CHANGELOG.md

# Changelog

All notable changes to CallShield will be documented in this file.

## Unreleased

- The data pipeline's test runner now uses the first Python on PATH that has the pipeline's packages installed. With an older Python ahead of it on PATH, three suites used to fail on a missing cryptography or numpy.
- `scripts/device_smoke.py` deletes its last screen dump before taking a new one. A dump that failed used to leave the old file in place, so a step could act on labels from the screen before.

## v1.13.0 (2026-10-30)

- Links in WhatsApp, Signal, Gmail and the other chat and email apps you screen now stay on your phone. With "Check links with PhishTank and OpenPhish" turned on, those links only go through the OpenPhish list CallShield downloads, and PhishTank never gets their domain. A flagged one now shows the same "Phishing URL detected" alert as a flagged link in a text, naming the app, in place of the general screened message alert. If a check hits a problem on one of those messages, CallShield no longer saves the message text with its note about it. Links in texting apps like Google Messages are checked the way they were before. When a flagged link there comes from a sender shown by name instead of a number, you now get the phishing alert naming the app too.
- The Blocked list on the Rules screen can be sorted now. Once you've blocked two or more numbers, chips above the list let you pick Newest first, By number or Most blocked, and CallShield remembers your pick. Most blocked counts the calls and texts it blocked from each number. Numbers blocked before this update have no block time, so they sort last under Newest first.
- Long-press any row on the Rules screen to pick it, tap others to add them, then Unblock or Delete them all at once. One Undo brings them all back. This works on the Wildcards, Ranges, Keywords and Trusted tabs too, and TalkBack reads how many rows you've picked.
- On Android 13 and later, copying a number no longer pops a "Copied" message on top of the preview Android shows for everything you copy. The two used to pile up at the bottom of the screen. The FTC complaint button doesn't pop one either now, and the reminder to paste the number into the form sits right under the button. Android 12 and older still show the messages, since nothing else tells you the copy worked there.
- On the Rules screen, the "Removed from blocklist" bar with its Undo used to cover the Add button, so you couldn't add anything until the bar went away. It now shows just above the button. On the Database tab, which has no Add button, it stays at the bottom.
- The bar that slides up with Undo and other short messages now uses CallShield's own colors. It's off-white with a green Undo in the dark themes and navy with a mint Undo in Light, instead of Android's stock lavender and purple.
- More of CallShield's short messages now fit at the largest font size. Android 12 and later cut a toast off after two lines, so the endings of the error, undo, export and "no browser" messages never showed, and neither did most of the one about emergency numbers. They're shorter now in English and Chinese. The copy messages on the blocked list and the FTC report no longer repeat the number, since a long number alone could fill a line. The FTC one still tells you to paste it in the form. "That didn't go through. Try again." has a Chinese translation now too.
- When Not spam on a blocked call alert runs into your own block, the notification that explains it now stays with CallShield's other blocked call alerts. It used to show up as a separate card, and it could replace a newer alert for the same number that arrived while Not spam was being checked. A number too long to be a phone number no longer offers Not spam at all. There's nothing to allow there, and the old message blamed a block you never made.
- The "Possible spam" popup no longer flashes up for a moment on a call that CallShield then rejects. It used to open while the call was still being checked, so a later check that rejected the call left it on screen until it was taken back. Now it waits until the call is going to ring, or go to silent voicemail, and a rejected call never shows it.
- With TalkBack on and a large font size, the bottom tabs other than the open one had no name for TalkBack to read. At 150% and up the bar shows just the open tab's label, and the others now read their names from their icons. At normal sizes each tab still reads its name once.
- Tapping Not spam on a blocked call alert for a number you blocked yourself now shows a short "Your own block still applies." and turns the alert into a notification that explains why. Tap it and the number opens in CallShield, where you can remove the block. The old message was a toast, and Android 12 and later cut it off after two lines, so the part about where to remove the block never showed. The Not spam and empty crash log messages are shorter too, so they fit at the largest font size.
- The caller ID popup no longer stays up for 20 seconds after CallShield rejects a call it first showed as possible spam. A rejected call never rings, so nothing told the popup the call was over, and it kept offering Block for a call that was already gone. It closes as soon as the call is rejected now.
- A call that came in at the moment the previous caller's popup closed could lose its own popup. Closing the old popup shut the popup service down even though the next call's request was already waiting.
- When Android stops asking for a permission or a default app role, CallShield's note about where to turn it on now shows in full at the bottom of the screen, with an Open App info or Open Default apps button. It used to be a toast that Android 12 and later cut off after two lines, and the settings page opened on top of it before you could read the rest. The note stays put if you switch tabs or turn the phone while it's showing.
- A single Not spam vote no longer keeps a number off the community watch list for 90 days. Reports from people on later days count again, so a number that starts getting reported after someone vouched for it can still show the warning. Reports from the day of the vote, or earlier, still don't count.
- A Report or Not spam result that came in just as the previous message closed, in Lookup or on a number's screen, could be skipped without showing. It shows now.
- When GitHub's rate limit stops a report, the report service now passes on how long GitHub asked it to wait, instead of always saying a minute. When GitHub refuses the service's access token, it answers that it's unavailable rather than rate limited, and the app keeps the report and tries again later.
- The update notice on Home can't be swapped back to an older release anymore. A mirror serving an older signed notice used to replace the newer one, which could hide an update.
- Regex rules shaped like a long run of optional digits, or a repeated group that ends in an optional part, are now turned down when you add them, since they could hold up call screening. One saved earlier in such a shape no longer runs.
- Turning the phone while Not spam waits out its Undo, or while Report is still going out, no longer loses the message that follows. Report's Undo for the block stays too.
- A number you block, unblock or report while the spam database is updating keeps that change when the update finishes. A change made just before the update wrote its rows could be put back the way it was.
- Texts from a regular phone number that ends in 7726 get screened again. CallShield leaves the 7726 carrier spam report short code alone, but it also skipped every full number ending in those four digits, so a blocked or known spam number like that was never checked, logged or flagged.
- If checking a text runs into an error, CallShield still lets the text through and now leaves a warning in the system log. Before, nothing recorded that the check had failed.
- Community reports that arrive without the app's report id now count as one reporter between them, per number and day. The app has sent that id with every report since v1.10.0. On 2026-10-30 a script that sent none reported the same few numbers from a new network each time, and each one counted as a different person. The rule covers the watch list, promotion into the database, the trending list, spam link domains and Not spam votes. Reports from builds older than v1.10.0 still count, but together they make one reporter.
- On Android 15 and later, Android hides a one-time code from apps like CallShield and puts "Sensitive notification content hidden" where the message was. CallShield screened that placeholder as if it were the text. It now leaves those notifications alone, so it never removes or logs one, and it warns you when a hidden code arrives during or just after a call from an unknown number, the way it already did for a code it could read. The placeholder is matched in your phone's language.
- The spam report form on GitHub now says up front that it files a public note, and that Report on a number's screen in the app is what sends the anonymous report that counts. It used to say a report there could go in the database, but issues were never read into it.
- Report on a number's screen now blocks the number on your phone too, and the message after it says so, with Undo to take the block back off. The report itself stays sent. One report rarely blocks a number for everyone, so you kept getting the calls unless you also tapped Block. A number you'd blocked already keeps its block exactly as it was.
- Lookup's result card now offers to block the number's whole area code, with Undo, the same way a number's own screen does. Before, you had to scroll down and open the full detail to find it.
- Report spam number on the More tab now opens Lookup on an empty number field, ready to type, where Report sends the anonymous report that counts. Until now it opened the GitHub form, which files a public issue instead.
- New `scripts/device_smoke.py` runs the release's phone checks over adb and prints PASS or FAIL for each one. They cover sync, What's new, the recommended lists, both area code offers with Undo, a number with no offer, Not spam's Undo and More's Report spam number. `--report` adds Report's block and Undo, and it sends a real report.
- Lookup now offers Report on every number you check. It only showed for a number something had already flagged, so the new number you came from More to report left you with Block and Mark trusted. Report in Lookup works like Report on a number's screen: it blocks the number on your phone too, with Undo.
- Reporting a number nothing had flagged sent the report with a blank type. It goes as spam now, and the block it adds on your phone says spam too, not Other.
- Undo after deleting a rule puts back exactly what was there. A rule you'd switched off came back switched on, and a temporary allow came back for good.
- Search shows an error with Retry when the first page of results fails to load. Before, it showed an empty list, as if nothing matched.
- With TalkBack, the checkbox and switch rows in the blocklist dialogs, backup sections and update checks read their label with the control, and tapping anywhere on the row toggles it. Each row stays at least 48dp tall. Settings links and rule conflicts are announced as buttons.
- A few labels read more clearly now. The allow-list range offer reads "Let its whole block of lines through too", and Lookup's checker names "Trusted numbers" and "CallShield blocklist".
- The wildcard dialog now refuses a regex that call screening would skip as too slow to run, like `(\d{3}){3}`, and suggests the simple form. It used to save the rule, show it as active, and never match a call with it.
- A text blocklist with a comment after a number on the same line (`+15551234567 # 3 reports`) read the comment's digits as part of the number, and a comma in that comment could make the whole list read as CSV. Lists that start with a byte-order mark also lost a JSON list's format, its own refresh interval, or a CSV list's first column name.
- The restore preview said a settings restore leaves out subscription URLs. It doesn't. It adds the backup's external blocklists and keeps the ones already on the phone, and the preview now says so.
- A restore leaves a number's existing allow or block on this phone alone, unless the phone's is temporary and the backup's is permanent. Restoring a backup's block deleted any allow the phone had for that number, emergency allows included, and a backup's plain allow could clear an emergency flag or make a permanent allow temporary. Merge has no Undo, so the change stuck. The preview now counts these numbers among its matches and says what happens to them.
- Blocking or unblocking a number from a downloaded list while a database sync was fetching its updated parts could be undone when the sync finished. It's kept now.
- A block decision waits at most a quarter second for its call-log entry to be saved, then blocks the call and saves the entry after. When another database write was running, like a sync, that wait could push the block past Android's five-second limit, and the call rang.
- The app now refuses the community watch list if it's served in place of the trending numbers feed. Both are signed and both list numbers, so a mirror could have passed one off as the other, turning numbers with a single report into blocked ones.
- A failed link check on an RCS or chat message can no longer crash the app.
- A database or storage error during a tap (a block, an allow, a rule, a setting) no longer closes the app. You get a "Something went wrong" message and can try again.
- The community report merge counts one phone once a day per number, whichever spam type it picks. Picking a different type each time let one phone count up to nine times a day toward the trending list. A not-spam report still counts on its own. Reports of one number that land within a minute of each other are folded together the same way, by spam or not spam instead of by type.
- A report the report service turns away (a number that can't exist, or one it already has) no longer uses up one of the 30 reports a minute it takes from everyone, so a flood of bad reports can't crowd out real ones.
- One report can now block a number for everyone when an FCC complaint from the last 90 days names the same number as the caller and doesn't say it was spoofed. Before, it took reports from several people on different days, so nearly every report expired after 30 days without blocking anything.
- Lookup's This is not spam and Mark trusted now wait five seconds with an Undo before the number goes on your allow list and the not-spam report goes out, the way Not spam on a number's screen already did. Not spam on two numbers in a row sends both now, where the second used to cancel the first without a word. Each screen shows only the result of its own tap.
- The Chinese translation's regex example in the wildcard dialog showed with its backslashes missing.
- Setup now spots a copy installed by an app store or installer that doesn't let Android allow SMS and call logs. Android never asks about those on such a copy, and their switches in App info flip back to Deny with no reason given. Once you've tried them, setup names the installer and offers Get the APK, which opens the latest release so you can install it over your copy from the Files app. Your settings stay. The README's troubleshooting section now covers this block next to restricted settings.
- Database v61 adds the FCC complaints published through 2026-10-30 and FTC's through 2026-10-29, for 51,407 numbers, and refreshes the 649 French telemarketing ranges. 24 of the numbers are ones a single person reported that a recent FCC complaint also names. The community watch list now carries 2 numbers that several people reported. Five came off it. +1 501-794-4158, +1 863-865-7795 and +1 895-746-5363 were foreign numbers the report service had misread, and every report of +86 138 0013 8000 and +86 133 9213 5190 came from a script that sent no report id, so each now counts as one reporter.
- The Simplified Chinese translation now covers nearly every screen, with 311 more strings and every plural, from aixtin (#42). Only the new setup note about reinstalling from GitHub, and its Get the APK button, still show in English.
- The Android post-call screen has a Call back button (#43). It opens your dialer with the number filled in, so a call that dropped is one tap from a redial and CallShield still needs no permission to place calls.
- Spam on the post-call screen now records the block and the report itself, and the home screen widget redraws itself when your lists change. Both used to hand the job to the app's own receiver with a broadcast, which Android 17 QPR2 no longer delivers once the app has left the screen, so the block could have been lost.
- Block area code no longer offers China's +86 410 or +86 413. The newest phone numbering data the offer is built from (libphonenumber 9.0.42) doesn't list them as area codes anymore.
- The app no longer closes as it starts when it can't read whether update checks are on. It skips setting up the weekly check that time and tries again on the next start.
- A database error while a screen is open no longer closes the app either. The screen keeps what it was showing, or its empty state if nothing had loaded yet, and the error is logged. If the app's settings can't be read at all, it opens to the main screen instead of a blank one.
- With TalkBack on, the count tiles on Home, More and Activity now read each number with its label, like "7, Today". TalkBack used to read every number in the row first and every label after, so you couldn't tell which count was which. Each entry on the Rules screen's Database tab is one stop now too, with its number, type and report count read together.
- Appearance on the More tab opens the theme picker right there. Before, it opened Settings at the top, with the Theme row further down and out of sight.
- Restoring a backup keeps when each number was blocked, so the Blocked list's Newest sort comes back in the same order. Backups made before this restore those blocks with the time of the restore.
- The Recent tab shows how CallShield handled each call when it came in. It used to check every number again when the list loaded, so a call you answered from a number you blocked later showed up as Spam and counted toward the Spam total. Now only calls CallShield blocked count as Spam, and an earlier call from a number flagged since says "Flagged after this call" along with the reason.
- TalkBack reads chips where only one can be on as radio buttons, selected or not selected. That covers the Activity and Recent filters, the Rules sort and Database filters, Lookup's Number and Message switch, the log cleanup days and the category actions. They used to say "Check box", which sounded like you could pick several. The Blocked log's Reason filter reads as a drop-down list.
- On a phone with two SIMs, the caller ID popup for a call on the second SIM closed the moment it opened. It went by the main SIM's call state, and that reads idle while the other SIM rings. The popup now watches each SIM and closes once every one of them is idle, the same way an outgoing call's warning does.
- On a phone with two SIMs, Answer and hang up now rejects a spam call when either SIM is roaming. Android doesn't tell call screening apps which SIM a call came in on, so CallShield only checked the main one, and a call on a roaming second SIM could get answered abroad, where answering can cost you.
- The report service now takes a number sent without a + only when it has ten digits, read as a US or Canadian number. Any other bare length is turned away, since nothing says which country it's from. A Chinese mobile sent as 15017944158 was being stored as +1 501-794-4158, a line in Arkansas, and could end up on the watch list. The import scripts for North American feeds still read a bare 1 plus ten digits as +1.
- The community report merge and the watch list now set aside reports from before that fix that were most likely misread that way. That's a +1 number whose +86 reading is already a known number, or one in an area code no phone line uses that didn't come from the app. A number already in the database or approved by hand is never set aside, and neither is a report from after the fix.

## v1.12.0 (2026-10-09)

- Numbers that other CallShield users reported, but that haven't been
  confirmed enough to block, now get a label. When two people on different
  networks report the same number on the same day and nobody marks it as
  not spam, the caller ID popup and the after-call notification read
  "Reported by 2 CallShield users, not confirmed". Two phones on one home
  network aren't enough on their own. A report from a second network has to
  agree. The label never blocks a call by itself, even in
  aggressive mode. The list is a new signed feed that updates with the
  trending numbers, and a not-spam report takes a number off it at the next
  merge.
- The report service's overall limit of 30 reports a minute now holds for
  the whole service. It used to be counted separately in each Cloudflare
  location. A report the service can't take no longer uses up your own
  allowance, and addresses in one IPv4 /24 now share a budget the way one
  IPv6 /48 already did.
- Real calls from the published support lines that scammers like to fake
  (Apple, the IRS, Social Security, Medicare and the big banks, 50 numbers
  in all) now ring when your carrier verified the caller. Complaints about
  those numbers come from people the fakes fooled, so they no longer block
  the real line. A call your carrier didn't verify is still blocked, and the
  reason now says whose number was faked. Looking one of these numbers up,
  or a text from one, keeps the saved reason, since no call went unverified.
  The caller ID popup names the organization and reminds you not to share
  codes or passwords on a call you didn't expect.
- When Android stops showing a permission prompt after you've said no twice,
  the Grant buttons in Settings, Home's notification and scan buttons,
  answer and hang up, and setup now open App info and tell you which switch
  to turn on. Before, tapping them did nothing. Setup also needed two dead
  taps first when you'd said no on an earlier visit, and now opens App info
  on the first one. The buttons that ask for the caller ID and spam role,
  and the call redirecting role, do the same with Default apps once
  Android stops showing their prompt. Closing a permission prompt without
  answering, the first time, no longer counts as the refusal that sends you
  to App info.
- The "Block area code" suggestion on Home and the Stats map is only
  offered for North American numbers now. For numbers from other countries
  it used to suggest a +1 rule that would block the wrong callers.
- A number's screen offers to block its area code outside North America
  too, written from the number's own country code: +33 1 for Paris, +49 30
  for Berlin, +49 33201 for Groß Glienicke. The table of area codes comes
  from libphonenumber, so a mobile number, or one from a country without
  area codes like Spain, gets no offer rather than a wrong one. The same
  goes for a range the table can't pin down, so a toll-free 800 number in
  Finland gets no offer rather than one for the whole Oulu area.
- Backups now carry the blocklists you subscribed to: each list's address,
  name and on/off switch. Restoring on a new phone adds any you don't have
  and downloads them on the next refresh. Lists already on the phone are
  left alone, including one added back when plain http:// addresses were
  still allowed, and Undo removes only the ones the restore added.
- Protection Test has a new card showing the last five times Android closed
  CallShield and why, such as to free up memory. It's read on the phone and
  never sent anywhere. Android 10 doesn't keep this record, so the card
  doesn't show there.
- Background jobs whose schedule changed in an update now pick up the new
  schedule the next time the app starts, instead of keeping the old one
  until a reinstall. The trending list sync stops after three failed tries
  and waits for its next run, and saving the blocked-call log gives up
  after twelve tries until the next blocked call or restart.
- Tapping Not spam on a blocked call tells the community only when the
  shared database did the blocking, including under a category rule. A
  block from a list you subscribed to, or from your own block list, stays
  on your phone. The same goes for Database prefix expansion: it tells the
  community only when a number from the shared database made the match.
- On a dual-SIM phone, the carrier's "Unverified" scam label is now read
  for the SIM that got the text, not the default one, and a SIM that was
  still locked at startup counts as soon as it's unlocked. Scanning the
  inbox again reads each text the same way.
- If the SIM was still locked when the phone started, CallShield used to
  read numbers by the phone's language region until the app restarted. It
  now switches to the SIM's country within a minute of the unlock.
- Meeting mode now starts only while a picked app shows an ongoing call.
  A "Connected" or sync notice from Teams, Zoom, Slack or Discord could
  keep the phone in meeting mode for hours before.
- After CallShield repairs a damaged database, the trending numbers come
  back as soon as there's a connection instead of up to 30 minutes later.
- After a restart, CallShield starts from the trending number ranges, scam
  web addresses and community watch list it last downloaded, so the
  "Reported by 2 CallShield users" label is there before the first refresh,
  with no connection too. It used to fall back to the copies it was built
  with, which could be months old and hold ones the community had since
  cleared. A phone updating from an older version fetches the current lists
  right away instead.
- A first text that asks you to message a WhatsApp link counts as reply
  bait even when the link ends the sentence, as in "https://wa.me!" or
  "(https://wa.me)".
- The caller ID popup and the blocked log now say "International call from
  Jamaica" (or wherever, and "text" for a blocked message) when a caller's
  number is from another country than your SIM's. Within North America the area code tells the US, Canada and the
  Caribbean apart, so a one-ring call from 876 no longer looks local. A
  toll-free number doesn't say where it is, so it isn't labeled. Russia and
  Kazakhstan share +7 and are told apart. It's a label only and doesn't change
  what gets blocked.
- Outside North America, a number in a flagged text written the way people
  write one at home (020 7946 0018 in the UK, 01 23 45 67 89 in France) is
  now picked up when the text asks you to call, ring or dial it (or names it
  as a helpline or hotline), so a call to it is held like one to a number
  written with its country code. Dates, prices, order and account numbers,
  and codes stay out.
- Times read the way your phone's language says them. The dashboard, More
  and the widget showed "Synced 5m ago" and "Last: 3h ago", which
  TalkBack read as letters and no language but English shortened that way.
  They now say "Last sync: 5 minutes ago", "Yesterday" or the date. Counts
  in range rules, list previews, the hot data test, the bundled snapshot
  notice and campaign reasons follow your language's plural rules too, so
  there's no more "1 numbers".
- Lookup has a Message mode. Paste a text you're unsure about and it gets the
  same content rules and link checks as an incoming text, with the reasons
  listed. It all runs on the phone. A link's domain goes to a URL threat feed
  only if you've turned those on.
- More has a My reports page listing what this phone reported to the
  community in the last 90 days, with the date and whether each report was
  sent, is still waiting to send, or didn't go out. Reported a number as
  spam by mistake? Tap Send not spam on that row and the correction goes out
  the same way. The list is kept on the phone only.
- Recommended lists has Lista Hũ, Paraguay's community list, with the
  reports made since January 2025. Its numbers are stored as +595 numbers
  whatever country your phone is in, and ones from other countries that
  people reported there are left out rather than misread. Lists that name
  their columns in Spanish ("numero", "tipo", "comentarios") are read too.
- Database v55 adds the FCC complaints published through 2026-10-09 and
  FTC's newest 400, for 51,368 numbers, and refreshes the 652 French
  telemarketing ranges.
- The data pipeline needs urllib3 2.8.0 or later, which fixes three
  advisories published 2026-09-30 (a hostile server could stall a download
  with an endless chunk or deflate stream, and HTTPS proxy TLS settings
  were ignored), and cryptography 50.0.2.
- Report on a number's screen now sends the anonymous community report,
  the one that counts toward blocking, and its result shows as a message
  wherever you've scrolled. It used to open a GitHub issue under your own
  account, which is public and never reaches the database. That's still
  there as a smaller "Report publicly on GitHub" link, and the second
  Report spam button lower down is gone. The screen also says when a number
  is already in the database, or when you reported it in the last 90 days,
  before you report it again. Reporting a number nothing had flagged now
  sends it as spam. It used to go out with no category, so the service
  filed it as unknown and My reports couldn't show it. Tapping Not spam
  right after a report no longer leaves its Undo waiting behind the
  report's message.
- A number's screen now keeps clear of the status bar and the navigation
  buttons. With three-button navigation the Undo message sat under the
  buttons, so tapping Undo after blocking an area code or marking a number
  not spam hit the bar instead and the change stayed. The back arrow and
  copy button at the top had crept under the status bar too.
- The README explains how to install on phones that enforce Google's
  developer verification, which started 2026-09-30 in Brazil, Indonesia,
  Singapore and Thailand. You can turn on "Allow apps from unverified
  developers" in Developer options and wait a day, or install over USB with
  `adb install`.
- The weekly pipeline check warns a week before an upstream source goes
  stale, without failing, so an overdue FCC or FTC import shows up while
  there is still time to run it. FTC went stale on 2026-10-07 and nothing
  said so until the next weekly run would have failed.
- The report merge can list the open in-app spam issues on GitHub with
  where each number stands (in the database, pending with how many reports
  and reporter groups, on the watch list, or not seen), so they get looked
  at and answered in the same pass. They still never count as reports.
- Smart suggestions on the dashboard now spot a campaign that calls from a
  new number in the same exchange every day or so. When this phone blocked
  or reported three or more numbers from one exchange, such as (737)
  259-xxxx, spread over more than a day in the last two weeks, it offers to
  block those 10,000 numbers, with Undo. It never offers your own exchange
  or one where a contact's number is, so it stays quiet unless it can read
  this phone's number and your contacts. Android shares the phone's number
  once SMS access is on, if the SIM has it. North American numbers only.
- The data import no longer asks for the sunlei/denylist text list. That
  GitHub repository is gone, so every import got a 404 and skipped it, and
  it never added a number. Its source entry is gone too.

