Patch Notes

• •NEW: 24-Hour Wilting Stories — share ephemeral photo, pixel art, and cybernetic text stories that automatically self-destruct after 24 hours. Stories update live over WebSocket and feature floating interactive reactions with author theme palette reproduction.
• •NEW: Zero-Knowledge Contact Keying — every story is protected with an ephemeral 256-bit AES key individually wrapped and delivered only to mutual contacts via metadata keys. The relay server cannot decrypt stories or media, and stories consume zero finite OTP pad bytes.
• •NEW: Interactive Story Canvas & WebP Flattening — place multiple styled text tags anywhere on top of photos or pixel art creations, which are automatically flattened and burned into a crisp, unified WebP visual.
• •NEW: Onboarding Privacy Modes — choose between “WiltKey Social Account” (server-assisted 24h stories and discovery with user-revocable identity key) and “Zero Server Data Mode” (absolute anonymity with zero server registration).
• •NEW: In-Chat Pixel Art & Avatar Sending — draw pixel art on the fly or send from saved avatar templates directly into 1:1 and group chats with one tap from the redesigned attachment sheet.
• •NEW: In-Chat Local Message Search — fast, local plaintext search across conversations with hit counting and previous/next navigation accessible from the 3-dot menu.
• •NEW: Private Notes & Custom Nicknames — add local-only private notes and override display names on contacts, persisted securely in SQLite.
• •Chronological File Downloads & BLE Stability — downloaded media now seamlessly replaces download placeholders in their original chronological position; Bluetooth BLE pairing handshake hardened against GATT MTU drops.

• •NEW: Instant QR Connect — connect remotely with a scan or short PIN. Remote connections automatically establish a 7-day Time Wilt stream cipher chat. In-person BLE pairing remains strictly required for OTP pad recharging to protect physical trust.
• •NEW: Media, Voice Notes & Links Gallery — browse shared photos, voice notes, and links per chat in a dedicated gallery with instant shimmer skeleton loading and decoupled async queries.
• •NEW: Message History Retention & Pruning — manage local storage by setting global retention limits (keep last 100–1000 messages) or prune chat history on demand while preserving encryption keys.
• •NEW: Client Integrity Verification — verified official Google Play Store builds receive a Shield badge (Golden Shield for Plus supporters), while community/custom builds display an Open Source tinkerer badge.
• •NEW: Modern Base Emojis — enriched status and reaction emoji sets with modern classics including Moai (“🗿”), melting face (“🫠”), salute (“🫡”), boba (“🧋”), and hundreds more.
• •Direct GitHub Release Checking — automated update notifications for FOSS builds directly through GitHub Releases API with automatic server release filtering.
• •Voice Player & Metadata Sync Fixes — resolved voice message duration initialization in media tabs and ensured bidirectional handshake profile exchange on initial QR connect.

• •NEW: @Mentions & Shortcode Autocomplete — type “@” in group chats to search members by username; automatically autocompletes to their verified “@SHORTCODE” and highlights the mention for the recipient.
• •NEW: Granular Notifications & Chat Muting — configure per-chat alert modes (“All messages”, “Mentions & replies only”, “Mute”) and customize global categories (Direct messages, Group messages, Security events) while preserving zero-knowledge FCM privacy.
• •NEW: Mentions & Activity Feed — incoming mentions, replies, and security events now log directly to the Dashboard Events feed with instant deep-linking into the conversation.
• •NEW: Hands-Free Voice Recording & Dynamic Duration — slide up on the mic to lock hands-free recording with dedicated send/cancel buttons; recording length dynamically calculates against available byte budget and relay capacity with automatic over-run protection.
• •Smart 1:1 Sync & Clean Gap Auditing — 1:1 chats now intelligently verify missing message ranges and record clean points, eliminating persistent “sync problem” warning icons after refunded or abandoned messages.
• •Byte-Budget Message Edit & Delete Fix — resolved false “out of budget” warnings when editing or deleting messages in finite byte-budget chats.

