F5 reboot closeout, 2026-10-17: the owner selected pi-home for real reboot acceptance. The source-matched native ARM64 host recovered its saved identity and service before login, retained pending delivery/history/cache, and delivered the original queued message once. Fresh authenticated ACKs and exact 16 MiB export passed after reboot (302.884 seconds for the file, 419.079 seconds overall). Two native TUI views share one owner; fleet boundaries hold. The disposable account, grant and services were cleaned after backup verification, preserving the Pi's original workloads. This completes the revised goal together with the qualified 0.1.235 workstation GUI, lifecycle and rollback evidence. The Pi's headless reboot is the owner-selected surrogate; the workstation stayed running. Implementation and scope.

F5 qualified235 installed,2026-10-17: the signed Linux desktop and packaged managed host now share the repaired a13c326f/7af9c125 pair. All normal release gates and public signature/hashes are independently verified. Actual update/two-viewdefer/activation, recipient ACK/offline-once, fresh interrupted16MiB, fleet scope, native error/repair, cold/concurrent startup, invitation review, lock and network recovery pass. Fresh current state preserves223messages/all176durableoperations/192pieces through signed 235->233->235 rollback. Updater timers are restored. Controller startup repair2b0 is independently qualified/active and its watchdog's scheduled execution passes. The final owner-manual login/reboot and postboot acceptance are still required; this is preboot readiness, not a full-completion claim. Runbook.

F5 controller cold-start recovery, 2026-10-17: the independent watchdog now distinguishes pending container creation/readiness from a crashed controller. Pending, correctly pinned startup retains its original activation deadline; observations never extend that clock or count pending as healthy. Runtime/pull/ configuration failures and deadline expiry still recover the previous image. The causal old-fail/new-pass and22 focused controls pass; actual-image controller qualification and activation follow separately from235 application artifacts.

F5 controller startup qualification, 2026-10-17: original235 deployment rolled back while its controller image was still pulling. Independent node logs establish normal startup93.505seconds after pod creation. The watchdog script and manifest are now explicitly classified as controller-only operations inputs, with tests retaining native artifact identity and rejecting unknown script/manifest changes. Controller qualification precedes the pending-startup policy repair; the original 235 package/source pair and failed rollout evidence remain authoritative.

F5 whole desktop attachment deadline, 2026-10-16: native stalled-service acceptance found background requests holding the shared client lock outside the host's30-second budget. A real mutex regression fails old code; the deadline now includes that contention and all attachment establishment. User mutations execute afterward. All30desktop tests/strict Clippy and the full paired gate pass. Actual native missing-service, missing-fleet and stalled-service repair journeys preserve identity, history and registration; the stalled error appears in30.898s and repair takes10.926s. The original22-second delayed-start/105-second stable-host control also passes using the normal optimized CLI build. Tokio's existing test-only clock utility is enabled; no production clock or dependency package changes. Signed successor qualification and final installed/manual boot acceptance remain required.

F5 signed233 installed acceptance, 2026-10-16: the normal signed updater and canonical managed activation now run matching0.1.233 desktop/host binaries. Recipient contents/authenticated ACKs, offline-once recovery, fresh16MiB interrupted transfer128.294s/165.046s, scoped fleet status, cold/concurrent startup, invitations, lock/unlock and network recovery pass. The actual packaged GUI also passes the 105-second delayed-start update regression. One current-state233->230->233 clone preserves217fullmessage digests, all147durableoperation-record hashes, memberships, cache and exact file exports. The private UI snapshot is a30-operation window; full-map evidence is separate. Final diagnostic release and manual login/reboot remain required. See installed evidence.

F5 local host diagnostics, 2026-10-16: the final audit found that gchat paths still described the legacy standalone fallback and omitted the saved service/build association. gchat paths --json now inspects the selected instance, saved service, service state, build bindings and lock/readiness with sanitized errors. The actual stopped/missing-config CLI regression fails old code and passes the repair; six read-only/IPC/property controls and strict core/TUI/API Clippy also pass. All paired CI commands now pass across the exact-input continuation after a retained build-quota failure:241workspace Rust, one released-client,80UI,124Chromium/124WebKit and28desktop tests, strict checks/build/generated/dependency gates. Actual read-only inspection of the installed233 host reports its correct association/build without restarting. Signed qualification remains required. Inspection never starts or unlocks a host.

F5 membership qualification, 2026-10-16: original232 failed an unlabeled ACK wait in the recovery fixture. Membership readiness now observes the authenticated commit and current recipients' pending-message state, rather than accepting an arbitrary message ACK. A real unrelated prior ACK fails the old barrier; three corrected journeys and strict core Clippy pass. Revoked recipients' unacknowledged records remain retained. Exact final message contents/ACKs and30-second deadlines remain required. The full affected core gate passes95tests with3existing explicit exclusions; signed-successor qualification follows.

F5 startup/update follow-up, 2026-10-16: installed230's cold checks exposed a deferred-check/verified-update ambiguity. A real disposable managed host delayed 22seconds makes the packaged GUI restart an already-current host after its startup check times out. The source now retains explicit installation eligibility, gates both UI actions and native installation, and rechecks Debian state before shutdown. The causal unit test fails old code;80UI units,124Chromium/124WebKit tests, 28desktop tests and strict desktop Clippy pass. Full paired CI also passes; the actual new GUI retains one host beyond the original105-second observation, shows the timeout without a restart action and preserves identity. Signed successor and installed closeout remain required.

F5 signed recovery, 2026-10-16: qualified Linux 0.1.230 is installed through the normal signed package and managed activation services. The minimal icon uses the saved host recipe; two simultaneous cold views converge on one managed owner. Exact bidirectional ACKs, offline-once delivery, scoped fleet status and the16MiB interrupted transfer pass. A current-state230->228->230 rehearsal preserves209 message digests,25operations and the exact file in every phase. Invitation review, lock/unlock, scoped network recovery and fresh post-network ACKs now pass on230. The startup/update successor and user-performed login/reboot remain tracked in installed evidence.

F5 Linux SDK qualification allocation, 2026-10-15: the native SDK job has a bounded 150-minute execution allocation. The original229 job passed the hour-long real unreachable-member stress case and subsequent checks but reached its former two-hour limit during released-facade compilation. Every test, signing requirement and product delivery/file/relay acceptance deadline remains required. Original229 is still failed; the next immutable candidate must qualify normally.

F5 personal startup follow-up,2026-10-15: standalone desktop profiles now retain their carrier, network and path choices in the same private host recipe. The real personal-runtime regression fails old publication; focused registration and existing fleet/daemon checks pass. Both browser engines, desktop tests/build, generated contracts and dependency checks also pass on the frozen pair. Intentional first fleet/service adoption remains possible only with the other saved choices unchanged and runtime ownership verified. A signed successor and final installed acceptance remain required. See startup association.

F5 retained-host recovery, 2026-10-15: saved-instance host selection, authenticated fleet status and the combined GComs recovery fixes pass source/native checks. Signed0.1.228 is independently verified and its fresh stopped backup restores all 205message digests, memberships and23operations in an isolated namespace. The next normal signed pair must still pass installed bidirectional delivery, interrupted files, fleet scope and the complete lifecycle. See startup/recovery procedures and exact qualification evidence.

F5 isolated Android cluster network, 2026-10-12: the owner-selected signed network configuration passed its focused native regression in Kubernetes (1 test, 0.04 seconds), and the headless release binary built successfully with the current frozen GComs companion. The private path, size, signature, expiry and retained network/root checks remain enforced. Source L0 passes. Full Android lab transfer and release timing remain separate requirements. Evidence.

F5 Android agent cluster lane, 2026-10-12: optional android_agent configuration adds a bounded, asynchronous reconciliation command to the existing release coordinator. Its command is an administrator-owned argv array with a 30–300 second observation deadline. The cluster worker owns original push timestamps, Kubernetes Jobs and FSN1 checkpoints, so stopping the observer cannot turn an uncertain release into a new execution. Public status includes only the scoped cluster observation. This lane serves boo.gcoms.agent; existing boo.gchat.app store workers retain their own state machine. All 55 focused coordinator/lane controls pass in Kubernetes (1.942 seconds); image activation and actual Android migration gates remain pending. Evidence.

F5 controller recovery activation, 2026-10-10: exact source b12c7a4 is running as image d1eab766f382 after 417 portable/Kubernetes controls and the ordinary authenticated-delivery canary. The controller-only rollout is deployed under its own journal and shared rollout lock; the original selected fleet journal remains blocked. No failed application release is published. Decisive hashes are retained in docs/evidence/android-ten-minute-20261009/controller-recovery.json. Android transfer and ten-minute workstation promotion qualification remain separate.

F5 Android qualification classifier, 2026-10-10: the exact standalone scripts/android_release_qualify.py operation file is excluded from shared native build inputs. Unknown SDK/native source files still invalidate their actual artifacts. Both input-classification controls pass. This source classifier is not a claim that the running release controller has activated it.

F5 Android release operations, 2026-10-10: the exact promotion tag guard, headless hub adapter and VPN diagnostic helper are reviewed operations inputs; their changes do not rebuild SDK or application packages. Native changes remain artifact inputs. Controller-only recovery may qualify against the selected controller target after a fresh exact-source health/artifact observation even while an unrelated fleet target is blocked. It refuses active mutations, pending/failed rollback, changed sources and unhealthy/mismatched controllers. The failed global journal is preserved; this is not a global deployment pass. Queue an exact reviewed source with release_controller.py --state STATE --config CONFIG --recover-source COMMIT; native/application fingerprint changes still refuse recovery. Twelve focused controller controls pass. Activation still uses the ordinary qualified deployment policy.

