# Pending — uncommitted Theseus changes Working-tree state that hasn't been committed or shipped. Read this before touching the same files. Update when you land or add work. Format: each group has a `session:` label so parallel sessions can see what belongs to whom and coordinate. Naming convention: `YYYY-MM-DD:short-slug` for date-bounded work, or `parallel:` for work owned by a session that isn't the current one. Last updated: 2026-10-29 (post-0.3.130 batch). --- Releases are no longer recorded here: the live version and hashes are in `../site/releases-manifest.json` and `https://dl.silentmode.st/releases-manifest.json`, and each release commit is `Theseus 0.3.x: ...` in git history. ## Staged for the next release (post-0.3.130) Queue of asks for the next cut. Items marked LANDED are edited in the working tree waiting for a bump + build. Items marked TODO still need the code change. - **LANDED: Nostr NIP-07 signer** — new bundled add-on `bundled-addons/nostr/` (0.1.0) plus host support. Puts `window.nostr` on https + localhost pages so any Nostr client (Primal, Coracle, Snort, nostrudel) can sign with the identity Theseus already holds. **Needs a Theseus release**: it changes `main.js` and bundles a new add-on, so the extension OTA alone cannot deliver it. **MISSED 0.3.130** — the folder is untracked (`??` in git status), so the detached-HEAD build worktree never saw it. For 0.3.131 the ship script must either `git add` the folder first or `cp -r` it into the build worktree the same way `build/`, `tor/`, `snapshots/` are copied. - [lib/nostr-signer.js](lib/nostr-signer.js) — new. Crypto half: `getPublicKey`, `signEvent` (BIP340 via nostr-tools `finalizeEvent`), nip04 + nip44 encrypt/decrypt. Recomputes `pubkey`/`id` rather than trusting the page. - [main.js](main.js) — `global._nostrAPI` next to `_hermesAPI`. - Identity is Hermes's key (`nostrKeyFromRoot(messengerRoot)`); vault with no mnemonic reports no identity instead of failing obscurely. - Policy per-origin (read vs sign), kinds 0/3/5/10002 re-prompt every time with no remember option. - Tests: `scratchpad/signer-test.mjs`, `nostr-policy-test.mjs`, `nostr-e2e.mjs`. - **LANDED: Home — SilentMode.X moved to the quick-links strip, Game.X takes its place in the Silent Mode cards.** [home.html](home.html) `defaultState().sections.sm` and `.q`. Game.X entry uses a built-in `game` brand mark (new SVG in `BRAND`); the real description and favicon will come from the live site once game.x is up (currently a stub). SilentMode.X moves into the slots strip as the 5th quick-link. **Still TODO:** update the remote cache at `https://dl.silentmode.st/home-cards.json` so existing profiles pick the swap up without resetting (local `sections.sm` isn't reseeded by `migrateCards` — only the remote fetch rewrites it for installed users). - **LANDED: Mail is now a Sidebar quicklink, not an extension.** The user flagged two things in one: the Mail add-on's 0.1.0 panel was a black screen (iframe + XFO: DENY), AND Mail conceptually belongs under Settings → Sidebar (webapp quicklinks) rather than Settings → Extensions. Both resolved by dropping the extension form entirely: - `settings.quickLinks` default list in [main.js](main.js) gains `{ id: "silentmail", url: "https://mail.silentmode.st/", title: "Silent Mode Mail" }` as the first entry. - `migrateAegisRename()` grew a mail retirement block: on first boot of this Theseus, any installed `extensions/mail/` folder moves to `addons-backups/mail-migrated-/`. The one-off `mail/` directory I added under `bundled-addons/` earlier in this session is removed again (the quicklink + retire is the right path). - `"mail"` added to the first-party reserved-ids list so a community add-on can't claim the id after retirement. - The quicklink does exactly what the old extension's "Open Mail" button did (new tab at `mail.silentmode.st`), without taking a panel slot or an Extensions row. - **LANDED: Left-side sidebar panels free their render tree after idle.** [main.js](main.js) `closeLeftPanel`: closed panels used to keep their loaded page (`leftPanelLoadedId` kept, webContents warm) forever — great for fast reopen, bad for RAM when the user docks a heavy app-like panel (Hermes, Pithos, mail) once and never comes back. Now a 2-minute idle timer blanks the panel to `about:blank` after close, dropping iframes/media/listeners; reopen inside the window still reuses the loaded page (`cancelLeftPanelIdleUnload` on open). `LEFT_PANEL_IDLE_MS = 2 * 60 * 1000`. Does NOT touch the right-side `sidebar` view (webapp tabs — Telegram, X, WhatsApp, AI chat) — those are longer-lived by design; follow-up decision whether to apply the same idle unload there. - **LANDED: Startpage light theme palette flip under `body.light`.** [home.html](home.html): the existing `@media (prefers-color-scheme: light)` block only flipped tokens when the OS preferred light. Picking the "light" background preset (`body.light`, set by `applyBg()`) left `--ink` white against a white page, so hero title, SM card titles, slot labels and the ".bch" extension read as pale ghosts. Added a full `body.light { --ink; --mut; --card; --line; ... }` block plus overrides for the hero/card translucent panels (dark-glass → light- glass on light theme so the dark text inside reads), the ctx-menu and modal (white surfaces, dark text). Dark theme untouched. ## session: `parallel:collision-policy` Owner's focus: BCNR ↔ ICANN name collision handling. Not mine — leave for that session to land or bundle by explicit ask. - Android / mobile: [../AriadneResolver/mobile/app/AndroidManifest.xml](../AriadneResolver/mobile/app/AndroidManifest.xml), [BchFetcher.java](../AriadneResolver/mobile/app/src/com/silentmode/ariadne/BchFetcher.java), [Bns.java](../AriadneResolver/mobile/app/src/com/silentmode/ariadne/Bns.java), [build.ps1](../AriadneResolver/mobile/build.ps1) — mobile-side collision changes. - Repo-wide: `.gitignore` gained a `/.keys/` line (harmless). ## Live state Shipped hashes live at `../site/releases-manifest.json` and `https://dl.silentmode.st/releases-manifest.json`. On-chain pointer at `releases.silentmode.bch`. See [GOTCHAS.md](GOTCHAS.md) for the release gotchas.