• •NEW: Contacts & Profiles — add friends to your contact list to view their status messages, avatar borders, and theme backdrops with instant synchronization.
• •NEW: Emergency Chats — start an on-demand Time Wilt chat when you need to contact someone whose pad is depleted.
• •NEW: Jump to Replied Message — tap any reply quote preview in chat to instantly scroll to and highlight the original message.
• •NEW: Avatar Templates — save up to 10 custom pixel art creations in the avatar editor and easily switch between them in Settings.
• •NEW: Message Editing & Deletion — edit or delete your sent messages securely without reusing one-time pad keystream material.
• •NEW: Markdown & Link Warnings — format chat messages with bold, italics, strikethrough, headers, and code, plus a safety prompt before opening external links.
• •Smarter Group Chat Auto-Sync — automatic gap detection checks for missing messages across member lanes on chat open and requests them from active members.
• •Voice Notes in Time Wilt Chats — fixed voice recordings failing to send in Time Wilt chats due to storage budget checks.
• •UI & Avatar Editor Improvements — fixed drawing canvas scrolling conflicts, added a dedicated palette switcher modal, and improved avatar corner alignment with borders.

• •NEW: Time Wilt groups — temporary group chats with a time limit and no storage budget limit to worry about during the life of the chat. The casual counterpart to byte-budget groups (unlimited time, limited budget for long-term/high-security use), designed for events, meetups, and short-lived teams. Create them from the Connect tab → “Time Wilt group.”
• •In-person countdown & renewal — each member's timer starts when they meet the host in person over BLE. When a member's timer expires, the group becomes read-only for that member until they meet the host again in person to renew their time. The host has no countdown; the group goes quiet once every member has wilted, and meeting anyone revives it.
• •NEW: Democratic group vote-to-nuke — destroying a group “for everyone” is now a group vote. Any member can propose destruction, and a majority of the other members must agree before the group is wiped for all participants.
• •Faster group messages — group messages (especially photos) now send once and are delivered to every member by the blind relay, instead of the sender uploading a separate copy for each member. This means faster sending and significantly less mobile data used on the sender's side, while maintaining full relay blindness.
• •Fixed re-joining a group whose time had run out.
• •Fixed Time Wilt groups sometimes showing storage/byte info instead of the remaining-time countdown.

• •Faster photo-heavy chats — conversations packed with images now open instantly. Photos load one at a time as they scroll into view (and stay unloaded off-screen) instead of the whole history decoding at once.
• •Steadier layout — images take a consistent thumbnail size and no longer make the chat jump around as they load. Tap any one for the full-screen zoom view.
• •Reliable large-photo delivery — fixed a case where a big photo sometimes wouldn't appear until you sent another message or hit sync; it now shows up on its own.
• •Cleaner hand-off right after downloading a photo — no more brief flicker before the image appears.
• •The image send dialog now leads with the actual payload size (what's charged against your pad budget), so it's clear when a large photo would exceed a free account's limit.

• •NEW: On-demand file downloads — photos and voice recordings are now downloaded on tap with a progress bar instead of auto-loading. The relay holds your file until your device confirms it saved, so interrupted downloads retry cleanly.
• •NEW: Uncompressed image option — send original full-resolution photo bytes untouched with the new top setting on the image compression slider.
• •NEW: Tier-aware file size caps — pre-send size validation enforces 5 MB for free accounts and 50 MB for WiltKey Plus subscribers with direct upgrade prompts.
• •Large-image stability fix — large message bodies now automatically store as local sidecar files, fixing chat loading issues on image-heavy histories.

• •NEW: Premium themes — added Phosphor (arcade CRT glow) and Tideline (calming water theme), complete with live previews across all builds.
• •NEW: Animated avatar borders — dynamic animated frames (orbit, aurora) alongside classic static borders.

• •PIN keypads now register input instantly on press-down for snappier unlocking.
• •Configurable fingerprint security idle slider in Security settings (1–24 hours, or off) replacing the fixed 4-hour window.

• •Fixed an issue where chat history appeared empty after nuking and re-pairing with a contact.
• •Corrected keystream borrowing accounting when lending keystream material to a peer.

