Lowfire
RSS

Changelog

Monday

Accounts on several servers, linked and recovered together

One app now holds accounts on several servers, and device linking and the recovery kit cover them all. If local history can’t open, the app says why and offers linking or a kit restore.

Lowfire on the Mac, light: Settings with two accounts on different servers and their linked devices.Lowfire on the Mac, dark: Settings with two accounts on different servers and their linked devices.
Accounts and devices on the Mac.
New

Several servers in one application

The organisation rail and account settings could work across accounts on several servers. Connection notices and account removal identified the relevant server, and the shared plugin interface gained account-aware access.

New

Setup and recovery adopt the new design

Account setup and recovery sheets adopted the flatter interface styling, including the recovery-kit presentation.

Also new

  • Clear recovery when local history cannot open. The application distinguished a locked keychain, missing key, damaged history, busy profile, newer database and disk problem in plain language. Where history was unreadable, it offered linking or recovery-kit restore and could set the old copy aside without deleting it.
  • A new kit after device revocation. Revoking a device offered creation of a new recovery kit. This made renewing recovery access part of the device-removal flow.
  • Direct conversations appear in shared organisations. A direct conversation appeared under every organisation shared with the other person. It no longer disappeared from one shared workplace simply because it had been associated with another.
  • More private notification defaults. New and unreadable preferences defaulted to showing only the sender in local notifications. An explicit choice to show message text was preserved.
  • Native Mac popup menus. Popup menus used the Mac’s own menu presentation, with real cascading submenus. The application’s own menu renderer also gained cascading submenus for environments that use it.
  • An explicit large-group limit. Client and server imposed a safety limit of 10,000 devices per group.
  • Server policy for limits and suspension. Server operators gained organisation membership limits and suspension policy. The server could also be imported as a reusable implementation for another deployment.
  • Understand a full or suspended organisation. Joining a full organisation explained that it was full and that the invite could work later. A suspended organisation showed the operator’s cleaned plain-text explanation and an optional link, while avoiding endless automatic retries.
  • Clients verify organisation membership. Clients checked signed organisation-membership changes and invite grants instead of trusting the server’s member list. Joining, inviting, leaving and changing administrators used that checked log, closing the route by which a server alone could introduce an organisation member.
  • Explain an inconsistent organisation roster. If the server showed conflicting membership records or a change the client could not verify, the client stopped following those member changes. A calm sidebar or conversation notice explained the problem while existing conversations continued.

