Files
Claude 3dc91ee695 fix: audit findings in group emoji reactions, edits, polls, Tor routing and amy
Marmot groups
- A custom-emoji reaction is the same reaction by shortcode: every one
  carries its own encrypted copy under its own URL, so chips merged
  nothing, a second tap reacted again instead of retracting, and the sheet
  never showed the emoji as yours. Chips group by shortcode, and the
  toggle, the duplicate guard and the highlight match by it.
- The picture of a reaction comes from the account's own packs. Tapping a
  peer's chip used to download the URL in their reaction: their
  ciphertext, or any URL a peer wrote. When the picture cannot be
  attached the reaction goes out as a bare :shortcode:, with no emoji tag
  pointing members at a public URL.
- Messages with custom emoji can be edited, and an edit carries its emoji
  the way a message does.
- A signed kind 1018 does not vote in a group poll: members vote inside
  the group, unsigned, and the poll id alone was enough to vote from a
  public relay.
- Emoji over the tag limit are dropped before any download or upload.

Android Tor
- "Continue without Tor" drops the SOCKS port and the relay client falls
  back to a direct one, but the dial gate still waited for Tor, so DM and
  untrusted relays never connected. The bypass now lets them dial.
- The waiting-for-Tor hint treats Tor off (a choice, or that bypass) as
  not holding relays back.

UI
- The poll sheet pads the keyboard and nav bar outside its scroll, with
  imePaddingSafe; suggestions follow the focused field; Tab moves to the
  next field instead of typing a tab MDK refuses; an option emptied
  mid-list can be removed; the ready check is derived state.
- Change vote can be cancelled; a quoted poll is a preview, not a ballot.
- Emoji tags of an edit replacing an edit no longer keep the old ones.
- A failed group-avatar plan still discards the compressed file.
- Every chat row skipped the Marmot reaction producer and the imeta
  parse when it has neither.

amy
- Epoch admins, media keys and verdicts ignore a record a crash cut short
  and replace it on the next write, instead of reading it as whole.
- Canonical error codes (forbidden, not_found).
- Harness: test 36 asserts the deletion positively; test 17 runs on
  bash 3.2 without a Blossom server.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AnG7pkzazc6jfhNkCkcX11
2026-10-24 16:25:47 +00:00
..