Changelog: v12.9.2-4015-pre (carrier-drop crash fix + this week's bug-hunt fixes)

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: decoder-dev

CHANGELOG.md

@@ -6,6 +6,33 @@
 
 ## [Unreleased]
 
+## [v12.9.2-4015-pre]
+
+### Fixed
+- **WEB proxy crash on carrier drops (lock inversion):** `activeSocksBridgeEndpoint` held the manager lock while calling a `queue.sync` method on the sidecar — whose failure handler takes that same lock from the sidecar's own queue. A call being resolved on main at the moment the carrier died deadlocked both threads into a watchdog kill. The getter now snapshots under the lock and leaves it before touching the sidecar, the same discipline `sendKeepalivePing` already followed.
+- **Accent-saturation static made atomic:** `PeerNameColors.saturationPercent` (written on the main queue when Extras change, read while colors are constructed during background text layout) was a plain static var — a formal data race, benign only because aligned Int32 loads don't tear. It now uses the same `Atomic` discipline as the fork's other cross-queue statics.
+- **Hide Mention/Pinned notifications never reached the NSE:** the settings bridge wrote the flags into the `group.<app bundle id>` App Group suite, but the extension's candidate list only contained `group.<full NSE bundle id>` (the NSE derives its app group by stripping the `.NotificationService` suffix, the bridge didn't), so the Notification Service always read `false` and mention/pinned pushes were never suppressed on the push path. The bridge now derives the same stripped base bundle id, so both processes land on the same suite. (Delivery still requires a working App Group container — i.e. an entitled build; a bare sideload degrades as documented in docs/network-audit.md F-2.)
+- **Ghost "Read on Interact": the online blink never fired.** The interact-override window only un-suppressed online reporting — nothing poked the presence manager while the app stayed foreground, so the "briefly show online after sending" half of the feature was a silent no-op (read receipts worked; presence didn't), and a presence update landing inside the window lingered online until the 30s timer. Presence is now re-asserted when the window opens and once more just after it closes, keeping the blink at the designed 1.5s.
+- **Message-saving export feedback:** exporting did nothing visible when the bundle could not be created (the row looked dead), and the "Exported N records" string existed in both localization tables but was never wired. Export now alerts on failure and reports the exported record count after the share sheet closes.
+- **Profile diagnostic rows (id / dc / registered):** tapping these fork rows triggered a full immediate re-layout of the profile screen (the visible "row changes on tap") instead of opening the standard value window. Tap now opens the same copy-value context menu that long-press did; the meaningless `requestLayout` tap side effect (copied from the expandable bio/link rows, where it serves header expansion) was removed, and `PeerInfoScreenLabeledValueItem.requestLayout` gained a no-op default so rows without expansion behavior don't need to fake one. Rows also became proper accessibility buttons (activate action = open value menu).
+- **Chat keyboard return key:** "Send with return key" is now applied to the keyboard whenever editing begins, not only when the input node is created — a mid-session toggle no longer leaves a "return" key that sends or a "send" key that inserts a newline.
+
+
+## [v12.9.2-4014]
+
+### Security
+- **Passcode at rest:** the app-lock passcode is now stored as a PBKDF2-HMAC-SHA256 digest (100k iterations, random 16-byte salt — the same scheme as the Archive password) instead of plaintext in postbox metadata. Legacy plaintext values still unlock and are transparently upgraded to the hashed form on the first successful entry; verification of hashed values is constant-time. The unused `lockId` property, which embedded the raw passcode, was removed. New passcodes are never stored in plaintext.
+- **WEB proxy audit fixes (docs/network-audit.md):** backup-IP DoH discovery no longer arms while a WEB secret is active (F-3 — it only leaked "uses Telegram" to the DoH resolver and was never dialed through the tunnel; SOCKS5 is deliberately not gated). The WEB-proxy settings screen now discloses that calls depend on relay support (F-1a).
+- **WEB proxy calls bridge (F-1b, client half):** the carrier parses WELCOME capability flags (bit 0 = arbitrary stream targets) and the sidecar then runs a loopback-only SOCKS5 listener — RFC 1929 auth with per-start random credentials, since iOS loopback is not app-isolated — mapping each SOCKS CONNECT to one carrier stream. Calls resolve a WEB proxy to this bridge at call-creation time (`PresentationCallManager.resolvedCallProxyServer()`), or stay direct when the relay lacks the capability, which is every current relay: the feature is inert until a relay implements `docs/webproxy-socks-bridge.md` (which now also carries the operator rollout guide).
+
+### Fixed
+- **UI consistency audit (docs/ui-audit.md):** the WEB calls note now reflects the bridge ("calls go through only if the relay supports call tunneling"); "Use for calls" is visible and controllable with a WEB proxy active (was silently applied with its stored default); uk/be app languages no longer get mixed RU/EN fork strings (table lookups follow the same rule as the ternary strings); the WEB catalog sheet got a title; the saved-messages feature is spelled from one string source; the "Auto" proxy summary value comes from one place; "WEB" is findable in settings search; dead `usePasteboardInfo`/`catalogPick` and a verbatim-duplicated status branch removed.
+- **Visual bug hunt (docs/ui-audit.md §4):** layout-affecting Extras toggles (compact chat list/preview, folder-tab font, timestamp seconds, sticker size, wide channel posts, reactions bar, deleted/edited marks) now apply live — the chat list re-lays out via a new `refreshForkItemLayouts()`/folders-subscription path, and open chats re-emit history through the fork's settings fingerprint, instead of leaving a half-old half-new UI until restart. Restored a missing `!` in `ChatListNodeState ==` that made every state comparison report a change (constant needless list re-layout churn on typing ticks). Localized the profile "registered" diagnostic label (was English-only).
+
+### Changed
+- Removed the dead vendored OpenSSL 1.1.1d tarball (`submodules/openssl`) — not referenced by any build target (TDLib builds against BoringSSL); the 1.1.1 series has been EOL since September 2023.
+- `Tests/AllTests` now aggregates the three existing unit-test suites instead of a dangling `TgCallsTests` label, so the default `Make.py test` build no longer fails.
+
 ## [v12.9.2-4013]
 
 ### Fixed