• •NEW: Avatar borders — dress up your pixel avatar with a frame. The Tinfoil Hat is free for everyone (and the only one on the GitHub/website build); your border shows up for the people you chat with, in one-on-ones and group chats alike.
• •NEW: Shop — a tabbed store for optional extras: colour-palette packs for the pixel-art editor, avatar borders, larger pad sizes at pairing, and the WiltKey Plus subscription. Cosmetics are purely local and never touch your chats.
• •NEW: WiltKey Plus — an optional subscription that keeps your offline messages waiting on the relay for 72 hours instead of 24, and raises your file-transfer limit from 5 MB to 50 MB.
• •Larger pad options at pairing, and a heads-up if there isn't enough free space on your device before you generate a big pad.
• •The GitHub/website (FOSS) build stays completely purchase-free and Google-free — palettes and larger pads are simply unlocked there.

• •NEW: Swipe to reply — swipe any message to quote it, with the original shown above your response so threads stay easy to follow.
• •Group chats now derive their keystream on demand instead of storing a full pad on disk — the same security, a much smaller footprint, and room for bigger groups.
• •One-on-one chats now retire spent sections of their pad as you go, so used-up key material doesn't linger on the device.

• •NEW: Wilting messages — send text that quietly disappears. Hold the send button to choose how long it lives (1–60 seconds); it wilts away shortly after the other person opens it. The countdown even survives closing the app.
• •NEW: Wilting photos — the same disappearing option for images, right in the send dialog.
• •Screenshot requests now leave a record: when someone asks to capture the chat, you get an in-conversation Accept / Decline that expires on its own — so you'll see it even if you were offline when they asked.

• •NEW: Photo sharing with a tap-to-zoom viewer — pan and zoom any image full-screen. Senders can optionally allow saving, and you choose the file format when you download.
• •NEW: In-app camera — snap and send a photo without leaving the chat.
• •NEW: Message reactions — react to any message with an emoji, including your own custom ones.
• •NEW: Consensual screenshots — capture a chat only when the other side agrees (one-on-one, or a group majority), without ever weakening the screenshot block.
• •Richer pixel-art emojis — the editor now supports up to 256 colours and new palettes.
• •Extra privacy hardening: the screenshot & screen-recording block is back on, plus new protection against tap-hijacking overlays and a heads-up if an untrusted accessibility service is watching the screen.
• •Fixed the pre-send image size estimate, which used to wildly over-report how large a photo would be.

• •NEW: Voice messages — hold the mic to record, and tap it first to pick the quality, from crisp all the way down to charmingly crunchy lo-fi. Each theme even plays them back with its own style.
• •NEW: Optional real-time push on the Play Store build — get notified the instant a message arrives without keeping a constant background connection. The wake-up is content-free: no message data ever passes through Google. The GitHub/website build stays 100% Google-free and uses its own on-device methods.
• •NEW: When a message arrives while you're using the app but not in that chat, a tappable banner now slides in — so you won't miss messages across busy conversations.
• •Fixed a loading spinner that could get stuck on the dashboard after finishing onboarding.
• •Tapping a message notification now reliably opens the right chat, and the alert clears once you've seen it instead of lingering.

• •Smarter battery-saver notifications: checks quickly right after you close the app, eases off to save battery while it stays quiet, and speeds back up the moment a message arrives.
• •Instant mode is now more resilient — if Android or your phone's battery manager stops the background connection, the app automatically falls back to catching messages so your alerts keep coming through.
• •New setup step explains how alerts work — Wiltkey never uses Google or Apple push, so you choose up front whether to be notified in the background.
• •Settings now have a dedicated Security tab for your fingerprint unlock, PIN, and identity reset, keeping the Profile tab just for customization.
• •Changing your PIN is now a clear two-step screen, fixing the confirm field overlapping the button on smaller phones.

• •Pair screens now warn you (with a one-tap toggle) when Bluetooth is off, instead of silently hanging — fixes group creation freezing with Bluetooth disabled.
• •Smoother custom-emoji background erasing — strokes now follow your finger live instead of lagging, and the editor controls no longer overflow on small screens.
• •Fixed the send button disappearing in group chats when typing very long messages.