## v1.11.0 (2026-09-30)

- A link written `https://evil.com\@paypal.com` in a text is now checked as
  evil.com, the host a browser actually opens. The text check used to read it
  as paypal.com.
- Two more North American rules stopped reading other countries' numbers as
  North American. A campaign burst (five callers from one area code and
  exchange in an hour) now counts only North American numbers, so five
  spoofed calls an Australian phone couldn't place, or five Singapore numbers
  from one block, no longer look like a campaign. The neighbor check also
  reads the phone's own number in its own region, so an Italian SIM's number
  no longer shares an exchange with a New York caller.
- In aggressive mode, a business's text is no longer blocked for its opt-out
  footer alone. "Reply STOP to opt out" scored 40 against aggressive mode's
  bar of 25, so a clinic's appointment reminder or a pharmacy's refill notice
  was blocked on its last line. Answer and opt-out wording now counts only
  next to another spam signal (a lure, a suspicious link, shouting or a
  callback number), or in a text that doesn't say who sent it. The carrier
  rules make a business open with its name ("Lakeside Family Clinic: ...",
  "[Corner Market] ..." or "this is Dana from Maple Street Dental"), while
  scams paste the footer onto a chatty opener that never says. A time like
  3:30, a link, a greeting or a word like Alert in front of the colon isn't
  a name. Recall on the IMC 2025 smishing sample went up slightly.
- A number the maintainer approved can now be taken back. Its entry in
  `spam_numbers_approved.json` gets `"revoked": true` and a date, and the next
  merge strips the review from the row. A row the review alone was holding up
  is unpublished. One with community reports goes back to the usual gate with
  the reports it actually got, so the review's date and count can't help it
  through. A number listed twice stops the merge with an error naming
  it, since two dates made its evidence flip and every phone re-download the
  database on each merge. So does deleting an approval outright, which used to
  leave the review in the row for two years. Not-spam votes no longer make a
  reviewed row a correction candidate.
- On a phone outside North America, a ten-digit number the phone couldn't
  place is no longer scored by North American rules. An Australian phone
  gave `8881234567` the toll-free score, and the VoIP-range, campaign-range,
  neighbor and model scores could pile onto a spoofed number the same way.
  Repeat calls from the same number still count everywhere. Phones in the
  US or Canada, or with no known region, behave as before.
- A link whose host ends in a dot, like `https://evil.com./login`, is now
  checked against the phishing feed and the spam-domain list. Browsers open
  it like the plain address, but the dot hid it from both, and from the
  link-shortener and suspicious-ending checks too. A user name in front of
  the host, as in `https://paypal.com@evil.com/`, no longer hides the real
  host from the spam-domain list either.
- Your own blocks, allow list and rules now survive a damaged database.
  Android deletes the file as soon as it finds a bad page, which used to
  take all of them with it. CallShield now copies them out first and puts
  them back into the new database. The screener also stopped letting every
  call through after a rebuild until the app restarted.
- A phone that comes back from a cloud backup, or whose database had to be
  rebuilt, downloads the whole spam list again. Before, the restored
  settings claimed the list was current and only changed parts came down.
- The outgoing call check now also holds a call to a number that appeared
  in a text CallShield flagged as spam during the last 30 days. Fake bank
  and delivery texts ask you to call a number back, and the hold notice
  says which day that text arrived. Numbers written with a + and a country
  code are picked up anywhere. Ten-digit North American numbers are picked
  up on phones set to that region and need the +1 elsewhere, since a Chinese
  mobile number has the same shape. Fullwidth digits, typographic dashes and
  a (0) after the country code are read too, and so are chats a messaging
  app's notification showed. Marking the sender Not spam forgets the numbers
  from its texts. Contacts and allowed numbers still ring straight through.
- A one-time code that arrives during a call from someone who isn't in your
  contacts, or in the 10 minutes after it, brings up a warning not to read
  it out to the caller. Imposters posing as a bank ask for exactly that code.
  It shows once per call, never for a contact or a number on your allow list,
  and works for hidden numbers too. Calls CallShield silenced or let ring
  without a check (blocking turned off, or a check that ran out of time)
  count as well, since you can still answer them. It knows codes split in
  two, like 123 456, and the words banks use for a code in Chinese, Japanese,
  Korean, German and Turkish. The text can even arrive after Android has
  closed the app. It has its own notification channel, so it can be turned
  off in Android's settings without touching other alerts.
- A trusted number can let its whole number block through. A doctor's office
  that calls from 555-234-5601 one day and 555-234-5617 the next needed every
  line allowed by hand. Now the entry's menu offers the numbers that differ
  only in the last 2 digits (100 numbers) or 3 (1,000), and the entry shows
  the block it covers as `(555) 234-56XX`. It's off by default, only a
  permanent entry of 8 digits or more can take one, and a number inside the
  block that you blocked by itself stays blocked. Backups carry the block.
- Settings > External blocklists opens with Recommended lists: OpenCallShield
  (Colombia), SpamChile (Chile) and Turkish Spam Numbers (Turkey), each showing
  its country and license beside an Add button. Nothing is downloaded until you
  add one, and none of them is merged into the database. Every list declares its
  country's number plan, so local rows such as `3131918305` and `03395051735`
  are stored as +57 numbers even on a phone in another country, and so are
  rows with a stray dial digit in front of the 57. A catalog list
  typed in by hand gets the same treatment, including one added before this
  release, on its next refresh. The catalog ships in the app and a signed copy
  is refreshed on every sync. An older signed copy served later, by a mirror
  for example, never replaces a newer one.
- SMS checks catch reply bait: a first text from a phone number you've never
  texted or heard from that fishes for an answer without a link. "Hi mum,
  this is my new number, my phone broke" is caught in English, Spanish, German,
  Dutch, Portuguese, Italian, French and a few more, and so are "Is this
  Sarah?" and "sorry, wrong number". On its own it blocks only in aggressive
  mode, since a real kid with a new phone writes the same words. Someone
  else's parent ("this is Maya's mom, here's my new number") doesn't count,
  and neither does a business's "Wrong number? Reply STOP" footer or an RCS
  or chat message, which never reaches the inbox that says who's a stranger.
- The SMS regression test runs 5,000 real smishing reports from the IMC 2025
  dataset (CC BY 4.0) and reports recall for each language. Content rules
  catch 12% of them, up from 10% before reply bait, and 26% of the wrong
  number and "hi mum" scams, up from 4.5%.
- The report Worker runs the current code. It had been serving a build from
  March, so reports carried no reporter identity and the trending lists and
  spam domains couldn't count independent reporters. It now records a daily
  reporter bucket, limits reports per network, per carrier block and overall,
  and turns away browser posts and bodies that aren't JSON.
- The README's caller ID popup screenshot shows the current popup, with its
  larger text and full-size buttons.
- The README matches the app again. The detection table lists the emergency
  and one-time-code floors and the carrier scam-label check, Rules shows its
  six tabs, backup is under Settings, Advanced, and the caller ID example uses
  the popup's current wording. It also names the hand-reviewed numbers source
  and says the build needs JDK 17 or 21.
- Numbers in the spam database keep blocking while any of their evidence is
  current. A number backed by both an FCC complaint and the database used to
  stop blocking when the complaint aged out in September 2027, nine years
  before numbers backed by the database alone. Phones that already have the
  database fix their stored copy once, on the first start after the update.
  A trending number blocks again when its database entry has run out, and the
  weekly pipeline check counts expiry the same way the app does.
- Expecting a call lets hidden callers ring too, including under the Contacts
  only, Personal, Sleep and Maximum profiles and during a meeting. Its text now
  says what still blocks: your blocked numbers, wildcard rules and a failed
  caller ID check. On a locked phone the Quick Settings tile asks you to unlock
  before it opens the window. Hidden callers also ring during a window before
  the first unlock after a restart. Once a call, the tile or an app restart
  has seen a window end, moving the phone's clock back can't reopen it.
- The community report queue was merged for the first time since reports
  started carrying a reporter bucket, which clears the weekly pipeline check
  before it would have failed on October 12. None of the 93 reports reached the
  publishing threshold, so the database (version 52) gained no new numbers and
  366 numbers wait for more reporters.
- Home shows a card when a newer CallShield release is out, with a link to its
  release page. The notice is a signed file that syncs with the spam database
  every six hours and when you tap Sync database, so it needs no extra server
  and nothing unsigned can fake it. Hide it and it stays hidden until the next
  release, and an older copy served late can't bring back a card you hid. The
  optional weekly update check in Settings works as before.
- Settings opens on Blocking, Safety, Notifications and Appearance. Advanced
  now starts with a When a call is blocked card, where silent voicemail,
  muting low-confidence blocks, answer and hang up, and call handling by
  category sit together, then Quiet hours. Most of those were among the
  detection engines, where they read like more ways to catch spam.
- Clearing the blocked log and blocking a whole area code happen straight
  away now, with Undo on the message that follows, instead of asking first.
  Undo puts back every log entry, or the area code rule you had before.
  Temporary allows and blocks from the log and Recent calls offer Undo too.
  Block on the caller ID popup shows Blocked with Undo for six seconds, and
  the community report waits until that's over, so an undone block is never
  reported. Restore with Replace keeps a copy of the sections it's about to
  clear, and Undo next to the result puts them back for 30 seconds, hidden
  callers' log entries and short codes included. A second tap on Clear log
  or Block area code, or a second temporary decision for the same number,
  keeps the first Undo working.
- Text rules see through disguised spam. Fullwidth and math-style letters,
  zero-width and other invisible characters, and Cyrillic or Greek letters
  that look Latin are undone before the SMS content checks and your keyword
  rules run. A link or brand name with hidden or look-alike characters in it
  counts against the message. Russian, Greek and Hebrew messages are read as
  written, even with a missing space after a full stop or a direction mark
  before a brand name. A look-alike web address is never reported as the
  real one, or as the address left after its first letter. The phishing link
  warning reads links the same way, so an invisible character inside a known
  spam domain no longer hides it.

## v1.10.0 (2026-09-28)

- Expecting a call lets unknown callers ring for an hour, three hours or until
  midnight, from Home or a Quick Settings tile. Your blocked numbers,
  wildcard rules and a failed caller ID check still block, and contacts-only
  mode steps aside for it. An ongoing notification counts down to the end and
  offers End now, and the window ends by itself.
- Numbers from the spam database keep blocking between database updates. A
  phone stops matching a downloaded number once its evidence expires, and every
  number in the database carried evidence due to expire between October 9 and
  October 25, so the database would have stopped protecting anyone if updates
  paused. Complaint evidence now lasts a year from its import, the database's
  own record ten years and French telemarketing ranges 90 days, and the weekly
  data check fails a month before any of it runs out. The fix travels with the
  data, so phones still on 1.9.0 get it with their next sync.
- A number the maintainer has checked by hand can go into the database when no
  imported source covers it. Such a row names the review as its evidence, and
  later reports can't take it back out. The first is +49 89 43780834, a Munich
  line reported in #27.
- The README says plainly that CallShield ships from GitHub Releases only, with
  no store listing planned, and the unused F-Droid submission files are gone.
- The Blocked log and Blocklist fit a 360x780dp phone with 3-button
  navigation and large text. When the screen is short for its text size they
  drop their intro lines and tighten the empty card, so "Show all activity"
  and the empty Blocklist card are no longer cut off or hidden under the Add
  button. An empty card that still doesn't fit scrolls.
- Home counts only the engines that can run. A toggle whose permission,
  screener role or notification access is missing no longer adds to the
  count. Home and Settings count the same two setup steps, and Home asks for
  notification access when RCS filtering, push-alert caller trust or meeting
  mode is on without it. A failed sync says what went wrong in a sentence
  (offline, lookup, secure connection, a server error, an unsigned or damaged
  update) instead of the raw error.
- The caller ID popup works with TalkBack. Its header and verdict are read out
  as they change, its text is at least 14sp, every button is a 48dp target,
  the verdict line says why a call looks risky, and Search looks the number up
  in the phone's language.
- A link in a text is checked against OpenPhish by its full host, so a phishing
  page on one subdomain is caught without flagging its sibling subdomains.
  The match stops at the site's own domain, so an entry on a shared host such
  as an Amazon S3 region flags only its own bucket, not every bucket there.
  OpenPhish is matched on the phone. PhishTank still receives only the site's
  base domain.
- Number details, Lookup and the block explanation describe FCC and FTC
  complaints in words, one line per kind, instead of the importer's field names
  ("FCC callback_business") and the same complaint repeated. Older rows that
  say "caller ID" or "advertiser" read the same way, and so do the database
  browser and search results. Your own notes are shown as you wrote them.
- The database is also published as data/spam_numbers.txt, one number per
  line under a short header, signed like the app's feeds, for projects that
  only want the list rather than the 51 MB JSON.
- A blocked-call alert offers Not spam, which lets the number ring for the next
  24 hours, instead of Block forever for a number that was already blocked.
  When the block came from the shared database it also tells the community
  database it was wrong. It isn't offered when your own rule, contacts-only
  mode or a failed caller ID check blocked the call, since a day's allow can't
  outrank those. Texts are called flagged everywhere, including the log, the
  export, the alert channel and what TalkBack reads for a text's reason, since
  they still reach your messaging app. The daily summary says "last 24 hours"
  rather than "today".
- Texts whose sender is a carrier's scam label are flagged. Singapore renames
  unregistered senders Likely-SCAM, Ireland Likely Scam and Australia
  Unverified, and the reason names the label. Unverified counts only on an
  Australian SIM.
- The getting-started guide matches the app again: setup's five steps, and a
  section for every Settings card with its settings and defaults. The README
  now says what the report Worker stores, what the widget shows and which
  folders the app can share, and its tests badge says it counts JVM unit tests.
- WorkManager is 2.12.0. The data pipeline now requires cryptography 50.0.1
  and urllib3 2.7.0 or later, which fix published vulnerabilities.
- Backups now carry the outgoing-call hold, the theme, the update check and
  the feed mirror, which a restore used to leave behind. Restoring an older
  backup leaves those four as they are. A test now fails when a new setting
  is neither backed up nor left out on purpose.
- Answer and hang up works for callers whose number arrives in national format,
  such as a UK 07911 number, instead of letting them ring out silently. While
  roaming it rejects the call rather than answering, and a second call that
  arrives during the hang-up delay no longer leaves the spam call connected.
- The spam model's quality gate scores exactly the rows its training held out,
  and the pipeline checks run it every time. It used to rebuild that split
  from whatever the database held, which mixed in rows the model had trained
  on, and nothing ran it. The shipped model scores F1 0.47 on its real
  held-out rows, against a floor of 0.45.
- A spam text from an international sender is logged once, with one alert.
  The notification listener dropped the + from the sender, so a +44 text
  the SMS receiver had already logged was logged again, and its spam check
  looked up the wrong number. A second, different text from the same sender
  within a minute is no longer swallowed as a duplicate.
- A caller blocked three times by quiet hours or Contacts only no longer looks
  like a rapid-fire robocaller. Only blocks that judged the caller count now,
  not ones your own schedule or mode caused, and not calls that were let
  through.

## v1.9.0 (2026-09-26)

- Phones no longer treat the empty trending feeds as an outage. Since
  September 25 the hot list, campaign range and spam domain feeds went out empty
  without being marked cleared, so every phone kept retrying the refresh and
  Protection test warned that the hot list was missing. They're republished as
  cleared, and the generators now refuse to publish an empty feed that isn't.
- Community rows that three separate reporters promoted stay in the database
  when their oldest reports pass 30 days. Once the report Worker records
  reporters, the old check would have dropped them about a month after
  their first report.
- A late community report for a number that is already in the database, such
  as one with FCC complaints, now counts instead of being thrown away.
- The FCC import now resumes from when complaints were published, not from the
  date written on each one. FCC's daily batches reach back years, so once a typo
  row dated September 26 moved the old cursor, every new batch was skipped: all
  535 complaints published that day. The next import picks them up.
- A number can't enter the database on one person's reports any more. The
  report Worker's reporter ID changes every UTC day, so one person reporting on
  three days counted as three reporters, and two reports minutes apart either
  side of midnight counted as two days. A new number now needs two reports at
  least 24 hours apart and, when reports carry reporter IDs, three different
  reporters on the same day.
- Three community numbers that database v47 dropped by mistake are back. The
  move to the promotion ledger only looked at their last 30 days, so rows whose
  reports were months apart looked uncorroborated. A fourth stays out, because
  its two reports came two hours apart.
- FTC imports without an API key now take the newest complaints each time. At
  400 a day, reading forward from the last run fell further behind FTC's daily
  volume.
- The report Worker's code now limits each /48 network to 20 reports a minute
  and the whole service to 30, and refuses an oversized upload before reading
  all of it. This takes effect at its next deploy.
- A keyless FTC import stops before the shared daily request allowance runs out
  and keeps what it fetched. Running into the limit used to record the whole
  import as failed.
- The Report button opens GitHub's spam report form, so in-app reports arrive
  labelled. The tracker also has a bug report form that asks for the app
  version, Android version, phone and Protection test result.
- Database v49 re-reads FCC's newest 500,000 complaints and adds 200 new FTC
  ones, for 51,362 numbers.
- The hot list and the spam domain feed count reporters on one UTC day. The
  report Worker's reporter ID changes at midnight, so two people reporting
  either side of it counted as four and could put a number on every phone's
  hot list.
- Calls from outside North America no longer get a US or Caribbean place name
  in the caller-ID popup. A +65 call used to read as Birmingham, AL, and Number
  details offered to block that US area code. On a phone outside North America,
  numbers without a + follow the phone's own region too, so a Chinese mobile in
  Recent calls no longer reads as Rockville, MD.
- Rapid-fire detection works for callers outside North America again. There it
  compares the whole number, so a +49 and a +1 number that share their last ten
  digits still never match.
- Contacts only mode no longer rejects every call, your contacts' included, when
  Contacts permission is off. It pauses instead, and Home, Settings and
  Protection test say so, with a button to allow Contacts.
- Run setup again no longer forces you to pick a protection level. Finish keeps
  your current settings and Back returns to the app. Leaving halfway also no
  longer switches off the "call screening is off" warning.
- Denying the Phone permission during setup no longer stops setup from
  finishing. Phone access is recommended, not required.
- The Undo offered after picking a protection level times out on Home, in
  Settings and in setup, so tapping it later can't roll back changes you made
  since.
- Home's Enable call screening, Enable overlay and Enable notifications buttons
  ask for that permission directly. They opened Settings, which could land on a
  page without the control. While a required permission is missing, Settings
  shows Grant and Enable buttons on Basic at any text size, not just labels.
- Backup and restore choices no longer reset when you switch between Basic and
  Advanced in Settings.
- Number details gives Block a row of its own, so the action labels stop
  breaking mid-word on smaller phones.
- TalkBack reads Settings' Basic and Advanced as tabs, page titles as headings,
  and setup's progress as 13% on the first step instead of 0%.
- Six page headings that only existed in English are translated into Chinese.
- Choosing Light in Settings works again. It had quietly stayed on AMOLED. The
  update keeps whichever theme each phone was showing.
- Protection test's ML spam check no longer fails on every phone. Its sample
  number scored just under the model's threshold, so the check could never
  pass. The new samples pass under the main model and its fallback, and the
  data checks refuse a retrained model that breaks them. Its cards span the
  page, the database count is formatted like everywhere else, and the hot list
  hint says what it's about.
- Dialogs and bottom sheets use the same 12dp corners as the app's cards.
- The caller ID popup is fully opaque, with 12dp corners like the rest of the
  app. At 96% opacity, bright text in the app underneath showed through the
  caller's name and verdict, and its 16dp corners were off the app's scale.
- Progress bars in Insights, Protection test and Settings are flat. Their rounded
  ends and end dot turned the thin bars into pills. Protection test's summary
  says optional extras, not premium ones.
- Empty Blocklist and Blocked log screens use the app's standard outlined card.
- More's cards keep their text centered, and the update check and crash log
  share the What's new card style. The update check's privacy note is no longer
  cut off.
- The last setup step says Finish is waiting for a protection level.
- Lookup reads "Look up a number". Its risk gauge sits on a soft glow instead of
  a solid disc, and the evidence rows line up.
- Home no longer shows this week's count twice.
- The block explanation calls the database CallShield's spam database, not its
  community spam database. Most of its numbers come from FCC and FTC complaints.
- Settings rows share one icon tone, region and caller-name rules open from a
  regular row, and switch descriptions are no longer cut off.
- Tapping More while inside one of its pages goes back to the More list.
- Labels with acronyms (SMS, ML, URL), the Insights and More headings, and the
  share, backup and daily summary titles use sentence case too.
- Protection test opens with a heading, and after a run it shows required and
  optional checks as two progress cards. Each result is an outlined row with a
  status mark and an OK, Fix or Review label.
- What's new starts with the latest release, folds older releases behind one
  card, and ends with a short note about what CallShield sends off the phone.
- Tabs, chips, empty-state cards and icon backdrops that had drifted back to
  pill and circle shapes use the app's corner scale again, and a test now fails
  if a pill shape returns.
- Buttons, headings and notification channel names use sentence case
  throughout, matching the rest of the app.
- Insights now opens with outlined totals, then its real weekly chart and
  detail cards. Its labels describe recorded call and text events accurately.
- Number details now groups block, report, call and area-code controls under a
  single action card.
- More now opens with a "Tools & support" heading and a protection summary
  card. Protection test, Settings, Statistics and What's new are full-width
  cards, so the main tools are easier to find.
- Blocklist now has a clearer rules heading, an outlined count card, a tab for
  each rule type, and a framed empty state.
- Recent calls now uses compact, neutral history cards and shows a Retry card
  when Android cannot load the call log. Calls already loaded stay visible.
- Blocked activity now has a clear heading, a framed empty state and compact
  status icons that distinguish stopped calls, flagged texts and exceptions.
- Lookup now opens with a clear number-check prompt and a private-check card.
  Risk results group the app's actual reasons under Evidence, and checking a
  number closes the keypad so the verdict stays visible.
- Activity now uses clear Recent and Blocked tabs and an outlined summary of
  actual call history. Its introduction names the history the app can show.
- Settings now opens on grouped Basic controls, with detailed access, detection,
  lists and backup options under Advanced. Cards match the dark screen design,
  and Settings no longer opens an unrelated database search.
- Setup now counts only the two required grants in its progress header. Its
  protection cards use tighter spacing and clearer selection styling.
- Home now puts today's results, call and text readiness, the latest blocked
  caller and protection levels ahead of the longer checks and tools.
- Home shows an empty recent-calls card until CallShield has stopped a call.
- Fresh installs now open in the AMOLED theme. Its graphite cards, mint controls,
  coral warnings and thin outlines follow the new screen designs. Existing
  theme choices remain saved, including Light and System.
- Setup now ends with a choice of Recommended, Strict, or Contacts only. Each
  card shows what changes. Home shows the active level, and profile changes
  offer Undo. Settings can restore the recommended controls with Undo too.
- The report Worker can now deploy from a clean checkout. Wrangler provisions
  its KV namespace and uses the current rate-limit binding format.
- Reviewed domains in `spam_domains_approved.json` now reach the published
  feed. The extractor stops with an error if the approval file has the wrong
  shape.
- Removed the inactive URLhaus lookup and its Settings claim. Optional link
  checks now name PhishTank and OpenPhish. The OpenPhish feed refreshes every
  six hours and reuses its local copy when the server reports no change.
- Cached prefix ranges now expire on time, even when no feed sync runs.
- Frequency auto-block now counts prior incoming calls that reached the phone's
  call log as answered or missed. Calls stopped or silenced by CallShield, and
  diagnostic entries, no longer push a caller toward the repeat-call limit.
- North American toll-free, VoIP, neighbor-spoof, hot-campaign and repeat-call
  checks now ignore international numbers whose last ten digits resemble a
  North American number. Other international risk checks still run.
- Region Rules now recognizes all 453 active geographic area codes in a pinned
  NANP registry snapshot, including new 465, 483 and 942. A code missing from
  the snapshot passes only if it could have come into service since then. N11,
  555, reserved, non-geographic and 900 codes have no region, so they stay
  outside your allowed regions. The 324 and 826 city labels are fixed.
- SkipCalls answers marked "unknown" or "other" now read "Reported, no
  category" and leave the caller ID warning unchanged. Only its named spam
  categories can flag a caller. The number page shows the neutral result too.
- New community-only numbers now wait for reports on two UTC days before they
  enter the shipped database. Reports with reporter buckets also need three
  distinct buckets, even when bucketed reports arrive after an earlier
  bucketless promotion. Pending reports expire after 30 days. The first pass held
  449 older, uncorroborated rows, leaving 51,357 numbers in feed v47.
- Setup now finishes once the required phone, message and call screening access
  is ready. You can skip notifications, caller ID overlay and notification
  access, see what each choice disables, and return through Settings later.
- The FCC import now ignores complaints with no issue date or a future date.
  Its saved cursor advances to a valid complaint, and the weekly source check
  uses the newest complaint date so an empty fetch can't hide a stalled feed.
  Release checks now recognise the importer's success and failure statuses.
- A catch-up import processed 500,000 FCC complaints and refreshed evidence on
  7,638 existing numbers. That import left 51,806 numbers in feed v46.

## v1.8.1 (2026-09-25)

### Protection

- Call handling by category no longer acts on a weak ML block. The on-device
  model types every call it blocks as a robocall, so a Robocall setting of
  Allow or Silence decided calls it scored from 65 to 79, where CallShield
  otherwise names no category. An ML block now counts as a robocall from a
  score of 80, and the Blocked log labels it the same way.
- When two outgoing calls overlap, Android giving up on the first one no
  longer stops CallShield answering for the second. Android's timeout
  doesn't say which call it's for, and it was applied to the newest call,
  which Android would then cancel as well.

### Interface

- The release history under More and the weekday schedule label read as
  plain English now. They used em and en dashes in 37 places, and the
  weekday preset now says "Mon to Fri" instead of joining the days with a
  dash. A unit test keeps dashes out of the English strings and the release
  history.
- The selected Keep for chip under Log cleanup and the red repeat count in
  the grouped Blocked log now meet the AA contrast minimum in the light
  theme. The chip's green text on its green tint came to 4.33:1 and the red
  count to 4.30:1. The chip label now uses body text, like the other selected
  chips, and the count badge a lighter tint (4.63:1 measured on screen).
- The Database tab keeps its type and source chips when Android closes
  CallShield in the background. They came back as All types and All sources
  while the list kept its scroll position, so it reopened partway down the
  unfiltered list.
- Changing a filter chip on the Database tab or in the Blocked log no longer
  shows the last filter's rows as the new filter's results. They stayed on
  screen, and could be tapped or swiped, until the new filter's first page
  loaded. The list shows its loading spinner for that moment instead, and
  its error card with Retry if that first page fails to load.
- The warning in the add-rule dialogs that another rule overrides the new
  one meets the AA contrast minimum in the light theme: 4.82:1, up from
  4.44:1, with a lighter tint behind the same yellow text.

### Data pipeline

- The weekly pipeline check no longer fails just because reports piled up
  since the last drain. About twenty arrive a day and drains are run by hand,
  so its 20-report cap tripped within a day of every drain while nothing was
  stuck. The weekly run now leaves dated reports to its age check, which fails
  once the oldest has waited more than 7 days. The cap still covers files it
  can't date, and applies in full to the local gate run right after a drain.

### Build

- The on-device repository tests use detectors of their own. They screened
  calls through the app's shared campaign detector, which saves what it sees
  to the installed app's database, so test numbers from earlier runs could add
  up to a campaign burst and fail a later test. The hot-list tests also
  cleared the app's live hot ranges and spam domains around every test. The
  two startup timing tests still read the app's own data, since that is what
  they time, but no longer add the calls they screen to it.
- The contrast test fails when any chip draws its label in the accent its
  container is tinted with at 15% or more, however the colors are written.
- A unit test checks that every check in the pipeline, the SMS-only ones
  included, has a Chinese name of its own. The Chinese sweep reached only one
  of the 37, so a missing or untranslated name passed.
- The database upgrade tests check what each upgrade does to empty fields,
  not only how many rows survive. An upgrade that turned a permanent allow
  into an expired one, dropped a logged call because it shared an empty key
  with another, or merged a number's two spellings without keeping the
  higher report count and the user's block now fails the build. The oldest
  hand-built databases also carry a logged message and a prefix now.
- The dashboard test checks each protection row's Ready or Needed badge, not
  only the checklist's headline.

### Translations

- The why panel names a telemarketing range in the app's language. On
  Android 10 to 12, with CallShield set to a language other than the
  phone's, the range came out in the phone's language, and a name written
  before a language switch kept the old one.

## v1.8.0 (2026-09-25)

### Protection

- Blocked calls can be answered and hung up instead of rejected, so a spam
  caller can't leave a voicemail. The Answer & hang up blocked calls switch
  in Settings is off by default, and it asks for the answer-calls permission
  when you turn it on, so Setup no longer asks for it. It applies to calls
  CallShield would reject outright. Silent voicemail mode, low-confidence
  auto-mute and a meeting-mode silence still go to voicemail, and a call that
  arrives while you're on another is rejected as before. The call is answered
  without video and hung up after a delay you can set from 1 to 10 seconds,
  since some carriers need longer before voicemail is skipped. Those short
  answered calls never count toward trusting a caller. Answering tells
  autodialers the line is live, so some call back. Contributed by
  @tikkamasalla (#22). Protection Test lists the answer-calls permission as
  not needed until that switch is on, instead of as a missing Samsung and
  Xiaomi compatibility grant.

- CallShield can stop a call you're about to make to a number it already
  flags. Callback scams only pay once you dial out, so that's where this
  catches them. It's off by default and uses Android's call redirection role,
  which the new Settings switch asks for. A call to a number on your
  blocklist, in the spam database, on a premium-rate line or on a
  callback-scam country code is held, and a notification says why and offers
  Call anyway. Contacts and numbers you trust ring through, and if the check
  runs slow the call goes ahead rather than being dropped, unless it's a
  premium-rate or callback-scam number, which is held on that rule alone.
  The hold never happens where you wouldn't see the notification. In car
  mode, under Do Not Disturb, or with CallShield's notifications turned off
  or turned down so they no longer pop up, the call goes through. Letting
  CallShield override Do Not Disturb only helps in priority mode, since total
  silence and alarms-only hide every notification. One Call
  anyway covers the number however the dialer spells it. If you start a
  second call before CallShield has answered for the first, the second one
  is checked on its own and never gets the first call's answer.

- Work-from-home job offers now count as spam content, in English, Spanish,
  Portuguese and Italian. That's a text promising pay by the day or hour for
  working from home or liking videos ("gane 300 EUR al día desde casa",
  "ganhe R$ 500 por dia curtindo vídeos"). On its own it's blocked in
  aggressive mode. With a shortened or suspicious link it's blocked at the
  default setting too. It takes both halves, so an interview reminder, a
  payslip, a part-time shift rate, a house-cleaning job or a cashback offer
  stays clean.

- A caller ID that arrives without its +1, such as 649 555 0123, now matches
  the spam database and the prefix list, which store numbers in +1 form.
  When Android's number library didn't recognize the exchange or the area
  code (a made-up number, or an area code newer than the phone's copy of the
  library), the number kept its bare form and slipped past both. Numbers you
  blocked or allowed match every spelling too, and so does the outgoing call
  hold. Blocking, allowing and removing a block also work across spellings:
  a newer block of 649 555 0123 replaces an older allow of +1 649 555 0123,
  and Remove my rule clears the block however it was saved.

