SendTraceScenario already swept framesPerGroup and recorded per-frame
send durations + arrival wall-times, but never correlated them — so it
could verify frame delivery but not the send-side latency a listener
perceives. Record each frame's send wall-clock timestamp and derive the
true send→arrival latency (time-to-first-frame + p50/p99/min/max) per
subscriber. With framesPerGroup > 1 this surfaces the batching window
(~framesPerGroup * cadence) as the latency floor.
Add framesPerGroup=10 and =50 (the production default) sweep entries to
both the prod and local-harness suites so the batching-vs-latency
tradeoff curve is visible in one run.
https://claude.ai/code/session_01PoQupfdoKU3ryQwLwTeXeM
pin "Add more…" button to bottom of populated favourites screen
group empty-state icon/headline/steps and add top breathing room
spread empty-state evenly and add numbered step prefixes
replace empty-state subtitle with 2-step instruction including inline star icon
hide explainer when favorite feeds exist and add "Add more…" button
Adds the v1.09.0 "We are going crazy" release notes, including the
last 2-3 weeks of work: Desktop multi-account, scheduled posts, LAN
video casting, thread muting, configurable home tabs, NIP-9A community
rules, the geode relay module, expanded QUIC RFC coverage and
quic-interop-runner results, moq-lite nestsClient, and the May fixes.
https://claude.ai/code/session_01PyGyMpa9XvTHrB4iqZX5oZ
An addressable event whose `a` tags reach itself — directly (self-mention)
or via any cycle of other in-cache events — would recurse unbounded
through `AddressHintProvider` / `EventHintProvider` branches and crash
with StackOverflowError on publish (`signAndComputeBroadcast` →
`computeRelayListToBroadcast`). The crash was reproducible on the device
when publishing a kind-1 note that referenced an article whose own event
carries a self `a` tag (e.g. YakiHonne-authored long-form posts include
their own naddr in their `a` tags).
Adds Czech, German, Brazilian Portuguese, and Swedish translations
for 19 new keys covering auto-create-drafts compose settings,
profile-UI section toggles, security-screen empty states and
section headers, external-resource comment scopes, and nest
host-action failure toasts.
On every re-subscribe (listener reconnect or publisher-cycle), the
moq-lite relay re-serves its cached latest group from the first frame.
The wrapper forwarded it straight into the decoder, so in a fully-muted
room the same old clip looped once per reconnect. Track the highest
group sequence delivered by prior subscriptions and drop any group not
strictly newer, mirroring kixelated/hang's Container.Consumer.#run.
https://claude.ai/code/session_01G9h2dzkEj6Y2F1Yr2kCojp
Move the detectDragGestures pointerInput from the whole button card to
the six-dot drag handle icon so drag-and-drop reordering activates only
when the user grabs the handle.
https://claude.ai/code/session_01Jyu8dLYN7MXVNaVZE3u2M9
Members were sorted to float the current speaker to the top, so a
member jumped to the front when they started talking and slid back
~250ms after they stopped — a constant shuffle in any active room.
The speaking state is already shown in-place via the mic badge and
audio-level ring, so keep members in their stable arrival order.
https://claude.ai/code/session_01GvvNS1FRn6gGvHRC7dgEtP
Convert the per-account `disableClientTag` toggle into a positive
`addClientTag` setting that defaults to enabled, and relocate it from the
Security Filters screen to the Compose Settings page.
https://claude.ai/code/session_01TkmBzzEz3kKnrjpbrKCpsf
The AppImage build inputs (AppRun, .desktop entry, icon, and the
CI-fetched linuxdeploy binary) are consumed only by desktopApp's
createReleaseAppImage task. Co-locating them under
desktopApp/packaging/appimage/ removes the `../` path escape from the
build script and keeps all desktop packaging assets inside the module.
https://claude.ai/code/session_0137ULcfJkASmfmffFBdW8ac
The bottom add-word text field sat behind the phone's navigation
and gesture bars. Apply the union of navigation bar and IME insets
to the bottom bar so it clears the system bars and rises with the
keyboard without a double-counted gap.
https://claude.ai/code/session_01KPkQbS9SYTigkkzYGU97Sz
Decision: keep the hand-rolled psbt/ + taproot/ consensus layer rather than
adopting fr.acinq.bitcoin-kmp. Rationale: a deliberately small single-key-path
P2TR subset, pinned to authoritative BIP-341/350 test vectors at every layer
(sighash, tweak, witness signature bytes, addresses, tx serialization), and
consistent with the project's minimal-dependency stance.
Recorded in amethyst/plans/2026-05-14-onchain-zaps.md with the consequence
spelled out (we own correctness; revisit if scope expands past single-key-path
P2TR). The psbt/ and taproot/ packages now carry a pointer back to that
decision so a future reader doesn't reflexively swap in a library.
Doc-comment + plan-doc only; no logic change.
The NIP-BC EsploraBackend was wired with a hardcoded mempool.space URL,
silently bypassing the user's Tor preference and ignoring the explorer
server they may have configured for OpenTimestamps.
