RCQ Android 0.216

Messages are now verified against your contact's key.

• Every message, edit and deletion is checked against the key pinned for that contact. No one can write, edit or delete under someone else's name, in a direct chat or in a group. The same check covers group membership changes, reactions and read receipts.
• If a contact's key really did change, their next message lands in requests with a note, instead of silently taking over the existing conversation. Blocking such a message never blocks the real number behind it.
• In any sheet, the first Back with the keyboard open just closes the keyboard; the next Back closes the sheet.
• An open chat redraws only what a receipt, reaction or presence change actually touched, and album previews decode off the main thread.

Server side (islands, already live): a large post in one room no longer holds up messages in another, and only a room's own members can broadcast into it.

Android 0.215

An account removed from the phone leaves nothing behind.

• Every wipe path (burn, removal in Manage accounts, the wipe PIN, removing the PIN, the duress teardown, the "account no longer exists" erase) now clears all data the account kept on the device: every per-account preference key (including private contact names, finished random chats and read positions), its cross-island, backup-island, guest-card and block stores, sender-key chains when no other account holds the same number, decrypted cache files (played voice notes, opened attachments, shared files) and its unsent drafts. Other accounts on the phone keep their data. Duress paths stay network-silent.
• A mute on a contact from another island is now stored by their address (number@island), so it no longer silences someone else with the same number. Existing mutes are migrated without losing any, and only own-island numbers go to the island's mute lists.
• The mute note says honestly that while the app is closed or locked with a PIN a muted chat may still sound once.
• The full network check shows every line in the app's language and numbers its control hosts instead of naming them.

Android 0.214

Pick messages together and forward them.

• Long-press a message for Select and Forward. Selection mode picks albums as a whole (up to 50 messages) and offers Forward and Delete (for me, or for everyone when every picked message can be retracted). Forwarding re-sends media with a fresh key through the normal send paths, so it reaches the recipient's island; view-once and expiring media and messages not yet downloaded are not forwardable. A forwarded message carries the original author's self-chosen name and shows "Forwarded from". Labels from iPhones now show on Android too.
• A contact on another island who deleted their account is detected when you open the chat or contact card (at most once a day per address, never through the message endpoint), marked "Account deleted" in the chat list, and can be removed from the banner. The mark clears only when a message signed with their pinned key arrives.
• Mute lists are no longer overwritten on the island at every start: only real local changes are sent, merged with the island's lists. A muted one-to-one chat stays silent when its message arrives by push while the app can drain it.
• Under the duress PIN, a language change (or any Activity recreation) no longer rebinds local stores to the real account.

Android 0.213

Blocking, notifications and the backup island work more precisely.

• Blocking someone from another island used to be stored by number only. Unblocking in Settings lifted the visible mark but left the block on their address, so their later messages were dropped silently and the sender saw one tick. A block now names one person on one island (their address and their pinned key), Unblock lifts exactly that block, and the Blocked users list shows the island. The block and unblock decisions are timestamped so other devices of the same account apply them in order.
• Removing an account from the phone did not withdraw its push registration on the island, so the phone kept getting notifications for an account it no longer held. Removal now withdraws it (with retries), the app reports which accounts are actually on the phone so leftover registrations are pruned, and a push for a number that is not on this device never rings or shows a notification.
• The Add sheet, its search results, drafts, shared content and deep-link dialogs no longer carry over when switching accounts or entering the duress view.
• Island descriptions in the picker open in full, the backup island switch says that it manages only the automatically picked island, the manual section is no longer collapsed, and the mailbox number text no longer claims the home number was taken.
• A backup island can be removed together with the copy on it; a removed backup island leaves the signed home record; a backup copy registers with a signed record of the home number.
• Room links carry the room's share key and every join path passes the key of the link that was tapped.
• A cross-island request notification now reads "Wants to chat with you".

Android 0.212

Conversations with other islands work all the way.

• A delete for everyone, an edit, a reaction or a receipt to a contact on another island was sealed to the same number on our own island, where that number is somebody else or nobody. The delete came back a few seconds later and the peer never saw a second tick. Controls now go to the contact's island with the pinned keys, like a message, under their own outer type (read, delete, edit, reaction), with three tries. Delivered receipts to one peer are batched (1.2 s, up to 64 ids).
• A message sent from the phone to another island never reached the account's other devices: that branch returned before the carbon.
• One number on two islands: the add paths refused only "our island against another", so N@a and N@b shared the one thread the bare number keys. Any clash is refused now, duplicates of one person (same number and pinned key) are collapsed, and a row signed by a contact's pinned key counts as that contact from any of their islands. Our own number is never routed out (Saved Messages), and a same-island contact wins over a cross-island one for messages, media, controls and receipts alike.
• A message deleted for everyone while it still waited in an unanswered request is taken out of the request instead of being replayed on accept.
• Settings: the automatically picked backup island can be made primary like a manual one. Diagnostics copy and share are icons next to the line.
• rcqbox.aar (sing-box) is now rebuilt from public source byte for byte, see docs/REPRODUCIBLE-BUILDS.md.

Android 0.211

Opening a big room no longer floods the island.

• Since 0.204, mapping a room's roster asked every member with a picture we hold no key for for their profile key, one unthrottled coroutine each. For anyone who is not a contact that meant a card read, a device list, a bundle read and a sealed deposit; in a 2271-member room it arrived as ~30 parallel GET /users/{uin}/info + /keys/{uin}/devices, the burst that set off the flagship's pool stalls (2-11 minutes, several times a day). The island itself is fixed in 2026.09.29.01; this release stops the burst. Profile keys are now asked of same-island contacts only, which are the only askers any client answers.
• Card, device-list and bundle reads to one island go through a shared gate of 4 in flight, and concurrent lookups of the same peer share one read; a waiter takes over when the read's owner is cancelled.
• Per-peer generations for the device and identity caches: a lookup that starts after an invalidation (a message from an install the list does not have, a 404, a key change) never joins or caches a read that began before it, so a copy is not sealed to an old device list.