Release 171 is deployed (2026-10-08): all 17 managed infrastructure targets, including eight relays, match the qualified release. Linux 0.1.176 is installed; the production hub and visible desktop run its exact packaged executables. Linux, Windows, both Macs, Android and SDK downloads are available. Controller-only correction 8eb7e28 deployed automatically after 415 actual-image checks and a full authenticated network check; its obsolete iOS queue entry was retired without rebuilding apps. The retained 64-client/30-minute campaign passed 720 authenticated deliveries, zero refusals and 1.792s p95, including the 5,235,248-byte file and relay restart. iOS awaits Apple encryption review; the separate Android worker delivery/launch journey remains unproven. See the current 171 observation in release evidence.

File-cache reactivation, 2026-10-08: after unlock, file controls and binary reads/writes wait for the retained encrypted cache to be enabled. Chat and history remain usable during preparation. Duplicate upload commits remain idempotent. The transient readiness state is not stored in profiles and changes no public API. Focused source validation and managed release acceptance are recorded separately. Validation: the causal regression, original file-recovery integration and responsive-unlock control pass; strict core Clippy and source/contract checks pass. Focused repair evidence.

Candidate167 packaging correction, 2026-10-07: pinned Tauri marks DEB binaries by changing UNK to DEB. Retained-build verification now permits precisely that three-byte mutation and checks every other byte; the CLI still requires its original hash. Actual qualified167 binaries reproduce and pass the corrected comparison. The protected signed build and full relay gate remain required.

Release simplification, 2026-10-07: Linux qualification, production compilation and load testing share verified retained binaries; signing bundles without compiling again. Trusted-main compiler caches serve successive release branches. Independent profile preparation and readiness run in parallel; shared-owner admissions remain ordered, and relay restart readiness no longer interrupts load observation. release.py status exposes native job steps; an explicit resume --platform linux-x86_64 permits one failed-job retry while keeping successful jobs. The full 64-client/30-minute gate and signed managed activation remain required. See automatic releases. Hosted timings and activation must be observed separately.

Live hub repair, 2026-10-06: normal controller invitation creation, exact-result replay/reopen and authenticated replies from both existing Pis are verified. Both provider catalogs now accommodate the hub's invitations across channels; the per-channel invitation/member limit remains 64. The repaired hub and visible desktop are stable with the supported fleet managed-update guard. These are temporary source-bound repairs; full bulk bootstrap/enrollment and the next qualified signed release remain separate. The latest isolated native-client run received 396,000 of 5,235,248 bytes in 600 seconds and did not enroll a new member; its template remains unpromoted. The signed successor includes the hub fixes but is blocked by release-volume capacity. See the live evidence and exact override retirement requirements.

Release scope, 2026-10-05: desktop relay sharing is deferred; the release retains the fleet capacity repairs, with Pi access tunnels replacing desktop contribution. Desktop sharing and router mapping stay disabled, including explicit attempts to enable sharing. Existing messaging remains available.

Release admission repair, 2026-10-05: old builds retained for late result collection no longer prevent the selected release from starting. Original requests remain reconcilable under existing worker limits; deployment and publication still require their normal evidence. Controller activation is a separate remaining step.

Windows release tooling, 2026-10-05: native CI exposed Linux-only imports, worker cleanup and temporary-path assumptions in the release checks. The corrections preserve qualification gates and use portable evidence-path validation. Local regression checks pass; the next Windows native result remains required.

Capacity hotfix handoff, 2026-10-05: fresh observations confirm all eight relays run gcoms-5d61b75-capacity-port/gcnode (SHA-256 a54a317de4068715512bcae2ff7512a49070c9f4421e00bb79d57019adbea21a) with 2048 circuits and 4096 connections. The local hub also runs the capacity patch. These are temporary operator overrides, not the next qualified managed release. The capacity port is integrated in the published source pair; the existing failed managed rollback must retain the working hotfix. Desktop publication and the combined 64-client campaign remain pending. Pi-a was re-imaged and its final drone journey requires fresh enrollment.

Parallel release qualification, 2026-10-05: Linux runs independent GChat, GComs and isolated relay-load jobs for one frozen source pair. Signing requires both native gates; deployment also requires the original 64-client load evidence. Late build results reconcile their original request after the build deadline, and publication has a separate persistent budget after infrastructure is ready. Failed load gates retain evidence and cannot prevent a newer candidate from starting. Implementation is under qualification; this entry does not claim fleet activation.

Release operations repaired, 2026-10-05: controller 7c0db5c is active after 254 actual-image checks and verification of 239 source files in Kubernetes. Store observation now reuses its pending request and closes finished worker logs; open descriptors fell from 1,022 to 8. The retained Android 1113 observation completed as available. Relay capacity and desktop sharing still require their load and live-delivery gates. See activation evidence.

GChat

Saved-host path qualification covers Unicode and spaces across supported platforms, lossless Unix byte-path references, and real Linux non-UTF-8 profile reopening. The focused paired Linux suite and strict checks pass; new Mac native qualification is tracked in durable-host evidence.

Controller qualification accepts additional source-bound test suites while keeping every baseline gate mandatory. Historical hash-pinned overlays retain their exact source/image evidence. This compatibility bootstrap allows follow-through checks to be added through the ordinary qualified controller update path.

Release ledger archival supports backup_archive_required: true on the POSIX controller. It retains closed daily snapshots for the verified archive worker and coordinates rotation with that worker's lock. Enable it with qualified off-site archival and freshness monitoring; see automatic release maintenance. Source qualification and production activation are recorded separately.

Cross-platform publication follow-through (2026-10-14, in progress): the reviewed IRC UX prose/receipt paths and delivery-controller helpers are classified separately from application artifacts. The classifier is deployed first through normal source-bound controller qualification. Durable delivery ownership, diagnostics and notifications follow in the qualified implementation; this checkpoint does not claim cross-platform publication or feature activation.

The follow-through implementation adds source-bound native failure evidence, stage-specific worker fingerprints, explicit bounded transient recovery and durable owned delivery tasks. release.py status reports per-platform publication and source containment; track --release FULL_ID retains an older change's obligation. The existing mirror timer consumes deduplicated intervention and completion notices. See the configuration and completion contract. Actual image/configuration activation is a separate required check.

Current activation is blocked by release-storage headroom. The source branch and diagnostic evidence are retained; the new automation is not yet deployed. Native blockers are now identified from original job and child logs, including the Mac path test, Windows tooling imports, iOS lifecycle assertion and SDK registry DNS.

Native build archival now uses the existing encrypted Hetzner S3 closed-file archive CLI (triform.closed-file-archive/v1). GChat selects only older completed build ZIPs older than one day, keeps current/latest/forty recent candidates and pending operator work online, verifies an independent restored ZIP against the original native receipt, then permits exact-file retirement. Logs, receipts and extracted artifacts remain local. A cold pointer records the pinned archive manifest and restoration receipt; restore original bytes before requesting historical requalification. No new archive format, key scheme or application qualification is introduced.

IRC workspace delivery, 2026-10-13: signed Linux 0.1.214 is installed and verified through the existing desktop entry, including normal relaunch. Channels, chat and users now share aligned header/content/footer rows; topics and multiline drafts size those rows together, and Channel recovery sits in the bottom strip. Native controls and retained identity/history/files are verified. The normal updater and registered background service are active. See the installed receipt for exact sources, hashes, test scope and retained limitations.

Earlier IRC UX delivery checkpoints

IRC UX delivery, 2026-10-13: the release-controller repair is active after its 425-check image/Kubernetes qualification and authenticated-delivery canary. After correcting paired formatting failures, Linux 0.1.193 passes GChat's complete native gate and the64-client load campaign. The paired GComs gate exposed an ordering race; it and a relay metrics-write repair now pass scoped native controls. The installed package remains0.1.176 pending the successor's complete signed release and actual desktop-icon acceptance. See release-repair evidence.

Linux0.1.200 now passes its complete native, load, signing and package-verification gates. A stale terminal fleet owner was recovered through the installed reconciler; its failed release record remains intact. Automatic owner cleanup passes499 regressions and follows normal controller qualification. Actual signed feed publication, local installation and icon-launched acceptance remain in progress. Ownership recovery.

Installed Linux acceptance now verifies0.1.200 through the existing desktop icon, including relaunch, retained identity/history/files and fourteen real native visual/interaction groups. Final release maintenance is being completed: verified sharing of successful canary artifact copies reclaimed4.419GB with all evidence and paths retained. The causal repair passes505 release controls; controller and scheduled-maintenance activation remain tracked in storage evidence. See the IRC UX acceptance and current scope in PLAN.md.

The desktop workspace now aligns the channel list, conversation and user list on shared header/content/footer rows. Topics and multiline drafts resize those rows together; Channel recovery remains reachable in the user-column footer. Narrow windows use the existing drawers. Source and installed-release validation are tracked separately in the IRC UX notes.

Desktop relay contribution is preserved as dormant work for a future release. /network relay status reports sharing off; /network relay auto reports that the feature is unavailable in this release. Saved preferences, environment variables and startup capacity options cannot enable it or router mapping. Mobile remains outbound-only. Fleet rollout and installed-client qualification are tracked in PLAN.md; this source description does not certify deployment.

Release status, 2026-10-04: Linux 0.1.98 and all 17 infrastructure targets are active and healthy. Linux, Windows, both Mac architectures and SDK archives are published. Controller c66c230 runs the production-minutes-v1 publication path in Kubernetes. Original Android and iOS artifacts passed its publication gates. Android 1113 is uploaded, committed to Google Play and processing; iOS 1.1.13 awaits Apple encryption approval, including France. Full GUI qualification and SDK 1.0 remain separate and incomplete. Mobile publication and Apple encryption approval remain separate from full GUI qualification and SDK 1.0; original failed reports are retained.

