v0.13.0

Feature release. PluralKit sync is substantially more reliable, sync correctness
and delivery were hardened across multiple CRDT review waves, custom fields gain
header icons and member layouts, markdown supports member mentions, and media
sync moves toward self-healing delivery. The sync pin moves to
prism-sync v0.13.0 (2992d60).

Added

• Custom fields can display profile header icons, with a combined icon picker,
  filled icon variants, and inline icon editing.
• A new member custom-field type and per-member field layout options.
• Markdown supports @member mentions that open the member in a sheet.
• Navigation settings gain label display modes (full, truncated, icons-only), and
  the home navigation item can be reordered.
• The sync settings screen was redesigned.
• Context menus support secondary-tap (long-press) and right-click overflow menus.
• Sleep gains a recovery banner and sheet, and accidentally deleted sleep sessions
  can be recreated.
• Fronting sessions can start at an earlier time, and notes can now be cleared
  from a session.
• The notes list gains search and per-member filtering.
• Media heals on demand and via pairing push, with thumbnails, a persisted upload
  queue, and eager hydration of referenced media on newly paired devices.

Changed

• PluralKit sync was hardened end-to-end: per-member push isolation, per-field
  PATCH payloads, client-side field caps, a stable service identity, token
  rotation, a mass-deletion breaker, and corrective imports that preserve data.
  Group-sync catch-up now backfills only the fields a peer is missing rather than
  re-broadcasting.
• Sync delivery is durable: each change and its sync intent commit together
  through a write-ahead outbox, ops are never dropped while the engine is
  unconfigured, and the delivery journal drains and acknowledges after commit, so
  a crash or interrupted pull no longer loses what you sent or received.
• Hybrid logical clocks tolerate device clock drift — watermarks advance
  monotonically, the push queue orders by logical time, forward excursions repair
  against validated relay time, and snapshot imports gate on drift — so a device
  with a wrong clock can't reorder history.
• Key rotation is crash-safe: revoke and rekey journal ahead of the rotation,
  verified epoch-key history travels in the pairing bundle, and batches that
  arrive before their key are quarantined and replayed once it does instead of
  being dropped. A device revoke still wipes only after a cryptographically
  verified self-revocation.
• prism_sync is built as a native asset, so a Rust toolchain is required at app
  build time.
• phosphor_flutter now tracks a maintained fork that compiles on Flutter 3.44+.

Fixed

• Switches and fronting sessions no longer resurrect through import, re-import, or
  stale snapshots, and primary-key tombstone collisions on import are handled.
• Pairing holds its snapshot until a new device catches up and persists a
  refreshed session token, so pairing no longer deadlocks or drops its session
  after a relay refresh; a stale device recovers through a signed session-refresh
  instead of re-pairing.
• Schema migrations run transactionally and idempotently, and migrated synced
  columns re-emit through a repair queue, so a half-applied upgrade can't strand
  data.
• Imported media and board posts now emit sync ops, and fronting orphan-rescue
  rewrites re-emit with normalized member ids.
• iOS recovers and diagnoses unreadable secure storage during sync setup instead
  of dead-ending recovery-phrase entry.
• iOS no longer links SDWebImage through both CocoaPods and Swift Package
  Manager.
• Spam-tapping archive actions no longer pops past the app shell.
• Mention overlays honor the active palette theme, deleted custom-field choices
  can be cleared, inline markdown renders inside blockquotes, and a custom
  notification skip duration is saved.
• GIF API hosts are allowlisted, secure-storage writes and at-rest app data were
  hardened, and the post-capture screenshot warning was removed.
• Backup export now carries the navigation label mode and media thumbnail hashes.
• Camera media compression applies EXIF orientation before storing dimensions.
• Spanish strings were added for image-fetch errors, alongside fixes across
  fronting date display, sleep recovery, navigation pill centering, chat
  speaking-as, and custom-field slider display.

Internal

• Folded in the CRDT correctness remediation waves (all three critical findings
  closed) and the full PluralKit sync audit.
• The relay serves each pull from one consistent snapshot, prunes batches
  atomically, keys snapshots per audience, guards the prune tail against live
  pairing snapshots, detects a restored database through a log-lineage token, and
  recovers stale devices through a signed session-refresh endpoint.
• Release builds disable icon font tree-shaking so the runtime icon picker can
  render any glyph, and the Windows desktop build links the system OpenSSL to
  avoid the native-asset MAX_PATH limit.
• Squashed the unreleased database migrations into the v32 floor, and added an
  identity-alias table with sync-generation columns.
• Member-add performance work (single-transaction custom-field commit, a
  lightweight member-name map) plus benchmarks and save-timing diagnostics.

Install

• macOS — Prism-0.13.0+13001-macos.dmg (Developer ID signed + notarized)
• Windows — Prism-0.13.0+13001-windows-x64-install.exe, or the portable .zip
• Linux — Prism-0.13.0+13001-linux-x64.tar.gz, or the .deb
• iOS / Android — TestFlight and Google Play closed testing; an unsigned iOS .ipa for sideloading is in the assets below

Built against prism-sync v0.13.0 (2992d60).