Martin only attaches <request/> (XEP-0184 receipts) in createMessage, so
Conversations/Monal had no licence to answer with <displayed/> and read
state was stuck on delivered. MUC stays exempt per XEP-0333.
Self-chat never showed Read: the outgoing message was promoted by
sendDisplayedMarkerIfNeeded, but a later XEP-0184 <received/> receipt
or a LMM correction overwrote .read with .delivered/.sent directly,
bypassing Delivery.merged. Mark self-addressed outgoing messages read
as soon as the server accepts them and merge every weaker status into
the ladder instead of overwriting.
The self-addressed read-marker carried a plaintext <body>, so clients
that do not know our namespace (Conversations, Monal) rendered it as a
"Сообщение прочитано" bubble in the self-chat. Service stanzas now ride
on their payload element only.
Refs #18
- Replace the sidebar-based MainChatView with MainTabView: a custom
bottom bar with Контакты / Звонки / Чаты / Настройки that looks the
same on iOS and macOS, and open chats via push navigation.
- Put the search field above the chat and contact lists (searchable on
iOS, an inline field on macOS) and add an aggregated call-history
screen backed by model.callHistoryMessages.
- Embed SettingsView as a tab, update verify.sh guards, and keep CI on
deterministic unit tests while the UI tests stay runnable manually.
- Lock only when the scene really backgrounds: transient inactive
states (system photo picker, app switcher) no longer swap in the
lock screen and break gallery selection on iOS.
- Cache biometric availability once per session off the main thread
instead of calling LAContext.canEvaluatePolicy in view bodies,
which froze the macOS lock screen, and auto-prompt biometrics on
iOS only.
- Keep UI tests as an opt-in target and guard both fixes in
verify.sh.
- Purge the poisoned self-session only once per account instead of on
every connect, and rebuild it from the own published bundle when
missing: deleting it repeatedly broke encrypt-to-self, so archived
copies of own messages (most visibly in the self-chat) failed with
"could not decrypt".
- Detect OMEMO 2 (urn:xmpp:omemo:2) payloads, which the pinned
MartinOMEMO does not implement, and show them as undecryptable
instead of empty plaintext bubbles.
- Guard both behaviours in verify.sh and document the namespace
limitation in SECURITY.md.
- Skip older-history loads silently while the connection is down:
the trigger previously failed with "not connected", popped the
global alert over the timeline and froze scrolling until dismissed.
- Accept fast reply-swipe flicks whose end state is clearly leftward
even without an intermediate horizontal lock, while scroll-owned
touches still never activate the swipe.
- Add a seeded-chat UI test mode (launch argument), accessibility
identifiers and a LumaUITests target with timeline scroll and reply
swipe tests; guard the fix in verify.sh.
- Accept only negative-width translations in canLock, offset and
shouldReply so swiping left-to-right stays entirely with the scroll
view while right-to-left keeps the lock/follow behaviour.
- Mirror the restriction in MessageReplySwipeTests and fix the
line-sensitive PhotosPicker data-fallback guard in verify.sh.
- Lock the gesture into a reply swipe once it starts clearly
horizontal (1.6 dominance, 12pt) and relax the ratio to 1.05
afterwards, so a slightly diagonal finish no longer cancels the
swipe while vertical scrolls stay untouched.
- Restyle the composer reply banner as a rounded telegram-like card
with the reply header, close button and two-line quote preview.
- Cover the lock/follow behaviour in MessageReplySwipeTests.
- Raise the swipe dominance threshold to 2.0 and add a 24pt
activation distance so diagonal timeline scrolls never move bubbles
or fire haptics, and snap the indicator back when a gesture turns
vertical mid-drag.
- Cover the stricter thresholds in MessageReplySwipeTests.
- After a call ends, send a plaintext <call-history/> service message
to the user's own bare JID with direction, status, duration, start
time, peer and video flag plus the call id as origin-id.
- Intercept the payload on live, carbon and MAM paths and upsert the
same system call card on every device; deduplication reuses the
origin-id as clientID, and missed incoming calls bump unread.
- Cover payload parsing and round-trip in CallHistorySyncTests, guard
the namespace and interception in verify.sh, and document the flow
in ARCHITECTURE.md.
- Gate every layer behind AppLockView when the lock is enabled and
lock on launch and on backgrounding; the passcode lives only in the
Keychain (AppLockVault) and the enable state defaults to off.
- Add the lock section to Settings: enable/setup, change passcode and
disable all require the current passcode via a shared passcode
sheet; Face ID / Touch ID unlock prompts automatically and can be
toggled with passcode confirmation.