Node 5 disk recovery, 2026-10-04: its anchor is ready after unused Docker build images were reclaimed. The five-minute node maintenance timer now covers the separate Docker image store when Kubernetes image pruning is insufficient; it removes only dangling images older than one hour and checks actual free space. See recovery evidence.

Routine releases: push main; the source mirror and Kubernetes coordinator build, verify, deploy and publish. The local package timer installs signed desktop updates. Inspect with python3 scripts/release.py status; use resume --platform <platform> for a retained failed stage and rollback for recorded infrastructure. See automatic releases and current evidence.

Routine publication now verifies the native build, signatures, permissions, startup lifecycle and eight fresh matching relays. Full mobile GUI upgrade/rollback/history/file journeys run separately with python3 scripts/release.py qualify --platform android or ios; they do not gate routine upload and never become passes from a build or upload. Routine work has a persistent 60-minute active budget, one transient retry and one-minute source settlement; external review pauses its budget. Native dependencies and compiler outputs are cached, while signed artifacts and every source binding are verified.

The Apple App Store creative pack adds four iPhone and four iPad screenshots plus English listing metadata to the iOS draft. App Store publication still requires the qualified build and Apple's encryption approval; the pack records its upload receipt and current status.

The Play Store creative pack contains an old-school chat visual direction, exported graphics, a local preview and listing copy submitted to Google Play. Its sample-data browser captures match the shared UI source of published Android build 1055; submission details are recorded in the pack's publication.json.

Current work follows the reliability test plan: cluster recovery/concurrency checks, then exact-artifact platform validation. Historical release/device observations below are not current qualification.

GChat uses the public gcoms Rust application API for its protocol runtime. It owns the chat archive and UI; GComs owns identity, encrypted protocol state, network enrollment, recovery, invitations and the file-transfer worker. GChat retains its archive, signed network settings, file-cache path/key and UI contract. The embedded backend is the default. To use a bundled shared service, run gchat daemon --gcomsd /absolute/bundle/gcomsd --gcoms-endpoint /private/runtime/gcoms.sock with the usual instance options. Each GChat profile remains independent inside that service. Locking/disconnecting stops that profile without stopping other applications.

In-process hosts retain incoming channel and private messages in a bounded, encrypted protocol inbox until the chat archive is saved. Failed archive writes leave those messages available for retry and show an actionable storage notice; uncommitted history is not published. The external shared-service archive path keeps its existing contract and is outside this new transaction boundary. See the archive transaction and rollback requirements.

Attached views share a cached projection and wait for actual archive/UI changes. Idle file observation does not copy the retained operation journal. Receiving, persistence, delivery acknowledgments and the cover schedule are unchanged. The controlled idle benchmark measured 92.45% less CPU with four views and a large retained operation history; this is not an installed-client or relay-load measurement. Signed Linux 0.1.13 now carries this fix through the update/APT feeds. The website’s Linux download link follows the qualified publisher automatically, with immutable package links, signatures, hashes and exact source details. Existing unlocked instances retain their running executable until their next start; see the deployment receipt.

For paired-source development, validate against the matching GComs checkout with its scripts/check-gchat.py --gchat /absolute/gchat --offline command. Keep public registry manifests and canonical release lockfiles intact; each published download retains its exact source and dependency bindings in its signed release manifest.

GChat is the reference chat application for GComs, with a Tauri desktop application, terminal client and local service built from one repository. The Rust API contract drives both native clients and generated TypeScript bindings.

Development and release authority remains in the existing local Forgejo repository. Public delivery uses IggyGG/gchat and IggyGG/gcoms as GitHub mirrors. Current downloads are signed Linux x86_64 and Android through Google Play. Mac and Windows updates for the current network are still being qualified; their earlier signed installers remain archived. Physical Android and iPhone checks are currently deferred. Four disposable Android emulators and the Mac iOS simulator passed their scoped lifecycle checks; exact source/artifact bindings remain separate from current runtime and mobile network/file qualification. Historical physical-device and release observations remain in PLAN.md. Live APNs/FCM and new store publication are not qualified by those lifecycle runs. Windows x86_64 and iOS releases are being qualified independently; availability and exact versions are listed on the download page. See platform release delivery. Retained Windows network diagnosis can reuse a pinned signed installer via windows-verify.yml (network_candidate: windows29), without rebuilding it; aggregate fixture diagnostics preserve the original recovery deadlines.

For installation and first launch, see gchat.boo and the installation guide. GChat includes signed Hetzner relay settings; users import a network invitation and do not configure relay addresses. The website and delivery tooling live in this repository.

Current validation covers secure connections, authentication, transport security, local IPC access controls, disconnect/reconnect behavior, and private file sharing. The shared Rust integration has a native Linux/macOS test and size matrix; see the GComs integration report. GChat's desktop release checks are recorded separately in the release evidence procedure.

Private file sharing adds verified pieces, restart, multiple authorized sources, explicit download acceptance and a bounded encrypted cache. Optional local persistence diagnostics measure protocol profile write counts, bytes and time during file-transfer investigation.

Build and run

Install Rust 1.98, Node 22, npm 11 and the platform's Tauri v2 prerequisites. After GComs 0.1.0 packages are available from crates.io/npm:

cargo build --locked -p gchat-tui
cargo run -p gchat-tui --bin gchat -- --help
npm ci --ignore-scripts
npm run check
npm test
npm run build
python3 scripts/collect-notices.py
npm run tauri -w @gchat/client -- dev

For development before package publication, use GComs' package-consumer staging script. Public manifests use versioned registry dependencies; no private Ghost checkout or sibling layout is required by the released project.

Run gchat paths to inspect the existing platform profile/archive locations. The desktop starts or attaches to the selected local host. Scoped installations retain an owner-private startup association after successful unlock; subsequent desktop and terminal launches recover the fleet configuration and start the exact registered Linux user service when needed. Conflicting host configuration is reported before attachment. See durable host startup for the contract and qualification status. gchat daemon --interactive starts a locked standalone service; attach a UI to unlock the selected instance. Headless deployments may use an owner-only passphrase file or private stdin pipe. Never put passphrases on a command line. An existing archive with a separate passphrase remains locked until explicitly unlocked.

Network and identity

GChat bundles the existing application's signed network defaults and installed trust root. Joining the operated network requires an invitation. Enter it through the application's onboarding flow. The invitation must agree with independently trusted network configuration. Custom providers can be configured explicitly.

An unavailable provider does not mean a profile is corrupt. Preserve the profile, archive, invitation and retained network state while diagnosing recovery. Do not create a replacement identity to repair an unavailable connection. The app preserves existing profile paths and formats during the GComs branding transition.

GChat cannot open a retained Ghost machine/central profile as personal chat. Use its original scoped host. Public GChat excludes managed commands, machine agents, recorders and private installer/identity services.

Project map

Location	Purpose
crates/chat-api (gchat-api)	Typed chat service and shared UI schema
crates/core (gchat-core)	Profile, archive, chat model and standalone service
crates/tui (gchat-tui)	gchat terminal application and daemon entry point
ui	Shared Svelte UI and bound RPC bridge
apps/client	Tauri desktop client
website	gchat.boo source; built with scripts/website.py

See TESTING.md, integration, network operation and SECURITY.md. GComs provides transport and typed services; GChat owns chat behavior and UI.

Conversation workspace

The IRC-style workspace keeps compact channel and user lists visible on desktop and uses drawers on narrow screens. Each list can be collapsed independently. Messages retain their layout while sending; routine channel activity is grouped and operation details stay compact. Tab completion, searchable /help, /find with context navigation, unread/mention indicators and both chat fonts are available. Notifications are an optional inline choice after unlock. The optional native visual harness requires PyGObject with GTK3, WebKit2 4.1, Cairo and Xvfb; its commands and evidence scope are in TESTING.md.

MIT OR Apache-2.0, with separate third-party notices. Current downloads cover Linux x86_64 and Android through Google Play. Mac and Windows current-network updates are being qualified; iOS publication awaits Apple’s France-inclusive encryption review. Android lifecycle checks include emulator coverage and a limited physical-phone follow-up; battery and attributable live push qualification remain open. Each download retains its own source and validation scope. See the release evidence procedure.

The preview uses GComs' rustls/XML advisory fixes and disables unused postcard heapless defaults. deny.toml records reviewed transitive-version exceptions and two unmaintained build-time macros (OpenMLS/libcrux and ratatui). These require follow-up upgrades; no runtime vulnerability is waived. The desktop dependency graph has its own audit and native packaging requirements. See the exact dependency review and follow-up.

Optional local fleet controller

Desktop/headless workers accept --fleet-config <private-file> (GCHAT_FLEET_CONFIG). The file pins this existing GChat safety number and fixed component partition. The worker opens <protocol-socket>.fleet for registered local credentials without opening a second profile. Locking or disconnecting drains fleet connections; registry changes revoke existing connections before replacement. The private component configuration must accompany every subsequent startup of that profile. Fleet publication metadata is an opt-in file API backed by the encrypted chat archive; ordinary file replies stay compatible.

Welcome and invitation cards

The shared welcome screen detects an existing identity before offering setup, confirms new passphrases, and offers the existing recovery guidance. Invitations can be saved as evergreen PNG cards and opened or dropped into GChat. Send the original PNG as a file: screenshots and edited images lose invitation data. Opening a card stages or previews it; joining still requires explicit acceptance of the service-validated network and channel. Text invitations remain supported. See UX behavior and qualification. No new dependencies.

Locked passphrase errors appear once, beside the field, and can be retried. The signed local Linux package passed native first-run, retained-profile upgrade, invitation picker and narrow-layout checks. See the installation receipt; public installer qualification remains separate.

