Mỗi bản phát hành, công khai.

Android Direct APK rebuild — Russian locale fix, GoDesk-branded launcher icons, full 3-ABI native bundle

• FIXAndroid: Russian system locale was rendering Arabic onboarding instead of falling back to English. Root cause was Flutter's default `basicLocaleListResolution` returning `supportedLocales.first` for unmatched languages — and gen-l10n sorts ARB files alphabetically, so `app_ar.arb` happened to be index 0. Added an explicit `localeListResolutionCallback` that walks the device's preferred-locale list, matches by languageCode, and falls back to `Locale('en')` cleanly.
• FIXAndroid: launcher icon was the default cyan-blue Flutter placeholder, not the GoDesk brand mark. Replaced with the amber (#f0a020) + cream (#f0e8d8) brand mark from `branding/godesk-window-favicon.svg` — generated 5 ic_launcher.png densities (mdpi/hdpi/xhdpi/xxhdpi/xxxhdpi) plus 5 ic_launcher_foreground.png at adaptive-icon densities (108..432px with 16% Material safe-zone inset), plus mipmap-anydpi-v26 adaptive-icon descriptor referencing the cream background color.
• FIXAndroid: previous APK was 124 MB but rebuild produced only 54 MB without the rustdesk native core. Native libs (`librustdesk.so` for arm64-v8a/armeabi-v7a/x86_64) live in `~/godesk-client/jniLibs/` from cargo-ndk but the Gradle source-set expected them at `flutter_godesk/android/app/src/main/jniLibs/`. Copied them into the right location + renamed the typo'd `liblibrustdesk.so` (arm64) to `librustdesk.so`. Final APK is 130 MB with all 3 ABIs bundled.
• FIXAndroid: build was failing with Jetifier transform error on byte-buddy-1.17.5.jar (`Unsupported class file major version 68`). byte-buddy 1.17.5 is compiled for Java 24, which Jetifier's bundled ASM doesn't understand. Set `android.enableJetifier=false` in gradle.properties — safe because all transitives are already AndroidX-native.
• ADRBuild pipeline: native Windows Flutter (`C:\src\flutter\bin\flutter.bat`) doesn't accept UNC paths as cwd (CMD limitation), and WSL's flutter expects Linux-native Java + Android SDK. New build flow: robocopy from `\\wsl.localhost\...` to `D:\godesk-build-tmp\`, build there, scp APK back. Documented in wiki/log.md so the next builder doesn't repeat the discovery.

Reality-Checker UI audit response — 12 dead controls fixed, 6 documented for next Rust patch round

• FIXSecurity/trust: View-only mode chip now actually enforces view-only on the remote session. Previously the chip wrote a key the Rust core ignored, so users got a full-control session despite picking view-only.
• FIXSettings → Image Quality: Eco / Balanced / Quality / Lossless presets now apply to every connect. Previously persisted to a key with zero readers.
• FIXSettings → General → Startup: Launch-at-login wired through `launch_at_startup` (writes the platform-native autostart record). Check-for-updates re-keyed to the option Rust actually reads.
• FIXSettings → Defaults: 6 of 11 toggles now apply on connect via per-session option toggles (show-cursor, mute-audio, lock-on-end, view-only, hide-wallpaper, clipboard). 4 still cosmetic, scoped for next round.
• FIXSettings → Network → Proxy: each save now calls `mainSetSocks` so the proxy is applied at runtime instead of just being persisted to options.json (where the runtime path ignored it).
• FIXSettings → About: IPC + E2E status panels reflect the live FFI bridge state instead of a hardcoded `ok: true`. They'll go red if the Rust core stops responding.
• FIXSession → FIT cycle button: choice now persists across sessions via a dedicated `godesk-display-fit-last` key.
• FIXSession → MORE → REBOOT: shows a follow-up message if the remote doesn't reboot in 30s (typical cause: controllee not running with admin rights).
• NEWSettings → General → Language: manual locale picker added (System default + 12 native names). Previously the app only respected the system locale, so users on Russian Windows couldn't preview the German / Polish / Turkish translations we ship.
• NEWgodeskflow.com/c/<slug>: invite links now actually resolve. Decodes the embedded peer ID + OTP and offers a deep-link into the GoDesk client. Previously these URLs returned 404.
• NEWSettings → Network → Custom HTTP headers: hidden — no Rust consumer existed for the option, so the field was deceptive. Will return when the consumer ships.
• NEWAuth gate: dart-define flags for Supabase URL + anon key are now baked into every Win build. Earlier v0.13.4 build silently shipped without them, bypassing the AuthScreen entirely. The 12 client locales now correctly land on email-OTP for first-run.

P1+P2 client UX polish — Simple/Advanced settings, mode chips, empty-state coaching, LCD palette differentiation

• NEWSettings has a Simple/Advanced toggle. Power-user sections (Network, Defaults, Encryption, Logs) hide by default and persist your choice across launches.
• BETTERConnect-mode chips reduced to [Full control] [View only] + Advanced ▾. File-transfer / TCP / RDP / Terminal modes still available, just one tap deeper.
• BETTERSession toolbar advanced ops (Privacy / Lock / Reboot) collapsed behind a single MORE ▾ menu. Reboot is visually flagged as destructive.
• BETTERLCD palettes differentiate by purpose: green for IDs and connection state, amber for file-transfer throughput, blue for diagnostics + encryption readouts.
• NEWEmpty-state coaching banner on Home shows ID-sharing tip when peer list is empty. Dismissible and persisted.
• NEWConnecting overlay stage labels (Resolving / NAT traversal / Encrypting / Connected) now i18n-keyed across all 12 locales.
• NEWAuthScreen has a Quit GoDesk option for users who don't want to authenticate.
• FIXAudio volume + mic-gain controls switched from rotary knobs to sliders — async cursor tracking on knobs felt unresponsive.
• NEWConcurrent-session enforcement live: tier limits (Free 1 / Lite 1 / Pro 3 / Team 10) gate at connect time via the active_session_count Supabase RPC. 30-minute stale-session window protects against crashed clients.