- Add NSFaceIDUsageDescription to both app targets, cover the passcode
policy with tests, guard the feature in verify.sh and document it in
SECURITY.md.
- Implement SCRAM-SHA-512 (RFC 5802 with SHA-512) as a Luma-side
SaslMechanism and register it ahead of Martin's SHA-256/SHA-1/PLAIN,
so modern servers preferring SHA-512 authenticate with it.
- Verify the math against Python-computed reference vectors (salted
password, client proof, server signature) in SCRAMSHA512Tests and
guard the mechanism registration in Scripts/verify.sh.
- Confirm the TLS stack negotiates TLS 1.3 (negotiatedSSL + ALPN via
SecureTransport, handshake verified against a TLS 1.3-only server)
and document the TLS/SCRAM posture in SECURITY.md.
- Translate Prosody's "doesn't match the one we calculated" SCRAM
failure into an actionable Russian message pointing at the typed
password, since the client math itself is verified against the
RFC 5802 test vector.
- Set explicit username/password text content types on the login
screen, disable smart text features, and add a password visibility
toggle so users can verify what they submit.
- Cover the mapping with a unit test and verify.sh invariants.
- Wait until the picker movie's file size stops changing before
staging it, so a movie whose final bytes are still being flushed is
never copied truncated (which produced drafts without a thumbnail
and unplayable previews).
- Log the whole camera video path (pickup size, staging result,
analyze outcome, thumbnail decode) under the video-preview os_log
category for fast on-device diagnosis.
- Cover the video analysis pipeline with a simulator test that
generates an HEVC QuickTime movie and asserts duration plus JPEG
thumbnail, and guard the diagnostics in Scripts/verify.sh.
- Claim the picker-owned temp movie synchronously inside the picker
delegate with FileManager.moveItem before returning, so the picker's
post-dismissal cleanup can no longer delete the source while a
background copy is reading it.
- Deliver the captured movie to the staging flow immediately; heavy
staging and thumbnail work still runs off the main thread.
- Add a verify.sh invariant for the synchronous movie claim.
- Dismiss the camera fullScreenCover through the SwiftUI binding
synchronously in the picker delegate before background file
preparation, so UIImagePickerController no longer dismisses itself
and desynchronizes the presentation state that the preview sheet
waits on.
- Keep the archive-sync suspension reserved across the dismissal and
surface an explicit error when the captured file fails to prepare.
- Add verify.sh invariants for the camera dismissal flow.
- Stage picked media only when the picker is dismissed with a
confirmed selection instead of on every selection change, so
canceling restores an empty binding and never schedules a preview.
- Reset the selection binding after dismissal and recreate the picker
via a reset token, so a stale selection can no longer leak into the
next presentation and break its preview/send flow.
- Add verify.sh invariants for the picker state machine.
- Delete a group chat from GroupInfoView or via a swipe in the chat
list: remove the conversation and its messages from SwiftData,
clean per-chat state, and leave the room on the server first when
joined.
- Keep "Покинуть комнату" as leave-without-deleting and suppress
deleted rooms for the session so roomState events cannot recreate
them; an explicit rejoin or a fresh invitation clears the
suppression.
- Add verify.sh invariants and document the behaviour in
ARCHITECTURE.md.
- Normalize SCRAM passwords with RFC 4013 SASLprep before the
challenge response, so they match SASLprep-compliant servers
(Martin hashes raw UTF-8) and PLAIN still sends the password
untouched.
- Capture the raw <failure/> condition with LumaSaslFailureModule and
map SASL errors to actionable Russian messages instead of the
cryptic OS-localized "Martin.SaslError, error 5".
- Cover SASLprep and failure message mapping with unit tests and new
verify.sh invariants.
- Drive chat list, timeline and forward picker from SwiftData @Query
instead of AppModel's in-memory arrays; inject the per-account
ModelContext from RootView with an in-memory fallback.
- Physically delete locally deleted messages (context.delete) and
purge rows marked deleted by older builds on store open, so @Query
views never resurrect them.
- Delete the legacy JSON snapshot only after a successful import save
and restore the completeUntilFirstUserAuthentication data protection
attribute on the store file.
- Mirror the old ChatArchive tolerant decoding in LegacyArchiveImporter
so snapshots from older schema versions (missing reactions,
isGroupMessage, roster fields) still import.
- Cover the new behaviour in ArchiveStoreTests and guard it with new
verify.sh invariants; update AGENTS.md, ARCHITECTURE.md and
SECURITY.md.
wt