- Your call category rules now reach more suspicious-pattern blocks. A call
  flagged as possible neighbor spoofing counts as a scam, one from an active
  campaign range as a robocall, and a toll-free one as a telemarketer, so
  the action you picked for that category applies. Those mappings existed
  but never matched, because they looked for internal names the block
  description had already turned into plain words. A suspicious-pattern
  block only gets a category when it's as confident as the default setting
  requires. One that only aggressive mode blocks, such as a lone
  neighbor-spoof or VoIP-range match, stays uncategorized, so no category
  rule can let it through. Before, a weak match that the block had typed as
  a robocall still counted as one.

- CallShield starts faster when a call wakes it. Looking for an interrupted
  backup restore held the main thread about 0.7 seconds on every start
  (measured on an Android 10 emulator), out of the five seconds Android gives
  a call. A marker file now proves there's nothing to finish, so startup takes
  about 60 ms, and only the first start after an install, an update or a
  restore still looks. The blocking rules also load as the app starts, which
  includes after a reboot or an update, instead of during the first call.
- Updating from an older version no longer leaves CallShield unable to open
  its database. An August change set up two database indexes the app itself
  didn't expect, so on a phone whose data came from a release before August
  2026 the database check failed on every launch and the update never
  finished. It now completes cleanly.

- **Protection data downloads work again.** GitHub moved its certificates to a
  new set of Let's Encrypt roots around 2026-08-02. The certificate pins in
  v1.7.36 through v1.7.38 matched only the old ones, so every download of the
  spam database, trending feeds and ML model has been refused since then. Your
  phone kept protecting you with the database built into the app, but nothing
  new arrived. Pins are now set on the Let's Encrypt roots themselves, plus a
  second CA as a backup, and every release is checked against the live
  certificate chain before it ships.
- If this ever happens again, Protection Test says so directly and tells you to
  update the app, and you get one notification per app version pointing to the
  latest release. A certificate failure used to look like a successful sync.
- The ML model evaluation gate now tests the actual weights that ship, at the
  threshold that ships, on a held-out split that was never used for training or
  threshold calibration. Previously it trained a fresh model at sklearn's default
  threshold, which passed easily while the real operating point didn't. The model
  itself was retrained on the current database with a three-way split (train,
  calibrate, evaluate).
- Protection data is now signed. The spam database, the trending feeds and the
  ML model each come with a signature from the maintainer's key, and the app
  throws away a download that doesn't carry a valid one and keeps what it
  already has. Until now certificate pinning was the only check, and when it
  broke in August nothing else stood between a phone and a tampered file.
- A download whose signature arrives damaged or late is handled for what it
  is. Right after a new feed is published, the download network can hand out
  the new file with the old signature for a few minutes, so a mismatch from
  GitHub is fetched again at the branch's pinned commit, before it counts as
  a failure. A signature
  the server fails to send is a network hiccup to retry, not an unsigned feed.
  A trending feed that is refused shows as refused in Protection Test instead
  of "unreachable".
- An older signed copy of a trending feed can't replace a newer one any more.
  Someone able to serve files once pinning fails could have replayed an old
  "nothing trending" feed and wiped the trending numbers on your phone. A
  trending feed also has to be the feed it says it is, so another signed file
  served in its place is refused, and one dated in the future can't lock out
  the genuine feeds after it.
- The spam model can't be swapped for an older signed copy either. Each model
  now records when it was trained, and the app keeps the one it has when a
  download is older.
- When the real download branch fails, the backup branch that doesn't exist no
  longer hides why. Its "not found" answer used to replace a passing server
  error and stop the app from retrying.
- If GitHub is blocked where you live, Settings > Feed mirror takes a second
  address for the protection data. CallShield asks GitHub first and then the
  mirror, falling back to the copy built into the app when neither has data
  yet. For ten minutes
  after GitHub couldn't be reached at all, the mirror goes first, so a sync
  behind a block doesn't wait out a timeout for every file. One tap fills in
  jsDelivr, which serves the same files and can lag by up to 12 hours. The
  signature check applies to every mirrored file, so a mirror can't slip in
  anything the project didn't sign, though it can hold back updates. An
  address is saved only once it serves a signed copy of the manifest, and a
  certificate failure on GitHub still brings up the update notice while the
  mirror is covering for it.
- The ML scorer no longer judges callers outside North America. It treated any
  ten-digit number as a US or Canadian one once the `+` was stripped, so an
  unknown Singapore mobile, or a landline in New Zealand, Belgium, Thailand or
  Seoul, got scored by a model that has only ever seen North American numbers.
  About a quarter of random Singapore mobile numbers and a third of New Zealand
  landlines were being blocked. International numbers now skip the model.
- A short but valid international number (the Faroes, Greenland, Andorra, some
  German landlines) is no longer counted as a malformed one by the heuristics.
- A call your carrier verified no longer rings through automatically when its
  number is on the spam database. Verification proves the caller owns the line,
  not that the call is wanted, and about half of all robocalls carry it. It now
  overrides a database match only when that entry's newest evidence,
  community reports included, is more than a year old and the number isn't
  trending right now. A number stays marked as trending until a newer hot list
  drops it or a week passes from when the list was made, and neither a restart
  nor a failed download clears the mark. That still protects people whose
  numbers were spoofed in old complaint data. Your own blocks and allows are
  unaffected.

- External blocklist subscriptions now stay current. A list used to be
  fetched only when you added it or switched it back on, so one that changes
  daily went stale on your phone indefinitely. Each list is now fetched again
  once a day, or on the interval it declares in an `Expires:` header line,
  never more often than every six hours. A download that comes back empty or
  with under half the list's numbers isn't applied in the background, because
  a broken export looks just like a list that cleaned itself up. The list
  keeps its last good copy and says why on its row, which also shows when it
  last updated. A list that fails to refresh says what went wrong: the
  server's HTTP status, the size or row limit, a download that isn't a list,
  or a certificate that couldn't be verified.
- Each blocklist row now names just the host a list comes from, never its
  whole address, and TalkBack reads the row as one item that switches the list
  off or on, with Remove in its actions menu. By touch only the switch does
  that, so a tap on a list's name can't take its numbers out. A list you remove
  can be put back with Undo right afterwards, numbers included, without
  downloading it again.
- Region rules can allow countries outside North America. Add a country by
  its calling code, like +39 for Italy or +57 for Colombia, next to the
  two-letter state and province codes. A Caribbean country that shares +1
  goes in by each of its area codes, so the Dominican Republic is +1809,
  +1829 and +1849. Two-letter codes always mean the state or province, and CO
  is Colorado, never Colombia.
- Region rules no longer mistake a ten-digit number from outside North America
  for a North American one. A Penang landline (+60 4) counted as Vancouver's
  604 area code, so allowing British Columbia let it ring. On a phone outside
  North America, a number Android couldn't put in international form is now
  read as a number from your own country instead of a North American one, so
  allowing your country's code lets it ring. One that starts with your
  country's international prefix (00 in most of Europe, 011 in North America)
  counts as the country dialed after it. Domestic numbers that happen to start
  the same way still count as domestic. That covers Bulgaria's 00800
  toll-free range, Tajik mobiles that begin with 00, Chile's 1230 toll-free
  numbers, and Belarusian, Russian and Kazakh ranges that begin with 810. A
  prefix followed by digits no country code starts with is blocked instead of
  passing as a local call.
- Settings has a Telemarketing ranges card for number ranges regulators set
  aside for sales calls. It can block Spain's 400 range (required for
  commercial calls from 17 October 2026), India's 140 promotional series and
  Brazil's 0303 telemarketing code. It can also let India's 1600 series, which
  belongs to banks, insurers and government offices, ring through past the
  spam database. Each one is off until you turn it on. Each matches the
  number with its country code, and on a phone from that country it also
  matches the number written without one.
- Meeting mode keeps unknown callers from ringing through your meetings. Pick
  the apps you meet or take calls in (Zoom, Teams, Google Meet, Webex, Slack,
  WhatsApp and a few more) and turn it on in Settings. While one of them shows
  a call in progress, a caller from outside your contacts goes quietly to
  voicemail. Contacts and callers you trust still ring, spam is still blocked
  as spam, and Android still lists the missed call. It works from the
  notification access CallShield already asks for and never needs your
  calendar. A withheld number goes to voicemail too, unless you already block
  those outright. WhatsApp, Signal, Telegram and Messenger count only while a
  call is on screen, since they keep other notifications up for hours. A call
  silenced for a meeting isn't held against the caller afterwards, so it can't
  make them look like a repeat or rapid-fire spammer.

### Interface

- Blocking a number from Lookup no longer saves Lookup's own wording as the
  block's note. Making a temporary block permanent wrote "Temporarily
  blocked" into it, and blocking a number Lookup had let through saved the
  reason it was allowed, like the name of India's 1600 series. With
  contacts-only mode on, it even replaced a note you'd written with "Blocked
  because contacts-only mode is on". Only a database entry or a range or
  pattern rule gives a new block its note now, and otherwise the block keeps
  whatever note the number already had.
- Switching filters in the Database tab or the block log no longer leaves
  the old list running in the background. Every chip you tried kept its own
  copy until the app closed, and each one ran its query again whenever the
  database changed, which happens all through a sync. Each list now keeps
  one. The
  Database tab also keeps its chips when you switch to another rules tab and
  back, and a new filter starts at the top of its list.
- Undo after swiping a number in the block log to block it now takes back
  that block and nothing else. It used to remove every block of the number,
  including one you'd saved earlier under a different spelling (+1 649 555
  0123 against 649 555 0123), and it didn't bring back the note on your
  earlier block or an allow the swipe had replaced. Now all of that returns
  as it was.
- That swipe now says when the block couldn't be saved. It used to show the
  number as blocked, with an Undo that had nothing to take back, before the
  block had been written. If Undo itself fails, a message says so and points
  you at the Rules tab, where the app used to close instead.
- The Database tab has filters now. One row of chips picks a type (robocall,
  telemarketer, spam, spam text or anything else), and another picks where a
  number came from: the spam database, trending numbers, a list you
  subscribed to, or your own blocks.
  Numbers from a subscribed list land under the right type chip whatever
  capitalization the list uses, each number's type reads in the app
  language, and Trending also shows trending numbers that were already in
  the database.
- Search no longer stops at 100 results. It keeps loading as you scroll, and
  the count shows every match.

- Tapping the "blocked recently" notification opens the Blocked log now. It
  used to do nothing at all.
- The Report button on a number's detail page no longer opens a GitHub issue
  saying the number was "Seen 0 times" when you looked it up by hand. It says
  the number isn't in the app's log yet. The issue title and body also stay
  in English whatever language the app runs in, since they go to the
  English-language tracker (issues #24 and #27 arrived this way).
- Blocking a number with the Block button at the bottom of Lookup saved the
  name of the check that flagged it ("prefix", "database") as the block's
  note, and Lookup then showed that under Details. It saves the result's
  own description now, the same as the other Block button on that screen.
- After the screen rotated or the font size changed, the next tap on an app
  shortcut or on that notification could be ignored. It opens its tab every
  time now, and it closes an open search, which used to cover the tab.

- Setup now says what to do when Android won't let a permission through. Apps
  installed outside an app store run into Android's restricted settings. The
  grant screen refuses notification access from Android 13, and the overlay
  and SMS permissions from Android 15, until you choose Allow restricted
  settings in App info. A step you were sent to grant that comes back still
  off now says so, with a button that opens App info (issue #21).
- Number Detail has a Share a false-alarm report button for a number
  CallShield flagged. It shares the number, the check that decided, its
  confidence, and the app and database versions, ready to post, and nothing
  from your messages, contacts or call log. There's no account and nothing is
  stored.
- A spam text in Google or Samsung Messages is logged and alerted once. The
  SMS receiver and the notification reader each logged it, so it showed up
  twice in the log and the statistics. The alert now says the text was
  flagged, not blocked, since it still reaches your messages app.
- Spanish, Portuguese and Italian scam texts are judged more accurately. A
  blocked card or a held parcel is feminine in these languages (tarjeta
  bloqueada, carta bloccata, encomenda retida), and the patterns only knew
  the masculine forms, so "su tarjeta ha sido bloqueada" slipped through. In
  aggressive mode, a parcel "pending delivery", a Brazilian birthday greeting
  ("Parabéns pelo seu aniversário") and an Italian insurance reminder ("il
  premio della polizza") no longer read as scams. Spanish "ha ganado", "has
  ganado", "te ha tocado" and "ha sido seleccionada" count only when a prize
  or an amount follows, so a match result, loyalty points, a work shift or a
  job application isn't flagged. An Italian premium "in attesa di pagamento"
  is a bill, not a prize.
- The "why was this blocked" panel now explains every decision. A region
  block, a contacts-only block, a temporary block or allow, a number from your
  phone's own block list, a range pattern, a caller-name rule and a push-alert
  allow all used to read "Blocked by an unrecognized protection rule." Each now
  says what happened and what still outranks it, and the panel no longer cites
  layer numbers left over from an older detection ladder.
- The light theme is easier to read. Green, red and amber text and the
  faintest gray labels dropped below the WCAG contrast minimum on tinted rows
  and cards, and amber missed it even on white. They're a shade darker now,
  and every text color is checked against every surface in all three themes.
- The drag handle on Settings sheets is a full 48dp touch target (it was
  32dp wide). In the call category sheet TalkBack now says which category
  each action belongs to, so "Allow" in the scam row can't be mistaken for
  "Allow" in the robocall row, and the selected action reads in dark text on
  its green tint.
- In the region and caller-name rules sheet, TalkBack reported the drag
  handle as 32dp tall whenever a setting had scrolled partway under the top
  of the sheet, which happens as soon as the keyboard opens. Compose let that
  setting's touch area claim the bottom of the handle. The sheet's content
  now sits under the handle, so it keeps its full 48dp. Taps always reached
  the handle.
- The trusted-source and message-screening pickers in Settings now see your
  installed apps on Android 11 and later. Android hides other apps from an app
  unless its manifest names them, and CallShield's named none, so every source
  showed as "Not installed", Google Messages included, and a trusted source
  couldn't be switched off. The manifest now names the apps on those two lists
  and nothing else.

### Live caller lookup

- Three of the four lookup services are gone, so the app no longer asks them.
  PhoneBlock's hash lookup and OpenCNAM now require accounts, which CallShield
  never takes, and WhoCalledMe's domain is parked. The parked page came back
  as a normal web page, so the app read it as "no reports" and showed
  WhoCalledMe as clean on every enriched call.
- SkipCalls, the one that still works, is now read correctly. It reports spam in
  an `is_spam` field the app never looked for, so every number it flagged showed
  as clean. A flagged number now shows as flagged, and its detail page shows
  the category SkipCalls gives (scam, for example). SkipCalls never gives a
  count, so the app no longer shows a made-up "1 report".
- When SkipCalls can't answer, the caller ID overlay keeps CallShield's own
  warning and says no source gave a definitive result. It used to switch to a
  green "Looks Safe".
- A lookup answer that doesn't look like a lookup result now reads as
  "unavailable", not "clean". The overlay no longer has a caller-name line,
  because nothing free provides one any more, and a spam hit no longer shows as
  "Caller ID found".

- Protection Test now tells a stalled publisher apart from a feed your phone
  couldn't reach. It reads the date each trending feed says it was generated.
  A feed that arrives but hasn't been regenerated in over a week reads as
  stalled, with no advice to retry a sync that is already working. Only a feed
  that never arrived counts as unreachable. From 2026-08-24 to 2026-09-05 every
  phone reported "unavailable" when the real problem was on the publishing side.
- A feed the publisher empties on purpose now reads as a quiet day ("nothing
  trending right now") instead of "empty, will populate on the next sync".
- Feed dates written with a `+00:00` offset, which is what the publisher
  actually writes, now parse on Android 10 to 13 as well.

### Data pipeline

- The FTC import stays inside the budget of api.data.gov's shared DEMO_KEY,
  which the FTC API limits to 10 requests a day. A run used to ask for 5,000
  records, hit the limit part way through and record nothing, so the weekly
  check has read FTC as never imported since the freshness record began.
  Without a key of its own a run now fetches 400 records, records the import
  and carries on from its cursor next time. Set `FTC_API_KEY` for a full
  window.
- The importer's summary no longer counts numbers the corroboration filter
  dropped as added. The 2026-09-25 refresh printed "Added: 294,619" while the
  database total stood still.
- The pipeline check now notices a stall in the weeks right after a drain. It
  used to measure the oldest queued report against the database's date, and
  every report queued after a drain is newer than that, so a second stall ran
  from 2026-09-05 without it firing. A weekly workflow now measures against the
  calendar, also flags upstream sources that have gone longer than their
  `stale_after_days` without an import, and keeps a single `pipeline-stalled`
  issue open until the next passing run. The importer records each source's
  last successful import in `data/source-freshness.json` for it.
- A validation workflow runs the Worker and pipeline test suites on every push
  that isn't a report commit. It builds nothing and publishes nothing.
- The pipeline tests no longer write into the real `data/` directory. A test
  merge had been overwriting the ignored `data/source-snapshot.json` on every
  run, and one release check passed only because of it. After the liveness
  change the same merge would also have stamped test imports into
  `data/source-freshness.json`, the file the weekly check trusts. The test
  runner now fails if any suite changes a file under `data/`.
- `feed_signing.py` now trusts only the keys inside the app's `TRUSTED_KEYS`
  list, read the way the compiler reads it. A key commented out of the list, a
  note beside a key, or an old declaration left in a comment doesn't count, and
  the file has to declare the list exactly once. A retired key left behind in a
  comment could otherwise still sign feeds that new installs refuse. The data
  README also stops telling you to edit the database after signing it, since
  the scripts bump its version themselves.
- `generate_hot_list.py` refuses the fixed test clock (`CALLSHIELD_NOW`) when it
  would write the real data directory. A feed published with a past stamp is
  refused by every phone as a replay, and one stamped in the future would block
  every genuine feed until that time passed.

### Community reports

- Each report goes out once. Reporting the same number the same way again
  within a day now says you've already reported it instead of sending it
  again, even after the app restarts. One number had arrived 12 times in a
  single day, and a double-counted report looks like extra corroboration.
- A report made offline, or while the report server is busy, is no longer
  lost. It waits and goes out once the connection is back. That includes the
  Block and Report buttons on notifications, which used to fail silently.
- Every report now waits in that outbox while it's being sent, so leaving the
  screen mid-send, or Android closing the app, can't lose it while the app
  goes on saying you already reported it. Reporting a number as spam and then
  as a robocall counts as one vote a day, not two. A report the server turns
  down, or one the outbox gives up on, can be made again the same day. Lookup
  now says when a report was queued or already made today instead of always
  saying it was sent. Leaving the screen mid-send doesn't send a report twice
  either, since one that got through takes its queued copy back out. Each
  report now carries an id, which the updated Worker below uses to tell a
  resend from a second report.
- The app treats the Worker's "already submitted" answer as delivered only when
  the Worker says it stored the report. A bare "already submitted" from an
  older Worker can mean the report was never stored, so the app now tries again
  later instead of calling it sent.
- The app's own unit tests no longer send reports. One of them had posted two
  fictional numbers, +1 555-123-4567 and +1 555-987-6543, to the report service
  on every run since July, and each landed in this repository's report queue.
  The merge always rejected both as fictional, so the database never took them.

The rest of this section takes effect when the report Worker is next deployed.

- The Worker counts an IPv6 client by its /64 instead of its full address. One
  subscriber could otherwise rotate through addresses to slip past the rate
  limit, or pose as enough independent reporters to put any number on the
  trending list every phone syncs. IPv4 is unchanged.
- The trending list counts reporters by phone, but never more than two from one
  /48. Carriers give each phone its own /64 out of a shared /48, so customers of
  one carrier used to count as a single reporter a day, short of the three a
  number needs. A home line that can pick its own /64s still counts twice at
  most, so it can't pose as a crowd. Each report carries a daily code for the
  /64 beside the one for the /48, and still no address. The text-domain feed
  keeps counting by /48, since its two-reporter minimum would otherwise let one
  /48 meet it alone.
- A "not spam" correction is no longer turned away as a duplicate of the report
  it corrects.
- A report that was stored no longer comes back as an error when the Worker
  can't write its duplicate marker, which had the app send it again.
- The Worker's landing page shows an example number it actually accepts.
- The Worker keeps the id each report now carries, remembers it for a week,
  and answers a resend of a stored report with "already stored", so the app
  counts it as sent. A report resent after the phone switched networks used
  to be stored again and counted as a second person reporting the number. The
  merge, the trending list and the text-domain feed now count a report stored
  twice under one id once, and the merge still does when the two copies land
  in different drains. It keeps the ids of reports from the last two weeks in
  `data/merged_report_ids.json`, and a ledger it can't read stops the merge
  instead of counting resends twice.
- The Worker answers "already stored" only when a report's own id matches one
  it stored. People sharing one home or carrier address got that answer for
  their own report of the same number, and the app counted it as sent. They
  now get a plain "try again later", and the app retries.

### Documentation

- The README now explains the signing-key rotation. Releases v1.7.26 through
  v1.7.29 shipped unsigned and the original keystore password was lost, so the
  key was rotated at v1.7.37. Upgrading over an older install can fail with a
  signature mismatch. The new Installing section covers exporting a backup
  first and gives the signer certificate SHA-256 to check an APK against. That
  caveat had only ever appeared in a comment on a closed issue.
- New sideload troubleshooting for GrapheneOS, CalyxOS and stock Android 13+.
  A sideloaded app is put behind restricted settings, so the SMS role and
  notification access are hidden and the permission dialog either never appears
  or appears and changes nothing. The README names the "Allow restricted
  settings" path and tells it apart from a permission that's really denied.
- The detection-pipeline section states that a blocked text still reaches your
  inbox, and why: only the default SMS app controls delivery.
- `data/README.md` now carries a contract for anything reading the published
  feeds: the `format_version` compatibility promise, the schema of each file,
  the regeneration cadence, and the licence obligations inherited from upstream
  sources. Saracroche range data is CC BY-NC-SA and those terms travel with any
  redistribution.
- Corrected the string, plural and database-size counts, and gated all three so
  they cannot drift again. The database figure moves on every community merge
  and was the only count nothing checked.
- Corrected README claims that had drifted from the code. The trending feeds
  and the ML model are regenerated by hand, not on a schedule, and the full
  database syncs every 6 hours rather than weekly. The model's threshold comes
  from its weights file (0.653 today, not 0.7). A "not spam" report can only
  put a community-only number up for review, a campaign range needs 4
  trending numbers and 6 reporters, and the app doesn't call PhoneBlock at all.
- The v1.7.36 notes had lost their heading and sat under v1.7.37. They have
  their own section again.

### Data

- Drained the 70 community reports queued since the 2026-09-23 merge. Database
  version 44 adds 51 numbers, bringing the total to 51,806. Ten reports were
  duplicates of one already in the queue, and eight "not spam" votes were
  dropped because the live report Worker still attaches no reporter identity.
  The same release refreshes the FCC complaint data, which updated 8,036
  existing rows and brought no new numbers through the two-source
  corroboration rule, and the Saracroche French telemarketing ranges, which
  grow from 431 to 653 prefixes.

- Drained the 204 community reports queued since the 2026-09-05 merge.
  Database version 42 adds 121 numbers, bringing the total to 51,755. After
  North America, most of the new numbers are from Colombia, Italy and Mexico.
  32 submissions were rejected as implausible, nearly all of them the fictional
  +1 555 numbers the app's own unit tests used to send. 29 "not spam" votes
  were dropped because the live report Worker doesn't attach a reporter
  identity yet.

- Drained a 280-file community report backlog that had been accumulating since
  the 2026-08-24 merge. Database versions 40 and 41 add 132 numbers and update
  31 between them, bringing the total to 51,634. Coverage outside North America
  grew most: Colombia to 71 rows, Mexico to 36, Russia to 6.
- The merge now lists every submission it rejects as implausible, and reports
  how many were collapsed as duplicates, so a drain that dropped a third of the
  queue no longer reads the same as one that dropped nothing. Votes dropped for
  missing reporter identity are counted separately instead of being filed under
  "implausible".
- Derived feeds now say whether an empty result is deliberate. The app already
  refused to drop its local rows for an unexplained empty feed, but nothing on
  the publishing side ever wrote the flag that distinguishes "there is nothing
  to report" from "the feed did not arrive", so a healthy quiet publisher was
  indistinguishable from an outage. `cleared` is set only for a feed named in
  the new `--cleared` flag: `--allow-collapse` alone forces the collapse guard
  but publishes `cleared: false`, because approving a collapse of one feed must
  never tell every device to delete rows for a feed nobody mentioned.
- The data pipeline is now gated on liveness, not only correctness. A queue
  deeper than 20 files, a report far older than the published database, or a
  queue of at least ten reports where most carry no reporter identity all fail
  `verifyPipelineTests`. Every suite stayed green through the eleven days the
  queue was stalled, because each one asked a question about a queue it was
  handed rather than the queue that exists.

### Build

- Took the library updates the current Android build tools can use: Paging
  3.5.1, Room 2.8.5, AppCompat 1.8.0, KSP 2.3.12, Okio 3.18.2 and
  Gradle 8.14.5. WorkManager now comes from work-runtime itself, since
  work-runtime-ktx has been an empty package since 2.9.0. Compose, Navigation
  and OkHttp stay put until the move to the next build tools, because their
  current releases need it.
- The unit tests now upgrade a database from every schema version CallShield
  has shipped, 5 through 18, using the migrations that ship, and fail if the
  result doesn't match what the app expects or a table loses rows. Each test
  database carries a row with every optional field empty, and a schema that
  has already shipped can't change without a version bump. The migration test
  that would have caught the August database lockout ran only on an emulator,
  and nothing ran it.
- The on-device tests keep their settings to themselves. They used the app's
  own saved settings, so once the app had loaded its built-in database on the
  test phone, every older test feed was refused as a rollback and the sync
  tests failed, and the backup and screening tests wrote test settings into
  the installed app. The dashboard tests now check the labels and buttons from
  the August redesign.
- The on-device accessibility checks draw each screen in the app's theme on
  its own background. They measured colors against the bare white test window
  instead, which failed 20 screens for colors nobody sees and hid the real
  light-theme contrast problems fixed above.

### Translations

- The last of the system text is translatable. That covers the Quick Settings
  tile and notification-access labels, the source breakdown in the daily
  summary, the note saved when you block or trust a number from a
  notification, and the explanation each detection layer gives in Lookup and
  the block log. Chinese has all of it. The Chinese daily summary also keeps
  its line breaks now, where before it ran together on one line.
- The signals behind a suspicious-pattern or message-content block are
  translated too. The block log and the "why" panel listed internal names
  like "neighbor spoof" or "shortened url". The screened-message
  notification and two Protection Test results named the deciding check by
  its code name ("heuristic", "sms_content"). Each signal now reads as a
  phrase in the app language ("Possible neighbor spoofing", "Risky link
  pattern"), listed once even when several links trip it, and each check
  goes by the name the block log uses.
- Warnings about an unsafe link say what kind it is (phishing, malware,
  spam) in the app language. They used to print the threat feed's own code,
  such as verified_phish or feed_domain_match.
- The caller-identity evidence an ML block can carry ("PASSporT attestation
  A metadata; DNO-listed origin") is translated as well, so a Chinese block
  log no longer switches to English halfway through an ML entry.
- The "why was this blocked" panel in Lookup and Number Detail is
  translatable, and Chinese has every line of it. It was written straight
  into the code in English, so a Chinese phone showed "Flagged by the
  heuristic engine at 80% confidence." under Chinese labels. The English
  wording hasn't changed, except that a category rule now names its
  category the way the category settings do ("Debt Collector", "Wangiri
  Scam"), and an RCS block names its underlying check the way the block log
  does.
- A few English words still showed up in that panel on a Chinese phone. A
  block by one of the country telemarketing ranges named the range in
  English ("Spain 400 commercial call range"), and Lookup's list of checks
  used the English check names. Both are Chinese now. The Chinese line for
  an unverified PASSporT attestation also said verification had failed, when
  all CallShield knows is that the carrier didn't report a pass.