The desktop dependency policy records exact native API version duplicates required by the updater's existing dependencies; see the graph review.

Release file checks use a bounded 16 MiB interrupted transfer; the 1 GiB campaign runs separately. See automatic releases.

SDK release archives are closed and hash-checked before atomic publication, including on Windows. Interrupted copies leave the previous index intact.

The macOS release worker allows 120 seconds per browser-download socket; this setup budget does not change application test deadlines.

Release publication accepts repeated references to the same verified artifact, while checking every evidence hash and rejecting ambiguous installer candidates. Both updater and package inputs are selected before public pointers change.

Release operation

Production uses immutable artifacts and separately bound qualification evidence. See automatic releases for conservative source-change classification, single-flight admission, and the owner-approved Windows 4 MiB recovery check. A tooling update or policy decision is not a native application pass.

The scripts/hosted-live.py qualification driver exercises real hosted GChat daemons on the installed protected network, with creator-offline admission, covered receipts, moderation, restart and a 16 MiB resumed file. It retains private profiles/evidence and waits for explicit network-operator provisioning of its generated channel ID. Running it is not an installed-release claim.

Hosted live qualification reports correctness and latency independently. The first completed protected-network two-client journey verified messages, policies, offline recovery and a resumed 16 MiB file, but missed small-room receipt and file-resume timing targets. See docs/evidence/irc-hosted-live-20260930/summary.json; it does not qualify the 64-member or native installed release gates.

The later two-piece hosted file window passes the two-client live correctness and latency journey, including interrupted 16MiB resume and covered completion. See docs/evidence/irc-hosted-live-20260930/window-07.json. Large-room capacity and native installed release qualification remain separate.

The integrated client uses IPC26 for hosted channels and modern files while preserving released legacy owner recovery. Update the paired daemon and client together; unpublished task IPC23/24 dialects are refused. Legacy Channel recovery remains an explicit owner action; hosted policy uses its own verified controls.

The current merged hosted implementation passes its two-client protected-network journey, including covered delivery receipts and interrupted 16 MiB verification. scripts/hosted-capacity.py provides separate 12-member smoke and 64-member application campaigns. The full 64-member campaign passes covered delivery, recovery, file resume, removal/replacement and cleanup; see the qualification receipt. Native installed publication remains separately gated.

Hosted channels show progress while catching up on a large membership backlog. The count reflects updates already applied, without estimating an unknown total. Ordinary offline-message recovery retains its ten-second qualification target; long membership replay is measured separately. Delivery status still requires authenticated recipient acknowledgments on the covered channel.

The paired implementation passes 1,142 GComs tests, 194 GChat tests, 63 UI tests, all 22 archive consumers and Linux desktop compilation. These source checks and the 64-member campaign do not imply publication of a new native installer.

Hosted channels retain the 64-member maximum, including the owner. Operators may lower it with /mode +l (2–64); clients and the service enforce the ceiling.

Retained earlier stabilization checkpoints

Native fixture simplification, 2026-10-04: retained Android da7073b passes initial enrollment/export and both upgrade and baseline rollback phases with unchanged identity/history/encrypted cache and authenticated acknowledgments, then exhausts the original compatibility deadline during final-restoration history observation. Fresh hierarchy removal, capture and read now share one ADB round trip. Each replacement checks authenticated messages before its OS export; an immediate next replacement performs only its required unlock, while subsequent messaging still reconnects normally. Android partial-transfer observation now requires an exact rendered filename, its adjacent transfer status, exact total and bounded verified counter. iOS empty-prefix handling accepts its actual accessibility placeholder without admitting existing input. All 71 focused controls pass in 2.956 seconds; native qualification is still required and all original deadlines and failed reports remain retained.

The active mobile helper da7073b passed 874 independent CI controls with five existing skips, plus 70 focused controls. It uses the corrected Android app-data cache path, normal system export and exact rendered acknowledgments; iOS narrows exact row queries and reconciles zero-character local input once within the original deadlines. Both actual native runs retain the original signed apps. Controller 7f423f8, all eight node headroom timers and both local release timers remain active. The running Linux executable still matches installed 0.1.98 byte for byte.

Release status, 2026-10-04: all 17 infrastructure targets are healthy and match the release. Linux, Windows, both Mac architectures and SDK 0.1.98 are published. Linux 0.1.98 is installed and its running production-profile executable matches it. Android and iOS installed acceptance, iOS OS invitation arrival, SDK 1.0 and the subsequent unattended release remain open. Apple encryption approval remains IN_REVIEW, including France.

Routine releases use the existing source mirror and Kubernetes coordinator: push main, then inspect with python3 scripts/release.py status. Controller 7f423f8 handles bounded temporary GitHub outage recovery. All eight node headroom timers are enabled and their scheduled checks pass. Failed reports, original provider requests and signed application bytes remain retained.

Routine releases: push main; automation builds, verifies, deploys and publishes. Inspect with python3 scripts/release.py status; use resume for a retained failed stage and rollback for recorded infrastructure. See automatic releases and current evidence.

Native iOS installation uses one simulator install request followed by exact executable hash reconciliation within its operation deadline. Initial setup permits at most 240 seconds inside its 600-second budget; upgrade and rollback retain 120 seconds. Delayed container registration does not trigger another install.

Android pixel diagnostics retain only numeric word positions and row geometry when exact rendered message matching fails. They cannot qualify delivery or replace the exact body and its own authenticated status.

The iOS fixture compiler runs alongside owned simulator setup, then XCTest executes the compiled fixture only after both compilation and retained-app installation pass. Both phases share the original setup deadline. Android recognition excludes actual owned button rectangles overlapping the transcript, preserving exact text and message-bound delivery checks.

System filename replacement waits for the actual owned picker field and keyboard, verifies that the old name is empty, then requires the exact new name before saving. Export and cache hashes remain mandatory.

Native iOS input confirms every exact prefix. Long invitations use 64-character keyboard batches; passphrases retain eight-character batches. Only numeric total/confirmed lengths enter diagnostics; command and journey deadlines remain unchanged.

The retained Android cecddf7 run passes exact rendered messages, authenticated acknowledgments in both directions and exact export filename confirmation. It then fails because the system picker has no Show roots control. The helper now accepts the normal Downloads screen directly or opens it through Show roots, using only the two owned DocumentsUI packages and exact Save labels; export hashes remain mandatory. iOS d3a64e5 is independently qualified and running against the original signed apps. Remaining dynamic WebView row queries now bind accessibility elements rather than unstable indices. All 69 focused controls pass in 2.936 seconds; L0 checks 825 paths and API 2/3 contracts remain unchanged. Native results are still required.

Retained iOS d3a64e5 passes visible enrollment, exact identity, initial covered messages, system export, upgrade and baseline rollback with unchanged identity/history/encrypted cache and authenticated acknowledgments. Its final restoration cannot start within the original 600-second compatibility budget. Exact label ancestor queries now narrow file and message row candidates before the existing uniqueness/status checks, removing repeated whole-tree scans without extending any deadline. The failed report remains retained; complete installed qualification is still required.

Native follow-up, 2026-10-04: Android 80d68e5 passes exact rendering, authenticated messages and the normal OS export with the original hash. Its encrypted-cache check searched filesDir, but the pinned Tauri Android resolver uses activity.dataDir; the fixture now checks the owned app instance beneath dataDir and still requires one exact encrypted piece. iOS 96d51b6 passes setup but the first keyboard batch enters zero characters. Input now waits for the actual keyboard and permits one local retry only when the complete previous prefix remains unchanged; partial or different values fail. Original command and journey deadlines, failed reports and signed applications remain retained. All 70 focused controls pass in 3.052 seconds; complete native results remain required.

These notes preserve earlier outcomes and implementation details. Current deployment and worker status are stated at the top of this README; old pending states below are not current launch claims.

Mobile follow-up (2026-10-03): native helper 8eced78 passed all 809 CI controls in 36.064 seconds. The actual iOS current and baseline archives/executables/signing checks passed; its XCTest bridge did not start before its original deadline. Its helper now reports only static compiler locations, numeric transport/HTTP codes and configuration/exit categories, and notices a dead runner immediately. Android reached its first password input, then lost the app before confirmation: text input now waits for the actual IME and exact focused value before Back, using the existing native smoke helper. No production app is rebuilt or resigned. Both original failures are retained; actual installed acceptance remains required.

Current launch (2026-10-03): all 17 infrastructure targets are deployed and healthy. Linux, Windows, both Mac architectures and SDK 0.1.98 are published. Controller 2b2478e is active with both containers ready, no restarts, 171 actual-image checks and 319 cold-pull Kubernetes checks. The automatic source gate passed 808 tests with five existing skips in 36.462 seconds. Android and iOS installed acceptance remain incomplete after explicit native worker failures; their reports are retained. Apple encryption approval remains IN_REVIEW, including France. Linux 0.1.98 is installed and selected on a fresh launcher start; the open desktop still uses its previous executable. Full launch remains open on the mobile gates and external store availability.

