v0.9.16 - MDK

What's Changed

• Fix/backfill review followups by @jgmontoya in #1553
• Measure epoch divergence from the current epoch, not the high-water mark by @dannym-arx in #1559
• Fix/refused ingest stays fetchable by @jgmontoya in #1565
• fix: scope replay rollback to canonical group state by @erskingardner in #1563
• perf(cgka-engine): reuse deferred peel candidates by @erskingardner in #1564
• Fix/backfill rearm and unknown group by @jgmontoya in #1569
• Send and fetch custom app events in chat by @dannym-arx in #1544
• fix(agent): make preview retries idempotent by @Datawav in #1555
• fix(hermes): preserve shed inbound replay by @Datawav in #1571
• fix(marmot-app): bound epoch backfill worker drains by @erskingardner in #1566
• ci: align QUIC broker gates and stabilize recovery tests by @Datawav in #1556
• fix(terminal-harness): add liveness-aware durable recovery by @Datawav in #1568
• fix(app): require relay coverage for replay completion by @erskingardner in #1581
• Remove sensitive data mode from audit logging by @erskingardner in #1580
• Fix ambiguous relay publish recovery by @erskingardner in #1582
• fix(adapter): normalize relay coverage identities by @erskingardner in #1583
• feat(terminal-harness): add shared chat commands by @Datawav in #1573
• Fix stale relay sockets after ambiguous publish timeout by @erskingardner in #1588
• fix(app): recover per-account relay queue overflow by @erskingardner in #1567
• feat(agents): deliver backend artifacts through SendMedia by @Datawav in #1574
• fix(marmot-app): require EOSE for full-history repair by @Datawav in #1586
• fix(app): wake reconnect backoff on catch-up by @erskingardner in #1589
• fix: reconcile relay history below cursor floor by @erskingardner in #1584
• feat(terminal-harness): deliver ordered inbound attachment batches by @Datawav in #1587
• Add marmot-c: macro-generated C ABI over marmot-uniffi by @dannym-arx in #1545
• Let a host supply its own account secret store by @dannym-arx in #1575
• Feat/epoch stall fruitless escalation by @jgmontoya in #1590
• Fix/epoch backfill error pacing by @jgmontoya in #1591
• docs(app): correct the disband passage-routing note and pin its vacuity by @jgmontoya in #1592
• Fix/drained seam system rows and rearm by @jgmontoya in #1593
• Fix/refusal doc honesty and summary merge by @jgmontoya in #1601
• fix(engine,app): fork-aware deferral lineage and reorg-aware stall runs by @jgmontoya in #1602
• fix(engine,app): announce a disband once, and heal terminal groups from the guard row by @jgmontoya in #1604
• Export per-account-id relay lists to the C ABI by @dannym-arx in #1605
• fix(transport): attempt-scoped subscription ids so a superseded EOSE cannot confirm a replay by @jgmontoya in #1607
• fix: recover durable outbound sends after connectivity returns by @mubarakcoded in #1603
• Reject stale invite acceptance after terminal removal by @Datawav in #1614
• Batch app-component reads onto one MLS group load by @dannym-arx in #1615
• Fix/upsert invalidation revive by @jgmontoya in #1608
• Share the convergence seen-id snapshot via Arc by @dannym-arx in #1618
• chore(release): prepare 0.9.16 by @erskingardner in #1626

Full Changelog: v0.9.15...v0.9.16