- A shipped locale can no longer decay silently. Each has a coverage floor in
  `scripts/translation_floors.json`, and dropping below it fails the build.
  zh-rCN starts at 76.1%. A locale with no recorded floor warns instead, so
  adding a translation does not break the build before anyone sets one.
- `check_translations.py --update-floors` now only ever raises a floor. Run
  after adding English strings that had no translation yet, it wrote down the
  lower coverage instead, and the Chinese floor slid from 76.1% to 75.6% that
  way. The eight strings behind the slide are translated now, and the floor is
  back up at 76.5%.
- Translators no longer get 101 strings the app stopped using when the August
  redesign replaced the old dashboard and onboarding screens. The build now
  fails when a string goes unused, and with the dead ones gone the Chinese
  floor is recomputed at 77%.
- A floors file that can't be read, such as one left mid-merge, now fails the
  check. It used to load as empty, which switched the gate off and let
  `--update-floors` write every floor again from scratch. `--update-floors`
  also fails when a locale is below its floor, where it used to report success.

## v1.7.38 (2026-08-29)

### Interface

- Introduced the Signal Ledger visual system across every primary page, with
  warm neutral surfaces, ink navy type, compact green status labels, and crisp
  dividers that keep dense protection data readable.
- Rebuilt Home, Activity, Lookup, Rules, and More around clearer page hierarchy
  while preserving the existing navigation and detection behavior.
- Updated Settings, Statistics, Protection test, What's new, onboarding, and
  number details so support flows share the same spacing and status treatment.
- Fixed narrow utility cards, nested Activity insets, long settings rows, and
  verbose risk headings found during device screenshot comparison.

### Distribution

- Removed the remaining remote verification workflow. Release checks, builds,
  signing, and packaging now run locally before publication.

## v1.7.37 (2026-08-24)

### Interface

- Added the Simplified Chinese (zh-CN) translation contributed by wj-on-git,
  covering 1,068 of 1,373 strings and 28 of 31 plurals with zero format-specifier
  drift. Strings added since the fork fall back to English individually. The
  locale is registered in locales_config.xml so it appears in Android's per-app
  language picker.

### Distribution

- Release APKs are signed again. The v1.7.26 through v1.7.29 release downloads
  were built without any signature, so Android rejected them as invalid packages
  (issue #19). The original release key's credentials were lost in a machine
  rebuild, so releases now use a new signing key and the pinned signer
  certificate moved with it. Anyone still on an old signed install has to
  uninstall it before installing v1.7.37.

### Data

- Blocked +8651667456713, an audiobook-course robocall reported through the
  in-app flow and the issue tracker (issue #20). Database version 38.

## v1.7.36 (2026-08-12)

### Interface

- Paged the Room-backed database, blocked-log, grouped-log, dashboard, and
  number-detail surfaces; moved statistics to SQL aggregates while keeping
  full-log export as an explicit non-UI path.
- Refined the shared Compose visual system around a compact header, flatter content groups,
  calmer dividers, text-led status treatments, and denser page spacing across Home, Activity,
  Lookup, Rules, and More.
- Dashboard now surfaces background-execution and battery-optimization risk with safe recovery
  links, an optional MIUI autostart route, and a dismissible warning that refreshes on resume.
- Expanded Compose accessibility coverage to every screen and bottom sheet, with warnings treated
  as test failures and swipe-only actions exposed through equivalent custom actions.
- Activity-log and blocklist swipe containers now keep a 48dp minimum target, expose the same
  delete/block/unblock outcomes as custom accessibility actions, and announce plain-English block
  reasons without carrier or detector jargon. RTT calls receive an explicit allow before any
  screening or caller-ID overlay path can run.
- Rebuilt Home around localized blocked-call/text outcomes for the current calendar week; completed setup
  now collapses to one reviewable row, while Settings owns the detailed access checklist.
- Categorized the Quick Settings protection tile under Privacy on Android 16.1+ while preserving
  the existing tile behavior on older releases.
- Removed the orphaned direct blocklist importer and unreferenced pseudolocale screenshot helper;
  the documented source-registry pipeline is now the sole supported data regeneration path.
- Lookup and number-detail verdicts now lead with the deciding rule or causal signal;
  deterministic matches no longer masquerade as 100% probabilities, and reversal actions
  are available directly from the verdict card.

### Data pipeline

- Persisted accepted sharded-feed version, update date, and manifest fingerprint;
  replayed, downgraded, malformed, and same-version-mutated manifests are rejected
  before Room replacement while legacy and bundled fallback paths remain guarded.
- Added a validated source registry and per-run provenance snapshot so feed
  access, licensing, attribution, redistribution, and freshness are reviewable.
- Source snapshots now include privacy-safe freshness, corroboration,
  false-positive, and quarantine aggregates; anonymous corrections remain
  review-only until an operator explicitly approves a community-only decay.
- Added a CC0, CallShield-authored SMS evaluation corpus spanning seven locales,
  sender/link metadata, hard negatives, and per-locale/message-type precision,
  recall, and false-positive budget checks.
- Imported numbers and prefixes now retain independent source evidence,
  confidence tier, parser metadata, and an expiry horizon in Room; expired
  feed evidence is quarantined out of hard-block and prefix-expansion paths.
- Empty hot-list, campaign-range, or spam-domain fetches no longer erase working
  protection unless the payload explicitly declares a clear. Unavailable feeds
  are retried and surfaced with the age of the last good refresh.
- Derived feeds now record the pending-report queue digest; collapse guards preserve
  healthy outputs, and the community merge refuses to consume reports until hot numbers,
  ranges, and domains were generated from that same queue.
- Drained the queued community reports through that guarded pipeline and committed the
  regenerated feed snapshots; unsupported reports did not promote into shared feeds.
- The spam database is now published as a manifest plus 256 content-addressed shards;
  sync validates hashes before one transactional Room refresh, downloads only changed
  shards, keeps the legacy monolithic raw URL for older clients, and bundles the shard
  set instead of the 11 MB monolith.
- FTC and FCC complaint imports now use bounded resumable cursors with 403/429
  backoff, preserve caller-ID versus callback-business roles and spoof signals,
  and require independent caller evidence before new complaint rows are promoted.
- PhoneBlock live enrichment now sends only full, one-digit-prefix, and
  two-digit-prefix SHA-1 hashes through a bounded expiring cache; Saracroche
  ranges are restricted to French `+33` allocations and source-owned ranges
  expire only after a successful non-empty refresh.
- Campaign detection now retains bounded seven-day local observations, combines
  them with the one-hour neighbor-number window after process restarts, expires
  stale evidence, and exposes repeat-number/callback and source-agreement counts
  in the block explanation without allowing a single repeated number to activate
  a campaign.
- Optional carrier identity extras now undergo bounded PASSporT/RCD structural parsing;
  Android PASS remains the verification gate, while A/B/C metadata, DNO-listed or
  unassigned status, and VoIP/prepaid line types make only small calibrated ML adjustments.
  Only a validated PASSporT `origid` UUID is retained in the call log.
- Added region-scoped sender-ID and numbering-plan provenance with registered, allocated,
  unverified, unassigned, and unavailable states; missing regional data fails open and
  unverified evidence contributes only a bounded advisory signal.

### Reliability

- URL checks now use privacy-minimized, opt-in URLhaus/PhishTank/OpenPhish and
  Safe Browsing/Web Risk adapters with bounded source-version caches; only
  canonical registrable-domain origins leave the device, and unknown feed
  responses remain advisory.
- Screening decisions now persist a stable reason code and the responsible
  rule ID, with Room migration/backfill, pending-log propagation, localized
  log filtering, and CSV/JSON export support. Legacy match text is retained
  for lossless restore compatibility.
- Android 16+ SMS interception is now presented as advisory: the receiver
  never assumes cross-app broadcast ordering or promises inbox suppression,
  while the permission and onboarding surfaces explain the default SMS app's
  delivery authority.
- Android 15 to 17 message evidence health now records redacted, delayed,
  sender-only, and unsupported SMS/notification states without message bodies;
- Protection Test now reads WorkManager's local attempt counts and Android stop
  reasons for scheduled sync, hot-list, digest, and protection-health work;
  repeated background-quota stops become a visible recovery warning.
- Community report abuse controls now reject requests without a Cloudflare client
  identity, distinguish malformed JSON (400) from corrupt or unavailable KV state (503),
  and log/reset invalid rate-limit state without leaking it as a client error.
  Settings and Protection Test show degraded mode while sender and URL checks
  continue when content is available.
- Call screening responses now pass through a single-response gate and still
  fail open on timeout or cancellation, with direct-boot, lazy-start, missing
  number, and error paths covered by Robolectric tests.
- Recognized emergency/public-safety numbers now have an absolute allow floor,
  and the repository refuses manual blocks for them with a user-facing explanation.
  Bounded verification-code SMS receive the same floor, are recorded as safety
  exemptions without a blocked notification, and cannot be undone by keyword,
  burst, or content checks.
- Added a privacy-minimized redress export containing only blocked-call date,
  time, calling number, and reason; raw SMS and allowed activity are excluded.
- Expanded screening fault injection for locked startup, cancellation, contact fast paths,
  slow checkers, direct boot, and concurrent fallback responses; every path remains fail-open.
- Isolated the direct-boot Robolectric store tests from the application-scope mirror observer,
  so the full JVM suite cannot rewrite device-protected preferences while asserting fail-open state.
- Log CSV/redress exports and backup generation now use ordered cursor batches and buffered
  writers, preserving row caps and redaction without materializing the full call history.
- Versioned the 20-feature spam model contract with shared Kotlin/Python golden vectors,
  deterministic time-of-day cases, model-score parity checks, and schema rejection for mismatched
  v3 payloads.
- Checker exceptions and deadline cutoffs now remain visible in Protection Test, lookup/log
  details, and CSV/backup exports without exposing exception text or delaying the response gate.
- Rules now run a standing overlap audit after sync and CRUD, showing the winning priority for
  whitelist/exact, wildcard/exact, and downloaded-prefix/hash-range conflicts with persistent dismissal.
- RTT calls receive an immediate explicit allow response so Telecom retains the active assistive
  voice/text session without screening or caller-ID overlay interference.
- Added an opt-in weekly GitHub Releases check that stores release metadata locally, notifies once
  per new version, and offers release/SHA256 links without downloading or self-installing an APK.

### Build

- Upgraded the Gradle wrapper to 8.14.4 and pinned its distribution checksum.
- Refreshed the non-AGP-9 build tranche: AGP 8.13.2, Kotlin 2.3.21, decoupled
  KSP 2.3.11, Compose BOM 2026.06.01, core-ktx 1.18.0, lifecycle 2.10.0,
  AndroidX Activity/Navigation, Robolectric, Kover, and serialization tooling;
  Room, WorkManager, DataStore, OkHttp, Moshi, ktlint, Hilt 2.58, and test
  artifacts remain on their already-current pins. core-ktx 1.19.0, lifecycle
  2.11.0, Hilt 2.60.1, and the Kotlin 2.4.x line remain in the AGP-9 blocked
  tranche because the AGP-8-compatible Hilt 2.58 compiler cannot read Kotlin
  2.4 metadata.
- Added `verifyReleaseDrift`, a reproducible release audit for synchronized
  version metadata, locked direct dependencies, explicitly dispositioned
  advisories, F-Droid preparation state, and privacy-safe source snapshots.
- Made the release-drift checkout test derive its audit clock from the generated
  source snapshot and added the current version-code Fastlane changelog.
- Added pinned pull-request and scheduled GitHub verification with Gradle lock,
  release/provenance, pipeline, and high-severity dependency-review gates;
  scheduled runs submit the resolved Gradle dependency graph and Dependabot tracks
  Gradle and GitHub Action updates.
- Release artifacts now carry an exact CycloneDX SBOM, in-toto/SLSA provenance
  record, and SHA-256 sidecar bound to the release-runtime lockfile; version tags
  also receive a GitHub OIDC build-provenance attestation.
- The screener hot path now has an executable 50 ms p99 JVM benchmark covering
  the same verdict call used by the detection pipeline.

## v1.7.35 (2026-08-10)

### Interface

- Database and activity surfaces now page Room-backed rows; dashboard and
  statistics cards use bounded SQL aggregates instead of materializing full logs.

### Reliability

- Sharded-feed version, update date, and manifest fingerprint are persisted;
  replayed, downgraded, malformed, and same-version-mutated manifests are
  rejected before replacing the local database.

### Build

- Added pinned pull-request and scheduled verification for tests, release
  provenance, dependency advisories, lock drift, and Gradle dependency graphs.

## v1.7.34 (2026-08-10)

### Interface

- Added plain-English TalkBack block reasons and equivalent accessibility actions
  for activity-log and blocklist swipe actions, with 48dp minimum swipe targets.
- Lookup and number-detail verdict cards now lead with causal decisions instead of
  presenting deterministic rules as probabilities.

### Reliability

- RTT calls receive an immediate allow before screening or caller-ID overlay work,
  preserving the active assistive voice/text session.
- Protection Test now surfaces WorkManager attempt counts and stop reasons, including
  a recovery warning when Android repeatedly defers background work for quota.

## v1.7.33 (2026-08-01)

### Detection data

- The data importer now ingests Saracroche's daily French telemarketing ranges
  as compact prefixes, preserving the source's 17M-number coverage without
  expanding the database into millions of rows.
- Optional PhoneBlock bulk imports now accept international E.164 numbers,
  map fraud/advertising ratings into CallShield categories, and fail closed
  when the service requires credentials. The existing public per-number lookup
  remains unchanged.
- FCC imports now retain both caller-ID and advertiser-business numbers from a
  complaint instead of silently dropping the second field.
- Added an opt-in HTTPS adapter for carrier-authorized Nomorobo IRS callback-
  scam CSV feeds; no private URL or credential is guessed or scraped.

### Security

- Post-call review can now be launched only by privileged Telecom callers, and
  community reports require a positively verified recent call-log match. Missing
  permission or a provider failure falls back to a local-only block instead of
  treating an unverifiable launch as authentic.
- The report Worker now fails closed when anti-abuse bindings are absent, rejects
  browser-originated submissions, and attaches a daily HMAC reporter bucket
  without storing client IP addresses.
- Hot-number and campaign-range promotion now requires several independent
  reporters over a meaningful time span. Range promotion also has a stricter
  per-number evidence floor and a per-run cap.
- Anonymous `not_spam` votes no longer mutate the shipped database. Explicit
  source provenance protects authoritative entries, while sufficiently strong
  community-only challenges are parked for maintainer review.
- Spam domains now require independent reporters, pass public-suffix and
  legitimate-domain checks, and remain in a review queue until approved.

- Messaging notifications can no longer establish their own push-alert trust.
  The conversation sender must already be a contact or have prior outbound SMS
  history before user-authored notification content can authorize a call.
- SMS relationship trust now requires prior outbound history; repeated inbound
  messages alone cannot bypass keyword or content screening.
- Release-secret checks now inspect every tracked text file and known binary
  key container, reject literal passwords containing dollar signs or disguised
  lookup names, and ignore common signing-key formats by default.
- The Accrescent helper now accepts passwords as `SecureString` values and uses
  ACL-restricted, short-lived handoff files because bundletool supports only
  inline or file-based password sources.
- SMS and RCS links are now checked against the local spam-domain list without
  disclosure. Optional URLhaus checks default off and send only a registrable
  domain, never a path, query, fragment, subdomain, or one-time token.
- Live caller enrichment is now explicit opt-in and limited to calls the local
  heuristic pipeline already marked suspicious. The setting identifies all four
  recipient hosts; clean callers stay entirely on-device.
- SMS preview and export redaction now bounds every regular-expression scan to
  the analyzer's maximum input size, preventing crafted long bodies from
  stalling the activity UI.
- The community translation gate now scans format tokens in linear time and
  rejects DTD/entity declarations before XML parsing, preventing malicious
  resource submissions from exhausting maintainer or CI machines.
- Release APK verification now requires the published signer-certificate
  SHA-256, so a throwaway key with a look-alike subject cannot pass the
  production release gate.
- Local contact-group scopes now use provider row identities that survive group
  renames. Existing title-based selections migrate automatically, with legacy
  matching retained until migration completes.
- Explicit user blocks now remain enforceable between reboot and first unlock.
  A minimal device-encrypted mirror carries only the blocking essentials;
  checks that need credential-encrypted data fail open until unlock.

### Reliability

- Re-audited the screening service, caller-ID overlay, and checker chain. Lazy
  repository or heuristics initialization failures now remain inside the
  screener's fail-open boundary so Telecom always receives an explicit allow.

### Added

- Current-version Fastlane/F-Droid artwork now includes six verified phone
  screenshots, the production launcher icon, and a branded feature graphic.
  Release metadata checks enforce the required asset count and dimensions.

### Fixed

- Lookup results now render localized spam categories and human-readable
  pipeline checker names, with neutral fallbacks that never expose new internal
  identifiers to users.
- Android 12+ cold starts now select matching Light or dark splash resources,
  and enabled post-call reviews render immediately from synchronous theme and
  preference mirrors instead of waiting on DataStore before their first frame.
- The caller-ID overlay now follows the selected System, Light, Graphite, or
  AMOLED palette instead of always rendering as a dark Catppuccin card.
- Dashboard readiness, setup status, Settings summaries, and bottom navigation
  now adapt cleanly at 200% font scale without clipped or overlapping text.
- Android device coverage now verifies TalkBack toggle state, caller-ID overlay
  proportions across display densities, and grouped block notifications on
  pre-Android-13 devices.
- The minified release build now has a verified replace-mode backup round-trip
  for blocklist, range-rule, settings, and activity-log data. Live Android
  Telecom smoke tests also confirm restored blocked callers are rejected while
  unlisted callers continue ringing.
- The complete 88-test Android device suite now passes against current behavior.
  Swipe-to-unblock fires exactly once without preserving a dismissed state for
  Undo, and stale integration/UI assertions now reflect current rule priority,
  sync status text, whitelist guidance, and contact-group selection behavior.
- External blocklist redirects are now handled manually, revalidated on every
  hop, limited to five hops, and refused if they leave the user-selected host.
- Regex-rule safety validation now uses an Android-compatible escaped closing
  brace, preventing the rule model from failing class initialization on-device.
- Backup restore now journals its DataStore and Room phases durably. Startup
  rolls back an uncommitted settings phase or completes settings after a Room
  commit, without replacing unrelated sync preferences.
- SMS senders with prior outbound history no longer have their message bodies
  rejected by the shared heuristic stage before the ordered trust rule runs.

## v1.7.32 (2026-08-01)

### Changed

- First launch is now a focused seven-screen guided setup instead of a broad
  permission checklist. Each step explains the exact Android control that will
  open and how to return to CallShield.
- Runtime phone, contacts, call-log, and SMS grants; the call-screening role;
  alerts; caller-ID overlay; and notification access are verified separately.
- Setup advances automatically after Android confirms a grant, skips an
  unavailable call-screening role safely, and sends permanently denied runtime
  permissions to App info for recovery.
- The final action is gated on every supported capability. If a permission is
  revoked during setup, the review sends the user back to the first missing
  step instead of offering a misleading continue-anyway path.

### Added

- Pure setup-state coverage pins the all-capabilities completion contract and
  unsupported-device behavior. Compose coverage exercises the full walkthrough,
  return-state auto-advance, recovery routing, and completion gate.

## v1.7.31 (2026-08-01)

### Changed

- CallShield now has a premium deep-navy tile with a luminous cyan shield,
  pearl-white handset, and coral block badge. The reference-inspired materials
  stay balanced and substantial at launcher sizes without decorative clutter.
- Dedicated adaptive, in-app, and monochrome variants replace the previous
  artwork in legacy and round icons, the splash screen, shortcuts, headers,
  onboarding, More, the Play Store asset, notifications, and the README.
- Notifications now use the CallShield silhouette as their small app icon while
  retaining their semantic action icons.
- The Android launch screen now uses the light product canvas and keeps the
  adaptive mark inside the platform safe zone instead of clipping its point.

### Added

- The selected reference source, transparent extraction, and production SVG
  master are preserved under `docs/design/logo/`.

## v1.7.30 (2026-08-01)

### Changed

- CallShield now opens in a warm, high-contrast light theme. Existing installs
  that were still using the old implicit AMOLED default migrate to Light;
  explicit System, Graphite, and AMOLED choices remain available.
- The six-item navigation bar is now a clearer five-destination shell. Recent
  calls and blocked activity live together under persistent Activity tabs, and
  manual blocking tools are grouped under Rules.
- Typography is larger and more consistent, headers and section spacing are
  tighter, explanatory copy is shorter, and filled controls replace many of
  the outlined fields, chips, cards, and status badges.
- Home, Activity, Lookup, Rules, and More now use the same border-light visual
  hierarchy, restrained green accent, and denser list grouping.

### Added

- More includes a compact Appearance shortcut with visible previews for
  System, Light, Graphite, and AMOLED themes.
- Six visual reference screens are kept in `docs/design/premium-system/` to
  make the implemented visual direction auditable.

## v1.7.29 (2026-07-30)

### Fixed

- Community reports written in the domestic dialling form are now stored on the
  key a real call actually matches. The national trunk prefix. The `0` in
  "+86 **0**558 646 8536". Was already dropped by the in-app reporter and the
  merge pipeline, but not by the report endpoint every client posts to, so a
  report filed that way was accepted, stored, and could never match the caller
  it was meant to block. Italy and Côte d'Ivoire are exempt: their national
  numbers really do keep a leading zero.
- One person can no longer promote a number to the trending hot list on their
  own. The report endpoint's duplicate check is deliberately permissive when
  its rate-limit storage is unavailable, and repeat submissions seconds apart
  were counted as independent corroboration. So a number could reach every
  device's high-priority trending list, and shipped report counts could be
  inflated, from a single reporter. Repeats filed within a minute of each other
  now count once, in both the hot list and the database merge. Genuine reports
  minutes apart still count separately, because that is the signal the trending
  list exists to carry.
- Repeated `not spam` votes from one reporter can no longer whittle a genuine
  community entry off the list one vote at a time.

### Changed

- Removed 145 unused text resources, 70 of them accessibility labels that were
  never attached to anything. They were dead weight for anyone translating the
  app, and the orphaned accessibility labels wrongly suggested screen-reader
  coverage that did not exist.
- The three implementations of report-number normalization. In the app, the
  report endpoint, and the data pipeline. Are now checked against one shared
  set of cases, so a fix applied to one and not the others fails the build.
  This is exactly how the trunk-prefix bug above survived.

### Added

- `docs/TRANSLATING.md` and `scripts/check_translations.py`: CallShield ships
  English only, and translation contributions are now welcome and mechanically
  checked. The checker reports per-language coverage and fails on the mistakes
  that only surface at runtime. Format placeholders whose count or type drifted
  from the English, plurals missing the categories their language needs, and
  languages that would never appear in Android's per-app language picker.

## v1.7.28 (2026-07-30)

### Fixed

- Spam scores no longer change with the time of day. The model was trained on
  a fixed reference hour, and 45 international rows the on-device scorer can
  never score were included as all-zero examples. The only rows where the
  time and `+1` columns differed. The trees learned "not the reference hour ⇒
  spam", so a caller scored materially higher in the evening than at noon,
  and legitimate-format numbers could be auto-blocked at night but allowed
  during the day. Unscoreable rows are now excluded from training,
  constant-feature weights can no longer leak into the fallback scorer, and
  the evaluation gate fails if a score varies across the 24 inference hours.
- Opening a number's details no longer resets the app. Returning from a detail
  screen used to drop you on Home with every tab's state cleared. Filters,
  the typed Lookup number, scroll positions, and the selected tab itself.
- Undo after swiping a log entry or blocked number away now actually restores
  it. The row came back and was immediately deleted again, so the entry could
  never be recovered.
- A failed hot-list refresh no longer throws away fresher protection. When a
  fetch failed (GitHub outage, captive portal, rate limit), the app replaced
  the up-to-date trending numbers, campaign ranges, and spam domains with the
  weeks-old snapshot built into the APK. And reported the sync as successful,
  so it never retried. The bundled snapshot is now only used to bootstrap a
  device that has no data yet, and a failed refresh retries with backoff.
- The same downgrade applied to the spam-detection model: a failed sync
  overwrote a newer downloaded model with the one bundled at build time.
- Lookup results now stay attached to the number that was actually checked.
  Editing the field after a check left the previous verdict on screen labelled
  with the new number, and Block, Report, and Mark trusted acted on it. So you
  could block or report a number that was never checked.
- The typed Lookup number and its result now survive switching tabs and
  rotating, as the v1.7.27 notes claimed.
- Running Protection Test can no longer crash the app if the database is
  unhealthy; it shows a failure card instead.
- The documented database regeneration command silently deleted every
  single-report community row (80 of them). `--min-reports` defaults to 2 but
  was applied to the whole merged database rather than only to newly-imported
  entries, so each regen erased the community contributions it claimed to
  preserve.
- Deleting a wildcard, range, or keyword rule, or a trusted number, can now be
  undone. It was instant and unrecoverable, with the delete button beside each
  row's enable switch. And removing an emergency contact silently re-exposed
  you to blocking.
- Add-rule dialogs keep their configured schedule when the screen rotates
  instead of silently reverting the rule to always-active.
- The daily digest notification opens the app when tapped; it previously did
  nothing at all.
- "Check spam sources" reports a failure instead of silently resetting, log
  export works when Settings is reached without visiting the dashboard, the
  blocklist import picker accepts the same file types as backup restore, and
  onboarding's permission button opens app settings once the system dialog
  will no longer appear.
- Notification-listener access is verified by exact package match, so a
  look-alike package can no longer make RCS screening report itself as active
  while unbound.
- Spam types are shown as readable labels everywhere, including in shared
  warning text that leaves the device.
- Data-pipeline writes are atomic, so a crash mid-write cannot publish a
  truncated database; runs that change nothing no longer cost every device a
  re-download; and the hot list ranks by reports inside its window instead of
  lifetime totals.

### Accessibility

- Recent calls now announce their direction. Incoming, outgoing, missed,
  rejected, blocked, and voicemail were conveyed only by an icon and its
  colour, so a screen-reader user could not tell them apart.
- Range-rule and blocklist-subscription switches announce which rule or feed
  they belong to instead of an anonymous "switch, on".
- The language picker announces which language is currently selected.
- Section titles are exposed as headings, so screen readers can jump between
  sections on every screen.
- Backup restore results are announced when they appear, and stay on screen
  long enough to be read.
- Forward chevrons mirror correctly in right-to-left layouts and no longer
  append "View details" to every row on the More screen.
- Secondary text now meets the WCAG AA 4.5:1 contrast minimum on every
  surface in all three themes; it previously fell to 3.6:1 on elevated cards.

### Performance

- The Stats screen no longer re-aggregates the entire blocked-call log on
  every recomposition, and builds its hour histogram once instead of twice.

## v1.7.27 (2026-07-30)

### Security

- The community-report worker no longer converts explicitly international
  numbers that total ten digits (Denmark +45, Norway +47, 8-digit +32/+43
  numbers…) into fabricated `+1` US numbers. A Danish user's report used to
  publish a random US subscriber's number to the shared database as spam.
- Nine "Caribbean scam" prefix rows in the shipped database used bare NANP
  area codes as country codes. Three collided with real country codes and
  hard-blocked legitimate callers. `+649` matched every Auckland, New
  Zealand number (+64 9…), `+473` matched Norwegian numbers (+47 3x…), and
  `+268` is Eswatini's actual country code. All nine now use their correct
  `+1` forms, and synced prefix rows are validated (`+` and 3 to 15 digits) so a
  malformed feed row can never hard-block every caller.
- The ToastedSpam import source is HTTP-only (no TLS on the host); an
  on-path attacker could inject numbers that would hard-block on every
  device. The pipeline now skips it unless run with
  `--allow-insecure-sources` on a trusted network.
- Spam-domain extraction now requires reports tied to three DISTINCT
  phone numbers before flagging a domain, so a single reporter re-submitting
  one number can no longer get an arbitrary domain marked malicious for all
  users. Bulk importers apply the same fictional-number plausibility gate as
  community reports, and the FCC row scraper no longer extracts "phone
  numbers" embedded in longer digit runs (timestamps, row IDs).

