FlowSplice 0.3.1

FlowSplice 0.3.1

FlowSplice 0.3.1 completes the 0.3 native Travel client generation, with Android,
iOS/iPadOS, and macOS applications sharing the Rust Travel Core with the CLI.
The project remains pre-stable; this release does not introduce compatibility or GA guarantees.

Distribution

This GitHub release publishes source code and release notes only. It has no binary
attachments. Deployment-specific installers are distributed privately.

Native clients require a deployment public root injected into an application
resource before signing. This authenticates the deployment during discovery and
enrollment without an additional manual fingerprint comparison. The network cannot
replace that root. Client private keys are still generated on the device, and Home
approval is still required.

Operators building native clients must supply their own external trust and signing
configuration; see private Travel packaging.
Actual deployment public keys, certificates, private keys, signing profiles, and
private installers are excluded from Git and public release assets. Deployment-neutral
CLI executables use separately supplied trust configuration.

Highlights

• Native enrollment, local mapping management, runtime status, and recovery on
  Android, iOS/iPadOS, and macOS, backed by one shared Rust engine.
• Android foreground-service lifecycle, network-change recovery, protected password
  storage, and bounded screen-off wake-lock behavior.
• iOS/iPadOS background continuity through a mixable audio session, with optional
  Live Activity presentation and explicit recovery cancellation.
• An independent macOS desktop application with menu-bar controls, route diagnostics,
  and a signed/notarized private distribution pipeline.
• Binary business-data frames, adaptive status observation, and reduced idle work.

Review fixes

The ten findings from the 0.3 branch review have been addressed:

1. Pin deployment trust throughout discovery and enrollment.
2. Cancel and join accepted flows when stopping the native runtime.
3. Restore bounded frame-write deadlines.
4. Roll back listeners when startup fails partway through.
5. Update TCP traffic counters during active transfers.
6. Recover persistent statistics after a reconnect and lost acknowledgment.
7. Flush UDP statistics incrementally across time buckets.
8. Let authenticated Relay endpoint updates supersede automatic bootstrap hints.
9. Expose Stop while iOS audio/runtime recovery is pending.
10. Handle non-restorable iOS identity/password state with a recovery path.

Clean Apple builds also install dependencies for both embedded Web frontends before
building the native products.

Validation and limits

Validation during development included Rust formatting/check/Clippy, 117 workspace
tests, five isolated review regression scenarios, the 75-check Docker E2E matrix,
native platform tests, signed-artifact verification, and physical iPad/Android
installation and launch acceptance. The user completed client acceptance testing.
These checks do not establish a professional third-party security audit or measured
battery consumption.

Preserve application data and the established signing identity when upgrading;
uninstalling a client is not an upgrade procedure. On Android, a cold launch while
stopped can show an empty mapping list until Start loads the runtime state. This
presentation does not by itself establish that saved mappings were deleted.

Physical overnight endurance and comparative energy measurements remain separate
validation work. There is no authenticated automatic updater, update anti-rollback,
or reproducible-build attestation. See the README for deployment,
trust, and loopback-service boundaries.