Full Python, source-audit and retained-contract gates now run automatically in the existing Stable contracts CI job on a clean Ubuntu worker with full Git history and the controller's pinned dependencies. The original failed workstation run is retained; its scheduler fixture is corrected. Original store lanes reconcile before background artifact work after the active release. Native helper 9970807 passed the independent automatic source gate (809 tests, five existing skips, 37.610 seconds). Its actual installed runs exposed two further adapter issues: the iOS evidence projection omits the complete simulator, which remains in its original hash-bound nested archive; Android reached Create identity but failed before its first password input. The corrected helper recovers the reviewed original ZIP, verifies its original build bytes, and captures/uploads Android startup pixels only before any input. The corrected input adapter passes against both actual cached iOS builds, including every simulator archive, authority, executable, identity and lifecycle reference (operations/actual-ios-original-adapter-658.json). All 16 focused mobile controls pass; L0 checks 820 paths and API 2/3 contracts remain unchanged. Native acceptance remains required. Retained metadata correction: authenticated retained iOS metadata may omit provider download expiry; exact source, run, hash, signing and lifecycle checks remain required. Android verifies actual launch status and retains a startup image only on its fresh owned AVD before any input or invitation. Controller qualification is separate from the immutable native helper binding. Active mobile launch corrections: baseline rotation requires an unchanged source-bound installed acceptance receipt; older publications remain available but cannot displace the configured qualified seed. Android startup records only fixed control counts and error types. Native acceptance and compatibility finish before store serialization. A separate iOS prerequisite worker reads Apple encryption status without uploading or submitting, so a qualified pending approval can release the global flight while the original store lane continues reconciliation.

Combined source gate passes 801 Python tests with five existing skips (223.575 seconds), L0 checks 820 source paths, and API 2/3 contracts are unchanged. The corrected image still needs qualification and activation; Linux, SDK and Apple Silicon Mac 0.1.98 are available.

Remaining launch corrections (2026-10-03, awaiting image qualification): iOS verification now recognizes the exact already-passed original startup/native reports while retaining the failed overall build. Its actual original evidence passes the corrected validator. A later corrected helper must prove its immediate frozen predecessor failed; every older dispatch and negative report stays retained. Android reveals existing accessibility controls below the fold within the original deadline. Native network startup records only public connection-state transitions. A fresh, source-bound encryption-review wait may release the global flight after complete native verification/compatibility, preserving the original iOS submission and automatic polling; no upload, review or availability pass is manufactured.

Launch status (2026-10-03): all 17 infrastructure targets are deployed and healthy. Linux and SDK 0.1.98 are available; the local Linux package is installed at 0.1.98. The qualified b7c0d02 controller is active with two ready containers, no restarts and 283 Kubernetes controls passed. Android and both Mac acceptance checks were dispatched concurrently. Windows retained-baseline startup and the corrected iOS verification returned explicit failures; their evidence remains retained while the other providers continue. The original iOS lifecycle passed. Apple reports the France-inclusive encryption declaration IN_REVIEW, so iOS publication remains externally blocked. The full launch remains incomplete. Discovery stays active with ten-minute settlement.

The active controller connects registered retained Mac/iOS builds to native acceptance and publication, preserves original failed provider outcomes, and allows one corrected iOS verification only after its exact predecessor fails. Android acceptance supports the shared emulator setup; Windows acceptance enables its isolated signing worker. Older dispatched work uses at most one background artifact worker and one background acceptance worker while the active release is incomplete. The original signed application source pair and public API contracts are unchanged.

Source validation passes 793 Python tests with five existing skips. L0 checks 820 source paths; 18 stable/three optional methods and API 2 fixtures remain unchanged. Live and retained evidence is recorded in launch status. Older checkpoints below retain their original outcomes.

Source changes reserve active-release capacity when older provider reconciliation is slow, and prevent fresh acceptance authority outside the active release while retaining existing requests. Android disposable-device setup accepts the shared helper's optional-package argument, and safe static traceback locations help diagnose harness failures. Full validation passes 787 Python tests with five existing skips and L0 checks 820 source paths. These changes still require controller activation and actual native acceptance.

Terminal GitHub rejection before report upload is now retained as a failed provider outcome with its exact run, artifact inventory and revoked request. A separately frozen helper can dispatch one derived follow-up while preserving the original failure; unknown requests, missing successful reports, expired/ambiguous archives and changed evidence cannot qualify. The release-signing environment now permits the frozen release/qualification-* branch family, preserving every existing protection rule. All 31 acceptance controls and 781 full Python tests pass with five existing skips (30.501 seconds); qualified controller activation follows.

Release operations use python3 scripts/release.py status, resume and rollback through the existing Kubernetes coordinator. Defaults combine changes after ten quiet minutes, run three artifact workers and up to six client acceptance workers concurrently, and keep status responsive during a serial deployment. Status shows each worker's stage and deadline. Completed SDK matrices can be reused when all build, test, toolchain, feature and policy inputs match; original provider archives and source labels stay intact. All 778 Python checks pass with five existing skips. The live controller passes 239 Kubernetes controls. All eight native relays, three hosted services and three anchors have updated and passed messaging checks, including the first full interrupted-file canary. All 17 infrastructure targets have passed. Native acceptance, publication and local activation keep the full launch open. Source discovery is temporarily paused while the frozen launch completes. See automatic releases.

Mac packaging can reuse a completed successful GComs native qualification when every source input, executable mode, workflow recipe and native environment matches. The original GChat qualification and failed GComs report stay intact. Packaging still builds the frozen application source, signs and notarizes it, and exercises the installed DMG. Registered follow-ups are collected only after provider success and independently checked against their complete immutable archive, frozen helper and original candidate. This avoids repeating the long native CI gates; actual packaging and installed-network acceptance remain required. The registered 0.1.98 Intel follow-up is queued.

Production registry configuration now lives in release/automation/registry.yaml: replicated retained storage, a pinned existing registry image and placement away from node 5. It is active on node 3 with two healthy replicas. All 926 files (3,898,893,202 bytes) match the source snapshot, six current/rollback image manifests and their blobs verify, and the original volume is retained. The first copy wrapper timed out and restored the old Deployment; its completed copy was then recovered and the source rechecked with the writer stopped before activation. Full validation passes 778 tests with five existing skips.

Registered iOS recovery waits for the retained original simulator's lifecycle pass, then dispatches verification of the unchanged signed IPA once from its frozen helper. A lost dispatch reply keeps the intent for reconciliation. No native application rebuild or signing occurs; upload remains disabled until the normal acceptance/submission stages. Actual lifecycle and IPA verification are still queued or pending.

The installed iOS lifecycle helper now receives its startup option explicitly. Its original failed workflow already retained the signed IPA and simulator, allowing verification to resume without compiling or signing the application again. The original failure remains recorded; actual retained verification is still pending.

The production pull probes now select ghost-bench's authoritative DNS automatically. A DNS correction creates a distinct probe request while preserving the earlier rejection evidence. The corrected controller is live and the actual probe passed before anchor activation.

SDK resumes publish a candidate index at /updates/sdk/<release-id>/index.json and verify those immutable bytes. The older 0.1.98 candidate is now available while 0.1.102 stays latest. Version collisions and changed indexes remain errors. Inventory, SDK and retained Mac packaging tooling changes require controller qualification instead of new application builds.

The original Windows and Apple Silicon 0.1.98 archives now pass independent verification of signatures, frozen source inputs, native CI receipts and installed offline lifecycle/cleanup. The original Windows archive has 58,003,839 bytes; the Mac archive has 71,818,229 bytes. Their provider hashes match. The shared release policy records three existing explicit 64-member capacity exclusions and retains the separate mandatory stress.mls64 gate. Twenty-two policy controls in each repo reject unreviewed and cross-project exclusions and a missing capacity receipt. The original failed independent check is retained. Installed-network acceptance and the remaining native platforms still have to pass; no API changed.

The native network and rollback fixtures now select the existing one-person invitation policy once, then wait for saved enrollment and the active channel projection. The earlier canary repeatedly opened the invitation chooser, so it never obtained a link and timed out after both clients connected. Its failure, grant revocation, profile cleanup and automatic rollback remain retained. The corrected fixture preserves API 2, existing authority and the original delivery, file and total deadlines. All 19 focused network/rollback controls and 702 Python tests pass with five existing skips. Installed-network qualification remains open.

The qualified maintenance image passes 141 actual-image/Kubernetes tests and 219 source hashes. Its real hourly compaction recipe verifies 23 SDK publications, shares 120 identical public copies and recovers 8,409,079,808 bytes. All archive paths and bytes remain; private provider originals stay separate. Available release storage rises to 21,635,923,968 bytes, above the 16 GiB reserve. The independent watchdog and main controller remain unchanged. Kubernetes recovers the transient registry eviction without deleting data or changing disk limits.

The controller's installed-network canary can now reach the eight approved native relay addresses on TCP 4433. Its earlier egress policy allowed public 443/22 and blocked the actual relay port; probes timed out. The corrected policy adds only the eight relay /32 addresses and preserves the existing rules. All eight connection probes pass from the actual controller. The failed journey, grant revocation, profile cleanup and automatic rollback remain retained. The normal inventory revision resumes the original rollout; covered messaging/file and recovery acceptance still have to pass. No application API changed.

Completed public SDK archives now have source-bound duplicate compaction. It verifies the original build and publication receipts, every selected archive hash and stable provenance before sharing public copies with identical ownership and permissions. Private provider originals remain separate. Every URL, byte, mode and receipt is retained. Bounded maintenance visits recent publications; tampering, path escapes, symlinks, FIFOs and replacement races fail closed. The live scan estimates 8,409,079,808 duplicate bytes across 23 publications; actual reclamation remains pending the qualified maintenance image. All 21 compaction tests and 696 full Python checks pass with five existing skips.

The corrected host installer is installed on all eight native hosts, preserving service policies and restricted SSH keys. The original qualified binary starts as gc-relay after the normal inventory correction. Its following network canary times out before the first client connects; the grant is revoked and the relay is rolled back. The original failure and correction remain retained, and all 17 targets remain healthy. Fleet/client activation is still required.

The original signed Linux 0.1.98 workflow passes both full native CI gates, signed packaging, actual infrastructure image tests and packaged desktop/CLI profile lifecycle and cleanup. Its complete 875,492,915-byte provider ZIP verifies independently against the original provider digest; the unchanged release handler checks GPG/updater signatures, source inputs and lifecycle receipts. All 12 infrastructure file hashes and 125 actual-image tests verify. The automatic rollout reaches relay 1, rejects activation and restores the previous binary; all 17 targets remain healthy. Installed-network acceptance is still required.