### Fixed

- Quiet hours no longer applies to SMS and RCS: an OTP or bank text arriving
  at night was cancelled from the notification shade and logged as "blocked
  during quiet hours". Quiet hours is a calls feature, and now also ignores
  historical scans (which classified old entries by whatever hour the scan
  ran). Setting start = end now blocks all day, exactly as the Settings
  screen has always described it, instead of silently disabling the feature.
- "Allow temporarily" now actually recovers callers blocked by downloaded
  prefix rules (whole-country wangiri prefixes included). The prefix layer
  sat above temporary allows in the priority ladder, so the recovery action
  silently did nothing; downloaded data now ranks below every user decision
  while user wildcard/exact rules still beat everything.
- Rotating the phone no longer yanks you back to the Home tab, replays a
  scan shortcut, or re-opens a closed deep-linked detail screen. The launch
  intent is now consumed through saved state, which survives activity
  recreation (the old in-memory consumption could not).
- Switching bottom tabs no longer wipes each tab's state: scroll positions,
  Blocked Log filters, the typed Lookup number, and Protection Test results
  all survive tab round-trips (tab content now lives in a saveable state
  holder), and add/edit dialogs keep their typed input across rotation.
- The suspicious-caller overlay ("Possible spam N%") is no longer instantly
  replaced by the generic area-code overlay for US/CA callers. The generic
  panel destroyed the warning before it could be read and restarted the live
  lookups from scratch.
- Twenty-three in-service NANP area codes (989 Mid-Michigan since 2001, 279
  Sacramento, 771 DC, 943 Atlanta, Canadian overlays 368/584/683/742/753/879,
  and more) were missing from the offline area-code map, so region blocking
  treated those callers as "international or unknown" and blocked them even
  in their own allowed region.
- A midnight-wrapping rule schedule with specific days selected (say,
  "Fri 22:00 to 06:00") now covers the after-midnight tail: Saturday 01:00
  counts as Friday night, and Friday 01:00 (Thursday night) no longer fires.
- The screening-pipeline time budget now uses the monotonic clock, so an NTP
  step or manual clock change mid-call can neither abort detection early nor
  overrun Android's 5-second deadline.
- Sync no longer records a database SHA newer than the data it downloaded (a
  data commit landing mid-sync made every later check report "up to date"
  while local data stayed one update stale). Push-alert capture no longer
  depends on the unrelated notification-screening opt-in (Outlook alerts
  were never captured by default), and the notification listener waits for
  the user's real screening allowlist before acting destructively.
- The overlay's Block and SIT-tone buttons, the Quick Settings tile, and the
  notification listener's settings observers no longer crash the whole
  process on a database write failure, an uninitializable audio track, or a
  corrupt preferences file (same guard the notification actions already had).
- Historical inbox scans no longer double-count the scanned message in SMS
  burst detection, flagging senders at one real message below the threshold.
- Restoring a backup no longer permanently pins the notification-screening
  defaults: "never customized" now survives the round trip, so sources added
  in future updates keep auto-enabling after a restore.
- Bulk blocklist imports now commit in chunks with a single up-front cleanup
  pass instead of one giant transaction that could stall call screening past
  its 5-second deadline mid-import.
- The rule-conflict advisory now recognizes conflicts between hand-typed
  numbers and stored E.164 entries (typing 2125550100 vs stored
  +12125550100), so "your trusted number overrides this block" warnings
  appear when the live pipeline would actually behave that way.
- "Commit preview" for external blocklists applies the feed that was
  previewed, not whatever URL is currently in the text field.
- The community-report worker only marks a report as "already submitted"
  after it is durably stored. A failed store no longer turned every retry
  into a five-minute "Duplicate report" rejection. And enforces its payload
  cap on the actual body, not the forgeable Content-Length header.
- Côte d'Ivoire numbers keep their leading zero (the 2021 renumbering made
  it significant, like Italy's) instead of being corrupted by trunk-prefix
  stripping. Bulk-import reruns no longer inflate report counts without
  bound. Counts now use snapshot semantics, which also keeps community
  "not spam" de-listing effective.
- The post-call review screen's content no longer sits a status-bar height
  too low with its button floating above the navigation bar (doubled edge
  insets), and opening the Recent tab can no longer crash the app when the
  call-log provider or a corrupt database throws mid-load.

### Changed

- Community report feedback ("Contributed anonymously", rate-limit waits,
  server errors) is now localized and typed. The Number Detail screen
  stops sniffing English substrings to pick the success color.
- Block reasons shown on Dashboard, Blocked Log, Recent, Lookup, and Number
  Detail now use the same localized labels as Statistics instead of
  de-underscored internal tokens ("hot list", "db match").
- Statistics peak-hour labels honor the device's 12/24-hour setting and
  locale; remaining "Whitelist" wording in backups, restore summaries, and
  accessibility labels now says "Trusted" to match the rest of the app;
  blocking a whole area code from Number Detail asks for confirmation first
  (same dialog as the Dashboard flow); and the window behind the UI follows
  the Light/Graphite theme, removing black flashes during keyboard resizes
  and transitions for non-AMOLED users.

## v1.7.26 (2026-07-28)

### Added

- Tapping a "Block area code" smart suggestion now asks for confirmation (showing
  the coverage. Roughly 7.9 million numbers) before adding the rule, and shows a
  toast when it's applied. The auto-generated rule description is now a localized
  string instead of a hardcoded English literal.

### Security

- The optional post-call review screen now verifies a matching recent call in the
  device call log before submitting a community spam report. A spoofed launch (any
  app can craft an `ACTION_POST_CALL` intent for an arbitrary number) with no
  matching call is blocked locally only and never contributes to the shared
  database; the legitimate flow is unaffected.

### Fixed

- External-link, dial, and settings intents (blocked-log/recent-calls web search,
  number-detail GitHub report and dial, overlay/notification/app-settings launches
  across Dashboard, Settings, Onboarding, and Protection Test) no longer crash on
  browserless devices or ROMs missing the target activity. They fall back to the
  app-details screen or a toast, via a shared `startActivitySafely` helper.
- The caller-ID overlay's paddings, accent line, corner radii, and button spacing
  are now density-scaled instead of raw pixels, so it renders with consistent
  proportions across mdpi to xxxhdpi devices (was oversized on low-density, cramped
  on high-density screens).
- Settings toggle titles (Power mode, Aggressive blocking, Quiet hours, Silent
  voicemail mode, Log cleanup) and the export/restore-defaults buttons now use
  sentence case, matching the screen's section headers.
- The More screen's "Synced Xm ago" label now advances while the screen stays
  open instead of freezing at the value it had when the screen opened.
- `PremiumCard`'s accent color now renders as a subtle hairline border for cards
  that opt into one (it was previously an ignored parameter).
- Backup-restore and external-blocklist status lines now carry a typed
  success/failure flag from the view model instead of the UI guessing from the
  (localized) message text with `startsWith("Restored ")` / `"Applied"`. Success
  vs error coloring stays correct under non-English locales and pseudolocales.
- Rule schedule labels now use localized day names and translatable "Every
  day"/"Mon to Fri"/"Weekends" strings, and the auto-generated rule descriptions
  written on "not spam" reports and blocked-log swipe-to-block are now localized
  string resources instead of hardcoded English.
- The "N blocked recently" summary notification now zeroes its counter when you
  dismiss the group, so it no longer over-reports across a process lifetime.
- Backups are now capped to the same row limit the restore path enforces (the
  blocked-call log absorbs the trim, keeping the most recent entries), so a large
  device can no longer export a backup the app then refuses to restore.
- Restore/import failures now show a localized generic reason instead of leaking
  raw exception text (content URIs, SQLite constraint names) into the UI; the
  underlying cause is logged for diagnostics.
- Removed the redundant `source` field from the backup format: exports only ever
  contained user-sourced blocked numbers and restore always recreates them as
  user rows, so the field was dead weight (older backups still restore fine).
- Cold starts now paint the user's real theme on the first frame (via a
  synchronous theme mirror) instead of flashing the AMOLED-dark default and wrong
  status-bar icons for Light/Graphite users until settings loaded.
- The home-screen widget now follows the system light/dark theme (color resources
  with a values-night variant) instead of being locked to the AMOLED-dark palette,
  so it no longer clashes on light-themed devices.

### Performance

- Blocked-log and recent-calls rows no longer replay their entrance animation
  every time they scroll off-screen and back (state now survives via the list's
  saveable registry), and recent-calls rows use stable per-entry keys so one new
  call at the top no longer re-animates the whole list.
- Wildcard/regex blocking rules now compile their pattern once and reuse it across
  screening calls (process-lifetime compiled-`Regex` cache) instead of re-escaping
  and recompiling per rule per incoming call on the 5-second hot path.

## v1.7.25 (2026-07-28)

### Added

- The repeat-caller auto-block threshold is now adjustable in Settings, and its
  description reflects the configured count (it was engine-consumed but had no UI).

### Fixed

- Unified the "Trusted" terminology across the trusted-numbers add flow (the tab,
  dialog, button, and confirmation no longer switch between "Trusted"/"Whitelist").
- Lookup, block, and report error messages are now localized generic messages
  instead of leaking raw exception text; the pipeline-trace verdict labels are
  localizable resources.

## v1.7.24 (2026-07-28)

### Security

- The community-report pipeline now validates every reported number for
  plausibility (Cloudflare Worker and merge script): fictional NANP numbers
  (area/exchange 555, N11 service codes), leading-zero "country codes", and
  implausibly short numbers are rejected instead of shipping to all users.
- Anonymous `not_spam` votes can no longer de-list authoritative FCC/FTC
  entries. They may only weaken community-reported rows. This closes a
  path that let an attacker remove real spammers from the shared database.

### Accessibility

- The Dashboard "Block calls"/"Block SMS" toggles, blocklist rule switches,
  schedule toggle, push-alert source rows, and backup-encryption toggle now
  announce their name and state to TalkBack as a single node.
- Blocked-log rows expose Delete and Block as TalkBack custom actions (no
  longer swipe-only), and the block swipe now offers Undo.
- Below Android 13, the app now detects when notifications are disabled in OS
  settings instead of always reporting them ready, and the enable-in-settings
  action is reachable.
- Bottom-nav items and compact buttons no longer announce their label twice;
  the active blocking profile is exposed as a selection state.

### Fixed

- Timestamps in the blocked log, recent calls, and number detail now follow
  the device 12/24-hour and locale conventions instead of forcing AM/PM.
- Haptic feedback honors the system "Touch feedback" setting.
- Backup copy no longer references non-existent API keys; onboarding feature
  text and category action chips no longer clip at large font scales.
- Blocked-call and blocked-SMS notifications from the same number now use
  distinct action intents, so tapping Block/Report affects the right one and
  reports the correct spam type.
- The Quick Settings tile toggle no longer risks leaving call and SMS blocking
  split if the shade is dismissed mid-toggle.
- Orphaned crash-log temp files are swept so they can't accumulate.
- Opening the Blocklist no longer loads the entire spam database into memory ,
  the full list is fetched only when the Database tab is viewed.
- SMS content analysis matches URL shorteners and suspicious TLDs against the
  extracted host, not the raw URL. Legitimate links like microsoft.com,
  reddit.com, and target.com are no longer flagged as shortened links, and a
  `.info` path segment no longer trips the suspicious-TLD signal.
- Whitelisted, contact, and temporarily-allowed SMS senders are no longer
  blocked by the burst or content heuristics; an explicit user allow now
  carries through to the SMS extension chain (keyword rules still apply).
- The "Neighbor spoofing" detection toggle is now actually honored. Turning
  it off stops the neighbor-spoof heuristic from scoring.
- Wildcard rules can no longer be used to stall call screening: runs of glob
  `*` collapse before compilation and regex patterns with long chains of
  open-ended quantifiers are rejected, so a pathological rule can't blow the
  5-second screening deadline.
- Contacts-only mode is calls-only again. An SMS from a non-contact (OTP
  shortcode, bank, delivery) is no longer logged as a blocked call.
- A suspicious SMS re-scored through the shared chain no longer pops the
  incoming-call overlay or fires live caller lookups.
- Wangiri detection no longer flags plus-less local-format numbers whose
  leading digits collide with international country codes.
- Explicit international numbers (`+45…`, `+47…`, `+212…`) are no longer
  mis-formatted as North American, and formatWithCountryCode no longer
  fabricates a `+1` prefix on them.
- Restoring a backup now refreshes the range-rule (hash-wildcard) cache, so
  restored range rules take effect immediately without an app restart.
- Re-applying an external blocklist subscription preserves an active
  temporary block's expiry instead of silently making it permanent.
- Backup restore keeps blocked-SMS log rows from alphanumeric senders
  (e.g. "BANK-ALERT") instead of dropping them on the round-trip.
- Block and whitelist edits are now atomic, so a process death mid-edit can
  no longer strip a trust entry without applying the block.
- The restore preview no longer loads the entire call log (including SMS
  bodies) into memory when logs aren't part of the restore.
- Opening a number's detail from Recent now canonicalizes the number, so a
  national-format call-log entry shows its blocked history, reputation, and
  the correct Block/Unblock state.
- Rotating or otherwise recreating the activity no longer replays a shortcut
  scan, re-opens a closed deep link, or snaps back to the shortcut's tab.
- Undo after removing a temporary block restores it as temporary (keeping its
  expiry) instead of as a permanent block.
- The database-count subtitle and "Setup needed" pill now update immediately
  after import/restore/block and after granting permissions in OS settings.
- The Dashboard "Just now" / sync-freshness labels advance while the screen
  stays open; number-detail lookups reset when the number changes in place.
- Recent Calls now shows system-blocked and voicemail call-log entries with
  their own icons and includes blocked calls in the Missed filter.
- Global search matches formatted phone queries (e.g. "555-123-4567") against
  canonically-stored numbers.
- Onboarding survives rotation, counts the call-screening step as required
  only on devices that have it, and no longer flashes the main UI first-run;
  the model-health card updates once the model finishes loading.
- Portable backups keep the full BackupRestore payload family (settings,
  range rules, logs) from R8 stripping, so a minified release build no longer
  risks silently losing restored data.
- The hot-list generator selects trending numbers by a real calendar date
  instead of a string compare, so corrupt future-dated rows (e.g. year 2915)
  can no longer pin themselves to the top of the bundled hot list.
- The merge script writes the database atomically (temp file + replace),
  quarantines unreadable/malformed reports instead of retrying them forever,
  self-heals implausible legacy rows, and repairs impossible first/last-seen
  dates. Drained the two-month report backlog and purged 426 fictional
  numbers left over from bulk imports.

## v1.7.23 (2026-07-22)

### Fixed

- Phone identity canonicalization now resolves the SIM region before the
  visited network region, so roaming no longer canonicalizes national numbers
  (and the one-time schema v12 migration) under the wrong country. The v12
  migration also skips unchanged rows so the bundled 32k-row database no
  longer pays ~33k no-op writes inside the first call's 5-second screening
  window, keeps community reputation visible after a merged temporary user
  block expires, and preserves the emergency flag when whitelist rows merge.
- The per-category guard for explicit blocks now matches the system block
  list's real match source (`system_block_list`); a typo had made that guard
  dead code. Daily digest source breakdowns now bucket category-policy
  verdicts by their underlying detection source instead of "other".
- Outgoing risk warnings are suppressed for numbers on the personal whitelist
 . The standing false-positive correction no longer re-warns on every dial ,
  and the warning overlay ignores the registration-time IDLE snapshot so it
  can no longer dismiss itself before it is readable.
- Repeated-call urgency now recognizes real, spaced-out retries even when a
  provider double-logs one attempt; machine-speed bursts remain rejected.
- Unknown-direction calls receive an explicit allow response instead of no
  response, so OEM stacks that omit the direction no longer hold the call
  until Android's screening timeout.
- The caller ID overlay unregisters the previous call-state watcher before
  registering a new one; back-to-back overlays no longer leak telephony
  registrations until idle-dismiss silently stops working.
- The "Call screening is off" alert clears as soon as the app resumes with the
  role restored, and never fires on installs that finished onboarding without
  ever granting the role.
- Lettered SMS sender IDs can no longer opt out of keyword and content
  screening: non-Latin sender names keep a readable canonical form and
  unrepresentable ones get a stable hashed identity instead of being skipped.
- Backups, blocklist exports, and log exports no longer crash the app when the
  export cannot be written (full storage, oversized encrypted payload); they
  report a clear failure instead. Blocklist imports now run in a single
  transaction, so a mid-import failure rolls back instead of leaving thousands
  of half-imported rows behind a failure message.
- Restoring with a typed passphrase now rejects plaintext files instead of
  silently restoring unauthenticated content; encrypted backups honor the
  authenticated KDF iteration count in their header so future strengthening
  cannot orphan old backups; repeated merges of legacy backups no longer
  duplicate log rows; restore counts no longer include entries refused by
  conflicting permanent decisions; and backup files are timestamped so a new
  backup cannot clobber one still being shared.
- The Lookup app shortcut opens the Lookup tab again, and the Lookup tab no
  longer reads the clipboard on every visit. The paste action reads it only
  when tapped, so Android's clipboard-access toast fires only on request.
- Quick Links no longer crash on devices without a browser.

### Changed

- Settings toggle rows are now fully tappable and read as a single switch to
  TalkBack; the push-alert switch regained its full touch target; informational
  captions moved to a higher-contrast text color; the push-alert sheet footer
  stays reachable in landscape; the last selected contact group can be
  deselected (falling back to All contacts); and the group picker no longer
  claims groups are unavailable when the real cause is a denied permission.
- Quiet-hours hour labels follow the device's 12/24-hour preference and
  locale. The widget's secondary text meets contrast requirements and its
  daily trend window is DST-safe. Onboarding's Enable Notifications opens the
  system notification settings on Android 10-12 where the runtime permission
  does not exist.

## v1.7.22 (2026-07-22)

### Changed

- Detekt and ktlint now run as zero-baseline gates in the standard Android
  verification lifecycle. Kotlin sources were normalized to the shared style,
  Compose-specific conventions are explicit, and actionable complexity,
  correctness, and unused-code checks remain enforced.
- Release verification now rejects app-version drift across Gradle, README
  highlights and badges, Fastlane changelogs and store copy, signing examples,
  and the F-Droid handoff. The F-Droid draft now labels v1.7.12 as the last
  externally prepared build instead of implying it is current app metadata.
- Outgoing risk warnings are now available as an opt-in, local-only safety
  check. Exact known-risk matches show one non-blocking overlay without remote
  lookups, contact analysis, call responses, blocked-log entries, or after-call
  feedback; unknown numbers remain silent.
- Contact trust can now cover all saved contacts or only selected Android
  contact groups. Group identity stays local and privacy-safe, membership
  changes invalidate the call-path cache, permission loss fails closed with a
  visible degraded state, and portable backup schema v7 preserves the scope.
- Portable backups can now be protected with a non-persisted passphrase. The
  versioned binary envelope uses PBKDF2-HMAC-SHA256 and AES-256-GCM with fresh
  salt and nonce values; wrong passphrases, tampering, and oversized plaintext
  fail before restore parsing or database mutation, while legacy JSON remains
  importable.
- Call handling can now be set per detected category to inherit the global
  policy, allow, send to voicemail, or block. Emergency and personal allow
  rules still win over category actions, while explicit personal blocks remain
  authoritative; the policy is explained in blocked activity and portable
  backup schema v6 preserves every selection.
- Phone identity now uses the device's injected ISO region to canonicalize
  valid national numbers to E.164 across matching, storage, imports, backups,
  and community reports. Short codes and opaque SMS sender IDs remain distinct.
- Room schema v12 migrates safe phone keys and merges national/E.164
  collisions without weakening permanent manual block or allow decisions.

### Fixed

- Checker failures are now recorded before the fail-open detection pipeline
  continues. Static cleanup also removes an unused overlay verification payload,
  stale statistics state, and an avoidable certificate-pin array copy.
- Release preflight now scans tracked build, script, and configuration sources
  for literal signing passwords and private-key material. Environment/property
  lookups remain valid, and synthetic guard tests prove failures never echo the
  matched secret value.
- Enabled installations now detect a lost Android call-screening role after
  startup, reboot, app update, and in a daily health check. One recovery alert
  is shown per loss episode; restoring the role or pausing call protection
  clears the private notice gate.
- Portable restore now writes all selected settings in one atomic DataStore
  update before mutating Room. A settings failure leaves every selected table
  untouched, and a later Room failure restores the exact prior preferences.
- Robolectric screening and SMS tests now own isolated DataStore files, Room
  databases, and coroutine lifecycles, eliminating cross-sandbox preference
  leakage and intermittent Windows atomic-rename failures.

## v1.7.21 (2026-07-22)

### Added

- A persistent appearance selector now offers System, Light, Graphite, and
  true-black AMOLED themes. Existing installs retain AMOLED as their default,
  while System follows the device's light/dark setting.
- Theme palettes have automated WCAG AA contrast coverage for primary text,
  secondary text, and primary actions.

### Changed

- The visual system now uses a tighter type scale, calmer semantic surfaces,
  restrained borders, compact section spacing, and consistent control density
  instead of decorative cards and gradients.
- Settings, onboarding, dashboard chrome, and the More hub use shorter copy,
  clearer grouping, and smaller headers while preserving 44 dp action targets.
- Nested More destinations now share one app header and a predictable Back
  action instead of stacking a second screen header below the shell.

## v1.7.20 (2026-07-22)

### Security

- Android cloud backup no longer uploads the Room database, which may contain
  phone numbers, call history, and raw SMS bodies. Direct device-to-device
  transfer and explicit user-created portable backups remain available.
- APK packaging now stages an explicit five-feed runtime allowlist instead of
  recursively embedding `data/`; 130 raw community report payloads and the
  maintainer README are no longer shipped. Debug/release verification fails if
  repository-only data enters the APK again.
- Outgoing calls are now rejected at the screening-service boundary before any
  inbound checker, response, overlay, log, or after-call feedback can run.
- External blocklist subscriptions now require HTTPS up front, matching the
  app-wide cleartext-deny policy instead of accepting feeds that can never load.

### Fixed

- RCS and notification-screening URL warnings remain active when SMS spam
  blocking is paused, matching direct-SMS phishing protection; the notification
  screening toggle still fully controls whether message content may be read.
- Corrupt public or private DataStore files now recover to safe defaults instead
  of repeatedly breaking settings reads, onboarding, and the screening hot path.
- Portable backup restore rejects more than 100,000 aggregate rows before
  normalization, conflict analysis, or database mutation, closing a CPU/memory
  exhaustion path that remained despite the existing 32 MiB byte cap.
- Portable backups now preserve active temporary block/allow expiries and the
  user's selected notification-screening apps. Expired temporary decisions are
  discarded during validation instead of returning as permanent rules.
- Repeated-call urgency now requires attempts separated by at least 15 seconds;
  duplicate call-log rows and machine-speed retry bursts can no longer create
  an automatic allow decision.
- Exported telephone deep links and post-call handles are now normalized with
  bounded work before reaching number details, preventing oversized or
  Unicode-homoglyph input from crossing the UI trust boundary.
- Language changes now preserve the active main tab and nested More screen
  instead of returning users to Home. Launcher shortcuts still navigate to
  their requested destination.
- Swipe-to-block in the activity log now restores the row after applying the
  block; swipe-to-delete retains its working Undo action on the current
  Material 3 dismissal API.
- Setup and statistics copy now correctly identifies the caller-ID overlay as
  optional and reports database entries rather than implying a byte size.
- The trusted-notification source picker now shows stable app names for all 17
  supported packages and uses a neutral state when none are installed.
- Deprecated Compose tab and swipe APIs were replaced, and the required API
  29 to 30 phone-state compatibility path is explicitly isolated, restoring a
  warning-free Kotlin build.
- The local community-report pipeline regression test no longer depends on a
  GitHub Actions workflow removed in v1.7.12; it once again validates the
  domain, hot-list, campaign-range, merge, and cleanup stages end to end.
- User-shared crash logs now redact phone-like values, credential fields, and
  URL queries/fragments from exception messages, while bounding individual
  messages and stack-frame output against pathological crash payloads.
- Screening now canonicalizes bounded E.164 caller IDs before applying unknown
  caller rules, so malformed, text-only, and overlong `tel:` handles cannot
  bypass the user's block-unknown setting.
- The reproducibility gate now verifies both signed and unsigned release APK
  names instead of failing after a valid unsigned release build.
- Pseudolocale screenshot QA now taps the actual Settings row in both layout
  directions and retries transient null UI roots after locale restarts instead
  of mislabeling or aborting captures.

## v1.7.19 (2026-07-21)

### Added

- **Offline region blocking and carrier-name trust rules.** Users can allow
  selected US states, Canadian provinces, territories, and toll-free numbers,
  then block calls outside that set. Optional case-insensitive CNAP glob
  patterns allow carrier-presented names through weaker region/statistical
  layers, while exact, system, prefix, and wildcard blocks remain authoritative.
- **Carrier-name block patterns.** The same bounded, case-insensitive CNAP glob
  rules can now reject recurring spam display names even as their numbers
  rotate. This best-effort layer runs after explicit and behavioral allows,
  persists through backup/restore, and fails open when no name is presented.
- **Opt-in notification screening for RCS, private messengers, and email.**
  Google and Samsung Messages remain the only defaults; users can separately
  enable AOSP Messages, SMS Organizer, Signal, WhatsApp, WhatsApp Business,
  Gmail, Outlook, or Thunderbird. Unselected sources are rejected before
  notification extras are read, and private-message/email detections produce
  non-destructive alerts.
- **Rule-priority conflict warnings.** Exact blocks, wildcard/range blocks,
  whitelist entries, and emergency allows are compared while editing. The
  inline warning names the rule that wins, including representative numbers
  covered by a broader pattern, before the user saves the overlap.
- **Persistent per-app language selection.** Settings now includes a language
  picker synchronized with Android's App Languages preference on Android 13+
  and persisted through AppCompat on Android 12 and lower. Release builds list
  only actual shipped locales; debug builds also expose en-XA and ar-XB for QA.
- **Repeatable pseudolocale screenshot QA.** Debug builds now include Android's
  `en-XA` and `ar-XB` resources, and an emulator script captures onboarding,
  dashboard, blocklist, and Settings in both locales while restoring the app's
  locale afterward.
- **A device-level call-screening deadline gate.** An API 35 instrumentation
  harness starts the real Hilt service lifecycle, drives the cold Room,
  DataStore, contact, and checker path, records latency, and reserves a full
  second beneath Telecom's five-second response deadline. The screening path
  is also included in baseline and startup profiles for ART compilation and
  release DEX layout; the acceptance run completed in 592 ms.
- **Deterministic off-device screening entrypoint coverage.** A Hilt-provided
  process coroutine scope can now be replaced by tests, and Robolectric drives
  the real call-screening service through allow, silence, and reject outcomes.
  It also delivers a valid UCS-2 SMS PDU through `SmsReceiver.onReceive()` and
  verifies that local phishing warnings remain active when SMS blocking is off.
- **Visible ML model health.** Protection Test now shows whether the GBT,
  compatible logistic model, built-in defaults, or a degraded fallback is
  active. Parse failures and GBT-to-LR degradation use explicit warning states
  instead of remaining visible only in local logs.
- **Automated accessibility regression coverage.** Compose Accessibility Test
  Framework checks now gate onboarding, dashboard, blocklist, and Settings for
  missing labels, undersized targets, contrast, and traversal problems.
  Expandable detail controls announce expanded/collapsed state, while duration
  labels use Android 16's native `TtsSpan` with a plain-text fallback below API
  36. The core surfaces also pass on-device checks with system outline text on.
- **Contacts-mode degradation detection.** `CallShieldPermissions`
  `isContactsModeDegraded()` reports when a contacts-dependent screening mode
  (contact-whitelist or contacts-only) is enabled but `READ_CONTACTS` is
  currently denied. A silent protection weakening that the base permission
  readiness matrix flagged only generically. Pure boolean predicate plus a
  `Context` overload; covered by readiness-matrix tests (789 tests total). The
  UI warning surfacing follows separately.
- **Opt-in Android post-call review.** Android 11+ users can enable a native
  Telecom post-call surface with clear “Mark spam & block” and “Add to
  contacts” actions. The spam action reuses CallShield's existing local block
  and community-report path, contact saving stays in the system editor, and
  the existing after-call notification remains the default when this is off.

