Chatlet becomes Lowfire, and calls survive network changes

The app is renamed from Chatlet to Lowfire. Calls and connections recover by themselves after waking or a network change, and the sidebar adapts to narrow windows and can be resized.

Also new

• One column at a time in compact layouts. Very narrow layouts showed the list, conversation or Details one at a time, with a shared Back action. This was the compact layout for small screens, before an iPhone bridge existed.
• Dates stay visible while scrolling. The current day label stayed pinned beneath the header while scrolling the transcript, then gave way to the next day’s label. Screen readers received the day dividers in the correct reading order.
• Checked channel-history handover. Members could hand encrypted, signed channel history to a newcomer, whose client checked it before importing. The first handover did not yet request older pages, recover files whose server copies were gone or reuse pages.
• Warnings for missing or inconsistent messages. Messages carried authenticated records of their order and of what their senders had seen, and receivers checked them. The transcript could show missing-message rows or warn when people had received inconsistent message histories. It cannot detect every message the server withholds.
• A documented server administration interface. The first versioned operator interface covered per-organisation limits and organisation state. Its responses were documented and checked as an explicit server-administration contract.

Fixed

• Reconnect after waking or changing networks. The client responded immediately when the system reported waking or a network change. It no longer waited for the old connection’s ordinary timeout before checking and reconnecting.
• Calls recover their network path. Calls renewed their signalling connection and shared their new reachable addresses when a network changed. Relay credentials were refreshed before expiry and retried after refusal, allowing a long call to recover its relay path.
• Conversation names get priority. The conversation name kept its space ahead of the member count and call indicator. An encryption lock button replaced the wider encryption pill, leaving more room for the title.
• Cancel buttons close their own sheets. Cancel and close buttons on interaction sheets used the sheet’s own authority to cancel. They no longer produced an unavailable-request error and left the sheet open when Escape would have worked.
• Toggle buttons report their state. Plugin buttons attached to a toggle command could report whether it was on or off. This also allowed controls such as Details to reflect their open state.
• Mac launches behave normally. Launching from Finder or the Dock brought the application forward again after a background-launch change had left it behind other windows. Hidden automated launches retained their separate handling, and ordinary runs regained the Dock badge and local notifications.
• Deleted imported text leaves search. When deleted messages were imported with history, their old words were removed from the local search index. Searching no longer found that deleted text through the import path.
• Offline members can rejoin later. A device removed while offline could return to an organisation through a later invite. It no longer remained trapped by its old membership state.
• Channel joins wait for the complete catch-up. After connecting or filling a message gap, a channel waited until the directory’s catch-up was complete before adding waiting people. Requests in the same fetched response could be handled together instead of being split into avoidable membership changes.
• Permissions stay correct after interrupted changes. Cached posting permissions were repaired after interrupted membership merges or failed storage writes. The conversation’s permission display and underlying encrypted-group policy stayed together instead of committing one without the other.
• Queued membership actions recheck the rules. Before signing an add or removal, the client checked the current conversation policy again. A change queued before a catch-up could no longer go out under permissions that had since changed.
• Direct conversations validate who belongs. Authenticated member lists for direct conversations gained stricter validation. A direct conversation could not silently accept a membership shape inconsistent with the two-person conversation.
• Device identity remains fixed during key updates. An encrypted-group key update could rotate encryption material while preserving the existing device certificate and signing key. An update that changed the device’s authenticated identity was refused.
• Exact identities in device and server messages. Device-log credentials were compared in full, and account identifiers received from the server had to be read exactly rather than shortened at an embedded terminator. Organisation-log entries were held to the same account-validity rules clients required.
• Invalid messages do not block genuine ones. A forged or damaged message could be rejected without advancing the receiver’s stored decryption state. A later genuine copy therefore remained readable, with successful messages retaining replay protection.
• Recovery-kit replacement takes effect before cleanup. Replacing a recovery kit disabled the previous kit before attempting backup cleanup. Cleanup failure could no longer leave the old kit usable during the replacement.
• Recovery uses the kit’s original derivation. A server refusal could no longer alter how a recovery kit derived its keys. Restore kept the key derivation determined by the kit.
• Disabled accounts stop before cleanup. Disabling an account took effect before cleanup that might fail. The application could not continue using the account simply because deleting related data did not finish.
• Organisation removal survives failures. Organisation-removal restrictions were stored and retried across interrupted work. They also reached conversations whose server registration had failed, so those partial conversations could not escape removal.
• Erase secrets throughout buffer changes. Secret erasure was strengthened so the compiler could not optimise it away, including when buffers grew. Invite links and codes were also cleared when their useful lifetime ended.
• Unexpected random-source failures stop safely. Random-byte generation retried only interrupted calls. Other failures stopped with a clear error instead of looping indefinitely.
• Photo-detail removal covers more formats. Remove Photo Details was enforced for TIFF, GIF and BMP attachments as well as the existing image paths. Those formats no longer bypassed the selected privacy preference.
• Private temporary screenshots. Scripted screenshots were written to private, managed temporary files. This tightened the handling of captures that may contain conversation content.
• Address-based server limits use the real address. Per-address request limits stopped sharing one common bucket for different clients. IPv6 addresses were grouped by their network prefix, so rotating addresses within that range did not receive a fresh allowance each time.
• Admission is checked before server lookup. The server reserved request admission before looking up the target server object. This moved the limit check ahead of work the limit was intended to bound.
• Transferred history checks message order too. The same message-order records were checked when importing handed-over history. History transfer no longer bypassed the order checks used for live messages.
• Repair a broken catalogue-key chain. A device cut off by a bad catalogue-key change could arrange a repair and identify the device that signed the break. Administrators gained records of these breaks and affected conversations could explain repeated or local problems.