The host installer fixes that activation failure: its private umask had created binary directories with mode 0700, denying traversal to the service's gc-relay user. Preparation now repairs those executable directories to 0755 while keeping installer state private; symlinked binary directories fail closed. Seven host installer tests and 687 full Python checks pass with five existing skips. The corrected helper is now installed on the eight native hosts; the original rollout resumes after its normal inventory correction. No application API or protocol changed.

Controller generation 59 (3792ae8) is active with two ready containers, zero restarts, 130 actual-image/Kubernetes runtime checks and 219 verified source hashes. Storage recovery, recent-candidate polling and unique worker logs are active. Linux/Windows portability passes with independently verified original provider archives; the previous controller and five private baselines are verified. The independent watchdog succeeds. The scheduled hourly maintenance run passes automatically on the controller's node, verifying three native artifacts and 17 retained images with every original archive and path preserved. All 685 Python tests pass with five existing skips; L0 checks 802 paths, 18 stable/three optional methods remain, and API 2 fixtures are unchanged.

The retained original iOS simulator app passes actual cold launch, relaunch and its native profile/background/reopen XCTest on the available Apple Silicon Mac with Xcode 26.2. Its executable is unchanged and is neither rebuilt nor re-signed. Both original 15-second liveness checks pass, followed by one native XCTest with no failures or skips (98.556 seconds); owned-device cleanup passes. The original failed provider verdict remains retained. Native messaging, fleet/client activation and a subsequent unattended release remain required.

Android build 1115 passes its original provider run automatically; the prior 1113 result remains retained. Independent verification checks the complete 161,556,865-byte archive and both exact Git source archives, 23 retained references, eight native ELF entries with 16 KiB alignment, eight JVM tests and the installed profile/background/reopen and invitation-picker journeys. Signing and owned-emulator cleanup pass. Live delivery acceptance is still required. No SDK 1.0 qualification or whole-fleet activation is claimed.

The original Linux qualification job for release 0.1.98 passes both full native workspace CI commands on frozen sources 52d28d7/8f8fdb3. Its original provider ZIP, source pair, derived Rust/npm inputs and every linked log hash verify with the unchanged qualification handler. The logs record zero failed Rust checks, 680 GChat Python checks with one existing skip, 211 GComs Python checks and both successful dependency audits. Signing and the infrastructure bundle are building.

The original Intel cold-reopen diagnostic passes five consecutive runs on unchanged GComs 138b071, under the original 15-second assertion. Each unskipped native test completes in 5.61–6.81 seconds; its source/test hash matches the original failed provider build. That earlier failure remains failed, and current Mac application qualification is still required. No application or API changed.

Earlier controller implementation checkpoints retain their original observations.

Controller generation 58 (3fec49a) is active with two ready containers, zero restarts, 125 actual-image/Kubernetes runtime checks and 219 verified source hashes. Its previous digest and five private baselines are verified; the independent watchdog succeeds. Retained-image compaction verified 15 images and recovered 4,894,228,480 bytes without removing any paths, bytes or permissions. The hourly recipe passed on 16 images, recovering another 453,869,568 bytes. Native Linux/Windows tooling portability passes with retained provider archives.

Storage-blocked builds now have a readiness-based recovery path: sufficient capacity resumes the original request without a controller revision change. Older work can be superseded only before its external action; active requests and receipts remain authoritative. Polling visits recent candidates first while retaining older active work. All 26 focused recovery controls and 684 Python tests pass with five existing skips; L0 checks 802 paths and API 2/3 contracts remain unchanged. Actual-image qualification and activation remain pending.

Worker logs now remain distinct when the host clock returns the same timestamp; the original build request still reconciles and both logs are retained. The scheduled compactor also follows the live controller's node so its existing ReadWriteOnce volume can attach. The original scheduled run never started and its placement failure is retained. All 685 Python tests pass with five existing skips, including 27 coordinator controls and the fixed-clock regression. The corrected native Windows rerun and actual-image activation remain pending.

Native workers now install the pinned cryptography==50.0.2 test dependency. Mac/Windows build qualification retains signatures and installed offline lifecycle; the required live network/file/rollback journey runs after fleet deployment with fresh acceptance authority. iOS cold launch avoids a redundant terminate request while retaining the 60-second deadline, both launches, liveness and cleanup. A retained-app startup probe and an unchanged-source Intel machine-reopen diagnostic are available. All 673 Python checks pass with five existing skips; native execution of these worker corrections remains pending. Original failures and provider archives remain retained. API 3/API 2 coexistence, RPC 1, IPC 26, the 64-member limit and covered receipts are unchanged. Fleet/client activation and a subsequent unattended release are still required before SDK 1.0. See docs/evidence/stabilization-20261001/live-controller-and-acceptance.json.

Earlier controller checkpoints below retain their original observations; current activation and pending work are described above.

Rollout selection now requires a qualified Linux target when the production inventory needs its infrastructure bundle. A newer verified mobile artifact cannot replace the desired deployment while that bundle is missing; the pointer advances only after the exact-source infrastructure receipt passes. Active rollout ownership and monotonic versions remain unchanged. Five regression cases and the full 672-test Python suite pass with five existing skips. The corrected controller image still requires its actual-image gate before activation.

Controller generation 56 (29bd39f) activates complete worker copy cleanup. The actual image and independent Kubernetes job pass 113 checks and all 219 source hashes. Both containers are ready with zero restarts; the previous digest is retained/repaired, five private baseline archives are verified and the independent watchdog succeeds. The actual HTTPS/TLS transport delivers authenticated multiple chunks, recovers the exact fixture hashes and removes keys, native copies and public ciphertext. This probe uses no real host grant and qualifies transport; the real native provider/workflow and application journey gates remain open. Evidence: docs/evidence/stabilization-20261001/live-controller-and-acceptance.json.

Controller generation 55 (add203a) activates encrypted retained acceptance. The actual image and independent Kubernetes job pass 113 runtime checks and 219 source hashes; all five configured private baseline archives are verified. Both containers are ready with zero restarts. The independent watchdog now uses the previous qualified schema-2-capable image and passes a live run. The handoff's actual HTTPS/native-worker check remains open.

Cleanup additionally removes the driver's owned current/baseline/peer native ZIPs and extractions after use, preserving diagnostic reports and the coordinator's original private archives. A required receipt covers those copies as well as the temporary key and decrypted transport files. All 667 Python checks pass with five existing skips; the strengthened cleanup image is being qualified before activation.

Published acceptance ciphertext directories remain traversable by the web server under the production private umask. The original archives and encrypted-response journal keep their private permissions. All 28 focused acceptance controls pass; actual-image qualification remains pending.

Retained native acceptance now waits for a verified running worker before issuing its existing host-owned canary grant. The worker publishes an ephemeral X25519 public key in a source-bound ready artifact; the coordinator encrypts retained provider ZIPs and the short-lived bootstrap invitation for that worker. Original ZIP hashes, provider runs, signatures and native journey gates remain mandatory. Completed acceptance must prove removal of its private key and decrypted copies. Lost publication reuses the same sealed response and original grant; it cannot renew authority. Existing dispatched requests preserve their original worker, request and secret delivery. No chat API, client contract or channel key changes. The controller and native workers explicitly pin cryptography==50.0.2 (previously a transitive controller dependency) for X25519, HKDF-SHA256 and AES-256-GCM. New configurations set delivery_url to https://gchat.boo/updates/acceptance; legacy configurations remain readable. Only ciphertext is published there. Original provider ZIPs remain private in release state, including retained seeds.

All 667 Python tests pass with five existing skips; L0 checks 802 paths and the 18 stable/three optional methods retain unchanged API 2 fixtures. Twelve new controls cover real multiframe encryption, tampering, source/queue binding, replay, retained originals and private cleanup. Actual-image qualification and activation of this new delivery path are pending; generation 54 remains active. See the release checkpoint.

Controller image builds now include an automatic runtime gate. The build uses committed Git bytes, verifies the actual image's source inventory and baked controller revision, and runs the release/acceptance/rollback/compaction suites without network access, keys or state mounts. Failed or skipped tests prevent bundle completion and retain their log. New schema 2 infrastructure archives include controller-runtime.json and controller-runtime.log, bound to the original source and image configuration; original schema 1 bundles remain readable. All 655 Python tests pass with five existing skips. The exact image passes 101 runtime checks and 217 source hashes. The gate is active in controller generation 54; rollback retention/repair and the independent watchdog pass.

Release storage compaction is active in controller generation 54 (ea4fdf8). It verifies completed source receipts and original provider ZIPs before sharing identical extraction and verification copies with hard links. The first live run retains every path, byte, permission and original archive across 123 builds while reclaiming 15.62 GiB. All seven platform builds resumed after headroom recovered. The hourly CronJob (17 * * * *, no concurrent runs) passed its first live recipe check. The actual image passes 101 independent tests and all 217 source hashes; both controller containers are ready with zero restarts, rollback is retained and repaired, and the independent watchdog succeeds. Five compaction refusal and retention controls pass. See the live receipt. Actual storage remains 128 GiB; a requested 160 GiB expansion is pending after Longhorn refused it under existing disk limits. The headroom gate remains in force. Installed acceptance and qualified fleet/client activation remain required.