### Changed

- **CallShield has a new cohesive icon system.** A flatter protected-handset
  mark now covers the repository logo, Play Store artwork, legacy square and
  round launchers, adaptive icons, shortcuts, splash screen, and Android 13+
  monochrome theming while retaining the app's AMOLED Catppuccin palette.
- **Manual refresh uses Android 16 progress notifications.** User-triggered
  database sync now shows a native `ProgressStyle` journey on API 36+ and an
  indeterminate progress notification on older releases, then removes it when
  the refresh finishes. After-call feedback intentionally retains its custom
  “Spam / Not spam” actions: API 35 and API 37 both reject `CallStyle` outside
  a foreground call service, user-initiated job, or full-screen call flow.
- **The on-device GBT catches more spam without abandoning its precision
  guard.** Training now exports sklearn's initial class-prior log odds and
  calibrates the shipped threshold for maximum held-out recall at a 0.92
  minimum precision. Exact on-device evaluation improved from 0.283 to 0.314
  recall while retaining 0.944 precision; legacy v3 models remain compatible
  with a zero initial score.
- **Compose navigation and setup surfaces are easier to scan.** The dashboard,
  onboarding, lookup, blocklist, recent activity, blocked log, More hub, and
  Settings now share a leaner hierarchy, clearer state and recovery copy, and
  consistent accessible actions without duplicating status information.

### Fixed

- **Oversized SMS analysis remains bounded on adversarial text.** URL matching
  now observes DNS label limits and skips regex scanning when no URL marker is
  present, eliminating quadratic backtracking within the existing 16 KB guard.
- **Phone numbers stay left-to-right inside RTL screens.** Every in-app,
  overlay, and localized-toast display path now wraps formatted numbers in
  Unicode bidi isolation; the UI padding audit found no physical left/right
  padding to migrate.
- **Onboarding respects edge-to-edge system insets.** Its progress header no
  longer renders underneath the Android status bar.

## v1.7.17 (2026-07-21)

Reliability drain. Background-execution survival, corrupt-DB recovery, bounded
digest, and off-device test coverage of the receiver hot paths.

### Added

- **OEM background-kill risk detection.** `BackgroundExecutionStatus` classifies
  the AOSP-portable risk that an aggressive battery manager (MIUI/HyperOS
  autostart, Samsung, ColorOS) silently kills sync and unbinds the listener,
  using `ActivityManager.isBackgroundRestricted()` +
  `PowerManager.isIgnoringBatteryOptimizations()`, with a best-effort MIUI
  autostart probe and the settings intent to fix it.
- **Sync-staleness predicate.** `SyncFreshness` flags when local hot-campaign
  data has decayed past a configurable threshold (default 3× the 6h cadence),
  so protection quietly falling back to the bundled snapshot can be surfaced.
- **Robolectric harness.** Adopted Robolectric 4.16 (no `returnDefaultValues`)
  with real-framework tests over `SpamActionReceiver` (notification-cancel hot
  path), `CheckerPipeline.run` (5s-deadline short-circuit / first-non-null-wins
  ordering / exception tolerance), and a pure `SmsReceiver.reassembleBody`
  multipart 16 KB-cap helper.

### Changed

- **Bounded daily digest.** `DigestWorker` computes blocked/call/SMS counts via
  aggregate SQL and reads only the short `matchReason` column for the source
  breakdown, instead of materializing the full 24 h `call_log` window (including
  message bodies) in a constrained background process.
- **Dependency freshness.** OkHttp 5.3.2 → 5.4.0, Moshi 1.15.1 → 1.15.2 (the
  AGP-8-safe subset; core-ktx/activity-compose/navigation upgrades require AGP 9
  and stay in the blocked tranche).

### Fixed

- **RCS filter self-heals after an OS unbind.** `RcsNotificationListener` now
  `requestRebind()`s in `onListenerDisconnected()`, so a low-memory/app-update/
  OEM unbind no longer silently stops all RCS filtering and push-alert capture
  until reboot.
- **Protection re-asserted on in-place update.** `BootReceiver` now also handles
  `MY_PACKAGE_REPLACED` (auto-update without reboot), reschedules the pending
  blocked-call-log worker, and rebinds the notification listener alongside the
  existing worker reschedules.
- **Corrupt database no longer fails open forever.** The call screener detects
  on-disk SQLite corruption in its fail-open catch, rebuilds a clean database,
  and re-syncs from GitHub/bundled data instead of allowing every call through
  indefinitely with no signal.

## v1.7.16 (2026-07-21)

### Added

- **Import/restore files are size- and row-bounded.** Blocklist import and
  backup-restore preview read the SAF-selected file through a bounded reader
  (32 MB cap) and cap applied blocklist rows (100k), instead of materializing an
  arbitrarily large file whole into memory. An OOM/ANR guard at the import
  trust boundary. Oversize files fail gracefully with the existing error copy.

### Changed

- **Blocked-call notifications align with Android 16 grouping.** The grouped
  blocked-event notifications and their summary now use `GROUP_ALERT_SUMMARY`,
  so a burst of blocks alerts through the single group summary rather than
  per-child. Keeping protection activity visible without being cooldown-muted.
- **On-device ML model health is now observable.** A corrupt or incompatible
  model payload that silently fell back to logistic regression (or failed to
  parse during sync) is now recorded as a typed `ModelHealth` state and logged,
  instead of degrading detection quality with no signal.

Deep audit pass. Correctness, data-safety, and security hardening in the
data/persistence/network layers.

### Fixed

- **Legitimate US/Canada callers are no longer misblocked as international
  "wangiri" scams.** The heuristic checked a +1 caller's area code against a set
  that mixed genuine Caribbean codes with international country codes, so real
  domestic area codes that collide with them. 678 (Atlanta), 267
  (Philadelphia), 224 (Chicago), 385 (Salt Lake City), 386 (Daytona), 248
  (Detroit), 252 (Greenville NC), 269 (Kalamazoo), 672 (Vancouver). Scored +80
  and were hard-blocked. NANP numbers are now only matched against genuine
  Caribbean area codes; international codes apply only to international numbers.
- **International numbers sharing digits with US premium NPAs are no longer
  misblocked.** A number such as Mongolia (+976) was flagged as a US 976
  premium-rate line; the premium check is now scoped to NANP numbers.
- **Backup restore is now atomic (prevents data loss).** In Replace mode the
  restore cleared the selected sections and then re-inserted rows in a bare
  loop; a failure partway through left the user's data half-cleared and
  half-restored. The clear plus every re-insert now run in a single Room
  transaction that rolls back on any error. Settings (stored in DataStore) are
  applied after the transaction commits.
- **Hot-list refresh is now atomic.** `replaceHotList` deleted the old
  `hot_list` rows and inserted the new ones as two separate statements, leaving
  a window (every 30-minute sync) where a concurrent call-screening lookup could
  miss a hot-list number. It now uses the DAO's transactional `replaceBySource`.

### Security

- **CSV log export neutralizes spreadsheet formula injection.** A blocked-call
  `matchReason` or (with raw bodies enabled) SMS text beginning with `= + - @`
  could execute as a formula when the exported CSV was opened in Excel/Sheets.
  Such cells are now prefixed with a single quote.
- **URLhaus response bodies are size-capped.** The phishing-URL check read the
  response with no bound, unlike every other remote lookup; it now uses the
  shared bounded reader (256 KB cap).
- **Hot-list/range sanitization enforces ASCII-only digits.** `HotDataSync`
  used Kotlin's Unicode-aware `Char.isDigit`, so a malformed feed row with
  non-ASCII digits could enter the hot-range set or dedup key yet never match
  the ASCII-normalized screening path. It now uses the project's `isAsciiDigit`.

### Changed

- Removed a dead `hot_list`-prefix branch in the daily digest's source
  breakdown (database hits always record `matchReason = "database"`).

### Security

- **CVE-2026-53914 (Kotlin build-cache deserialization) posture documented.** The
  runtime is unaffected; the exposure requires a shared/remote Gradle build cache
  feeding untrusted metadata. CallShield configures none, so the vector is not
  reachable. `gradle.properties` now documents this and warns against adding a
  remote cache until Kotlin reaches ≥ 2.4.20 (that bump rides the AGP 9 tranche).

### Fixed

- **After-call feedback notification is now dismissed by its own action buttons.**
  The "Was this spam?" notice was posted with one ID (`stableId(number, 62)`) but
  the Spam / Not-Spam actions cancelled a different, long-abandoned ID
  (`number.hashCode() + 10000`), leaving the notification stuck on screen. Both
  sites now use a single shared `NotificationHelper.feedbackNotificationId()`.
- **Phishing-URL (URLhaus) warnings no longer require SMS spam blocking to be on.**
  `SmsReceiver` returned early when "Block SMS" was disabled, before the message
  body was assembled, so the URLhaus malware-URL check could never run. Message
  extraction and the phishing check now run independently of the block-SMS
  toggle; only spam classification and block-logging remain gated behind it.
- **SMS senders no longer pollute the voice-call campaign detector.** SMS checks
  reuse the voice-call checker chain, so every incoming SMS sender's NPA-NXX was
  being recorded into the in-memory call-burst detector. A burst of legitimate
  SMS from one carrier prefix could trip campaign-burst blocking of real voice
  calls from that prefix. The recorder now ignores SMS-path invocations.
- **Caller-ID overlay now dismisses when the call actually ends.** It previously
  stayed up for a fixed 20 seconds, hovering over unrelated UI after a 2-3 s
  blocked/rejected call. A permission-gated call-state watcher dismisses it on
  `CALL_STATE_IDLE`; the 20 s timeout remains as a backstop.

- **Malformed v3 `fallback_weights` are rejected instead of silently zeroed.**
  The logistic-regression fallback guard checked the (always-20) array size, so
  a model whose fallback keys failed to parse produced an all-zero LR that never
  flagged spam. It now requires a minimum count of successfully-parsed named
  weights.
- **RCS encrypted-message placeholder detection is now locale-tolerant.** It
  matched English literals only, so on non-English devices the localized
  "encrypted message" placeholder was fed to the SMS content rules as real
  content. Detection is now keyword-anchored (en/es/pt/fr/de/it/nl) and
  length-bounded so it cannot misclassify real short messages.

### Changed

- **GitHub default-branch resolution is cached (6 h TTL).** Every raw-feed fetch
  used to issue a fresh unauthenticated `GET /repos/{owner}/{repo}`; a single
  hot-list refresh plus model-weight sync could burn several of GitHub's 60
  requests/hour unauthenticated budget, after which all feeds silently fell back
  to bundled data. Resolution is now cached per repo.
- **SMS-only checkers use dedicated priority constants** (`SMS_KEYWORD`,
  `SMS_CONTEXT_TRUST`, `SMS_CONTENT`) instead of borrowing call-ladder values by
  arithmetic, so a future renumber of the call ladder can't silently reorder SMS
  checks. Values and ordering are unchanged.
- Corrected the misleading "geographic_distance" ML-feature documentation. It
  is a coarse fixed-reference NPA proxy, not true user-relative geography (a
  user-relative feature remains roadmap 2.2.4). Behavior and model schema
  unchanged.
- **Phone numbers are bidi-isolated in notification text** so they render
  left-to-right and correctly ordered inside RTL (Arabic/Hebrew) sentences.
  Added reusable `PhoneFormatter.isolate()` / `formatIsolated()` helpers; the
  wider UI-screen adoption + logical-padding audit remains tracked in ROADMAP.

## v1.7.13 (2026-07-20)

### Changed

- **Removed the only manual API-key entry.** The optional AbstractAPI carrier /
  line-type key field is gone from Settings. CallShield now requires and offers
  no credential entry of any kind. Every lookup and enrichment source it uses
  is free and keyless (GitHub raw data, SkipCalls, PhoneBlock, WhoCalledMe,
  OpenCNAM, URLhaus, and the app's own Cloudflare Worker).
- Any AbstractAPI key stored by an earlier build is purged from both the public
  and private no-backup DataStores on first launch (`purgeLegacyAbstractApiKey`).

### Removed

- Deleted the unused `NumberTypeChecker` (AbstractAPI phone-validation client);
  it was never invoked on the screening or overlay path.
- Dropped the `phonevalidation.abstractapi.com` certificate pin and its
  `HttpClientTest` assertion, plus the AbstractAPI Settings strings.

### Testing

- Updated `RemoteLookupParserTest` and `HttpClientTest` to match the removed
  surface; `testDebugUnitTest` green.

## v1.7.12 (2026-06-27)

### Hardening

- Added a durable pending blocked-call log queue. `CallShieldScreeningService`
  writes an idempotent Room row before responding to Android, then a
  Hilt-backed WorkManager retry worker flushes it into `call_log` without
  duplicate final rows, notifications, or widget refreshes.
- Upgraded Room schema to v10 with `call_log.logKey` and
  `pending_blocked_call_logs`, plus migration and DAO coverage for duplicate
  suppression and retry timing.
- Added a shared ASCII-only digit utility and routed security-sensitive phone
  extraction paths away from Unicode digit matching.
- Added Cloudflare Worker rate-limit/dedup tests and Android 429 retry-delay
  feedback for community report submissions.

### Testing

- Verified `testDebugUnitTest`: 645 tests, 0 failures, 0 errors.

## v1.7.11 (2026-05-18)

### Fixed

- **Profile selection auto-reset** ([#2](https://github.com/SysAdminDoc/CallShield/issues/2)). Selecting a blocking profile (Work / Personal / Sleep / Maximum / Off) appeared to "reset" on the Dashboard chip row after process death or ViewModel recreation. The profile's underlying flag changes (block calls, aggressive mode, time block, etc.) were correctly applied and persisted, but the active-profile *indicator* itself was held in an in-memory `MutableStateFlow` and lost on every VM init. Now persisted to DataStore under `KEY_ACTIVE_PROFILE`; the dashboard chip stays selected across restarts.

### Distribution prep (post-v1.7.10) (UX and visual polish)

- Extended the premium Compose component system across the major user-facing
  flows, including dashboard scan actions, number details, recent-call recovery,
  blocklist utilities, diagnostics, onboarding, and settings.
- Replaced mixed raw action buttons and ad hoc icon wells with shared premium
  actions, compact actions, and icon tiles so destructive, recovery, loading,
  and secondary states read consistently across the app.
- Tightened trust-critical copy and semantics for reporting, source checks,
  permission recovery, import/export, and settings save actions.
- Added a shared per-permission degraded-mode matrix so dashboard and
  Protection Test recovery states name the affected feature and next action.

### Fixed

- Routed lookup, manual block, whitelist, recent-call, and blocked-log
  phone-number inputs/actions through the shared ASCII-only digit helper, with
  regression coverage for Unicode digit spoofing.
- Added bounded response-body guards and typed fallback statuses for
  enrichment lookups so oversized or malformed third-party responses do not
  crash overlay, details, or line-type parsing.
- Added byte, row-count, and schema guardrails for first-party GitHub spam,
  hot-list, spam-domain, and model-weight feeds so malformed responses fail
  before replacing the last known-good local data.
- Added external blocklist subscription guardrails: HTTP(S)-only CSV/TXT/JSON
  feeds are byte- and row-capped, preview add/remove/source impact before
  commit, and can be disabled or removed with feed-owned rows rolled back.
- Added URLhaus privacy mode and local-domain-first SMS/RCS URL checks so
  spam-domain feed matches avoid remote lookups, fragments are always stripped,
  and query strings are removed by default before URLhaus submission.
- Guarded the app-start contacts cache observer behind `READ_CONTACTS` so a
  clean install without contacts permission still starts and runs instrumented
  platform smoke tests.
- Added typed per-source enrichment diagnostics and privacy copy across overlay
  and number details so timeout, rate-limit, parse-error, oversized, disabled,
  unavailable, clean, and found states are visible without logging raw queried
  numbers.
- Redacted blocked SMS bodies from default log previews and CSV exports while
  keeping a separate warning-gated raw SMS export action for cases that require
  original message text.
- Added answered-caller trust with configurable count/window limits so repeated
  answered callers can bypass weaker heuristic/ML suspicion while explicit
  block rules still win first.
- Added emergency-callback grace with a configurable window so unknown callers
  can ring through after a local emergency call while explicit block rules
  still win first.
- Added SMS burst protection for repeated unknown senders and same-prefix flood
  patterns, including blocked-SMS notification actions to mark safe or report.
- Revised STIR/SHAKEN authenticated-allow copy and reasoning details
  so carrier attestation is described as caller-ID authentication, not caller
  safety, with A/B/C PASSporT wording covered by JVM tests.
- Added a backup restore preview step with parsed counts, conflict warnings,
  and explicit Merge or Replace apply modes so restores validate before
  mutating local blocklist state.
- Added selective backup and restore sections for blocklist, whitelist,
  wildcard/range rules, SMS keyword rules, non-secret settings, and opt-in logs
  so transfers can avoid unrelated personal data.
- Enabled checked-in Room schema export with instrumented migration coverage
  from database versions 5 through 9, plus a CI guard that fails on
  uncommitted schema drift.
- Added a high-API instrumented smoke lane for target-SDK permission,
  protected-service, Android 16 `SDK_INT_FULL`, notification-channel,
  full-screen-permission, and Android 17 OTP-delay compatibility assumptions
  while keeping the full API 29 emulator suite.
- Migrated Compose ViewModel Flow collection to lifecycle-aware
  `collectAsStateWithLifecycle()` so UI-only collectors stop with their
  lifecycle instead of continuing while screens are stopped.
- Aligned community-report number normalization with the hardened
  ASCII-only screening normalizer across the Android app, Cloudflare Worker,
  and Python report/import scripts, with regression coverage for Unicode
  digit spoofing and overlong numbers.
- Preserved pending community-report evidence for hot-list and spam-domain
  generation by deriving those feeds before the destructive report merge, with
  a Python regression test wired into CI.
- Added privacy-preserving SMS spam community reports that submit only
  sanitized domain and URL-signal indicators, never raw message text, while
  feeding fixture domains into `spam_domains.json`.

### Architecture

- Added production-used domain use-case wrappers for call spam checks, SMS spam
  checks, database sync, blocklist management, and log/blocklist export, then
  routed the live screening/scanner/sync/ViewModel entrypoints through them
  while preserving `SpamRepository` as the backing implementation.
- Moved `SpamCheckResult` and `SyncResult` into `domain/model` so use cases,
  UI, services, and tests now consume the same domain result types instead of
  repository-local data classes.
- Added domain repository contracts for spam checks, database sync, and
  blocklist management, then routed the use cases through a
  `SpamRepositoryAdapter` bridge ahead of the larger repository split.
- Split `SpamRepository` into a compatibility facade over
  `SpamRepositoryImpl`, `SettingsRepository`, `SyncRepository`, and
  `BlocklistRepository`, preserving existing singleton callers while moving
  detection, settings, sync, and blocklist/log concerns behind data-layer
  collaborators.
- Added the Hilt 2.58 Gradle plugin/runtime/compiler on the KSP path and
  annotated `CallShieldApp` with `@HiltAndroidApp`, establishing the DI
  migration baseline while staying compatible with AGP 8.10.1.
- Added a Hilt `DatabaseModule` that provides `AppDatabase` and `SpamDao`
  singletons for the upcoming repository and consumer injection steps.
- Added a Hilt `RepositoryModule` that provides the existing
  `SpamRepository` facade and binds the spam-check, sync, and blocklist domain
  repository interfaces to `SpamRepositoryAdapter`.
- Added a Hilt `NetworkModule` that provides the existing pinned
  `HttpClient.shared` as the singleton `OkHttpClient`.
- Migrated `MainActivity` and `MainViewModel` onto Hilt, with
  `MainViewModel` now receiving the existing `SpamRepository` facade plus
  sync, blocklist, and export use cases through constructor injection.
- Migrated `CallShieldScreeningService` onto Hilt field injection for the
  `SpamRepository` facade and call-spam use case while preserving the existing
  one-snapshot, fail-open 5-second screening flow.
- Added AndroidX Hilt Work 1.3.0, installed `HiltWorkerFactory`, removed the
  default WorkManager initializer, and migrated sync, hot-list, and digest
  workers to `@HiltWorker` assisted injection without changing schedules.
- Added a Hilt `DetectionModule` plus `CheckerDependencies` so the live
  checker pipeline, screening service, app-startup hot-data/model priming, and
  sync workers consume detection helpers through an injectable seam while the
  remaining object-to-class conversion continues.
- Converted the remaining detection helper singletons into
  constructor-injectable classes backed by shared compatibility facades, keeping
  existing UI/test utility call sites source-compatible while Hilt consumers
  receive injectable instances.

### Testing

- Upgraded AndroidX Test/Espresso to the 1.7.0/3.7.0 line and refreshed locks
  so Compose instrumented settings coverage runs on the API 36 emulator.
- Added Kover 0.9.8 to the locked Gradle graph and wired CI to run
  `:app:koverVerifyDebug` plus `:app:koverXmlReportDebug`, gating the
  JVM-tested data/util core at a 35% minimum line-coverage threshold.
- Added ktlint 1.8.0 and detekt 1.23.8 as locked Gradle checks, with
  baselines for existing style/complexity debt and a CI `static-analysis` job
  that fails on new ktlint or detekt findings.
- Added an `AppDatabase` constructor seam to `SpamRepository` so Android
  integration tests can run the repository against an in-memory Room database
  without starting the larger DI refactor.
- Added instrumented call-pipeline integration coverage for manual whitelist,
  STIR/SHAKEN failed/trusted ordering, user blocklist, prefix, wildcard,
  hash-wildcard, and frequency escalation priority tiers.
- Added instrumented SMS-pipeline coverage for whitelisted-sender inspection,
  keyword-before-content ordering, and generic SMS content-analysis blocking.
- Added a `SpamDataSource` seam and mocked in-memory Room sync integration
  tests for `syncFromGitHub()`, including remote snapshot population and
  preservation of user-block flags during remote refresh.
- Added a `HotFeedDataSource` seam for hot-list feeds and instrumented
  in-memory Room coverage for hot number insertion, stronger existing-row
  preservation, hot-range refresh, spam-domain refresh, and invalid-entry
  tolerance.
- Added deterministic onboarding Compose UI coverage for the four-page setup
  walkthrough, permission request affordances, call-screener setup action, and
  unsupported-screener fallback state.
- Extracted dashboard hero, setup checklist, and stats-row composables for
  deterministic Compose coverage of protection hero copy, sync freshness,
  blocked-count stats, and the call-screener setup action.
- Added blocklist swipe-left removal with snackbar undo for manual block
  entries, plus Compose coverage for manual add normalization, regex validation,
  delete action, and swipe removal.
- Extracted quiet-hours settings into a deterministic composable, added an
  all-day warning when start and end match, and covered the toggle callback,
  validation message, and hour picker in Compose tests.

### Localization

- Audited all 100 tracked main Kotlin files for hardcoded user-facing strings
  and recorded the findings in `docs/hardcoded-string-audit.md`.
- Moved clear backup/restore, blocklist import/export, CSV export, spam share,
  sync result, Quick Settings tile, clipboard, search-result, recent-duration,
  and number-detail stragglers into `strings.xml` resources and plurals.

### F-Droid

- Added Fastlane listing metadata under `fastlane/metadata/android/en-US/`.
- Added a draft `fdroiddata` metadata file with the v1.7.10 build, upstream
  binary URL, expected signer fingerprint, and tag/update settings.
- Added an F-Droid submission runbook with the remaining GitLab MR,
  fdroidserver lint/build, and signature-copy verification steps.

## [v1.7.10] (2026-05-14)

Continuation roadmap pass focused on the Compose dependency refresh.

### Compose stack

- **Compose BOM 2026.05.00 upgrade**. Moved the UI stack from the 2024.12
  BOM to the 2026.05 release train, resolving Compose UI/Foundation/Runtime to
  1.11.1 and Material 3 to 1.4.0.
- **Locked graph refresh**. Regenerated dependency locks across debug,
  release, and unit-test classpaths so every app configuration resolves the
  same Compose, lifecycle, core, savedstate, and profileinstaller graph.
- **Compose resource lint cleanup**. Replaced stale `LocalContext.getString`
  and `LocalContext.resources` reads in composables with `stringResource`,
  `pluralStringResource`, or `LocalResources`, keeping snackbar, toast,
  semantic, and validation copy configuration-aware.
- **Verification**. `lintDebug` is green on the refreshed Compose train; the
  full reproducible-build, unit-test, and lint pipeline was rerun after the
  migration.

## [v1.7.9] (2026-05-14)

Continuation roadmap pass focused on WorkManager dependency and scheduling
hardening.

### Background work

- **WorkManager 2.11.2 upgrade**. Upgraded the background-work stack and
  refreshed dependency locks across debug, release, and unit-test classpaths.
- **Schedule contract coverage**. Added JVM tests for `SyncWorker`,
  `HotListSyncWorker`, and `DigestWorker` WorkRequest construction, covering
  repeat intervals, connected-network constraints, initial delay, and backoff
  policy.
- **Schedule construction seam**. Centralized each worker's WorkRequest
  creation behind testable companion helpers while preserving the existing
  unique periodic work names and `KEEP` enqueue policy.
- **Stable DoS-guard verification**. Warmed the SMS analyzer before timing
  the large-body guard so the test measures analyzer behavior rather than JVM
  regex initialization.

## [v1.7.8] (2026-05-14)

Continuation roadmap pass focused on DataStore and backup privacy hardening.

### Settings and backup privacy

- **DataStore 1.2.1 upgrade**. Upgraded the settings dependency and refreshed
  the locked dependency graph.
- **No deprecated encrypted-preferences path**. Audited the settings and
  backup layer; CallShield does not use `EncryptedSharedPreferences`,
  `androidx.security`, or Tink-backed preferences today, so no encrypted
  preference migration target exists.
- **No-backup credential storage**. Moved the optional AbstractAPI enrichment
  key into a private DataStore under `noBackupFilesDir`, with one-time
  migration from the legacy public settings key.
- **Scoped restore boundary**. Public DataStore settings and the Room
  database remain restorable, while optional local credentials are kept out of
  Android Auto Backup scope.
- **Backup-rule documentation**. Corrected backup rule comments and README
  copy so they no longer imply that every preference is excluded.

## [v1.7.7] (2026-05-14)

Continuation roadmap pass focused on reproducible-build groundwork.

### Build integrity

- **Gradle dependency locking**. Enabled repository-wide dependency locking
  and checked in the generated lockfiles for release/debug/test resolution.
- **Build metadata guard**. Added `verifyReproducibleBuildInputs` to fail if
  Gradle build scripts start embedding wall-clock build metadata into APK
  inputs.
- **AGP VCS metadata disabled**. Release APKs no longer include
  `META-INF/version-control-info.textproto`, and
  `verifyReleaseApkReproducibleMetadata` fails if it returns.
- **Release hash sidecars**. CI release artifacts now include `.sha256`
  sidecars for artifact integrity, and local signed releases can generate the same sidecar via
  `scripts/write-release-sha256.ps1`.
- **APK content comparator**. Added `scripts/compare-apk-contents.ps1` for
  rebuild checks that compare ZIP entries while making APK Signing Block
  differences explicit.
- **Verification runbook**. Documented the fixed inputs, signed-vs-unsigned
  artifact distinction, offline rebuild command, and hash comparison workflow
  in `docs/reproducible-builds.md`.

## [v1.7.6] (2026-05-14)

Continuation roadmap pass focused on network dependency hardening.

### Network and dependency hardening

- **OkHttp 5 upgrade**. Upgraded OkHttp from 4.12.0 to 5.3.2 and kept
  callers on the shared `HttpClient` derived-client pattern.
- **Central certificate pinning**. Added SPKI pins for GitHub raw/API,
  Cloudflare community reports, URLhaus, AbstractAPI, and the free caller-ID
  enrichment hosts.
- **Kotlin, AGP, and Room alignment**. Upgraded AGP to 8.10.1, Kotlin/KSP to
  2.2.21, and Room to 2.8.4 so the OkHttp 5 dependency stack builds cleanly
  with current metadata.
- **Pinning regression coverage**. Added `HttpClientTest` to lock the pinned
  host inventory and pin-format requirements.

