v0.17.0

[0.17.0] - 2026-07-30

Bug Fixes

• Stop manufacturing a phantom peer named "relay" (bindings) (6b3789a)
• Stop the pending layout from lying about terminal outcomes (protocol) (b2996f8)
• Migrate legacy pending queues all or nothing (protocol) (e7cf8a8)
• Claim the ids the first restore pass settles (protocol) (1443a97)
• Stop the first restore walk from eating the whole pool (protocol) (29652e2)
• Bound the outbox prunes that run after its walk (protocol) (2efb4ec)
• Let the launch own every restore delete pool (protocol) (71b9c08)
• Constrain the dedup fields a binding caller can set (protocol) (cfba166)
• Validate a dedup config where it is supplied (protocol) (12fc896)
• Survive a state record the store cannot read this session (protocol) (3bd4f04)
• Make the restore delete budget bound the launch, not the walk (protocol) (d674cc4)
• Sweep the Android state store's orphaned temporaries (bindings) (a7826ce)
• Budget every delete a restore issues, not just some (protocol) (4fe2d84)
• Budget the deletes a restore's reader issues (protocol,bindings) (d0bc594)
• Bound restore's deletes, not just its reads (protocol,bindings) (89d6974)
• Sweep the iOS state store's write temporaries (bindings) (b70088d)
• Drain the settlements a pause parked (protocol) (d55f9c3)
• Stop an attestation clobbering what a peer advertised (protocol) (cd9097d)
• Note the deadline of a pending entry a flush puts back (protocol) (ef44d23)
• Flush the directory after discarding a state record (bindings) (5939b4c)
• Count an AtomicFile twin as one enumerated record (bindings) (965af64)
• Create the Python state directories owner-only (bindings) (131d7e2)
• Survive a state record whose bytes will not decode (protocol) (f3a593b)
• Freeze the pending tail a restore never reached (protocol) (3a987c4)
• Keep the settlements a rolled-back restore earned (protocol) (d3c3878)
• Cap the settlements restore parks for start() (protocol) (60113a7)
• Bound the TOFU walk, and say why it must not prune (protocol) (197af1f)
• Settle an outbox record nothing can name (protocol) (b99b7bc)
• Verify a legacy-store claim is exclusively ours (bindings) (f29c72f)
• Sweep Python state-store write temporaries (bindings) (f3bddba)
• Bound the two cache restores like every other walk (protocol) (ec36104)
• Verify a legacy-store claim before adopting it (bindings) (f86a111)
• Flush the Android state directory after a store and delete (bindings) (18adfb6)
• Settle a destination the adoption probe destroyed (protocol) (8f0e892)
• Freeze a pending queue that cannot be read this session (protocol) (6513eed)
• Prefer the AtomicFile backup when listing state keys (bindings) (8556768)
• Keep an unaddressable queue whose ids cannot be read (protocol) (c258630)
• Fail closed when the block list cannot be listed (protocol) (1ab58d3)
• Stop validating the target of a group removal (protocol) (828f5d3)
• Bound state listing by entries examined, not keys kept (bindings) (b27b940)
• Say when a secure store cannot adopt the pre-namespace one (python) (9d5f52c)
• Bound every category walk, and retry the tail adoption skipped (protocol) (3502482)
• Flush the iOS state store before it says it stored (bindings) (3a6a338)
• Settle a record the store itself says is unreadable (protocol) (643e5f4)
• Settle only the delivery state that is actually gone (protocol) (5f8aa0f)
• Adopt pre-split protocol state instead of abandoning it (protocol) (8679831)
• Settle restored delivery state that cannot be recovered (protocol) (e2a3228)
• Refuse the same storage namespaces on every platform (bindings) (d7a6988)
• Drain an ACK batch that has waited exactly its timeout (reliability) (9bd0f2c)
• Address state records by digest and bound their reads (bindings) (3c59841)
• Adopt the pre-namespace secure store on upgrade (bindings) (1cb1bbd)
• Validate storage namespaces before they become paths (bindings) (dae9dc8)
• Make the built-in stores durable before they return (bindings) (f8b6f5a)
• Tie the state record cipher to its secure store (protocol) (752824e)
• Stop re-queueing renewing the pending lifetime (reliability) (a16d7aa)
• Bound the pending queue by bytes, not just count (reliability) (9f58992)
• Seal sensitive protocol state at rest (storage) (091093a)
• Bound pending session messages (reliability) (c59b956)
• Reject invalid mutation targets up front (groups) (5fffb40)
• Require an install-owned state root (python) (17b842a)
• Commit pinned UniFFI output (bindings) (ea85c7e)
• Make lifetime expiry arithmetic panic-proof (reliability) (1d2479b)
• Scope built-in stores to protocol accounts (storage) (4fd1126)
• Separate protocol state from secure storage (storage) (e88bf75)

Performance

• Bound the pending restore's write and delete bursts (protocol) (91e99b4)
• Hand protocol-state records across as bytes (uniffi) (3e51430)
• Bound the outbox restore walk by the outbox's own cap (protocol) (9e49b89)

Refactoring

• Key pending records by message id, not recipient (protocol) (1383de7)
• Validate an ACK update with the real validator (protocol) (21ab34f)
• Inline the one-use storage wrapper macro (uniffi) (a5519a5)
• Give protocol state its own error type (storage) (59e9c6c)
• Decouple protocol state from MLS storage (storage) (5daa9d1)

Documentation

• Refresh the doc set for the storage-split release, and fix the RN pending-TTL drift it exposed (#242)(89b917a)
• Say that an upgrade does carry delivery state across (bindings) (e111c61)
• Explain why a walk tail actually drains (protocol) (3e1bec7)
• Say that an upgrade does migrate its delivery state(eb2a812)
• Say what a writable app container actually buys an attacker(34e66a6)
• Call recipient validation what it is — a breaking change(9da0392)
• Say what else a legacy-store conflict costs (bindings) (b0a6ac2)
• Say out loud that downgrading resets the block list(11cefa6)

Testing

• Pin the provider record ceiling to its constant (protocol) (437e3b7)
• Count the extras a forward carries twice (protocol) (91ef07e)
• Measure the pending budget the way admission does (protocol) (2b2784c)
• Exercise native protocol state stores (bindings) (9d73361)
• Remove dead protocol test setup(599a636)

Miscellaneous

• Give researchers safe harbor and ship the license text with each crate (#255)(a5fbbc4)
• Assert project copyright notice on distributed copies (#254)(bfe908e)
• Ship third-party license attribution with distributed binaries (#253)(56c3034)
• Release mesh-sdk v0.17.0 (#243) (bindings) (920444a)

Build

• Bump actions/upload-artifact from 4 to 7 (#236) (deps) (288d45d)
• Bump actions/setup-java from 4 to 5 (#235) (deps) (b4b7482)
• Bump criterion from 0.5.1 to 0.8.2 (#233) (deps) (00dd9dc)

Ci

• Typecheck the RN package in CI and put a 7-day cooldown on Dependabot (#244)(90b30e6)