owner's grant and comparison job (#2660) by @erskingardner in #3044
• test(app): bound the three-device journey's settle by passes, not 10 s by @erskingardner in #3047
• Bind emoji set downloads to the shown version; add install progress and cancel by @erskingardner in #3043
• fix(storage): preserve original removal validation after tag damage by @erskingardner in #3021
• Delete the runner_owns_debt gate's off arms (#2660) by @erskingardner in #3050
• Delete the runner_owns_debt gate (#2660) by @erskingardner in #3052
• Ask rebuilt REQs from the cursor floor alone (#2660, #2793) by @erskingardner in #3053
• Delete the adapter's owner capture and native clamp pager (#2660) by @erskingardner in #3054
• feat(chat-list): chat-text search filter leaf (#2983) by @erskingardner in #3039
• Clean up OpenMLS state after failed legacy group creation by @erskingardner in #3056
• Read emoji install and preview storage off async workers by @erskingardner in #3057
• feat(chat-list): message-text select-all filter leaf (#2983) by @erskingardner in #3080
• test(session): pin admitted commit replay classification by @erskingardner in #3084
• Prove founding rollback across cancellation and late writes by @erskingardner in #3088
• test(storage): cover moderation backfill and legacy expiry by @erskingardner in #3082
• Adopt block lists under an immediate transaction (#3046) by @erskingardner in #3094
• test(session): hold sibling repair through carrier acknowledgement by @erskingardner in #3100
• test(adapter): pin wrong-relay EOSE and comparison cancellation by @erskingardner in #3103
• Pin redacting attachment and conversation Debug contracts by @erskingardner in #3087
• Pin host event labels and typed group error payloads by @erskingardner in #3107
• test(diagnostics): cover admission and refused-delivery accounting by @erskingardner in #3095
• Prove apply rollback when frozen pass completion fails by @erskingardner in #3108
• Pin account-device host state and action conversions by @erskingardner in #3109
• test(diagnostics): bound supported export schedules by @erskingardner in #3110
• Pin CLI stream trust, candidate retry and partial sync output by @erskingardner in #3113
• Pin comparison cancellation, cut and refusal boundaries by @erskingardner in #3116
• Test cancellation while a C subscription callback is running by @erskingardner in #3117
• test(cli): prove co-member guards and founding descriptions by @erskingardner in #3124
• Prove stale commit verdicts survive missing-checkpoint halts by @erskingardner in #3125
• test(storage): cover block-list ordering and durable suppression by @erskingardner in #3091
• Pin parser-produced Markdown binding mappings by @erskingardner in #3129
• Prove late Welcome anchoring rolls back the complete join by @erskingardner in #3131
• test(cli): own account setup and management dispatch by @erskingardner in #3133
• Preserve live routes when legacy group creation fails by @erskingardner in #3137
• test(cli): own media scheduler account and worker slots by @erskingardner in #3136
• Pin directory progress and notification host mappings by @erskingardner in #3140
• test(storage): own native attachment and avatar guards by @erskingardner in #3143
• test(cli): cover TUI stream dispatch and composition by @erskingardner in #3146
• Test current maintenance and history binding choices by @erskingardner in #3153
• test(cli): prove parsed TUI startup choices reach real owners by @erskingardner in #3155
• Test message and stream binding choices by @erskingardner in #3152
• Test C remote signer login and credential restore by @erskingardner in #3156
• test(uniffi): pin presentation choices and real window recovery by @erskingardner in #3163
• test(adapter): dispatch the thousand-group burst from the SDK receiver by @erskingardner in #3200
• test(uniffi): pin remaining local host choices and limits by @erskingardner in #3166
• Test runtime cursor guards and legacy stream continuation by @erskingardner in #3173
• Test group and profile popup command forwarding by @erskingardner in #3174
• Prove deferred recovery survives generation-close failures by @erskingardner in #3130
• Prove replay fence plans preserve account ownership by @erskingardner in #3132
• Test UniFFI attachment and avatar state mappings by @erskingardner in #3128
• Prove analytics worker connectivity sampling through real relays by @erskingardner in #3134
• test(uniffi): own account and group conversion choices by @erskingardner in #3180
• test(app): publish relay caps in the failed-send rename regression by @erskingardner in #3201
• fix(tui): bind timeline panes and live resources to their account by @erskingardner in #3141
• test(engine): retain avatar activity for unknown legacy profiles by @erskingardner in #3183
• test(engine): pin ingestion alias and deferred-release contracts by @erskingardner in #3184
• fix(marmot-app): settle relay-plane shutdown cuts as preemptions by @erskingardner in #3202
• test(engine): bound route backfill and retain repair eligibility by @erskingardner in #3191
• Preserve replay infrastructure errors at native read boundaries by @erskingardner in #3192
• test(uniffi): pin group preflight targets and error context by @erskingardner in #3193
• Pin host diagnostics, push and startup mappings by @erskingardner in #3144
• test(engine): preserve native projection choices and typed rejection by @erskingardner in #3196
• Commit staged group artifacts and projection atomically by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3142
• test(uniffi): protect group image status and Debug privacy by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3197
• test(engine): cover due leave maintenance and queued retention by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3198
• Delete the old recovery owner's execution storage (#2660 rows 9-10) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3104
• Retain admin policy failure phases and sender counts by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3168
• Test UniFFI conversation choices and close guards by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3178
• Test remaining current UniFFI event choices by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3182
• Pin current timeline binding labels and subscription tags by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3160
