v0.9.11 - MDK

What's Changed

• Publish empty follow list for new identities by @erskingardner in #1170
• Upgrade SQLCipher and enforce exclusive Marmot roots by @erskingardner in #1173
• Scope convergence reservation to admin intents and schedule on real cutoffs by @erskingardner in #1174
• Refactor convergence drain maintenance and reservation lifecycle by @erskingardner in #1187
• fix: broadcast group events applied inside an outbound send by @erskingardner in #1186
• Establish the convergence assurance foundation by @erskingardner in #1188
• feat: support www bare autolinks by @agent-p1p in #1178
• Add exact convergence oracle and scenario input ledger by @erskingardner in #1190
• fix(cgka-engine): reopen a stale convergence pass at the current tip instead of halting the group by @jgmontoya in #1182
• Add convergence subject boundary by @erskingardner in #1194
• Fix SQLite transaction boundary busy handling by @erskingardner in #1191
• Add injectable convergence dual clock by @erskingardner in #1195
• Retire consumed self-remove proposal work by @erskingardner in #1192
• Upgrade dependencies flagged by cargo audit by @erskingardner in #1197
• Document multi-device design exploration by @erskingardner in #1199
• Fix simulator rollback publication semantics by @erskingardner in #1196
• Align canonicalization with adopted convergence contract by @erskingardner in #1198
• Harden SQLite projection pruning and secure deletion by @erskingardner in #1201
• Enforce per-account session ownership by @erskingardner in #1200
• fix(cgka-engine): mirror the inbound-commit epoch inside the merge transaction instead of best-effort by @jgmontoya in #1184
• Add subject-level convergence virtual time by @erskingardner in #1202
• Make inbound commit capability projections atomic by @erskingardner in #1203
• Bound deferred peel residence across restarts by @erskingardner in #1206
• Add explicit simulator outbound publication lifecycle by @erskingardner in #1205
• Add full-system convergence quiescence by @erskingardner in #1216
• Add deterministic convergence failure capsules by @erskingardner in #1217
• Complete Scenario IR and retained-relay simulation by @erskingardner in #1233
• Add Milestone 3 adversarial convergence campaigns by @erskingardner in #1235
• Feat/incident replay classifier parity by @jgmontoya in #1204
• Add Pi terminal harness connector by @erskingardner in #1244
• Add Milestone 4 independent convergence verification by @erskingardner in #1243
• Fix simulator production output audit by @erskingardner in #1247
• Add Milestone 5 app and multi-process convergence simulation by @erskingardner in #1248
• Move full simulator campaigns to nightly CI by @erskingardner in #1249
• fix: zeroize CLI nsec imports by @agent-p1p in #1215
• fix(storage): zeroize OpenMLS serialization buffers by @agent-p1p in #1214
• fix(storage): redact group image keys from Debug by @agent-p1p in #1212
• fix(hermes): bound timeline context size by @Datawav in #1234
• fix(account): zeroize NIP-49 export intermediates by @agent-p1p in #1213
• fix(openclaw): bound timeline context size by @erskingardner in #1257
• Feat/epoch stall backfill escalation by @jgmontoya in #1208
• test(marmot-app): stabilize runtime start ordering check by @agent-p1p in #1255
• Fix/incident replay halt evidence followups by @jgmontoya in #1245
• Fix physical iOS Marmot root lease startup by @erskingardner in #1266
• Anchor the private directory walk below the ancestors Android refuses to open by @mubarakcoded in #1267
• Resolve the Android private-root path alias instead of skipping it by @mubarakcoded in #1269
• Fix Hermes installer guided setup by @erskingardner in #1268
• Ignore retired relays in discovered account routes by @erskingardner in #1274
• Make account import setup resumable by @erskingardner in #1280
• Add distributed campaign runner core by @erskingardner in #1270
• Add commit-addressed checkpoints for own-commit fork recovery by @erskingardner in #1285
• Add distributed campaign execution lanes by @erskingardner in #1271
• Feat/queue and recover nonstable sends by @jgmontoya in #1246
• Add convergence failure corpus lifecycle by @erskingardner in #1272
• Enforce convergence capability naming by @erskingardner in #1273
• Preserve own sent messages through convergence by @erskingardner in #1300
• Allow iOS background access to account secrets by @erskingardner in #1301
• Add group-profile scenario oracle coverage by @erskingardner in #1299
• Bump pinned Rust toolchain to 1.97.1 by @dannym-arx in #1305
• Add stateful canonical journey generator by @erskingardner in #1302
• Add account-open stage telemetry, scaling benchmarks, and pre-snapshot readiness by @erskingardner in #1306
• Reconcile convergence reliability plan by @erskingardner in #1310
• fix: fail when the control socket link disappears by @agent-p1p in #1281
• Add transcript and secrecy scenario vectors from the multi-VM catalog by @dannym-arx in #1292
• Add isolation and catch-up scenario vectors from the multi-VM catalog by @dannym-arx in #1294
• Add engine two-phase hydration with fail-closed unhydrated state by @erskingardner in #1307
• Make generated scenarios selectable across adapters by @erskingardner in #1313
• Defer runtime group hydration to a background pipeline after readiness by @erskingardner in #1308
• fix(openclaw): import plugin-sdk symbols that survive the beta re-cut by @erskingardner in #1332
• feat: expose dial-safe profile image fetch by @agent-p1p in #1288
• perf(app): detach invite read-side catch-up by @agent-p1p in #1309
• Add an explicit storage close so hosts can suspend without a lock kill by @erskingardner in #1333
• fix(app): close invite catch-up lifecycle races by @erskingardner in #1340
• Add convergence route assurance inventory by @erskingardner in #1338
• Restore sender ratchet reorder policy by @erskingardner in #1341
• feat: expose lightweight group roster projection by @agent-p1p in #1312
• fix: release account sessions after reconcile failure by @agent-p1p in #1317
• perf(app): reduce create-group latency by @agent-p1p in #1316
• feat(hermes): send multi-image responses as one Marmot album by @agent-p1p in #1323
• feat: provide bounded local membership reads by @erskingardner in #1342
• test(app): cover reconnect hydration ordering by @agent-p1p in #1343
• Harden simulator oracle and replay fidelity by @erskingardner in #1344
• Add four-party cross-route convergence regression by @erskingardner in #1345
• Add the admin-churn/v1 generated scenario family by @dannym-arx in #1295
• chore(release): prepare 0.9.11 by @erskingardner in #1346

Full Changelog: v0.9.10...v0.9.11