Fixed

  • Account switching keeps the interface consistent. After switching organisations, the footer, connection banner and organisation rail now agreed on the selected account. A server-supplied account host was also checked consistently when adding or forgetting an account.
  • Replacing the only account keeps chat open. Replacing a profile’s sole account no longer briefly returned the application to account setup. The shared chat experience stayed active through the replacement.
  • Local history opens without blocking the window. Looking up the encrypted history’s key moved off the interactive event loop. Setup, linking and restore waited for usable local storage, while cancelling discarded the pending key result safely and retry kept using the original key.
  • Paste the whole recovery kit. Restore accepted a complete pasted recovery kit rather than requiring a specially extracted portion. Restore wording also handled a single message correctly and identified the backup’s server.
  • New Conversation works while composing. Command-N and other application shortcuts reached their commands while the composer had focus. Text editing and input-method composition retained their own keyboard handling.
  • Copy the text you actually chose. Copy in a sheet used that sheet’s text, and Copy Text from a message’s context menu used the message the menu belonged to. A “Copied” notice appeared only when copying succeeded.
  • Scrolling content clears the scrollbar. Scrollable panels reserved room for the scrollbar. Text and controls no longer sat underneath it.
  • Cancelling a menu does not become input. Closing a native popup without choosing an item no longer produced an input action. A selection from a menu that had changed meanwhile was ignored safely.
  • Complete first frames on navigation. The first switch to a conversation or opening of Settings no longer displayed an incomplete frame.
  • Fresh text for each toast. A new toast’s status label no longer retained bytes from the previous toast. This prevented stale text appearing in a later notice.
  • Long drafts wrap with less repeated work. Very long text without spaces stopped triggering repeated rescans during wrapping. Character measurements were reused for the selected font settings, reducing repeated text-layout work.
  • Less work in interface styling. The interface stopped repeatedly checking the same inherited style matches and retained only the final style rules it needed. This reduced styling work and retained data without changing the intended appearance.
  • Smaller picture-preview memory peaks. PNG thumbnails could be built without holding a full-size decoded picture, and JPEG thumbnails used smaller temporary row buffers. Received pictures also avoided duplicate decoded-pixel copies.
  • Staged previews release temporary memory. Reading a staged attachment avoided a full extra database copy. Large preview scratch space was released promptly after decoding, with failure paths clearing incomplete output.
  • Safer first-use texture uploads. The Mac renderer changed how a new graphics texture was initialised before first use. The change addressed how uploads allocate memory.
  • Idle encrypted groups can be released. Inactive encrypted-group state could leave memory and be loaded again when needed. Large-group work also reduced how much state the open conversation needed to retain.
  • Larger groups join more efficiently. Group welcome information no longer carried the whole group tree inside each welcome message. Joins were batched and the tree filled more compactly so group membership changes stayed smaller.
  • Less repeated organisation and profile traffic. Organisation membership updates could carry just what changed. Adding people stopped resending every name, and a batch of joins no longer required one profile announcement per existing member.
  • A late leave cannot undo a rejoin. If an old leave notification arrived after someone had rejoined, the server kept the current conversation membership. The late event no longer removed the inbox’s record of that conversation.
  • Bounded server work for busy accounts. Message acknowledgements took a fixed amount of work, and initial synchronisation limited welcome data by its total size. Membership-change replies also stopped waiting for unrelated follow-on work.
  • Explicit refusals for oversized requests. An oversized live-connection frame received an explicit refusal. Server database operations were also kept within the hosting service’s statement limits, avoiding failures for larger requests.
  • Delivery goes through shared gateways. Live connections moved behind delivery gateways, with grouped notifications and acknowledgements instead of repeating work for each socket. Offline signals were limited to devices that were behind, and acknowledgement batches used a more compact transfer.
  • Gateway notifications reach the right account. When a gateway held connections for multiple accounts, a conversation update reached only the connected account that belonged to it. This corrected account selection inside the delivery path.
  • A refused account has a clear way out. When a server refused an existing account, the application explained the situation and offered a way forward. It no longer left the person at an unexplained connection failure.
  • Restore explains version mismatches. Restore checked client and server compatibility before continuing and explained when either side was too old. The protocol’s minimum-version rule was documented so incompatible older clients could receive that explanation.
  • A completed file send clears its staged copy. Shared send handling waited for the staged attachment’s deletion to be saved before treating that cleanup as complete. Failed sends stayed readable in the composer model, while expired error notices no longer rearmed idle frames.
In the works 10 changes · designs and groundwork
  • Broadcast-channel posting rules. Broadcast channels gained a rule for who may post, checked by every member, and commands to manage it.
  • History sharing for channel newcomers. The design for handing channel history to newcomers was accepted, and channel messages gained content signatures for checked history transfer. A channel history-sharing policy and its switch were added.
  • A signed organisation membership record. A new design replaced the all-member encrypted directory with a signed membership log and encrypted catalogue. The server log and client verification were built.
  • More flexible encrypted-group roles. The accepted design separated membership from permission to change an encrypted group. Shared permission checks, roster access and message fields were the first part of that work, ahead of the larger limited-role member design.
  • Encryption tools for the future catalogue. The encryption layer gained a way to seal material directly to another device, with measurements for rotating a catalogue key. These were building blocks for the new organisation catalogue.
  • Messages that race a membership change. An accepted design proposed a short window, by keeping past keys, for reading messages sent just before an encrypted group changed keys. The retry rule was refined.
  • Typing indicators and private presence. Designs were accepted for short-lived messages that are never stored and for encrypted organisation presence. The server gained a one-time delivery path, and platform services gained idle, lock, sleep and time-zone facts.
  • Shared actions for more than one interface. Messages, files, calls, setup, channels and settings gained common workflows that could be presented by different interfaces. Confirmations and forms kept the original caller and account context through asynchronous work.
  • Release updates gain their public keys. The application was configured with primary and spare public release keys and the planned update-feed address. Only numbered distribution builds would check it, and the feed host still awaited the first release.
  • Decisions on larger organisations, roles and presence. The roadmap recorded the owner’s decisions on larger organisations, roles, presence, history and the next chat features.
Under the hood 10 changes · tests, tools and the server
  • Research into graphics memory and launch peaks. Graphics-allocation experiments and phase-by-phase measurements were recorded, including rejected approaches. What makes up large-window idle memory and the launch peak was still unexplained.
  • Large-organisation and delivery research. A load harness and research examined larger encrypted channels, and a temporary server benchmark measured gateway behaviour.
  • Safer automated development runs. Development clients were prevented from accidentally opening the owner’s real profile. Verification also covered linking and restore waiting states through real clients on two servers.
  • Self-hosting and continuous checks. Deployment tools supported a second isolated server deployment and rejected configuration drift or reused deployment identities. Automated server and Linux-build checks were set up alongside that work.
  • Deterministic checks and shared results. The check process was split between repeatable correctness checks and longer measurements. Unchanged inputs could reuse recorded results, test compilation was reused, and long runs shared machine slots to reduce duplicate work.
  • More dependable test conditions. Server and interface checks waited for the state they needed instead of fixed delays, and graphical checks shared applications more efficiently. Linux capture scaling, setup geometry, native text and link fixtures, and temporary-profile attachment checks were corrected.
  • Memory-safety and encryption regression checks. An uninitialised test command was fixed, and memory-safety builds filled local variables with a known pattern to expose similar mistakes. Encryption tests gained stronger stored-record checks and stopped reporting a stale load error when an unrelated write-size threshold failed.
  • Startup and memory observations under load. The startup probe accounted for stale Mac application registrations and the machine’s own launch cost. Memory observations waited for the footprint’s settling behaviour instead of accepting the first brief flat interval.
  • Less repeated build work. New development checkouts could reuse the main checkout’s existing encryption-library build output, so dependencies were compiled less often.
  • Clearer roles for coordinating the work. Coordinator, worker and landing roles were made explicit, with grouped landings and clearer failure handling. Documentation-only changes gained focused checks, and stale manual-test notes and an accidentally committed check log were removed.