• Test account attachment paging and real retained cursors by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3165
• test(bindings): preserve typed error actions and size categories by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3177
• test(uniffi): pin local send, moderation and media outcomes by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3162
• Skip unnecessary workspace-shard SDK cleanup by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3204
• test(fs-private): cover reachable path refusal errors by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3090
• test(cli): wait out a busy device-group reset at production timing by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3207
• Add private account inbox recovery controls by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/2685
• Preserve native storage failures during message replay by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3148
• Pin projection input and confirmed carrier contracts by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3199
• Keep self-update and disband preparation atomic by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3208
• Delete capacity-wait eligibility (#2660 rows 9-10) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3209
• Retain due SelfRemove wakeups after staging failure by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3210
• test(engine): pin deferred capacity retry and cutoff readiness by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3205
• Own bounded automatic rejoin in the runtime by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/2699
• fix(engine): preserve backend failures during candidate context capture by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3211
• Move Markdown parsing to Odin by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3214
• Reopen certified epoch gaps at upgrade conversion (#3059) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3215
• Fix Swift bindings for the MarmotKit nightly by @mubarakcoded in https://github.com/marmot-protocol/mdk/pull/3216
• docs: created_at order is send order only across seconds by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3218
• Drive automatic rejoin from account workers by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/2700
• Keep the open's coverage goals for the sweep, not the first prune's park by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3217
• Mark and remove inactive linked devices by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3227
• fix(tui): preserve feedback and newest repeated reads by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3229
• Refuse an admin's Leave until the host demotes it (#3014 interim) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3223
• Give up on account startup after a stall, not a total budget by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3224
• fix(cli): read the daemon's answer without half-closing first by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3221
• Report a non-admin's refused Commit as authorization_failed by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3220
• Fix Odin setup and Apple builds for the nightly by @mubarakcoded in https://github.com/marmot-protocol/mdk/pull/3232
• ci: retry release downloads and cache the pinned Odin archive by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3233
• Ask a sibling for private KeyPackages its waiting chats can use (mdk#2883) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3222
• Keep rival-branch proposals from invalidating a candidate path by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3228
• Retire unused Add leaves a linked device can never open (mdk#3042) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3225
• Re-drive an admin's step-down while leaving (#3014) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3235
• Show a blocked leave and let the user cancel it (#3014) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3236
• Assert the recovery runner's fairness, useful progress and scorecard end state by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3237
• Compare binary-local CI test archives by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3206
• Remove unused direct dependency declarations by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3243
• Use an FHS Nix development shell by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3242
• Find hint-less event previews beyond the operational relays (#3060) by @rademenezbtc in https://github.com/marmot-protocol/mdk/pull/3213
• Retry replay after a replacement Welcome by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3244
• Add advanced timeline search by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3245
• Release a dropped relay plane's transport instead of leaking ~3 MB per wnd request by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3249
• Stop repeating finished housekeeping on an idle maintenance tick by @mubarakcoded in https://github.com/marmot-protocol/mdk/pull/3035
• Wait for bob to reach the winning branch in rival_branch_leave by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3254
• Retire a rejoined group's history from before its new copy (#2660) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3247
• Record an admin's leave before its step-down (#3014) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3250
• Decode only the shown profiles in cached user search by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3257
• Announce committed rejoin status when a later group fails to prepare by @dannym-arx in https://github.com/marmot-protocol/mdk/pull/3246
• Step an admin down and leave its chats when signing out (#2818) by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3255
• fix(campaign): serve the production NIP-11 document from the container relay by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3251
• Read bare-domain profile links as https during onboarding by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3260
• Release MDK 0.15.0 by @erskingardner in https://github.com/marmot-protocol/mdk/pull/3261

New Contributors

• @vincenzopalazzo made their first contribution in #875
• @thepurpose-npub made their first contribution in #2717
• @tidley made their first contribution in #2614
• @rademenezbtc made their first contribution in https://github.com/marmot-protocol/mdk/pull/3213

Full Changelog: v0.14.0...v0.15.0