rc22

release candidate 22: pull-path head rollback fix (P8); audit hardeni…

rc20

rc20

rc19

feat(serve): compact repo.secsec at startup so prunes reclaim disk

Client prune and staged-push promotes free redb pages but never truncate the file, so the blind server's repo.secsec sat at its high-water mark forever. Compact once at serve startup — the one exclusive-access moment, before the store is shared via Arc and the endpoint accepts — mirroring the client's existing startup compaction. Best-effort: a failure logs and serves anyway.

rc18

rc18: visibility-minimization pass + brand logo (crossed-lines mark a…

rc17

fix(macos-ui): relaunch sync child on wake to survive sleep (tokio ti…

rc16

fix: sync reconnect probes the link before trusting it (sleep/wake re…

rc15

fix: rustfmt main.rs --passphrase-stdin arms to unblock lint CI

Two over-width spots from 29ba12a (BadPassphrase match arm; run_revoke dispatch) failed cargo fmt --check. Pure reflow, no behavior change.

rc14

feat: build.sh --install/--uninstall for the macOS menu-bar app

--install builds, copies the .app to /Applications, installs the LaunchAgent, and reloads launchctl (unload then load -w) so it runs now and at login. --uninstall unloads the agent and removes the app + plist. Gitignore the compiled binary and .app bundle.

rc13

docs: tighten comments codebase-wide — detail lives in secsec-*.md

Module docs compressed to short summaries with § pointers; fn docs cut
to 1-3 lines keeping MUST/safety contracts; inline origin-story blocks
reduced to the constraint they guard. Also drops a stale 'genesis
generation only' claim on open_repo (it peels any generation).
Comments/docs only — no behavior change. 260 tests, clippy -D warnings,
fmt, and KAT vectors all green.

rc9

rc9: history (log/restore) + sync-loop audit

Since rc8:
- secsec log / log <path> / restore <path> [version] (read-side over the object plane)
- restore: undo a delete correctly when the file is gone from disk
- sync loop: tolerate a transient roster fetch; keep the re-fold atomic
- reconnect is close_reason()-driven (no error-string parsing); verified by
  a kill+restart server test (client re-dials, re-handshakes, converges).