What's new — Flamenet Messenger

2026-09-07

android 0.12 relay

Messages that would not send, and a whole lot of Android catching up.

Fixed — Messages to someone who had reinstalled their app could fail with “Something went wrong reaching that server” — and the server was fine. Your phone was quietly refusing to send, because it could no longer confirm the other person's keys were the ones on public record. It can again, and messages go through.
Fixed — When your phone does refuse to send, it now says why. Before, anything it could not explain came out as a network error, which sent people off to check their signal for a decision the app had made.
Fixed — A photo you sent as a file kept the location it was taken. Photos sent the usual way never did. Both are stripped now, on every path.
Fixed — “Erase and start fresh”, offered when stored keys cannot be read, did not actually start fresh — it left the unreadable keys in place and came straight back to the same screen. It works now.
New — Reply to a particular message, so an answer that arrives an hour later still makes sense.
New — Files and Wallet have their own place in the bar, instead of being buried in your account.
New — Settings for notifications and for how the app looks, neither of which Android had.
New — You can report a story, which there was previously no way to do.
New — If a network blocks the app, you can now connect through a helper server — and hand the one you use to a contact who is stuck behind the same block.
Changed — A new look: one dark theme that shades from purple through blue into black, a new app icon, and text you can actually read on top of it.
Changed — The call screen is quieter — no boxed-in panel, no rings around the avatar.

If you run your own relay

The device directory now serves the account's address alongside its devices. Clients need it to check a published key against the transparency log on any send that does not open a new session; without it they compute the pre-address subject, match no leaf, and refuse to send. Update the relay before telling anyone to update their app.

2026-09-05

android 0.10

Three things that failed quietly, and now don't.

Fixed — Signing in could sit there saying nothing at all — no error, no spinner that ever finished. If it cannot get through now, it tells you, instead of leaving you to guess whether the app is broken or your password is wrong.
Fixed — If the record that proves this phone's keys never quite finished being written, people could be refused when they tried to message you — with a warning that made it sound like somebody was impersonating you. It could not be undone, and restarting the app did not help. The app now checks on startup and puts the record right.
Changed — Sending a picture with the camera button leaves out where it was taken. Sending it as a file does not, because a file is sent exactly as it is — and now the screen says so before you choose, rather than leaving the safer option looking like the shortcut.

If you run your own relay

Nothing to do. The startup repair for the transparency log reads /e2e/log/device and only republishes when a device has no entry, so it costs one request per launch and nothing at all on a healthy deployment. A relay too old to have that route is handled — the check fails quietly rather than reporting a problem the person does not have.

2026-09-05

android 0.9

The things you kept reaching for and couldn't find.

New — Change a message after you've sent it. It arrives on the other phone as the same message, marked edited — not as a second one nobody can tell apart from the first.
New — Search everything you've ever said, across every conversation. It happens on your phone, because the server has never been able to read a word of it and still can't.
New — Forward a message on, pin the ones worth keeping at the top of a conversation, and react to one without writing a reply.
New — Put a timer on a single message instead of the whole conversation. If somebody screenshots one of those, you'll be told.
New — Stories grew up: several pictures as one sequence, a story just for a group, replies, and mentioning someone by name. Your own posts are kept in a private archive so you can save one before it goes.
New — Report or block someone from a story. A report goes to whoever runs your server, and the app tells you plainly that your copy of what you're reporting travels with it — there's no way for the server to look at it otherwise.
New — Files and Wallet are on the phone now. Your vault opens with the Flamenet passphrase you already have, and you can send a file straight into a chat with the label it carries.
New — A half-written message is still there when you come back to it.
Fixed — "Unsend" did not unsend. It removed the message from your phone and left it on theirs, while the word promised otherwise. The button now says what it does.
Fixed — A message that expired took its words with it and left the picture or the voice note sitting on the phone.
Fixed — A call that was refused because the other person's key had changed just failed. It now says that's why, which is the one case where it matters.
Fixed — Files asked you to invent a second secret it never needed. It asks for your Flamenet passphrase.
Fixed — A contact with no address was listed as the word "null", and a link saved to the vault looked like it had done nothing at all.
Changed — The app checks the server's identity itself rather than trusting the certificate alone, forgets key material the moment it's finished with it, and keeps count of every message that had to travel the less private way — with a switch to refuse those instead.
Changed — Guessing at the app lock gets slower the more you get it wrong.

If you run your own relay

Story and message reports land in a new content_reports table, and a report carries the reporter's own decrypted copy of what they are reporting. That is the one place readable user content exists on the server, it is there because somebody chose to put it there, and no route reads it back — you read it out of band. Plan for it before you turn moderation on, and treat that table as you would any other sensitive record.
Nothing else here needs anything from an operator. Clients update themselves from downloads/android-latest.json as usual.

2026-09-05

relay

The server can no longer hold a readable message.

Changed — The relay has no route that accepts a readable message, and no table for one to land in. The key it used to hold over those messages is gone with them — so there is nothing on the server for anyone to decrypt, including whoever runs it.
Fixed — A group of any size was quietly limited to about five messages an hour. The limit counted one unit per recipient device rather than one per message, so the bigger your group the sooner you were cut off. One-to-one chats were never affected.

If you run your own relay

FN_AT_REST_SECRET, FN_MESSAGE_RETENTION_DAYS and FN_READ_MESSAGE_RETENTION_DAYS are no longer read. Leaving them set is harmless; delete them when convenient.
A migration drops the messages table. It was empty on this deployment, and the migration does not preserve rows — check yours before upgrading if you ever enabled the plaintext path.
The send rate limit now counts one unit per message rather than one per recipient device. If you lowered FN_SEND_RATE to compensate for group fan-out, you can raise it back.
CI now pins the flamenet-e2e commit it checks against, in a file called .e2e-ref, so a merge in that repository can no longer turn this one red. Two advisory jobs still run against its HEAD and are allowed to fail.