## [v1.7.5] (2026-05-13)

Continuation polish pass focused on Statistics localization and scan feedback.

### Stats and scan feedback polish

- **Localized chart labels**. The weekly Statistics chart now uses locale
  weekday abbreviations instead of hardcoded English day names.
- **Resource-backed detection labels**. Statistics detection-source names are
  now string resources, including the corrected "Prefix match" label.
- **Consistent scan errors**. Call-log and SMS inbox scan permission/failure
  messages now use the same resource-backed copy system as the rest of the UI.
- **Cleaner legend formatting**. Source legend count/percentage labels now
  use a formatted string resource for localization-ready output.

## [v1.7.4] (2026-05-13)

Continuation polish pass focused on the advanced settings credential flow.

### Settings trust polish

- **Safer optional API-key control**. The AbstractAPI key field is now masked
  by default, with explicit show/hide control rather than a permanently visible
  credential field.
- **Clear saved-state feedback**. The control now distinguishes "Not
  configured", "Saved locally", and "Unsaved changes" so users can tell whether
  a key is active or pending.
- **Lower-friction saving**. The save action is disabled until the local value
  changes, and switches to a clear-key action when a stored key is being
  removed.
- **Trust copy**. Advanced settings now state that the optional key is stored
  only on the device and can be left blank to disable carrier enrichment.

## [v1.7.3] (2026-05-13)

Premium-polish pass focused on trust, visual discipline, state recovery,
and user-facing release clarity.

### UX and visual polish

- **Shared shape and typography rhythm**. Standardized premium surfaces to
  modest rectangular 12 dp corners, removed negative/expanded letter tracking,
  and kept status backdrops within the existing no-pill design rule.
- **App chrome refinement**. Tightened the top shell spacing, reduced header
  card weight, and removed the selected bottom-navigation pill indicator. The
  active tab is now communicated through icon/text color and weight.
- **State treatment consistency**. Aligned buttons, filter chips, dialogs,
  progress bars, tabs, cards, and icon backdrops around the same restrained
  radius system.

### Trust and feedback

- **Blocked Log recovery states**. Empty and filtered log states now explain
  what is happening, use a proper premium state card, and provide a "Show all
  activity" recovery action when filters hide existing records.
- **Trusted-source sheet feedback**. The push-alert source picker now shows
  installed-source coverage, total supported-source coverage, and skeleton
  loading while app labels resolve.
- **Lookup/report semantics**. Spam report actions now use a flag icon rather
  than a favorite icon, and Number Detail database/risk labels use the shared
  rectangular status treatment instead of default Material chip backdrops.

## [v1.7.2] (2026-05-13)

Extreme hardening pass. Eight surgical fixes across UI design rules,
phone-number spoofing defence, regex-DoS guards, unbounded in-memory
maps, and crash-log durability. 28 new JVM unit tests; full suite at 613
passing.

### Security & correctness

- **ASCII-only phone-number normalization**. `normalizePhoneNumber()`
  now drops Arabic-Indic (٠-٩), fullwidth (０-９), and other non-ASCII
  digits that `Char.isDigit()` previously accepted. Visually-identical
  homoglyph caller IDs no longer bypass exact blocklist matches. Also
  strips zero-width / RTL marks (ZWSP, LRM, RLM, BOM) injected into
  spoofed numbers before the `+` check.
- **SMS body DoS guard (`SmsContentAnalyzer.MAX_ANALYSIS_LENGTH = 16 KB`)**
 . Caps the input fed into the regex sweep. Multi-MB SMS bodies on the
  inbox-scan path can no longer pin the 5 s screening deadline.
- **Multipart SMS reassembly cap (`SmsReceiver.MAX_REASSEMBLED_BODY = 16 KB`)**
 . A malformed delivery claiming hundreds of segments can no longer
  drive `joinToString` into unbounded memory.
- **WildcardRule ReDoS hardening**. Rejects catastrophic-backtracking
  shapes (`(a+)+`, `(a*)+`, `(a|aa)+`) at validation time, before the
  regex even compiles. Phone-shaped patterns (`^\+?1?\d{10}$`, area-code
  alternations) still pass.
- **CrashReporter atomic write**. Crash logs now write to `*.txt.tmp`
  and atomically rename. Power loss or a second crash mid-write can no
  longer leave a half-written report that looks legitimate.

### Reliability

- **OneShotNoticeGate bounded map**. Added a 1 024-entry LRU cap on
  top of the existing 6 h TTL prune. Long-lived processes that see many
  unique callers can no longer grow the notice-gate map without bound.
- **NotificationHelper PendingIntent ID separation**. `notifyAfterCall`
  now derives its request codes from `stableId(number, salt)` with
  distinct salts per intent rather than `number.hashCode()` and
  `hashCode() + 1`, removing collisions with block-notification intents
  for adjacent hashes.
- **`updateSummary` cancel guarded against SecurityException**. The
  no-blocks-yet `NotificationManager.cancel(SUMMARY_ID)` path now
  swallows the API 33+ revoke-between-check race the same way
  `safeNotify()` does.

### Design system

- **No pill / oval backdrops**. Removed every `RoundedCornerShape(999.dp)`
  in the app:
  - `StatusPill` (Theme.kt) now uses 6 dp corner radius and differentiates
    by colour/border/font-weight, not shape.
  - Onboarding and Protection-Test progress bars switched from
    `RoundedCornerShape(999.dp)` to 4 dp.
  - Blocked-log count badge switched from `CircleShape` to
    `RoundedCornerShape(10.dp)` (text-bearing badge, no longer fully
    rounded).

### Tests

- 28 new JVM unit tests across `NormalizePhoneNumberTest`,
  `SmsContentAnalyzerTest`, `OneShotNoticeGateTest`, `WildcardRuleTest`.
- Full suite: 613 tests passing in ~10 s.

## [v1.7.1] (2026-04-29)

### Improved

- **Caller-ID overlay race & feedback**. `CallerIdOverlayService` no longer blocks on all three external lookups; first spam-hit-wins via the `Race.kt` helper, so user-visible callerID appears sooner.
- **External lookup hardening**. Tightened `ExternalLookup.kt` against transient races and stale results when one provider returns much later than the others.
- **Push-alert allow feedback**. `PushAlertRegistry` + `OneShotNoticeGate` now surface "Allowed by you" notices the next time a previously-allowed number rings, so the user can revoke without digging into logs.

## [v1.7.0] (2026-04-24)

Round-2/3 borrow-and-harden pass. Competitor-OSS research
(aj3423/SpamBlocker, adamff-dev/spam-call-blocker-app, rspamd patterns)
distilled into two user-facing detection-pipeline improvements plus a
behavior-preserving refactor of the block-response decision table.
Fourteen new JVM unit tests cover the priority ladder and the
silence-vs-reject branches.

### Added

- **STIR/SHAKEN Trusted-Caller Allow**. New detection layer that short-
  circuits the weaker statistical blockers (heuristic, ML, campaign-burst,
  frequency-escalation) when the carrier signs a `PASSED` attestation on
  the calling number. Paired with the existing STIR_SHAKEN block slot
  (which fires on `FAILED`) to form a clean decision table: PASSED → allow,
  FAILED → block, NOT_VERIFIED / null → no opinion.
  - New checker: `data/checker/Checkers.kt::StirShakenTrustChecker` at
    priority slot `STIR_SHAKEN_TRUSTED = 5_300`. Sits **below** every
    explicit user rule (manual whitelist, contact whitelist, user
    blocklist, prefix, wildcard, hash-wildcard, system-block-list) so an
    intentionally blocked number stays blocked even if the carrier
    verifies it. Sits **above** heuristic / ML / campaign-burst /
    frequency so it does what it's here to do.
  - New setting: `KEY_STIR_TRUSTED_ALLOW`, **defaulted on**. Toggle
    exposed in Settings → Detection Engines → "STIR Trusted-Caller Allow".
  - Source: Round-2 OSS research. Aj3423/SpamBlocker + adamff-dev
    attestation-level filtering. We intentionally do NOT treat attestation
    `C` (verified-fail) as a sole block signal because US wholesale
    carriers routinely stamp C on legitimate traffic.
- **Auto-Mute Low-Confidence Blocks**. New opt-in setting that silences
  blocks with `confidence < 60` to voicemail instead of hard-rejecting
  them. Users can then review uncertain calls after the fact without an
  audible interruption. High-confidence hits (database match, user
  blocklist, STIR FAILED, heuristic ≥ 60) are always hard-rejected even
  with auto-mute on.
  - New helper: `CallShieldScreeningService.shouldSilence(silentVoicemail,
    autoMuteLowConf, confidence)`. Pure decision function, testable
    without a CallScreeningService / Android runtime.
  - New constant: `AUTO_MUTE_CONFIDENCE_THRESHOLD = 60`.
  - New setting: `KEY_AUTOMUTE_LOW_CONFIDENCE`, defaulted off. Toggle
    exposed in Settings → Detection Engines → "Auto-Mute Low-Confidence
    Blocks".
  - `KEY_SILENT_VOICEMAIL` still wins when on. Silence-every-block
    beats silence-only-uncertain.
- **14 new JVM unit tests**. `StirShakenTrustCheckerTest` (8 cases:
  enablement gates, pure decision paths, full priority-ladder regression
  sweep) and `CallShieldScreeningServiceAutoMuteTest` (6 cases: the three
  decision table branches + confidence-threshold boundary).

### Changed

- `CallShieldScreeningService.respondBlock()` now delegates response-
  shape decisions to a new private `buildBlockResponse(prefs, confidence)`
  helper. All three response shapes (silent-voicemail / auto-mute /
  hard-reject) share one reviewable decision table. Behavior-preserving
  for v1.6.3 users. Same `CallResponse.Builder()` flag sequence is still
  emitted per branch.
- `CheckerPriority` ladder extended with `STIR_SHAKEN_TRUSTED = 5_300`.
  Existing slot numbers are unchanged.
- ROADMAP `Current State` header rolled forward from v1.2.8 → v1.7.0 and
  now documents the round-1 architecture refactor (IChecker pipeline,
  Race.kt, PushAlertChecker) that shipped in the v1.6.x series.

### Fixed

- Internal audit caught during the v1.7.0 development cycle: the
  first-cut priority slot for `STIR_SHAKEN_TRUSTED` was placed above
  `USER_BLOCKLIST`, which would have let a carrier-signed PASSED call
  override an intentional user block. Corrected to slot `5_300` before
  ship; added a regression test suite in `StirShakenTrustCheckerTest`
  that asserts the ladder invariant against every explicit user rule
  so the bug cannot return silently.

## [v1.6.3] (2026-04-24)

Hardening pass targeting defects the v1.6.1 audit missed. Nine
surgical correctness fixes across the screening pipeline, backup
system, SMS receiver, and several services.

### Fixed (high)

- **PushAlertChecker. Title/body scope for anchored digit match**
  (`data/checker/PushAlertChecker.kt`). The v1.6.1 fix added a
  lookbehind/lookahead to the 7-digit match so "5551234" wouldn't
  match as a substring of a longer digit run, but the regex still
  ran against `title + "\n" + body`. Since `\n` counts as a
  non-digit boundary, a standalone 7-digit run in the **title**
  (order ID "Order #5551234", delivery PIN, tracking number) could
  allow an unrelated caller whose last-7 happened to match. The
  digit match is now scoped to `alert.body` only. Phrase matches
  (`your driver`, `out for delivery`, …) still run against the full
  title+body because phrases legitimately appear in titles.
- **BackupRestore. Schedule fields now round-trip** (`data/BackupRestore.kt`).
  `BackupWildcard`/`BackupKeyword` dropped `scheduleDays`/`scheduleStartHour`/
  `scheduleEndHour` on export. A time-gated rule restored from a v2
  backup silently lost its schedule and fired 24/7. Backup version
  bumped to 3; readers still accept v1 to v3.
- **SmsReceiver. Removed misleading `abortBroadcast()`** (`service/SmsReceiver.kt`).
  CallShield isn't the default SMS app, so `abortBroadcast()` on
  `SMS_RECEIVED_ACTION` is either unordered or a no-op depending on
  OEM/API level. The message still landed in the inbox. The call
  (with its apologetic comment) suggested CallShield blocked SMS
  delivery when it only logs the block. Comment rewritten to be
  explicit: we log, we do not suppress.
- **CallerIdOverlayService. Publish session id before `addView`**
  (`service/CallerIdOverlayService.kt`). Lookup jobs scheduled
  during view construction could compare against an older
  `activeSessionId` and mis-attribute results to the prior session.
  Belt-and-braces: set the id first, unwind on addView failure.

### Fixed (medium)

- **CallbackDetector. `NUMBER LIKE ?` SQL prefilter** (`data/CallbackDetector.kt`).
  The outgoing-24h and incoming-5min queries previously scanned the
  full CallLog window and post-filtered in Kotlin. On heavy users
  that's hundreds of rows decoded per screening call. SQLite now
  narrows on the trailing 7 digits before handing the cursor back;
  Kotlin still does an exact 10-digit match because CallLog formats
  vary (parentheses, dashes, country-code presence).
- **CallShieldTileService. Mutex-serialized toggles** (`service/CallShieldTileService.kt`).
  Two rapid QS-tile taps could both read the current state, both
  compute the opposite, and both write. Leaving the toggle
  apparently stuck. A single `Mutex` now serializes the
  read-modify-write on each tap.
- **SpamMLScorer. Sweep stale `.tmp` on `loadWeights`** (`data/SpamMLScorer.kt`).
  A process kill between `writeText` and `renameTo` left an orphan
  `spam_model_weights.json.tmp` that accumulated forever because
  `loadWeights` only reads the final file. Startup now deletes any
  stale tmp before reading.
- **WildcardRule. Regex path uses `numberVariants`** (`data/model/WildcardRule.kt`).
  The glob path matched an input across its `+1`, bare-digit, and
  `1`-prefixed forms; the regex path only matched the raw input.
  A user-written regex anchored to E.164 (`^\+1832555\d{4}$`)
  silently missed SMS senders arriving without the `+1`. Regex now
  tries every variant for parity.

### Fixed (low)

- **SitTonePlayer. AtomicBoolean CAS for single-flight** (`service/SitTonePlayer.kt`).
  The `@Volatile var isPlaying` check-then-set wasn't atomic; two
  coroutines entering `play()` concurrently could both see `false`
  and both proceed. Replaced with `AtomicBoolean.compareAndSet`.

### Tests

- `CallbackDetectorTest` updated for the new query builder signature
  and the `NUMBER LIKE '%<last7>'` prefilter.
- `PushAlertCheckerTest` gains two regression cases covering the
  body-only digit scoping.
- `WildcardRuleTest` (new) covers the glob+regex parity and the
  ReDoS guard.
- `BackupRestoreTest` updated for v3 schema, including schedule-field
  round-trip cases.
- **577 unit tests pass.**

### Known follow-ups (not fixed this pass)

Real findings from the audit that deserve their own session:

- Contact cache has no `ContactsContract` observer. A contact added
  via the OS remains "unknown" for up to 60s. Needs lifecycle wiring
  and should land alongside a sibling observer for
  `BlockedNumberContract`.
- `MainActivity` uses `collectAsState` (not `collectAsStateWithLifecycle`)
  so the dashboard minute-ticker keeps running in background. Touches
  many screens; do in one sweep.
- Backup restore is additive; picking the wrong file mixes two users'
  state. Needs a product decision on Replace-vs-Merge prompt.
- Screening-service block logging is fire-and-forget on `appScope`;
  under memory pressure Android can reclaim the process before the
  Room insert runs. Needs `goAsync`-equivalent keep-alive.
- `MainViewModel` is 400+ lines with 28 StateFlows; wants to split
  into domain-specific ViewModels.
- Phone-number normalization duplicated across 13+ screens. Wants
  a `PhoneUtils` extraction.

## [v1.6.2] (2026-04-24)

Maintenance release. No app-code changes since v1.6.1. Bundles the
refreshed spam database and a CI cadence fix.

### Changed
- **CI**: `merge-reports.yml` now runs weekly (Mon 08:00 UTC) instead of
  every 30 minutes. The hot-list refresh cadence was generating ~48
  commits/day to master; the weekly build workflow already covers the
  same ground. No effect on shipped app behavior.
- **Data**: refreshed community hot list and campaign-range aggregates.

## [v1.6.1] (2026-04-22)

Post-release audit fixes. Every item came out of a v1.6.0 code review;
no new features.

### Fixed (critical)
- **STIR/SHAKEN bypassed whitelist**: `CallShieldScreeningService` ran the STIR check inline *before* `isSpam()`, so a user's manual whitelist entry (emergency contact added via the app UI, not the device address book) was hard-rejected whenever the caller failed carrier verification. STIR is now a regular `IChecker` at priority 8,500. Below MANUAL_WHITELIST (10k) and CONTACT_WHITELIST (9k), above every block. Verification status threaded through `CheckContext.verificationStatus`.

### Fixed (high)
- **PushAlertChecker direct-number match anchoring**: a spam caller's last 7 digits appearing as a *substring* of any digit run in a recent notification (order ID, tracking number, dial-in PIN) used to return `allow("push_alert")`. Now anchored with `(?<!\d)…(?!\d)` boundaries so only standalone 7-digit runs qualify. TTL on both match paths unified to 10 minutes (was 30 min for number match).
- **PushAlertChecker trust-phrase list tightened**: dropped the bare `calendar` regex (matched any notification mentioning "calendar"). Tightened `(is |has )?outside` to require a subject word ("is outside", "arriving outside", "I'm outside", "we're outside") so weather notifications no longer fire it.
- **Verification/MFA phrases now package-gated**: "verify", "verification code", "OTP" etc. only fire for the four messaging-app packages that actually send SMS codes. Outlook MFA pushes no longer unblock unrelated callers. `appointment reminder` is gated to calendar apps.

### Fixed (medium)
- `util/Race.kt`: a competitor that threw was synthesizing `onTimeout` as its result and, for callers where `decisive(onTimeout) == true`, winning the race on the failure. Now failures are tracked as a separate state and only decrement the `remaining` tally.
- `PushAlertRegistry` opt-out updates are now atomic via `applyOptOuts(Set)`: prune-before-publish eliminates the window where a concurrent screening verdict could read stale alerts from a just-disabled package. Defensive `HashSet(disabled)` copy on every write guards future callers.
- `SystemBlockList.isBlocked`: a `SecurityException` (default-dialer role revoked mid-session) now clears the lookup cache in addition to marking availability off. Prevents a stale `true` entry from the previous role session influencing subsequent checks.

### Fixed (low)
- `CheckerPipeline.run` now bails before each checker when `ctx.timeLeftMillis() <= 0`. Cheap insurance in case a future checker blocks long enough to eat the 5-second deadline.

### Added
- `PushAlertCheckerTest`. 11 regression tests pinning the H1/H2/H3 fixes (anchored digit match, dropped bare phrases, package-gated MFA).

## [v1.6.0] (2026-04-22)

Peer-inspired track. Features ported from the strongest OSS Android call/SMS blockers
(SpamBlocker, YetAnotherCallBlocker, Saracroche, Fossify Phone, BlackList).

### Added
- **Priority-sorted checker pipeline (A1)**. Every detection layer is now an `IChecker` implementation with an explicit priority. 13 checkers (manual whitelist → ML scorer) run through `CheckerPipeline.run` with first-non-null wins. Replaces the 140-line `isSpam()` waterfall with a 25-line dispatcher. Each layer is testable in isolation and the "why blocked" trail is explicit. Inspired by SpamBlocker's `IChecker` architecture.
- **Budget-aware parallel race (A2)**. `util/Race.kt` races N suspend blocks against a budget, returns the first decisive result, cancels losers. Built on `Channel` + `select` + `AtomicInteger`. Foundation for reputation-API work under the 5-second CallScreeningService deadline.
- **Push-alert bridge (A3)**. Notifications from 24 messaging/delivery/rideshare apps (Uber, DoorDash, Amazon, FedEx, Google Messages, Gmail, Outlook, etc.) can vouch for an unknown caller within 30 minutes. Direct number match OR trust-phrase match ("your driver", "verification code") allows the call through. Biggest false-positive fix in the OSS landscape.
- **A3 allowlist editor**. Modal bottom sheet lists every trusted source package with per-package switches + "Restore defaults". `PackageManager`-resolved labels, installed-first sort. Opt-out semantics. Future default additions propagate automatically. Gated behind the master toggle.
- **System block-list checker (A4)**. Read-only bridge to `BlockedNumberContract.BlockedNumbers`. If the user has marked a number via stock Phone/Messages, CallShield respects it. Graceful degradation via `SecurityException` catch for non-default-dialer installs.
- **Length-locked `#` wildcard rules (A5)**. Saracroche-style range patterns like `+33162######`. Pure character-index matching, no regex JIT. Covers any NPA-NXX in one rule. New "Ranges" tab with pattern overlap detection, coverage count pill, and a safety rail rejecting patterns that cover >100M numbers. Country-prefix variant generator matches national-format and international-format numbers from the same rule.
- **Per-rule schedule gating (A7)**. Every rule type (`WildcardRule`, `HashWildcardRule`, `SmsKeywordRule`) now carries an optional day-of-week + hour-window schedule. Rules can be restricted to e.g. "Mon to Fri 09:00 to 17:00". Shared `ScheduleSection` composable across all three rule-add dialogs; list items show an "Active …" pill when gating. `daysMask == 0` is the "no gating" sentinel so legacy rules behave identically.

### Fixed (opening audit pass, opus-4.7 context)
- SpamMLScorer double-scoring: `isSpam()` + `confidence()` each ran feature extraction + tree traversal. Replaced with `verdict()`. Single pass returns `(score, confidence, isSpam)`. Material on the 5-second deadline.
- SpamMLScorer parse-failure leak: `parseAndApply` mutated state to defaults mid-parse. Now `parseModel` is pure (returns `ModelState?`) and the caller commits atomically. A corrupt sync can no longer expose default weights to live scorers.
- CoroutineScope leaks in `SpamActionReceiver` and `CallShieldWidget`. Each allocated a fresh scope per invocation. Both now use `CallShieldApp.appScope`.
- CallShieldScreeningService hot path: 4+ individual DataStore `Flow.first()` reads before `isSpam()` took its own snapshot. Now single `readPrefsSnapshot()` threaded through the entire call chain.
- CallShieldScreeningService response-loss: Room logging ran before `respondToCall`, risking "Android auto-allows after 5s" if the service was unbound mid-write. Response now happens first; logging offloaded to `appScope`.
- Room `LIKE` wildcard injection in `searchNumbers` / `searchLog`. User-typed `%` or `_` was silently treated as SQL wildcard. Pre-escaped via `escapeLikeQuery()` with `ESCAPE '\'` on the queries.
- `SmsContentAnalyzer`: dead code (unused `body.lowercase()`) removed; `PHONE_IN_BODY` regex switched to `(?i)` flag for consistency.

### Performance
- Single-snapshot prefs sharing across `isSpam` + `isSpamSms` removes one DataStore round-trip on every SMS.
- Checker-level `isEnabled(ctx)` gating skips expensive checks (regex compile, ML traversal, heuristic analyze) before any work, not after.
- `HashWildcardMatcher.matches` is ~20 ns per call. Beats regex by 100x on length-locked range patterns.
- `PushAlertRegistry` is lock-bounded but uses a 128-entry ring buffer; dedup of identical sequential alerts.

### Database
- Room `DB_VERSION = 9`. Three additive migrations layered on top of v1.5:
  - `MIGRATION_6_7`: new `hash_wildcard_rules` table.
  - `MIGRATION_7_8`: schedule columns on `hash_wildcard_rules`.
  - `MIGRATION_8_9`: schedule columns on `wildcard_rules` and `sms_keyword_rules`.
- All additive, all `DEFAULT 0` sentinels. Zero risk for existing data.

