Mosh 0.8.0

The first release of Mosh on Flutter. The desktop app was rebuilt from the
ground up: the React + Tauri shell is gone, the UI is Flutter, and everything
that must be right lives in one Rust core (mosh-core) behind
flutter_rust_bridge (ADR 0009, 0010, 0012). Windows ships as a per-user
installer. The same code base runs on Android (arm64) from CI, not yet as a
published build.

Added

• Voice calls. Real microphone capture and speaker playback in the Rust
  core (Opus, cpal), AES-GCM sealed frames over the mesh, a jitter buffer, a
  ringtone, incoming-call OS notifications when the window is unfocused,
  mute, and call-log entries in the conversation.
• Voice messages. Record, review and send from the composer; play inline
  in the message row.
• Attachments. Drag-and-drop and paste-to-attach on desktop, image and
  video thumbnails, a media viewer with video and audio playback, opening
  files in the system handler, and download / cancel / retry controls.
• Channels, groups and orgs. Channel and group screens with their own
  diagnostics, DM offers from a channel or group member, the org roster
  section in the rail with admin add, and a revoked-org badge.
• Onboarding. Invite cards open the chat or group straight away; an
  accepted DM invite opens the chat; the mosh:// scheme is registered on
  Windows and Android; the Advanced disclosure exposes the bind interface,
  listen port and static peer.
• Diagnostics drawer. Session, mesh and event-log sections with the
  peer's id, transport and last connect outcome.
• Encrypted history. Conversations and MLS state survive a restart. The
  data-encryption key sits in the OS credential store and is unlocked by
  user presence (Windows Hello on desktop, biometrics on Android) behind a
  lock screen.
• Desktop shell. A shared title bar with a live state pill, the sessions
  rail with unread badges and the active highlight, and the welcome pane with
  inline setup steps. Mobile gets the responsive rail-to-chat layout with its
  own header menu and search.
• Two languages. English and Russian throughout, ICU plurals included.

Changed

• One moss node per installation. The DM runtime no longer starts a second
  "relay" node under the same peer id. Reaching a contact behind a NAT is moss's
  job: the app registers the contact as a connect target and moss picks direct,
  hole punch or its own network relay. Telemetry now shows each installation as
  one node.
• An honest chat status. The chat header says one of three things: waiting
  for your contact, contact is offline, or connected with the transport next to
  it (direct or relayed by the network). "Connected" appears only after the
  contact's app answered. The rail badge, title-bar pill and diagnostics card
  say the same thing; the diagnostics card shows the contact's peer id and the
  last connect outcome instead of a relay row.
• A text never fails. A message typed before the contact is reachable
  shows a clock, survives a restart, and goes out by itself in the order it was
  written, moving to a tick and then a double tick. Retry stays for
  attachments, which need a live path. See ADR 0026.
• Messages read as rows, not bubbles, with sender grouping, avatars,
  delivery ticks, the MLS badge and a locale-aware timestamp.
• Release builds are smaller. The Rust core is built with whole-program
  LTO and stripped symbols; the moss library drops its symbol table and
  build paths.

Fixed

• Calls. Audio no longer dies one second after the call connects, a call
  shows one overlay instead of two, ring signaling survives a dropped frame,
  playback opens on any output device, and a failed audio setup is reported
  inline instead of silently.
• Sending. A message published with no peers is not marked sent; a send
  interrupted by a crash comes back as failed, not pending; a send the relay
  never tried is re-routed; every conversation kind has its own inbound queue.
• Groups. The admin is derived from the commit, not from a handoff frame.
• Desktop. Ctrl+V pastes again, local images open, the first send waits
  for the runtime, and Windows bind changes relaunch the app.
• Peers. The counterpart's moss id is persisted and may be re-announced
  after the handshake, so a restart finds the peer again.
• Android. The keyring panic is gone, the display cutout is respected, the
  key is injected only once the app is in the foreground, and the build links
  against the right native libraries.

Known limitations

• The Windows installer is not code-signed yet; SmartScreen warns on first
  run. Verify the SHA-256 published with the release.
• Android is built by CI as a debug APK for arm64 and is not published.
• macOS, Linux and iOS are not shipped in this release.

Install

Windows (x64): download mosh-0.8.0-setup.exe below and run it. It
installs per-user under %LOCALAPPDATA%\Programs\Mosh with no admin prompt
and upgrades an existing install in place; message history is kept.

The installer is not code-signed yet, so SmartScreen shows "Windows protected
your PC": click More info, then Run anyway. Verify the download first:

(Get-FileHash .\mosh-0.8.0-setup.exe -Algorithm SHA256).Hash.ToLower()
# must equal the hash in mosh-0.8.0-setup.exe.sha256

Commits (399)

Features

• feat(dm): one moss node, a proven status, and a text that never fails (9291283)
• feat(onboarding): an accepted DM invite opens the chat (743a80f)
• feat(onboarding): open the chat or group straight from the invite card (3e13843)
• feat(errors): setup and org screens choose the wording from the bridge kind (67c9de1)
• feat(conversation): choose the action-error wording from the bridge kind (d9c06c6)
• feat(bridge): add the six kind-tagged shared conversation actions (26763f2)
• feat(probe): channel-dial can send without waiting for a peer (bcfed11)
• feat(probe): the probe drives groups and channels, not only DMs (e1f9677)
• feat(theme): port React dark palette to ThemeData (db3b35d)
• feat(a11y): Tab/Shift+Tab focus-trap wrap-around for in-app modals (71e36f8)
• feat(android): open external attachments via open_filex on Android (247b358)
• feat(android): FileProvider infra for external attachment open (21af026)
• feat(dm): DeliveryTicks full-label + accessibility parity (4baad80)
• feat(onboarding): clamp listen-port input to 0-65535 parity (5e1504e)
• feat(confirm): scrim no-op + Esc/back cancel parity (f50c6ba)
• feat(diagnostics): PeerStatusDrawer Esc + focus parity (bf9700b)
• feat(dm): peerLabel fallback parity for rail + header (6204dd0)
• feat(attachments): stream media over loopback (bdd2ecd)
• feat(notifications): enable Android delivery (ddedea5)
• feat(voice-call): add production ringtone (529a5f3)
• feat(vpn): relaunch after Windows bind changes (d0adaab)
• feat(attachments): open media without thumbnails (a8cd877)
• feat(attachments): open files externally (194aa77)
• feat(attachments): expose transfer busy state (fb4e06f)
• feat(gateway): wire group DM offers to Rust (04e51f9)
• feat(gateway): wire channel DM offers to Rust (d5fe16e)
• feat(chat): add mobile kebab menu (ChatHeaderMenu) with filter toggle + per-screen actions (aecb413)
• feat(channel,group): render localized per-chat empty state (0f22e0c)
• feat(chat-pane): inline NewSessionPanel with menu + steps on desktop (793e463)
• feat(chat-pane): show OnboardMenu inline in desktop welcome (e240763)
• feat(composer): ChatDropZone desktop drag-and-drop file attach (React parity) (b4d681e)
• feat(composer): paste-to-attach clipboard image (React parity) (6cb0d5b)
• feat(shell): ChatPaneWelcome Start CTA (React EmptyState parity) (f425ca2)
• feat(shell): shared desktop titlebar with live state pill (React parity) ([19110ba](https://github.com/re...