Android 0.210

Messages from another island no longer vanish, and spoilers stay covered everywhere.

• #1055: removing a contact put their bare number on a local drop list that nothing ever cleared, and ingest dropped every row from that number after the ack, from any island. Re-adding the person from either side, a new request or an accepted one did not help: their contact request never showed and their messages woke the phone and were never filed. The list now speaks only for our own island and only while the sender is not in the roster again; adding somebody or seeing them in the roster clears it, and a sender from another island goes through the cross-island gate like any stranger.
• A contact request from another island now raises a notification ("Wants to add you"), gated the way ingest decides it (another island, not already a contact, not blocked). Tapping it opens the account it was for.
• A token the island stopped accepting (a signed key change on another device, a move, a converted copy) left the app on "connecting" for ever: the island refuses such a socket before accepting it, so the 4401 close never arrived. A 401 on our own island now runs the refresh probe without its wipe branch, pinned to the account that asked, and a final answer ("keys changed on another device") is shown once instead of asked every minute.
• Spoilers are covered on album tiles, on the chat and room media walls and on the pager pages opened from them; the video walk never steps into a spoiler clip.
• A message that failed to send can be deleted while offline; a resend already in flight no longer sends a deleted message, and the retraction is retried on reconnect.

Android 0.209

Backup copies stop passing for people, and the chat's media reads like one album.

• #1054: a contact request to somebody's backup copy (multihoming §5a) used to wait forever, because nothing reads requests there. The island now refuses it with 403 backup_copy naming the home address, and marks copies with home on search, profiles and outgoing requests. The app says whose copy it is and offers to add the person at their real address, after checking that the home's card holds the copy's own signing key.
• #1052: the chat's fullscreen viewer pages through every photo and clip of the conversation, not only one album; spoiler pages stay covered until tapped.
• #1053: a uin@island address in a message opens that person's card instead of being drawn as a site link; numeric mailboxes at mail providers stay text, and a number that clashes with a known contact is refused like in the Add sheet.
• #1051: pinned invite links show their rooms' names instead of twenty rows of "Группа".

SHA-256:

• arm64-v8a 906e1911f2a2951e6a405b03dd3d3f996bd46593d62cda43b1ee39e19448efc1
• armeabi-v7a 2705c4f12b6cc89791c85f24ceaea1970b316a5cd10c2de3c26fecb1b987ab51
• universal 68848c7ba30fed26c9a3ac25b01cd7a31687644514da7c059eeef5ddf50c5fc3

Android 0.208

Fingerprint unlock works again (#1049).

The lock screen asked for the fingerprint once, 400 ms after it was drawn, without checking that the app was actually in front. When another window held focus at that moment (a permission dialog, the launcher transition, a heads-up), the request was dropped with no callback, the button stayed disabled while looking active, and the sensor never lit. The prompt is now requested every time the lock screen is really in front (resumed and focused), the button is never disabled by a prompt in flight, and every outcome is answered exactly once: unlocked, closed, failed (with the system's own words), or key reset. A transient keystore error no longer turns biometric unlock off, and removing every fingerprint now says so instead of "unavailable right now".

Also in this build: a background media send behind a message database that failed to open now shows the "not sent" toast instead of waiting forever.

SHA-256:

• arm64-v8a bc86d043ed3dd4b26193cfe0f75fd5c2e5fc41dacdbb11fe02fc7b99f33d89e5
• armeabi-v7a 569dd11dcbd85d90fd4f649bbe685b16637bd7629684918ced1ee5424bd18990
• universal 5858093ee7436adbcadc2621781bc942b701fe77afddd534b4bac8ec218b41b7

Android 0.207

A chat lock that holds, replies with pictures, and calls that leave an honest trace.

• Chat lock (#1045): removing a chat's lock, deleting or leaving a locked chat, and linking a web session all ask for the PIN. A locked chat reopens behind its PIN after any way out of it. Locked chats stay out of notifications, long-press previews and search. A section behind a PIN guards every way into its chats. In-app PIN gates share the lock screen's attempt counter and lockout, which now runs on a clock the Settings app cannot move.
• Replies (#1048): a picture, video, voice note, file or location sent as a reply carries the quote. A media send that is still uploading when the app locks finishes after you unlock into the same account, and never goes out from another account.
• Calls (#1047): a call to a phone whose app was off leaves a missed-call row and notification instead of an anonymous "New message". A call the callee declined is not handed back to them as missed, and the caller is told it was declined. After "not online, notification sent", hanging up returns to the chat at once. A contact a call found offline is shown offline until presence says otherwise.
• Media (#1042): a group's media wall and a chat's All media page like an album and can jump to the message in the chat.
• Screen-off notifications (#1044): a settings card, and a one-time banner on vivo/iQOO/Huawei/Honor/OPPO/Xiaomi, to exempt RCQ from battery optimisation and open the maker's background settings.

SHA-256:

• arm64-v8a b2d6d0bb0e3e5ca2e97f5d9e87d930cfba8792183a64687990a1cc0914db3008
• armeabi-v7a 154870505f9664cc71fedb95756985b180356f076ed4d61c248aca09958634ba
• universal 1978d3913793b5965005bddc7f76b4cf020f83cf6a91dee32043e3c7c28a2a02