Changelog: v12.9.2-4019-pre section (upstream issue batch + capture lifecycle + APNs redaction)

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: decoder-dev

CHANGELOG.md

@@ -6,7 +6,14 @@
 
 ## [Unreleased]
 
+## [v12.9.2-4019-pre]
+
 ### Fixed
+- **Video messages: recording stuck on an infinite loading state.** A wedged capture session never emitted the preview-ready signal the hold-to-record button waits for, so the button spun forever and recording never started — only restarting the phone helped (upstream issue #1772). Camera readiness now has a 10s timeout: the capture session is torn down and recreated (bounded at 2 resets per screen), and a timed-out recording attempt fails cleanly instead of spinning.
+- **Video messages: silent audio track after a phone call.** When a call ended, the capture session resumed video but the app's audio session was never reactivated, so the rest of the recording had a live video track and a permanently silent audio track (upstream issue #2113). The audio session is now reactivated on interruption-end while recording, and an audio watchdog fails the recording (instead of saving a mute tail) if audio samples stop arriving for more than 4 seconds while video keeps flowing.
+- **Video messages: recorded with the wrong microphone.** Round video recording did not opt into the video audio-session configuration, so on devices with multiple microphones it kept the automatically selected (often the quiet earpiece-adjacent) input, while voice messages used the bottom mic (upstream issue #1195). Video notes now use the video-recording session mode with the bottom microphone preference.
+- **Camera: freeze on rapid front/back switching.** Each switch is a full blocking session cycle (stop → reconfigure → start); rapid toggles queued N full cycles and froze the preview for seconds (upstream issue #1396). Switches are now coalesced into at most one pending switch with the last requested target.
+- **Privacy: full APNs device token written to the app log.** Registrations are now logged as a fingerprint (length + first/last bytes) — enough to correlate entries, without exposing the installation identifier to anyone who can read the logs.
 - **Media downloads: `WEBFILE_NOT_AVAILABLE` permanently poisoned web-referenced media (inline GIFs).** The multipart fetcher completed the resource with a size of 0, which MediaBox persisted as a "fully downloaded 0-byte file" — the GIF tile then stayed blank forever, surviving restarts, since nothing would ever fetch it again (upstream issue #2244). The fetch now keeps the resource retryable: `WEBFILE_NOT_AVAILABLE` retries with exponential backoff (1–16s, 5 attempts) and then fails the fetch, which re-fetches when the consumer re-subscribes. Defensive guard added in both MediaBox file contexts: a reported size of 0 is no longer accepted as evidence of a completed resource.
 - **Saved GIFs: infinite software-decode loop, 100% CPU until force quit.** A GIF whose stream reaches EOF without producing a single decodable frame (e.g. H.264 in a pixel format the software decoder can't handle) made `BatchVideoRenderingContext` reopen the FFmpeg reader forever in a synchronous loop. A reader that produced no frames is now treated as a decoding failure — the animation stops and shows a placeholder instead of spinning (upstream issue #2246; same fix as upstream PR #2315).
 - **Chat list: tapping one chat could open a different chat.** ListView dispatched selection by resolving the touch through item nodes' MODEL frames; after an interrupted or uncommitted layout animation (fast folder switching) the model frame could disagree with the row actually displayed under the finger, opening an unrelated chat (upstream issue #2124). The selection (and secondary action) is now cross-checked against UIKit's presentation-based hit-testing, and cancelled on mismatch — a dropped tap instead of a wrong chat. Also bounds-checks the item index against the live items array.