• •NEW: Stickers — hold down any emoji (including your custom ones) to send it big and on its own.
• •Delivery status now catches up when you reopen the app, even without unlocking — fixes confirmations that could stay stuck after the app was minimized.

• •NEW: Updated custom emoji editor: erase to transparent, rotate your image, and undo steps while creating emojis.
• •Fixed messages getting stuck on a single "sent" check — delivery status now reconciles reliably, even if the app was closed when the message arrived.
• •Messages no longer go missing after reopening the app. Added a sync button in the chat header to manually pull anything you might be missing.
• •The chat now scrolls with the keyboard, so the latest message stays visible while you type.
• •Back button / gesture now closes the emoji picker first instead of leaving the chat.
• •Smoother PIN entry during setup — keyboard "enter" jumps between fields and submits.

• •Navigation buttons now don't block the chat input anymore.
• •Fixed a chat disappearing from a device after a one-sided nuke signal and re-pairing.
• •Added a restart button on the pairing screen for a quick wipe.
• •Temporarily removed the screenshot block functionality for testing.
• •Added a copy debug button to help with bug reports.
• •Added a warning on the pairing sync screen to not close the app.

First build of Wiltkey released.

• •Play Integrity Token Verification: Added /api/v1/integrity/challenge and /api/v1/integrity/attest endpoints to verify Google Play Integrity verdicts server-side with anti-replay cryptographic nonces.
• •Ed25519 Attestation Signing: Verified clients receive an Ed25519-signed attestation token (WILTKEY_ATTESTATION:<userId>:...) signed by the relay's public key, verifiable offline by all peers.
• •Postgres & Redis Attestation Caching: Attestation records are cached in PostgreSQL (client_attestations) and verified nonces in Redis to minimize Google API calls and ensure instant query responses.
• •Zero-Knowledge & FOSS Invariant: Google never receives user contact graphs, chat content, or message metadata. FOSS/community clients remain first-class citizens without any feature degradation.

• •The relay now re-advertises any not-yet-downloaded file on request, so a FILE_OFFER missed while a client stays connected is recovered immediately instead of waiting for its next reconnect. Live on api.wiltkey.org; no app update required beyond the matching client build.

• •Replaced auto-streaming of large file payloads with on-demand download signaling: the relay sends a lightweight FILE_OFFER frame (metadata only).
• •When the recipient requests the file (REQUEST_FILE), the relay issues a short-lived download token (FILE_TOKEN) for streamed HTTP downloads via GET /api/v1/file?token=... with progress tracking.
• •The object storage file and database record are retained until the client confirms disk write via a FILE_RECEIVED acknowledgment, guaranteeing retry capability if a download drops.

• •Large messages now stream through object storage with a database-backed link instead of sitting in memory, and the relay falls back to the database under memory pressure — so bigger transfers and busy queues don't strain a host. It still holds only encrypted payloads and deletes them on delivery.
• •WiltKey Plus, server-enforced: a subscriber's offline messages are held 72 hours (vs 24), and their transfer ceiling rises from 5 MB to 50 MB. Entitlement is verified relay-side; a payload over the 50 MB hard cap is refused outright.
• •Self-hosters stay Google-free: with no entitlement store configured, everything simply holds 24 hours and the subscription checks are no-ops — the relay behaves exactly as before.

• •Added an optional wake-up path for the Play Store build: the relay can send a content-free push when a message is waiting for an offline device, so the app is notified without holding a background connection.
• •The relay stores only a device wake-up token (in Redis, auto-expiring) — never message content. The encrypted payload stays queued and is pulled by the client on its next connection, exactly as before.
• •Entirely opt-in for self-hosters: the sender is a no-op unless Firebase credentials are configured, so a self-hosted or GitHub-build relay behaves identically to before with zero Google dependency and no new libraries.

The Go blind relay went live: challenge-response Ed25519 auth, blind message routing, and Redis-backed offline queues that hold only opaque ciphertext and delete it on delivery. Fully self-hostable — see the setup & security guide.