Interactive-control audit + sound-output FFI + macOS notarization

• FIXOnboarding GRANT buttons now actually request OS permissions (Accessibility / Screen Recording / Input Monitoring on macOS). Earlier builds toggled a local boolean — gate could be passed without granting anything.
• FIXVolume + Mic-gain knobs in Settings → Audio now persist their value across restarts (godesk-audio-volume / godesk-audio-mic-gain options).
• NEWmacOS .dmg signed by Developer ID Application: UPDEVTEAM LTD — notarized + stapled by Apple. spctl reports 'Notarized Developer ID'.
• NEWSound-output FFI: Settings → Audio → Output device picker now enumerates real devices via cpal/PulseAudio.
• BETTERWindows installer (NSIS) bundles librustdesk.dll directly. v0.9.5 → v0.13.1 jump caught it missing.

Full per-screen i18n coverage — Settings, Onboarding, Invite Manager

• NEWOnboarding (38 keys), Invite Manager (20 keys), Settings (26 keys: tabs + section labels + buttons) all read from AppLocalizations. 9 locales updated in lock-step.
• NEWmain_get_sound_outputs FFI exported from the Rust core. Linux uses a new get_pa_sinks helper (mirror of get_pa_sources).

Phase F — tray status icon + client-side ban check + per-screen i18n start

• NEWTray menu now shows live account state (email, tier badge, device count) and a Sign out leaf wired to Supabase signOut.
• NEWis_account_banned Supabase RPC + client-side gate. Banned accounts can't open new sessions even with device-count headroom.
• NEWAuthScreen, Home tier banner, Connecting overlay password form, Session toolbar tooltips, Files toolbar buttons all i18n-keyed.
• FIXEmail field couldn't accept the letter 'O' (global keyboard handler ate it). Skip global shortcuts when EditableText has focus.

Phase C/D/E — account enforcement, sessions audit, i18n scaffold

• NEWTier limits config table seeded (Free 30 devices / Lite 50 / Pro 200 / Team unlimited). RealBridge.connect() pre-gate refuses dials when the device cap is hit.
• NEWSessions audit telemetry — every successful connection inserts a row into Supabase 'sessions' with peer IDs + duration. Failures silent (don't kill an in-flight session if Supabase is down).
• NEWi18n scaffold for 9 locales: en, es, pt, fr, ar, hi, id, vi, zh. flutter_localizations + intl wired in main.dart.
• NEWTier usage banner pinned above YOUR ID — used / cap devices + amber-at-80% upgrade prompt.

Phase A — Supabase magic-link auth + interactive-control audit

• NEWSupabase project (eu-west-1) — accounts, devices, subscriptions, sessions audit, ban_list. Magic-link OTP via Supabase signInWithOtp; AuthScreen accepts both 6-digit token and full URL paste.
• NEWComprehensive interactive-control audit: VIEW + FILES session-toolbar buttons wired, retryTransfer re-issues sessionSendFiles from _transferOrigins, defensive try-catch wraps every input handler.
• FIXMouse jitter (was 1000+ Hz pumping FFI). 8 ms throttle = 120 Hz on the wire.

ScreenCaptureKit migration — replaces CGDisplayStream on macOS Tahoe

• FIXApple killed CGDisplayStream on Tahoe — Capturer::new succeeded but no frames came back. New ObjC bridge (libs/scrap/native/macos_sck/sck_bridge.{h,m}) exposing C ABI to Rust. Verified 25 fps capture.
• BETTERPermission prompts (Accessibility, Screen Recording, Input Monitoring) fired at startup instead of mid-session for clearer UX.

Mac↔Win remote-desktop end-to-end on godeskflow.com infra

• NEWMigrated rendezvous + relay off rustdesk.com onto self-hosted hbbs/hbbr at id.godeskflow.com / relay.godeskflow.com.
• NEWSingle-binary architecture (ADR-014): try_start_cm bypassed when CM binary missing, desktop_changed loop bypassed in user-mode GUI launch.
• NEWmacOS Hardened Runtime + cs.disable-library-validation so dlopen of librustdesk.dylib works under notarization.

Address book — ADD PEER, hotkeys, latency graph, inline logs

• NEWADD PEER dialog with OS picker + ID validation. Address book persists via bridge.upsertPeer / forgetPeer.
• NEWLatency sparkline panel (live diagnostics stream).
• NEWHotkeys: Ctrl+L for ID input focus, Ctrl+1..9 for display switch in active session.

Drag-drop, sort menu, inline theme controls, multi-monitor

• NEWFiles screen: drag-drop file paths from explorer, drag handle to reorder transfer queue.
• NEWSettings → General → inline theme controls (dark mode toggle, accent palette, LCD palette, intensity slider).
• NEWMulti-monitor support: switchDisplay FFI + display switcher PopupMenuButton in session toolbar.