- New BitcoinExplorerEndpoint: the single source of truth for the Bitcoin
explorer base URL, shared by OTS verification and onchain zaps. A
user-configured custom URL always wins; otherwise mempool.space when Tor
is active, blockstream.info when not.
- TorAwareOkHttpOtsResolverBuilder.getAPI now delegates to it (behaviour
unchanged for OTS).
- AppModules wires EsploraBackend through BitcoinExplorerEndpoint using the
same OTS server setting (otsPrefs) and the same money-flavoured Tor-aware
OkHttp client OTS uses — so onchain zaps honour Tor and the user's
explorer choice.
- Removed the dead AccountSettings.onchainEsploraEndpoint field and
DEFAULT_ESPLORA_ENDPOINT const: the OTS explorer setting is now the single
configuration point. The field was never persisted or read.
Adds BitcoinExplorerEndpointTest. amethyst compiles; the new test passes.
A Comment event (kind 1111) scoped to an external identifier (`I` tag)
previously rendered as a bare text post and landed in the Home "New
Threads" feed. Treat it as a reply to that external scope: it now shows
in the conversations feed and renders a typed chip (hashtag, geohash,
url, or generic) above the comment text.
https://claude.ai/code/session_01ArHkNXu1ANrVGZAyMWg4Xu
The big one: the source package was named `nipBCOnchainZaps/build/`, which
the repo .gitignore (`build/`) silently matched — so OnchainZapBuilder.kt
(the main source, not just its test) was NEVER committed. The pushed branch
did not compile; the pre-commit hook only checks the working tree, so this
went unnoticed. Renamed the package `build` -> `builder` (a source package
must never be named `build`) and updated all references; the recovered files
are now actually tracked.
Re-audit findings on the previous fix commit:
- CachingOnchainBackend.txCache was unbounded -> memory leak in a long
session. Added a bounded cache (maxCachedTxs, oldest-entry eviction).
- OnchainZapSender still trusted the signer's returned PSBT for witness
UTXOs and tap internal keys (used to compute the sighash + the verified
output keys). Now it copies ONLY the PSBT_IN_TAP_KEY_SIG records back onto
the PSBT we built, so a signer can contribute signatures and nothing else;
verification and finalization run entirely on our own PSBT.
Test coverage added:
- OnchainZapBuilderTest: confirmed-UTXO filter — unconfirmed UTXOs excluded
by default, spendable only with allowUnconfirmed, confirmed preferred.
- CachingOnchainBackendTest: confirmed-tx cached forever, unconfirmed
re-fetched after TTL, not-found never cached, tip/fee TTL, bounded
eviction.
All quartz / commons jvmTest suites pass; quartz android + amethyst compile.
CRITICAL
- PsbtSignatureVerifier: independently verifies every key-path signature in a
PSBT (BIP-340 sig over the BIP-341 sighash, against the tweaked output key).
- OnchainZapSender now rejects a signer that returns a different transaction
than it was asked to sign (byte-compares the unsigned tx) and verifies all
signatures before broadcasting — closes a substitution attack where a
malicious/buggy external signer could redirect funds.
HIGH — break test circularity
- Pin the full BIP-341 keyPathSpending input-0 witness: signing the vector
sighash with the vector tweaked key reproduces the vector signature
byte-for-byte (also pins BIP-340 nonce determinism).
- Pin TaprootAddress.fromPubKey + SegwitAddress.encodeP2TR against all seven
BIP-341 wallet-test-vector P2TR mainnet addresses.
- EsploraBackendTest: JSON-parsing coverage for /tx, /address/{}/utxo, the
mempool.space and blockstream fee formats, and schema-fallback.
MEDIUM
- OnchainZapBuilder filters to confirmed UTXOs by default (allowUnconfirmed
opt-in) and signals BIP-125 RBF (nSequence 0xFFFFFFFD).
- CachingOnchainBackend: TTL-caching decorator (confirmed tx forever,
unconfirmed/tip/fees short TTL) so a feed of onchain zaps doesn't fan out
into one HTTP request per event. Wired in AppModules.
- OnchainZapVerifier computes real confirmation depth from the chain tip and
asserts the backend echoed the requested txid.
- EsploraBackend falls back to the standard Esplora /fee-estimates endpoint
(blockstream.info) when /v1/fees/recommended 404s.
LOW
- BitcoinTransaction.parse caps input/output/witness-item counts to stop a
hostile varint from triggering a giant pre-allocation.
- OnchainZapEventTest: asserts kind:8333 on-the-wire tag structure against the
NIP-BC spec.
- alt tag now includes the amount ("Onchain zap: N sats"), matching the spec
example.
All quartz / commons / androidHostTest suites pass; amethyst compiles.
ScheduledPostsScreen used a plain Scaffold with no bottom bar and an
unconditional back arrow, so a user who pinned it to the bottom nav got
a back arrow and no bottom bar instead of the standard tab-root shell.
Add AppBottomBar(Route.ScheduledPosts) and gate the back arrow on
nav.canPop(), matching every other bottom-nav-eligible screen: back
arrow + no bottom bar when entered from the drawer, no back arrow +
bottom bar when entered from the bottom nav.
https://claude.ai/code/session_01WZXxqCGYT4JEQBwwBNiUjm
Claude