October 5, 2026

• Several servers in one application

  The organisation rail and account settings could work across accounts on several servers. Connection notices and account removal identified the relevant server, and the shared plugin interface gained account-aware access.

• Link and recover all accounts together

  Device linking and the recovery kit were extended across the profile’s accounts. Settings grouped devices by account, and link, kit and restore sheets explained what happened to each account.

• Setup and recovery adopt the new design

  Account setup and recovery sheets adopted the flatter interface styling, including the recovery-kit presentation.

• Clear recovery when local history cannot open

  The application distinguished a locked keychain, missing key, damaged history, busy profile, newer database and disk problem in plain language. Where history was unreadable, it offered linking or recovery-kit restore and could set the old copy aside without deleting it.

• A new kit after device revocation

  Revoking a device offered creation of a new recovery kit. This made renewing recovery access part of the device-removal flow.

• Direct conversations appear in shared organisations

  A direct conversation appeared under every organisation shared with the other person. It no longer disappeared from one shared workplace simply because it had been associated with another.

• More private notification defaults

  New and unreadable preferences defaulted to showing only the sender in local notifications. An explicit choice to show message text was preserved.

• Native Mac popup menus

  Popup menus used the Mac’s own menu presentation, with real cascading submenus. The application’s own menu renderer also gained cascading submenus for environments that use it.

• An explicit large-group limit

  Client and server imposed a limit of 10,000 devices per group. This was a safety limit, not a claim that every large-organisation performance goal had been achieved.

• Server policy for limits and suspension

  Server operators gained organisation membership limits and suspension policy. The server could also be imported as a reusable implementation for another deployment.

• Understand a full or suspended organisation

  Joining a full organisation explained that it was full and that the invite could work later. A suspended organisation showed the operator’s cleaned plain-text explanation and an optional link, while avoiding endless automatic retries.

• Clients verify organisation membership

  Clients checked signed organisation-membership changes and invite grants instead of trusting the server’s member list. Joining, inviting, leaving and changing administrators used that checked log, closing the route by which a server alone could introduce an organisation member.

• Explain an inconsistent organisation roster

  If the server showed conflicting membership records or a change the client could not verify, the client stopped following those member changes. A calm sidebar or conversation notice explained the problem while existing conversations continued.

• Account switching keeps the interface consistent

  After switching organisations, the footer, connection banner and organisation rail now agreed on the selected account. A server-supplied account host was also checked consistently when adding or forgetting an account.

• Device links work for another ready account

  Opening a device link could find any ready account on its server, even if another selected account was unavailable. Recovery-kit links were refused when an existing ready account made that restore path inappropriate.

• Replacing the only account keeps chat open

  Replacing a profile’s sole account no longer briefly returned the application to account setup. The shared chat experience stayed active through the replacement.

• Local history opens without blocking the window

  Looking up the encrypted history’s key moved off the interactive event loop. Setup, linking and restore waited for usable local storage, while cancelling discarded the pending key result safely and retry kept using the original key.

• Paste the whole recovery kit

  Restore accepted a complete pasted recovery kit rather than requiring a specially extracted portion. Restore wording also handled a single message correctly and identified the backup’s server.

• New Conversation works while composing

  Command-N and other application shortcuts reached their commands while the composer had focus. Text editing and input-method composition retained their own keyboard handling.

• Copy the text you actually chose

  Copy in a sheet used that sheet’s text, and Copy Text from a message’s context menu used the message the menu belonged to. A “Copied” notice appeared only when copying succeeded.

• Scrolling content clears the scrollbar

  Scrollable panels reserved room for the scrollbar. Text and controls no longer sat underneath it.

• Cancelling a menu does not become input

  Closing a native popup without choosing an item no longer produced an input action. A selection from a menu that had changed meanwhile was ignored safely.

• Complete first frames on navigation

  The first switch to a conversation or opening of Settings no longer displayed an incomplete frame.

• Fresh text for each toast

  A new toast’s status label no longer retained bytes from the previous toast. This prevented stale text appearing in a later notice.

• Long drafts wrap with less repeated work

  Very long text without spaces stopped triggering repeated rescans during wrapping. Character measurements were reused for the selected font settings, reducing repeated text-layout work.

• Less work in interface styling

  The interface stopped repeatedly checking the same inherited style matches and retained only the final style rules it needed. This reduced styling work and retained data without changing the intended appearance.

• Smaller picture-preview memory peaks

  PNG thumbnails could be built without holding a full-size decoded picture, and JPEG thumbnails used smaller temporary row buffers. Received pictures also avoided duplicate decoded-pixel copies.