Stable client contracts

The numeric iOS allocator is active in controller generation 49 (e0e7fb9), with 81 independent checks, both containers ready and the previous image retained. Live discovery exposed an older 1.0.103 reservation for the same source pair; replaying it prevented a valid replacement. Discovery now checks the original manifest digest and other fields, preserves that invalid row and ref, and reserves a new valid version on a distinct immutable ref. Lost publication retries reuse that new reservation. The real Git/ledger regressions and 637 Python checks pass with five existing skips. The retry fix is active in generation 50 (defc0e1), with 82 independent checks, both containers ready, retained/repaired rollback and a successful minute watchdog. It automatically reserved build 1.1.0; that native run passed numeric validation and later failed its unchanged 60-second simulator launch limit. Its verified archive and successful owned-device cleanup are retained. The next automatic reservation, 1.1.2, includes the latest SDK fixes and is building. The original 1.0.100 worker failure and later invalid rows are retained in the allocation checkpoint.

Retained acceptance now binds the signed application and its qualification worker independently. The worker uses a full commit and a checked immutable reference; its report must match that commit's actual tree and the application's original source manifest. A corrected worker may follow only a completed failed attempt with its archive, run and revoked grant retained. An unknown dispatch keeps its original request and worker across controller updates. Acceptance workflow edits require fresh infrastructure qualification. Image validation exposed three legacy fixtures that implicitly depended on an unset controller revision. Those cases now select legacy behavior explicitly; a new control checks the production default and rejects moving refs. The original failed image Job is retained. Controller generation 52 (5db2dbe) now passes 87 independent checks, including all 212 included source hashes and prior-image restoration. Both containers are ready with no restarts and the independent watchdog succeeds. Actual installed acceptance and qualified fleet/client activation remain required.

Retained iOS lifecycle rerun 37017329318 passes using the exact native visibility Switch. The entire provider archive is verified; app 1.0.87 keeps the same binary hash, is neither rebuilt nor re-signed, and uses no Keychain signing fixture. Normal Show/Hide, exact input, background/manual unlock, remembered reopen, original timing and cleanup checks pass. Original run 36862393296 remains failed. This verifies retained profile lifecycle; network messaging, upgrades, push and physical devices still need their own acceptance. See the control checkpoint.

Status updates to reviewed iOS/SDK receipts no longer reserve application versions or infrastructure images. Exact file names are classified; unknown evidence, Rust, locks and packaging changes still invalidate artifacts. The real Git classification controls and 637 Python tests pass with five existing skips. The refinement is active in controller generation 51 (421be37): 82 independent checks pass, both containers are ready with no restarts, the previous image is retained and repaired, and the independent minute watchdog succeeds. Client and fleet activation remain subject to the native and installed acceptance gates.

The service retains GChat API 2 attachments alongside API 3 for the stable major. Typed RPC service 1 retains its original methods. Optional methods are advertised as chat.method.<id> in instance capabilities; clients select detailed history, search and network replies only when advertised. Advertisements grant no permissions. Older clients receive their original delivery states: service acceptance is local acceptance, failure is unknown, and only a verified recipient receipt is delivered.

scripts/check_contracts.py checks retained contracts and released source hashes. scripts/check-released-client.py compiles the frozen API 2 client and exercises the current local server. Both are required by native CI. Breaking wire changes need a separate major service and coexistence with the stable service; compatible features do not require coordinated client and daemon upgrades.

Automatic deployment and activation work

The live Kubernetes release coordinator gates publication on a fresh, exact-source deployment observation. Its configured 17-target inventory serializes native and Kubernetes services, retains rollback artifacts, and preserves configuration and relay identities. Acceptance rotates to the most recent available predecessor with a retained, source-bound installed acceptance receipt. The initial qualified baseline remains a fallback when an older publication lacks that receipt. Reviewed GComs status documents preserve both application and infrastructure identity; unknown inputs still require fresh artifacts. These controller changes are active in generation 52. New client/relay activation and native acceptance remain subject to their qualification gates; see current work. Controller source 5db2dbe is active with 87 deployment/acceptance checks, a successful independent minute watchdog and retained previous image. Mobile acceptance recipes and verified retained Android/iOS baselines are configured. iOS passphrase qualification uses the native visibility Switch and normal Show/Hide actions to check the exact entered value within the original ten-second assertion. The pinned watchdog also repairs the exact retained controller digest through scoped registry access; the original blocked connection is retained as a control. Native SDK Linux and Windows recovery pass; fresh native size/Mac and installed acceptance remain open in the operational checkpoint.

The Linux release workflow also builds a retained native-service/OCI bundle. It runs full paired qualification separately from signing and packaging. The packaging job verifies the same-run qualification archive and both source/dependency bindings before accessing signing keys. Failed attempts retain separate evidence; an incomplete qualification cannot start packaging. Native run 36844555101 passes qualification and packaging. Its retained source pair is not relabeled as a newer release. The release controller uses skopeo to publish digest-pinned images from the verified provider archive; the build worker requires Docker. These infrastructure steps remain subject to live deployment and installed-network qualification. The bundle retains service, controller and push gateway images and binds their exact source pair. The controller includes checksum-pinned kubectl 1.35.2. Native deployment uses a forced SSH command and a root-owned service inventory; the controller key can upload verified binaries and operate only those installed units. The operator's Kubernetes account is scoped to the managed workloads. Only the coordinator mounts its rotating token and restricted SSH key. Cold pull jobs run in the separate test namespace. Linux installers now carry both gchat-desktop and gchat; the worker checks their hashes and isolated service lifecycle before publication. The controller uses the same Ubuntu 24.04 runtime as the Linux worker. An optional root-owned canary policy issues bootstrap-only invitations lasting at most one hour; retries reuse the same grant and cleanup revokes it. Canaries cannot allocate public names or select caller-supplied authority. release_network_canary.py extracts its CLI from the provider archive bound by the successful build and verification receipts. It requires bidirectional covered recipient acknowledgments, 16 MiB interrupted recovery and the same identities after reopen. Interrupted canaries revoke their grant and stop only their recorded disposable processes before retrying. These service checks do not qualify rendered UI behavior or application upgrade/rollback on another platform. Before a Kubernetes mutation, the worker retains the previous pinned images and their layers. Rollback repairs those layers from storage. A separate minute-based recovery job watches controller updates, restores the previous image after a failed start and resumes interrupted rollback. Keep its last healthy image pinned when updating the main controller. Image configuration digests come from the retained Docker archive. This supports Docker installations that return an attested image index from image inspect. Archives with native OCI layouts use that representation so configuration bytes are preserved; classic Docker archives explicitly convert their manifest. Previous images are retained with their original Docker or OCI manifest digest in directory transport. Previously recorded valid OCI rollback receipts remain supported. The gateway build uses GComs' reviewed, hash-bound context. Its initialization and runtime containers advance together. release_inventory.py renders all eight native relays, both bootstraps, hosted channels, three Kubernetes anchors, catalog, push and controller from the operator's installed policies. Each target requires a real canary; controller activation follows the other services. The recovery job shares the controller's node and volume without repeatedly changing file ownership.

release_acceptance.py dispatches platform-specific desktop and mobile acceptance from distinct retained releases. It creates disposable state with the baseline, then upgrades, rolls back and restores the current application, requiring identity, history, encrypted cache and covered delivery throughout. Its current/baseline source, archive and installed binary identities must differ. Failed cleanup still stops the remaining owned children and retains a failed report. It runs the same 16 MiB network recovery gate and refreshes all eight relay observations. Only a private expiring bootstrap invitation reaches that worker. Completed receipts can refresh without discarding evidence; an unknown dispatch is reconciled before another worker can run. Initial baselines may be pinned in /config/acceptance.json; otherwise the controller selects the platform's latest normally published native provider. Missing baselines or native/mobile evidence keep publication waiting.

mobile-acceptance.yml installs the retained Android split APKs or iOS Simulator app on a fresh owned device and drives ordinary UI, deep links and the system file picker. It checks rendered history, identity, unchanged encrypted cache and covered delivery across baseline → current → baseline → current, then runs the same bounded 16 MiB interrupted transfer. The peer is the qualified current Linux or Apple Silicon package for that exact pair. Only the iOS XCTest runner is built; the applications are neither rebuilt nor re-signed. Component checks pass; native execution remains required; the producers and initial mobile baselines are active in the qualified controller. The generated coordinator config includes mobile acceptance before either store submission. Missing matching peers or baselines keeps that stage waiting. Changes to the explicitly reviewed acceptance drivers and GComs status documents request fresh qualification without rebuilding identical apps. Unknown files, packaging scripts and native application workflows remain artifact inputs.

Desktop updates activate after 30 seconds without input when drafts, sends, files and foreground work have cleared. Other windows and daemon activity can defer activation. A Linux fleet service can explicitly opt in with GCHAT_OWNER_MANAGED_UPDATES=1; the owner-authenticated maintenance protocol still checkpoints the instance, observes process exit and restarts only the verified owning GChat user service. Normal unlock may be required after activation.

Hosted sends, policy changes and committed consumer receipts wake the application worker immediately after durable local acceptance. Wake-ups coalesce while work is in flight; idle polling remains once per second and transport stays covered. The worker does not wake routing recovery or claim recipient delivery early.

Hosted and contact files (qualification in progress)

The shared file controls now select the explicit hosted/contact transfer profile for those conversations and preserve the legacy channel/PM cache. Piece data uses bulk transport; verified download-completion acknowledgments stay covered. Contact blocks replace the file worker's authorization set before the command completes. The new profile has a separate encrypted .pieces.v2 cache. Both caches share one GChat admission budget. File permissions follow the conversation: direct message permission for contacts and hosted-channel permission for hosted rooms. End-to-end, capacity and native release qualification is still in progress on the IRC parity branch.

