Every change.In writing.

Closed a ratchet message-key reuse window under fast successive sends.

Closed a TOCTOU on the SecureString constant-time compare.

Argon2id parameters increased: m_cost 32 MiB → 64 MiB, t_cost 2 → 3.

Hardened the release build pipeline; artefacts are now signed with SHA-256 + ML-DSA-65.

Sealed-sender disambiguation: relay no longer sees recipient timing patterns.

Fixed a disappearing-message race that could skip the prekey wipe.

Dev-mode verbose envelope error log (was leaking envelope size in debug builds).

Closed an ICE-candidate replay accepted at the exact 30 s boundary.

WebRTC ICE candidates now individually Ed25519-signed (was: signed envelope only).

Anti-replay window narrowed from 60 s → 30 s; sequence-bound validation added.

Short Authentication String (SAS) over verified channel for call setup.

ML-DSA-65 signing alongside Ed25519 for every handshake transcript.

liboqs integration via JSI bridge; native ML-KEM-768 / ML-DSA-65 on iOS & Android.

Closed an Argon2id salt-entropy bias on first-launch derivation.

Closed a dual-signature transcript canonicalisation mismatch that could allow signature substitution.

HKDF info label format: "lumes-v1-..." for forward compatibility.

Duress PIN with silent wipe; bypass for USB/MDM/custody hooks.

Four-layer PIN enforcement on every secret unwrap.

SecureString in-memory class with sodium.memzero on closure return.

Argon2id-wrapped envelopes for all long-term secrets (Realm key, identity, prekey bundle).

Closed a dev-mode envelope-size leak in debug builds.

12-layer cryptographic stack documented in Docs.

Full Signal-style Double Ratchet (3-step: DH out, chain advance, mk derive).

ChaCha20-Poly1305 AEAD on every message body.

Realm DB encrypted with 512-bit derived key.

Protocol version bump: keyset rev 0x0e2a.

Forward-secure delete: mk + spk + gsk zeroed (not just plaintext).

Group symmetric key rotation every N messages or on membership change.

Memory leak in ratchet state cleanup on session close.