• Staged previews release temporary memory

  Reading a staged attachment avoided a full extra database copy. Large preview scratch space was released promptly after decoding, with failure paths clearing incomplete output.

• Safer first-use texture uploads

  The Mac renderer changed how a new graphics texture was initialised before first use. The change addressed upload allocation behaviour; the standalone measurements did not by themselves establish an overall application memory saving.

• Idle encrypted groups can be released

  Inactive encrypted-group state could leave memory and be loaded again when needed. Large-group work also reduced how much state the open conversation needed to retain.

• Larger groups join more efficiently

  Group welcome information no longer carried the whole group tree inside each welcome message. Joins were batched and the tree filled more compactly so group membership changes stayed smaller.

• Less repeated organisation and profile traffic

  Organisation membership updates could carry just what changed. Adding people stopped resending every name, and a batch of joins no longer required one profile announcement per existing member.

• A late leave cannot undo a rejoin

  If an old leave notification arrived after someone had rejoined, the server kept the current conversation membership. The late event no longer removed the inbox’s record of that conversation.

• Bounded server work for busy accounts

  Message acknowledgements took a fixed amount of work, and initial synchronisation limited welcome data by its total size. Membership-change replies also stopped waiting for unrelated follow-on work.

• Explicit refusals for oversized requests

  An oversized live-connection frame received an explicit refusal. Server database operations were also kept within the hosting service’s statement limits, avoiding failures for larger requests.

• Delivery goes through shared gateways

  Live connections moved behind delivery gateways, with grouped notifications and acknowledgements instead of repeating work for each socket. Offline signals were limited to devices that were behind, and acknowledgement batches used a more compact transfer.

• Gateway notifications reach the right account

  When a gateway held connections for multiple accounts, a conversation update reached only the connected account that belonged to it. This corrected account selection inside the delivery path.

• A refused account has a clear way out

  When a server refused an existing account, the application explained the situation and offered a way forward. It no longer left the person at an unexplained connection failure.

• Restore explains version mismatches

  Restore checked client and server compatibility before continuing and explained when either side was too old. The protocol’s minimum-version rule was documented so incompatible older clients could receive that explanation.

• A completed file send clears its staged copy

  Shared send handling waited for the staged attachment’s deletion to be saved before treating that cleanup as complete. Failed sends stayed readable in the composer model, while expired error notices no longer rearmed idle frames.

Designs, contracts and foundations are work in progress; they do not by themselves mean a finished feature is available.

• Broadcast-channel posting rules

  Broadcast-channel foundations defined who may post, with every member checking the rule and commands to manage it. This was the posting-policy layer; the day’s change did not itself complete every broadcast-channel interface.

• History sharing for channel newcomers

  The design for handing channel history to newcomers was accepted, and channel messages gained content signatures for checked history transfer. A channel history-sharing policy and its switch were added, while the actual handover and import still followed later.

• A signed organisation membership record

  A new design replaced the all-member encrypted directory with a signed membership log and encrypted catalogue. The server log and client verification were built, while the encrypted catalogue records remained in progress.

• More flexible encrypted-group roles

  The accepted design separated membership from permission to change an encrypted group. Shared permission checks, roster access and message fields began that work, leaving the larger limited-role member design unfinished.

• Encryption tools for the future catalogue

  The encryption layer gained a way to seal material directly to another device, with measurements for rotating a catalogue key. These were building blocks for the new organisation catalogue rather than its completed user experience.

• Messages that race a membership change

  An accepted design proposed a short window for reading messages sent just before an encrypted group changed keys. The retry rule was refined, but retaining those past keys was still design work on this date.

• Typing indicators and private presence

  Designs were accepted for short-lived messages that are never stored and for encrypted organisation presence. The server gained a one-time delivery path, and platform services gained idle, lock, sleep and time-zone facts; visible typing and presence were not completed by those foundations.

• Shared actions for more than one interface

  Messages, files, calls, setup, channels and settings gained common workflows that could be presented by different interfaces. Confirmations and forms kept the original caller and account context through asynchronous work; a finished terminal client was still separate work.

• Release updates gain their public keys

  The application was configured with primary and spare public release keys and the planned update-feed address. Only numbered distribution builds would check it, and the feed host still awaited the first release.

• Architecture before the next expansion

  The roadmap recorded the owner’s decisions on larger organisations, roles, presence, history and the next chat features. It kept the distinction between accepted designs and implemented behaviour explicit.