Independent contacts and local IRC workflows

Use /contact card to share your signed card deliberately, then /contact add alias card to save a peer. Both sides must add each other. /contact open alias opens a persistent conversation independent of all channels. /contact update accepts only the same identity; /contact verify alias fingerprint records a manual comparison. No global directory or automatic scoped-identity linking is introduced. /block persists across reopen, stops new sends and suppresses new inbound replies; it cannot recall packets already admitted to the transport.

Text, /me and /notice use durable application messages and exact-content, peer-authenticated receipts. A notice never triggers an automatic notice reply. /away reason, /back and /presence on|off share presence only with the current contact, with ten-minute leases and seven-minute renewal. Sharing defaults off; unknown or expired presence is not proof that someone is offline.

/mute on|off suppresses a conversation's unread indicators while retaining history. /ignore member and /unignore member affect only the current scoped identity. /highlight add text|remove text|list marks matching incoming messages. /alias name /command arguments creates a bounded single-command alias; arguments are appended literally and aliases cannot replace built-ins or run shell commands. /unalias name removes it. Contacts and preferences use separate encrypted .contacts and .preferences sidecars that older GChat clients leave untouched. Signed-card import commands have a 192 KiB limit; ordinary message limits remain.

Hosted channel work in progress

The opt-in /hosted create #name nickname [private|public|code] and /hosted join invitation #alias nickname commands use the installed network's hosted MLS service. Private creation is the default. /help in a hosted channel lists moderation, invitations, roles, presence and channel commands. /whowas nickname-or-scoped-id searches this channel's retained name observations, including departed members. It keeps at most 2,048 observations and returns at most 64 matches; it does not query other rooms or discover global identities. Operators can explicitly publish a directory name with /publish name, and withdraw it with /publish --remove. Use /hosted list [cursor] anywhere, or /list in a hosted room, to browse the installed network. Public admission alone does not publish a room. Private/secret rooms and encrypted topics stay out of listings. Topic, nickname, action, notice and signed activity share the same desktop/TUI API. Message status distinguishes queued, service accepted, recipient delivered and failed. A durably queued local message appears immediately, even while a service request is stalled. Service acceptance never proves recipient delivery.

Hosted history uses a separate encrypted .hosted-history sidecar; older GChat versions cannot rewrite it. Existing channel archives and scoped private messages retain their identities. Unlock alone does not create hosted history. IRC control formatting is rendered with bounded styles, never HTML or terminal escape output. This task branch requires its paired GComs IRC-parity branch. No dependency or installed-release update is implied. Newcomers see Topic pending until an authorized member returns to hand off the encrypted topic; invitations contain no extra metadata secret. Independent-file transfers and full network/native capacity qualification remain in progress. Channel owners can open Channel recovery… from the users panel or channel details, or type /recover-membership. Review missing acknowledgements, select members to revoke, and confirm. History and unconfirmed messages stay; removed members need fresh invitations. Recovery never marks those messages delivered.

Release tooling has a separate Linux/Windows portability workflow; it does not compile applications or qualify installed releases. Mac artifact paths retain POSIX ZIP syntax on all hosts. The coordinator daemon remains POSIX-only.

Windows candidate 36 can be diagnosed with the retained-installer workflow, without compiling again. Its interrupted-transfer deadline failure is preserved; a later run must meet the same budgets and cleanup checks. iOS retained-verification archives also retain the original failed startup report referenced by recovery.

Retained iOS releases can recover from a simulator launch timeout using the original signed IPA and unchanged simulator app. The original failure remains retained; fresh native tests, profile/reopen lifecycle and complete cleanup must pass before verification can authorize upload. No application rebuild or re-signing is performed by that recovery path.

Generated release configurations keep installed acceptance receipts in separate platform directories. A passing Linux application check cannot authorize a mobile release; SDK qualification remains separate. See automatic releases.

Mac release CI now includes the same bounded 16 MiB interrupted-file and authenticated-message journey as Windows, using disposable profiles and a protected fixture invitation. Existing releases retain their original evidence; this automation change alone does not qualify or publish a new installer.

Current paired GComs source selects responsive profile 46: messages are eligible immediately, with independent randomized interactive cover. Timing/activity privacy is unqualified. See production policy; this source change is not a claim that installed/store artifacts have been updated.

Mobile installed acceptance uses an uppercase fixture nickname with exact native input confirmation. Simulator installs verify the retained executable hash; a timed-out install can reconcile or retry once. Initial setup may use up to 240 seconds within its existing 600-second budget, reserving 120 seconds for runner readiness; upgrade/rollback installation keeps its 120-second limit. No app binary is rebuilt for these worker corrections. See automatic releases.

Mobile worker observations use complete readable canaries across adjacent wrapped transcript lines, preserving random body entropy and authenticated recipient binding. iOS fills owned test fields through the normal system Paste action, verifies the exact result, and clears the local-only clipboard immediately.

Owned iOS workers use simctl to copy and verify each input in the fresh simulator before normal Paste, then clear that simulator clipboard on success or failure. Android can continue an already populated invitation form only for the exact reserved invitation.

Simulator installation reserves time for container lookup and hashing within the existing deadline. Android receipt observation uses two normal OCR segmentation modes and adjacent smaller-font receipt lines; complete exact message and delivered status remain required.

Android export workers enter the exact filename through the normal system DocumentsUI picker with explicit package and focus checks. Other applications cannot receive fixture input.

Local readback on 2026-10-04 verifies that the running production-profile executable matches the managed GChat 0.1.98 installation. The source-mirror and package-update timers are active.

iOS export fixture recovery stages the same exact passphrase for normal reconnect after the OS picker and clears the owned simulator clipboard even when export fails.

Current mobile workers select the existing Android Readable font through normal UI. iOS uses the normal keyboard in eight-character chunks, verifies each exact prefix, and uses normal password visibility controls for exact confirmation. The current input path has no clipboard or Paste-menu dependency. Original failed worker reports remain retained.

Android native OCR groups words by physical row overlap rather than sparse recognition block IDs. Exact full bodies and their own delivered status remain required; diagnostic word counts do not authorize acceptance.

iOS acceptance reads only the exact identity and safety-number static texts and binds accessibility results by element identity, avoiding unstable index scans. Public diagnostics retain only counts. See Apple’s query documentation.

Android body-row observations account for lowercase x-height within ordinary line spacing. Distant rows, changed words and unrelated delivered statuses remain refused; a flat-row text match is diagnostic only.

The Linux turnover_daemon fixture requires bootstrap input only for fresh profiles. Reopened profiles reject startup seeds and inbox cards, and recover through their encrypted retained directory and authenticated relay re-entry. Fixture bundle renewal runs only for freshly created profiles. This preserves the retained-state check in GComs' gchat-turnover.py --mode smoke journey. The validated smoke record covers both-direction acknowledgments, file integrity and delivery after retained profile reopening; it does not qualify a new installer or fleet deployment.

The standalone GComs Android agent has its own workstation deployment lane. Its reviewed release operations do not rebuild these application packages or unchanged SDK matrices; runtime and unknown inputs retain ordinary qualification.

Typed chat operations now wait for their own saved RPC result before reporting completion. A reusable invitation returns its link while the public operation history keeps the redacted receipt. Repeating the same operation ID, including after reopening, returns the saved result without consuming another invitation slot. The 64-invitation limit and component permissions are unchanged.

A stopped RPC worker no longer blocks a later update checkpoint when its outcome is unknown or its completion could not be saved. The durable admission stays unknown, and retrying the same operation cannot repeat its effects. Active workers and pending completion writes still block maintenance. The focused regressions exercise an effect followed by uncertainty or panic, and a failed encrypted-store write; see validation.

Release operations

The release controller supervises active local work every 10 seconds, GitHub jobs every 2 minutes and store review status every 15 minutes. Confirmed provider quota exhaustion creates a durable shared cooldown (15 minutes to 6 hours, honoring provider reset times); ordinary permission errors remain blocked. Status includes the waiting reason and next check. Accepted submissions retain their original operation IDs. Controller-only updates use independent image qualification and the managed deployment path, preserving application versions. An explicit Intel-only test correction can reference the existing deployment only after unchanged-runtime provenance and fresh health/load evidence are verified; its own native qualification and installed acceptance remain mandatory.

Controller maintenance retains each inventory revision's activation and rollback evidence separately, including successive controller-only updates to one native release. The independent watchdog follows the same frozen activation directory; rollout qualification includes the immediate-predecessor rollback regression.

Portable provider fixtures do not depend on optional HTTP packages installed on the build host. Native failure follow-ups identify the original test/job and keep their earlier snapshots when the diagnostic worker changes. Interrupted immutable artifact downloads retain their verified request binding and resume the exact remaining byte range under the original collection timeout.

Controller qualification keeps scratch non-executable. Its fake transport fixtures run through the Python interpreter and still exercise actual child processes and bounded pipes. Failed image checks retain a separately named failure artifact, while deployment continues to require the successful, source-bound controller bundle.

Apple encryption review keeps being observed when a newer deployment is selected. That retained-request poll is read-only: approval alone cannot upload, submit or publish the app. Status uses the newest bound review observation while retaining the original no-upload proof and publication budget.

Automatic follow-through is deployed as controller ca310e6: seven-platform delivery records, source-bound diagnostics, bounded recovery, owned follow-ups and desktop notices are active. The IRC alignment delivery is still 3/7 published at this checkpoint. Linux217, Android1231 and SDK222 contain it; both Macs and Windows still advertise176, and no iOS availability is confirmed. Use live release.py status for subsequent progress. Deployment and publication evidence.

F5 closed deployment scheduling,2026-10-15: an exact source-bound blocked deployment can release the routine build flight after its rollout owner and every mutation/rollback have settled. Its original failure, artifact and dispatched worker receipts remain unchanged. This prevents verified sibling platforms from pinning a repaired successor indefinitely. See release operation.