v2.3.0

Changelog

• 9b9e15f: chore(deps): bump whatsmeow to 20260716 + x/net,sys,text train (#289) (@phsb5321)
• 73d6607: chore(fix): apply go 1.26.5 go-fix modernizations + gate-blocking clone dedup (#327) (@phsb5321)
• 525f365: chore(fix): restore Go 1.26.5 fixed point (#349) (@phsb5321)
• 1a59519: chore(lint): drop stale Go patch version from .golangci.yml comments (#291) (@phsb5321)
• 4960e92: chore(ux): draft ux-audit config for the pairing page (PILLAR wave 3) (#337) (@phsb5321)
• bd1ccef: ci(bench): reproduce idle-RSS + hot-path benchmarks in CI (roadmap 2.2) (#326) (@phsb5321)
• 63c7656: ci(lint): golangci-lint v2.12.2 — drop SA5011 false positives (#346) (@phsb5321)
• 1db658b: ci(sonar): stop a runner backlog from failing an unrelated PR (#325) (@phsb5321)
• 48bfc5d: ci: bump quality-gates for the alignment fix; correct the pin rationale (#345) (@phsb5321)
• f402491: ci: bump quality-gates to the pin carrying the alignment suite (#347) (@phsb5321)
• 8d4492a: ci: bump quality-gates — the CI gate finally has the jscpd ratchet (#353) (@phsb5321)
• 568f745: ci: pin quality-gates past v1 for the Gherkin gate (#344) (@phsb5321)
• d1d5489: docs(changelog): regenerate [unreleased] for the 35 commits since v2.2.0 (#330) (@phsb5321)
• 4339fc5: docs(changelog): regenerate stale v2.x history via git-cliff (#290) (@phsb5321)
• 766f26b: docs(codeowners): delete the shadowed root file (#340) (@phsb5321)
• 3a3bc27: docs(manual): correct --since semantics after seq stamping landed (#303) (@phsb5321)
• 7a92e8a: docs(media): fix --caption example that matches nothing (#316) (@phsb5321)
• 6733726: docs(readme): real regenerable CLI demo, not a hand-written cast (#372) (@phsb5321)
• af3062a: docs(spec-guard): the check is required as of 10/08 (#343) (@phsb5321)
• a279a8f: feat(events): carry the source messageId to subscribers (#362) (@phsb5321)
• aba3903: feat(events): surface isForwarded + forwardingScore on message events (#370) (@phsb5321)
• f887d22: feat(media): fromMe direction discriminator on media.list (WAA-14) (#335) (@phsb5321)
• f24ffd2: feat(media): narrow media list by sender, caption and time window (#314) (@phsb5321)
• 380336b: feat(moderate): make revoke scope=self actually delete for me (#367) (@phsb5321)
• c7471fb: feat(poll): send polls with poll.create (F-091) (#336) (@phsb5321)
• 9b7367b: feat(receipts): add played receipts for voice notes and view-once (#309) (@phsb5321)
• 5fae0bc: feat(send): add @mention support to wa send (#292) (@phsb5321)
• 453d31e: feat(send): sendMedia --ptt sends audio as a voice note (#302) (@phsb5321)
• fe220c5: feat(spec-guard): enforce CLAUDE.md rules 2 and 16 at runtime (#338) (@phsb5321)
• 4a21f0d: fix(agentdocs): guard the reverse of the openrpc drift check (#307) (@phsb5321)
• db347d7: fix(app): route every domain event variant, fail closed on the rest (#296) (@phsb5321)
• bc6b103: fix(ci): isolate reproducibility Go cache (#351) (@phsb5321)
• 3788dee: fix(ci): isolate reproducibility snapshots (#352) (@phsb5321)
• 37752d8: fix(cli): classify catalogued daemon error codes into exit buckets (#306) (@phsb5321)
• 15ef08e: fix(codeql): manual build-mode for Go, closing the audit ledger (#334) (@phsb5321)
• 98e200d: fix(domain): read message text through Content, not a type switch (#295) (@phsb5321)
• dfd87cf: fix(errors): stop collapsing RPC sentinels to -32603 over --remote (#312) (@phsb5321)
• 0bb0fd3: fix(events): project every message variant, not just three (#294) (@phsb5321)
• 66fa82f: fix(export): report the linked PN/LID chat, not half a thread (#356) (@phsb5321)
• ef97bb2: fix(health): report the real pairing instant as sessionSince, or nothing (#324) (@phsb5321)
• 553b1e4: fix(history): persist reactions instead of blank rows (#301) (@phsb5321)
• 4b1a8f0: fix(mcpbridge): wa_search_messages targeted the wrong RPC method (#305) (@phsb5321)
• ba327ac: fix(media): match --caption without regard to case or accents (#322) (@phsb5321)
• e7150ed: fix(media): refuse media.list rows a daemon did not confirm filtering (#320) (@phsb5321)
• 5220f24: fix(media): surface the PTT flag on inbound audio in media.list (#308) (@phsb5321)
• e4b4e4c: fix(nix): match dev shell Go to go.mod (#350) (@phsb5321)
• 6a15696: fix(pair): refuse pairing on a wiped store instead of faking success (#323) (@phsb5321)
• 1cdb0ad: fix(rest): a send token may revoke for itself, not for everyone (#369) (@phsb5321)
• a7d5a7c: fix(safety): remove daily send caps (#360) (@phsb5321)
• 87d46e2: fix(security): bump Go 1.26.4->1.26.5 for reachable GO-2026-5856/-4970 (#287) (@phsb5321)
• d7abfc5: fix(send): harden mention validation per adversarial review (#293) (@phsb5321)
• c9ee486: fix(send): refuse with the canonical JID the server returned (#357) (@phsb5321)
• 8c262a4: fix(service): join bootstrap errors instead of discarding first (SF-06) (#332) (@phsb5321)
• 7f69c35: fix(socket): deliver event payload and FR-060 filter selectors (#297) (@phsb5321)
• 100eef8: fix(socket): replay buffered events on subscribe --since (FR-061) (#304) (@phsb5321)
• e98b1a4: fix(spec-guard): stop echoing untrusted paths into the Stop reason (#342) (@phsb5321)
• 0918dbd: fix(transcribe): upload .ogx CAS files as audio.ogg (#361) (@phsb5321)
• 2d7ecc1: fix(wad): map param errors to -32602, not -32603 (#299) (@phsb5321)
• f50ad7a: fix(wad): stamp a monotonic seq on every event (#300) (@phsb5321)
• 8166444: fix(warmup): stop re-pinning day 0 on every restart (#371) (@phsb5321)
• bc24f2d: fix(whatsmeow): persist stickers and pins, keep history variants (#298) (@phsb5321)
• 0324320: refactor(media): collapse duplicated write and handler prologues (#313) (@phsb5321)
• 9186e47: test(allowlist): first BDD slice for the default-deny brake (#339) (@phsb5321)
• 3710eb0: test(mcp): Streamable-HTTP conformance round-trip (spec 111 M2) (#328) (@phsb5321)
• 8b4f5a8: test(mcp): close pooled conns so Shutdown does not wait out its budget (#331) (@phsb5321)
• 8fa6cd4: test(poll): table-drive the three refuse-before-IO cases (#348) (@phsb5321)
• b3643c1: test(spec-guard): exercise the refusal path the live job never ran (#341) (@phsb5321)
• 0d0ae68: test(webhooks): pin Standard Webhooks 1.0 delivery headers (huly WA-3) (#329) (@phsb5321)