## [v1.5.0] (2026-04-15)

### Fixed
- SpamMLScorer race condition: replaced 6 independent @Volatile fields with single atomic ModelState snapshot to prevent half-updated model reads during concurrent scoring
- WildcardRule glob-to-regex: all regex metacharacters (`.`, `(`, `)`, `[`, `]`, etc.) now properly escaped. Previously only `+` was escaped, causing false matches on patterns like "212.555*"
- Frequency auto-escalation: unbounded time window caused legitimate callers with 3+ calls over months to be auto-blocked; now uses 7-day sliding window
- RcsNotificationListener: replaced verbose `scope.coroutineContext[Job]?.cancel()` with idiomatic `scope.cancel()`
- SyncWorker: non-retryable failures (HTTP 404) were silently reported as success to WorkManager; now correctly returns Result.failure()
- SpamActionReceiver: bare CoroutineScope without SupervisorJob could crash before pendingResult.finish() on uncaught exceptions
- MainViewModel scan guard: TOCTOU race allowed duplicate concurrent call log / SMS scans; flag now set before coroutine launch
- isWangiriCountryCode: Caribbean +1 NPAs (876 Jamaica, 284 BVI, 649 Turks & Caicos, etc.) were never detected as wangiri due to overly broad US/CA exemption

### Performance
- Consolidated 7 separate OkHttpClient instances into shared `HttpClient.shared` singleton with per-caller derived builders. Eliminates redundant connection pools and thread pools
- Cached hot-path Room queries (prefixes, wildcards, keyword rules) behind @Volatile lazy fields with write-through invalidation. Removes per-call disk I/O from the 5-second screening deadline
- DataStore settings in isSpam(): single `dataStore.data.first()` read replaces 8+ separate Flow .first() collector operations
- CampaignDetector.trimTrackedPrefixes: replaced O(n log n) sort with O(n) min-scan inside synchronized block

### Hardening
- WildcardRule: user-provided regex patterns capped at 200 chars to guard against ReDoS on the call screening path
- SmsContentAnalyzer: URL regex pattern length-capped at 2048 chars to prevent ReDoS on pathological SMS bodies

## [v1.4.0]

- Changed: Update hot list + merge community reports 2026-04-13T15:33
- Changed: Update hot list + merge community reports 2026-04-13T14:38
- Changed: Update hot list + merge community reports 2026-04-13T13:40
- Changed: Update hot list + merge community reports 2026-04-13T12:56
- Changed: Update hot list + merge community reports 2026-04-13T12:29
- Changed: Update hot list + merge community reports 2026-04-13T11:31
- Changed: Update hot list + merge community reports 2026-04-13T10:36
- Changed: Update hot list + merge community reports 2026-04-13T09:41
- Changed: Update hot list + merge community reports 2026-04-13T08:47
- Changed: Update hot list + merge community reports 2026-04-13T08:44

## Roadmap archive (2026-08-10, ROADMAP.md)

<details>
<summary>Original roadmap snapshot</summary>

````markdown
# CallShield Development Roadmap

**Roadmap revision:** 2026-06-27 · **Anchored to:** v1.7.12 (versionCode 40)

This roadmap merges the original Phase 1 to 5 plan, the Addendum A "peer-inspired track" (round-1/2/3 borrows from SpamBlocker, YACB, BlackList, Saracroche, adamff-dev, Fossify), and a fresh Addendum B harvested from a 30-source research sweep across OSS competitors, commercial competitors, FCC/IETF/ATIS standards, Android 15/16 platform changes, dependency changelogs, and adjacent-domain OSS (NetGuard, Pi-hole, rspamd patterns).

Source-cited. Every Addendum-B item maps to an entry in **Appendix. Source Index**. Anything that contradicts CallShield's stated philosophy (on-device, no accounts, no API keys, no cloud audio, FOSS) is either rejected or flagged.

---

## Current State (v1.7.12)

Working Android spam call/text blocker. **100 main Kotlin files, 37 JVM test files, and 15 instrumented test files.** Post-v1.7.10 work added `AppDatabase`, `SpamDataSource`, and `HotFeedDataSource` seams plus in-memory Room integration tests for the call, SMS, database-sync, and hot-feed pipelines, completed deterministic onboarding, dashboard, blocklist, and settings Compose UI coverage, added a Kover 0.9.8 debug coverage gate for the JVM-tested data/util core, added local lint/ktlint/detekt gates with baselines for existing static-analysis debt, introduced production-used domain use-case wrappers for spam checks, SMS checks, sync, blocklist management, and exports, moved `SpamCheckResult`/`SyncResult` into `domain/model`, added domain repository interfaces with a `SpamRepositoryAdapter` bridge, split the data layer so `SpamRepository` is now a compatibility facade over `data/repository` collaborators, completed Hilt DI for the app, services, workers, repositories, and detection helpers, completed the 1.8.1/1.8.2 localization/plural pass, and added v1.7.12 durable blocked-call logging with Room v10 `logKey` idempotency plus a pending-log retry worker. v1.7.12 also adds Cloudflare Worker rate-limit/dedup tests, Android 429 retry-delay feedback, and shared ASCII-only digit utilities. **645 JVM tests plus instrumented integration/UI/runtime coverage**.

15-layer detection pipeline (priority-sorted `IChecker` registry), GBT v3 ML scorer (20 features, atomic ModelState, pure-Kotlin inference) with logistic-regression v2 fallback, Jetpack Compose UI on Catppuccin Mocha + AMOLED, Room 2.8.4 with explicit migrations v5+, scheduled WorkManager hot-list + weekly sync from GitHub, RCS NotificationListener, CallerIdOverlayService with first-hit-wins lookup race, SIT-tone anti-autodialer, URLhaus phishing detection, Cloudflare Worker community reporting, and local Gradle/lint/release verification.

**Stack fingerprint:** AGP 8.10.1 · Kotlin 2.2.21 · Compose BOM 2026.05.00 · Room 2.8.4 · WorkManager 2.11.2 · OkHttp 5.3.2 · Moshi 1.15.1 · DataStore 1.2.1 · Kover 0.9.8 · ktlint 1.8.0 · detekt 1.23.8 · Hilt 2.58 · AndroidX Hilt Work 1.3.0 · minSdk 29 · targetSdk 36 · KSP for Room/Hilt codegen. **No KMP, no Glance, no SQLCipher.**

```mermaid
graph LR
    P1[Phase 1: Foundation] --> P2[Phase 2: Detection Quality]
    P1 --> P3[Phase 3: Real-Time Pipeline]
    P2 --> P4[Phase 4: Platform & UX]
    P3 --> P4
    P4 --> P5[Phase 5: Scale & Partnerships]
    P1 -.-> AB[Addendum B: Research Track]
    P2 -.-> AB

    style P1 fill:#a6e3a1,color:#000
    style P2 fill:#89b4fa,color:#000
    style P3 fill:#fab387,color:#000
    style P4 fill:#cba6f7,color:#000
    style P5 fill:#f38ba8,color:#000
    style AB fill:#f9e2af,color:#000
```

---

## Status Legend

`[DONE]` shipped in a tagged release · `[WIP]` partially landed · `[NOW]` next 1 to 2 releases · `[NEXT]` 3 to 6 releases out · `[LATER]` long-horizon · `[?]` under consideration · `[X]` rejected (with reasoning).

---

## Locked Design Philosophy (do not contradict without flagging)

1. **On-device first.** Every detection layer must work offline. Network calls are enrichments, never gating.
2. **No accounts, no sign-in, no telemetry.** Anonymous community reporting via Cloudflare Worker is the maximum ceiling.
3. **No required API keys.** Any third-party API must have a free, no-auth tier or be optional.
4. **No cloud audio.** Voice frames never leave the device. Deepfake / fingerprint detection runs locally or not at all.
5. **FOSS distribution.** Every release must be reproducible-buildable for F-Droid; no GMS-only code paths.
6. **5-second screening deadline.** `CallShieldScreeningService` must respond <5 s. All hot-path code is budget-aware.
7. **Backward compat for hot-list URLs.** GitHub-raw endpoints remain serve-and-respond for v1.2.x clients indefinitely.

Any roadmap item that contradicts these is flagged inline with **⚠ philosophy conflict** and given an explicit case.

---

## Phase 1 (Foundation (Testing, Architecture, Security))

**Goal:** engineering discipline, testability, security hardening. Every later phase depends on this.

### 1.1 Unit Tests for Detection Engines `[DONE]`

Shipped: 30 test files now exist under `app/src/test/`, covering `SpamMLScorer` (logistic + GBT), `SpamHeuristics`, `SmsContentAnalyzer`, `PhoneFormatter`, `CallbackDetector`, `BackupRestore`, `WildcardRule`, `HashWildcardMatcher`, `LogExporter`, `BlockingProfiles`, `BlockReasoning`, `CampaignDetector`, `TimeSchedule`, `PhoneNumberFuzzTest`, `JsonParsingFuzzTest`, `HotPathBenchmarkTest`, `OneShotNoticeGate`, `CrashReporter`, `DashboardStatusModel`, `Race`, plus `CallShieldScreeningServiceAutoMuteTest` and `StirShakenTrustCheckerTest` from v1.7.0.

### 1.2 Integration Tests `[DONE]`

| Task | Size | Depends | Files |
|------|------|---------|-------|
| 1.2.1 Full `isSpam()` pipeline test with in-memory Room. Exercise core priority tiers and verify priority ordering | XL | `[DONE]` | `androidTest/.../data/SpamPipelineIntegrationTest.kt` |
| 1.2.2 Full `isSpamSms()` pipeline test. Context trust bypass, keyword rules, content-analysis order | L | `[DONE]` | `androidTest/.../data/SmsPipelineIntegrationTest.kt` |
| 1.2.3 `syncFromGitHub()` mocked. Verify atomic Room population via `@Transaction` | M | `[DONE]` | `androidTest/.../data/SyncIntegrationTest.kt` |
| 1.2.4 `HotListSyncWorker`. Hot_numbers, hot_ranges, spam_domains parsed and stored, per-entry error tolerance | M | `[DONE]` | `androidTest/.../service/HotListSyncIntegrationTest.kt` |

`SpamRepository` now accepts a constructor-provided `AppDatabase` and `SpamDataSource`, and `HotDataSync` accepts a narrow `HotFeedDataSource`, so Android integration tests can use `Room.inMemoryDatabaseBuilder()` plus fake remote/hot-feed snapshots without starting the Hilt refactor.

### 1.3 Compose UI Tests `[DONE]`

Eleven instrumented test files now exist (`CrashReporterInstrumentedTest`, `DashboardStatusBadgeTest`, `ThemePrimitivesTest`, `SpamPipelineIntegrationTest`, `SmsPipelineIntegrationTest`, `SyncIntegrationTest`, `HotListSyncIntegrationTest`, `OnboardingTest`, `DashboardTest`, `BlocklistTest`, `SettingsTest`).

| Task | Size | Status | Files |
|------|------|--------|-------|
| 1.3.1 Onboarding flow. 4 pages, permission requests, call-screener setup | M | `[DONE]` | `androidTest/.../ui/screens/onboarding/OnboardingTest.kt` |
| 1.3.2 Dashboard. Hero stats, sync freshness, screener banner | M | `[DONE]` | `androidTest/.../ui/screens/main/DashboardTest.kt` |
| 1.3.3 Blocklist. Add/delete, wildcard validation, swipe-to-delete + undo | L | `[DONE]` | `androidTest/.../ui/screens/main/BlocklistTest.kt` |
| 1.3.4 Settings. Toggle persistence, quiet-hours validation, schedule picker | M | `[DONE]` | `androidTest/.../ui/screens/settings/SettingsTest.kt` |

### 1.4 Local Verification Pipeline `[DONE]`

Kover 0.9.8 gates the debug JVM unit-test report for the data/util core at a 35% minimum line-coverage threshold; current filtered coverage is 41.06%. The filter intentionally excludes Compose screens, Android services, permission entrypoints, and `data.local` Room classes because Kover only collects local JVM test coverage, while those surfaces are guarded by instrumented integration/UI tests. Android lint, ktlint, and detekt run locally with baselines for existing style/complexity debt so new violations are visible without forcing a giant reformat/refactor in the same release. Ratchet Kover and reduce baselines as architecture seams land.

| Task | Size | Status | Files |
|------|------|--------|-------|
| 1.4.4 Code-coverage gate via Kover, ratcheting threshold (start 35%, +5% per release) | M | `[DONE]` | `app/build.gradle.kts` |
| 1.4.5 Lint + ktlint + detekt local gates | S | `[DONE]` | `.editorconfig`, `app/build.gradle.kts` |

### 1.5 Clean Architecture Refactor `[DONE]`

`SpamRepository` now preserves the public singleton/facade API while the concrete data responsibilities live under `data/repository`. The `IChecker` registry (Addendum A1) still owns detection ordering, now through `SpamRepositoryImpl`.

`domain/usecase` now contains thin, production-used wrappers: `CheckSpamUseCase`, `CheckSpamSmsUseCase`, `SyncDatabaseUseCase`, `ManageBlocklistUseCase`, and `ExportLogsUseCase`. The wrappers are wired into the live call/SMS screening paths, historical scanners, sync worker, and `MainViewModel` blocklist/export flows. `domain/model` now owns `SpamCheckResult` and `SyncResult`. `domain/repository` defines `SpamCheckRepository`, `SyncRepository`, and `BlocklistRepository`; `data/repository/SpamRepositoryAdapter` bridges those contracts to the facade. `data/repository/SpamRepositoryImpl` owns the 5-second checker path and Room-backed hot caches, `SettingsRepository` owns public/private DataStore reads and writes, `SyncRepository` owns GitHub/bundled/hot-list persistence, and `BlocklistRepository` owns blocklist, whitelist, rule, log, search, and cleanup operations.

| Task | Size | Status | Files |
|------|------|--------|-------|
| 1.5.1 Domain use cases: `CheckSpamUseCase`, `CheckSpamSmsUseCase`, `SyncDatabaseUseCase`, `ManageBlocklistUseCase`, `ExportLogsUseCase` | L | `[DONE]` | `domain/usecase/*.kt` |
| 1.5.2 Extract `SpamCheckResult` and settings models to domain layer | S | `[DONE]` | `domain/model/*.kt` |
| 1.5.3 Define repository interfaces in domain | M | `[DONE]` | `domain/repository/*.kt` |
| 1.5.4 Split `SpamRepository` into `SpamRepositoryImpl`, `SettingsRepository`, `SyncRepository`, `BlocklistRepository` | XL | `[DONE]` | `data/repository/*.kt` |

**Critical:** the call/SMS pipeline integration tests in 1.2.1/1.2.2, sync integration tests in 1.2.3, and hot-feed integration test in 1.2.4 now exist. Run the full integration set after each split to verify priority ordering and data-refresh behavior.

### 1.6 Dependency Injection (Hilt) `[NOW]`

Hilt is pinned to 2.58 for the current AGP 8.10.1 stack: 2.59+ requires AGP 9, while 2.58 explicitly held AGP 9 support back [src 31]. The app uses KSP for the Hilt compiler following the official Gradle setup [src 32], and AndroidX Hilt Work is pinned to the current stable 1.3.0 line [src 33].

| Task | Size | Status | Files |
|------|------|--------|-------|
| 1.6.1 Add Hilt 2.58 (AGP 8-compatible current line [src 31]) | S | `[DONE]` | `libs.versions.toml`, `build.gradle.kts` |
| 1.6.2 `@HiltAndroidApp` on `CallShieldApp` | S | `[DONE]` | `CallShieldApp.kt` |
| 1.6.3 `DatabaseModule` providing `AppDatabase` + `SpamDao` singletons | M | `[DONE]` | `di/DatabaseModule.kt` |
| 1.6.4 `RepositoryModule` binding interfaces to impls | M | `[DONE]` | `di/RepositoryModule.kt` |
| 1.6.5 `NetworkModule` providing the shared `OkHttpClient` (with cert pinning, see 1.7.2) | M | `[DONE]` | `di/NetworkModule.kt` |
| 1.6.6 `MainViewModel` → `@HiltViewModel` with injected use cases | M | `[DONE]` | `MainActivity.kt`, `MainViewModel.kt` |
| 1.6.7 `CallShieldScreeningService` → `@AndroidEntryPoint` | M | `[DONE]` | `CallShieldScreeningService.kt` |
| 1.6.8 Workers → `@HiltWorker` | M | `[DONE]` | `CallShieldApp.kt`, `SyncWorker.kt`, `HotListSyncWorker.kt`, `DigestWorker.kt` |
| 1.6.9 Convert `object` singletons (`SpamHeuristics`, `SmsContentAnalyzer`, `SpamMLScorer`, `CallbackDetector`, `SmsContextChecker`, `CampaignDetector`, `HashWildcardMatcher`) to injectable classes | L | `[DONE]` | data layer |

The helper objects are now constructor-injectable classes. `DetectionModule` provides their shared singleton instances, `CheckerDependencies` routes the live checker chain, screening service, app startup, hot-list sync, and model sync paths through that seam, and companion compatibility facades preserve existing UI/test utility call sites until those lower-risk callers are migrated.

**Risk:** migrate one consumer at a time; keep `getInstance()` fallback until all consumers migrated.

**Alternate (worth a spike):** Kotlin 2.2 `context(...)` parameters [src 20] could replace some `@Inject` for pure-logic boundaries. Don't do it as the primary DI strategy. Hilt's lifecycle binding is still needed for ViewModel/Worker scoping.

### 1.7 Security Hardening `[WIP]`

| Task | Size | Status | Files |
|------|------|--------|-------|
| 1.7.1 Move signing credentials to `local.properties` / env vars | S | `[DONE]` (`build.gradle.kts:33-47`) |. |
| 1.7.2 Certificate pinning. GitHub raw, Cloudflare Worker, all enrichment APIs. Use OkHttp 5 `CertificatePinner` (post-1.7.5 upgrade). | M | `[DONE]` v1.7.6 | `data/remote/HttpClient.kt`, `HttpClientTest.kt` |
| 1.7.3 Replace any `EncryptedSharedPreferences` with **Tink `AeadSerializer` + DataStore 1.2** [src 21]. AndroidX Security `EncryptedSharedPreferences` is on the deprecated path. | M | `[DONE]` v1.7.8: no `EncryptedSharedPreferences`/`androidx.security` path exists; DataStore upgraded to 1.2.1 and optional key moved to no-backup DataStore instead of adding an unused Tink path | `SpamRepository.kt`, settings layer |
| 1.7.4 Consider `android:allowBackup="false"` or restrict via existing `backup_rules.xml` (currently `allowBackup="true"`) | S | `[DONE]` v1.7.8: backups remain enabled for Room + public settings, while optional credentials now live under `noBackupFilesDir` and migrate out of backed-up DataStore | `backup_rules.xml`, `data_extraction_rules.xml`, `SpamRepository.kt` |
| 1.7.5 OkHttp 4.12 → **OkHttp 5.x** [src 18]. Adds Happy Eyeballs (RFC 8305), ZSTD compression module, JPMS, separate Android artifact, eliminates 4.x cookie-jar SSRF. | M | `[DONE]` v1.7.6 (`OkHttp 5.3.2`) | `data/remote/HttpClient.kt`, version catalog |
| 1.7.7 Reproducible-build verification. Match SpamBlocker's F-Droid story. Eliminate build-timestamp embedding, enable Gradle `dependencyLocking`, document hash-comparison procedure. [src 1, src 24] | M | `[DONE]` v1.7.7 for source-content groundwork; signed byte-for-byte validation remains a F-Droid signature-copy follow-up | `build.gradle.kts`, CI, `docs/reproducible-builds.md`, `scripts/compare-apk-contents.ps1` |

### 1.8 String Extraction `[WIP]`

`955+ string resources` and 6 plural groups are already extracted (per README), and the 1.8.1 audit now records remaining literal buckets. Continue.

| Task | Size | Files |
|------|------|-------|
| 1.8.1 Audit all main Kotlin files for hardcoded user-facing strings | S | `[DONE]` `docs/hardcoded-string-audit.md`, `res/values/strings.xml` |
| 1.8.3 Number-formatting localization. Display E.164 numbers in local format ((212) 555-0100 in en-US, +33 1 23 45 67 89 in fr-FR) using `libphonenumber` or `PhoneNumberUtils.formatNumber()` [Addendum B item B.27] | M | `data/PhoneFormatter.kt` |

> **2026-08-04 research note (1.8.3 / B.U.7):** prefer bundling over the platform API. `PhoneNumberUtils.formatNumber(String, String)` delegates to the OEM's *bundled* libphonenumber, so output varies per device and goes stale on old builds; the single-arg overloads are deprecated since API 21. Use `io.michaelrocks:libphonenumber-android:9.0.36` (tracks upstream within days, loads metadata via `AssetManager` as upstream's own Android guidance asks). Upstream jar is 360,303 bytes; measure the real APK delta with `bundletool` before committing. The size cost is the only open question, not the choice.

---

## Phase 2 (Detection Quality)

**Goal:** behavioral features, STIR/SHAKEN parsing depth, feedback loops, fuzz/perf gates.

### 2.1 ML Model Upgrade `[DONE]`

GBT v3 (20 features, pure Kotlin inference, ~50 KB model, sigmoid output, atomic ModelState) shipped in v1.6.0. Logistic v2 fallback retained. JSON v3 schema with backward compat to v2. Threshold 0.7.

### 2.2 Behavioral / Temporal Features `[NEXT]`

| Task | Size | Depends | Files |
|------|------|---------|-------|
| 2.2.1 Time-of-day feature. Sin/cos cyclical encoding | M |. | `SpamMLScorer.extractFeatures()` |
| 2.2.2 Call frequency feature. Calls from this number in 7/30-day windows | M |. | `SpamMLScorer.extractFeatures()`, `SpamDao` |
| 2.2.3 Ring duration feature. Short rings correlate with autodialers | M |. | `CallShieldScreeningService` |
| 2.2.4 Geographic distance feature. Area-code distance from user's home area code | M |. | `SpamMLScorer.extractFeatures()` |
| 2.2.5 Retrain with expanded features (20 → 24-26) and ship a v4 weights JSON; keep v3 backward compat | M | 2.2.1-4 | `scripts/train_spam_model.py`, weights schema |

### 2.3 STIR/SHAKEN Enhancement `[WIP]`

v1.7.0 shipped the binary trusted-allow / FAIL-block layer. Remaining: **PASSporT JWT depth.**

| Task | Size | Depends | Files |
|------|------|---------|-------|
| 2.3.1 Parse full PASSporT token per **RFC 8225** (header `typ=passport, alg=ES256, x5u=…`; payload `iat`, `orig`, `dest`, optional `mky`) [src 14]. Android exposes the SIP `Identity` header on API 30+ via `Connection.getExtras()`. | L |. | New `data/StirShakenParser.kt` |
| 2.3.2 Per **RFC 8588 SHAKEN profile**: extract `attest` (A/B/C) and `origid` (UUID) claims. Display neutral carrier-authentication status in caller-ID overlay (A=caller+number authenticated, B=caller authenticated only, C=gateway only/no opinion); never label attestation as safe/trusted caller status. [src 14] | M | 2.3.1 | overlay UI, `BlockedCall` model |
| 2.3.3 `iat` replay-attack guard. Reject tokens with `iat` more than 60 s old/skewed [src 14] | S | 2.3.1 | parser |
| 2.3.4 Persist `origid` UUID in BlockedCall for **RFC 9027 traceback** participation. Future-proofs FCC traceback consortium reporting. [src research, RFC 9027] | S | 2.3.1 | `SpamDao`, `BlockedCall` |
| 2.3.5 Attestation level as ML feature (A reduces score, C raises) | M | 2.3.1, 2.2.5 | `SpamMLScorer.extractFeatures()` |

### 2.4 Graph-Based Campaign Detection `[NEXT]`

In-memory `CampaignDetector` exists. Persist to Room and broaden window:

| Task | Size | Files |
|------|------|-------|
| 2.4.1 Persistent call-graph table. Track NPA-NXX prefix clusters over 7-day window | L | new `data/local/CallGraphDao.kt` |
| 2.4.2 Burst rule. 5+ distinct numbers from same NPA-NXX in 1 h = active campaign | M | `data/CampaignDetector.kt` |
| 2.4.3 Geographic clustering across users (post-Phase 3 server) | L | server |

### 2.5 After-Call Feedback `[WIP]`

Skeleton ("Was this spam?" notification) shipped in v1.4.x. Remaining:

| Task | Size | Files |
|------|------|-------|
| 2.5.1 Bottom-sheet variant for in-app review (richer options: spam type, severity) | M | new UI, `CallShieldScreeningService` |
| 2.5.2 Persist feedback as labeled rows in Room | S | `SpamDao`, new `FeedbackEntry` |
| 2.5.3 Export feedback to training pipeline (opt-in) | M | `train_spam_model.py` |
| 2.5.4 On-device Bayesian classifier learning from local feedback (per-user) [Addendum B item B.13] | L | new `data/BayesianFeedbackModel.kt` |

### 2.6 Quality Gates `[WIP]`

| Task | Size | Status | Files |
|------|------|--------|-------|
| 2.6.1 Phone-number fuzz tests | `[DONE]` | `PhoneNumberFuzzTest.kt` exists |. |
| 2.6.2 `isSpam()` perf benchmark, hard ceiling 50 ms p99 | `[WIP]` | `HotPathBenchmarkTest.kt` exists; needs local gate | `androidTest/.../SpamCheckBenchmark.kt` |
| 2.6.4 **Baseline Profile** for screener cold-start [Addendum B item B.30]. First-call latency drops measurably; CallScreeningService has 5 s deadline | M | `[NEXT]` | `app/baselineprofile/` |

> **2026-08-04 research note (2.6.4):** profile the **service** path, not the launcher activity. A `StartupMode.COLD` activity benchmark will not cover Hilt graph construction, Room open, or the DataStore snapshot on the `onScreenCall` path after process death, which is the only latency that can drop a call. `androidx.benchmark` stable is 1.4.1 (1.5.0-beta01 2026-07-29); 1.5.0 flips `androidx.benchmark.requireAot` to default-true, which is what you want here.

---

## Phase 3 (Real-Time Data Pipeline)

**Goal:** delta sync, two-tier DB, optional honeypot. **Caveat:** the existing GitHub-raw + 30 min hot-list pipeline already meets the realistic target. A full backend is justified only if community-report volume outgrows GitHub Pages economics.

### 3.1 API Server `[LATER]`

| Task | Size | Files |
|------|------|-------|
| 3.1.1 OpenAPI 3.0 spec. `POST /reports`, `GET /reputation/{number}`, `GET /blocklist/delta`, `POST /feedback` | M | `server/openapi.yaml` |
| 3.1.2 Ktor server impl (Kotlin shared models with Android) | XL | `server/` |
| 3.1.3 Migrate Cloudflare Worker to thin proxy for backward compat | L | `worker/`, server |
| 3.1.4 API-key gate (anonymous, rotating, rate-limited) + JWT for admin | L | `server/auth/` |
| 3.1.5 Token-bucket rate limiting | M | `server/middleware/` |
| 3.1.6 Abuse detection. Coordinated false reports, report flooding | L | `server/abuse/` |

### 3.2 Real-Time Streaming `[LATER]`

| Task | Size | Files |
|------|------|-------|
| 3.2.1 Delta API. `last_sync_timestamp` → only-deltas response | L | `data/remote/ApiDataSource.kt`, server |

> **2026-08-04 research note (3.2.1):** the transfer problem does not need the server. `data/spam_numbers.json` is 11.1 MB / 413,876 lines / 51,463 numbers, is bundled into the APK by `stageBundledAssets`, is re-downloaded whole whenever its SHA moves (7× in the last 200 commits), and is rewritten wholesale in git each time. A static content-addressed shard set on GitHub raw. A small manifest of shard hashes plus per-shard files, fetch only the shards whose hash changed. Gets most of the win with no backend and keeps the legacy full-file URL serving for old clients. See the P1 item in Research-Driven Additions (2026-08-04). YetAnotherCallBlocker's incremental daily deltas are the prior art.
| 3.2.2 SSE push for new hot numbers within 30 s of ingestion | XL | server, new `service/RealtimeSyncService.kt` |
| 3.2.3 Polling fallback when SSE drops | M | `HotListSyncWorker.kt` |

### 3.3 Two-Tier Database `[NEXT]`

This one is worth doing **without** a backend. The bloom filter alone gives O(μs) negative checks for the 32K → 100K+ growth path.

| Task | Size | Files |
|------|------|-------|
| 3.3.1 Bloom filter for the full DB (FPR < 0.1%) loaded at startup | L | new `data/local/BloomFilter.kt` |
| 3.3.2 Optional cloud-reputation API for filter-positive lookups | M | new `data/remote/ReputationApi.kt` |
| 3.3.3 Two-tier lookup: bloom (μs) → exact Room (ms) → optional cloud (10 to 100 ms) | M | `SpamRepositoryImpl.isSpam()` |
| 3.3.4 Strict offline mode toggle. Disable all network calls including enrichment [Addendum B item B.21] | M | settings |

### 3.4 Honeypot Network `[?]`

⚠ Operational and privacy cost. Justified only at much higher scale. Defer behind Phase 5.

### 3.5 Geographic Clustering `[LATER]` (depends on 3.1)

---

## Phase 4 (Platform & UX)

### 4.1 Kotlin Multiplatform → iOS `[LATER]`

| Task | Size | Files |
|------|------|-------|
| 4.1.1 Extract pure-logic into KMP module. `SpamMLScorer`, `SpamHeuristics` core, `PhoneFormatter`, `HashWildcardMatcher`, regex packs | XL | new `shared/` |
| 4.1.2 `expect`/`actual` for contacts, call log, DataStore/UserDefaults | XL | `shared/src/{commonMain,androidMain,iosMain}/` |
| 4.1.3 iOS shell. SwiftUI, settings, blocklist, detection toggle | XL | `iosApp/` |
| 4.1.4 **CallKit `CXCallDirectoryProvider`** + `CXCallDirectoryManager` reload | XL | `iosApp/CallShieldExtension/` |
| 4.1.5 **Saracroche-style 4-target architecture** [src 7]: Main App + Call Directory Extension + Unwanted Communication Reporting + Message Filter Extension | XL | iOS app |

**Constraint:** CallKit is preload-only; no real-time evaluation. Strategy: periodic CallKit reload from local DB; community reports via the shared backend if Phase 3 lands first.

### 4.2 Adaptive Layouts `[NEXT]`

| Task | Size | Files |
|------|------|-------|
| 4.2.1 `calculateWindowSizeClass()` + `androidx.window 1.3+` [src research] | S | `MainActivity.kt` |

> **2026-08-04 research note (4.2):** current stable is `androidx.window` **1.5.1**, which adds Large/XLarge breakpoints, `WindowMetrics` from an application `Context`, and direct `WindowLayoutInfo` getters; `WindowSizeClass` stays in androidx.window (no Material3 migration). This tranche also stops being optional at targetSdk 37: the orientation/resizability/aspect-ratio opt-out is removed for `sw >= 600dp` and `PROPERTY_COMPAT_ALLOW_RESTRICTED_RESIZABILITY` stops working. Note there are currently no `values-land` or `sw600dp` resources of any kind.
| 4.2.2 Tablet list-detail pane for blocklist / log | L | screen files |
| 4.2.3 Foldable `FoldingFeature` support | M | `MainActivity.kt` |
| 4.2.4 Landscape. Horizontal stats, wider dialogs | M | screens |

### 4.3 InCallService Integration `[LATER]`

| Task | Size | Files |
|------|------|-------|
| 4.3.1 Custom call screen (Android 12+). Spam score, caller name, location, attestation badge on incoming UI | XL | new `service/CallShieldInCallService.kt` |
| 4.3.2 Replace overlay with InCallService when available; overlay fallback for older devices | M | `CallerIdOverlayService.kt` |

### 4.4 After-Call Bottom Sheet `[NEXT]`

| Task | Size | Files |
|------|------|-------|
| 4.4.1 "Was this spam?" bottom sheet (replaces notification chip for unknown allowed calls). Thumbs up/down + type selector | M | new UI |
| 4.4.2 Skip for contacts and whitelisted numbers | S | service |

### 4.5 Contact Enrichment `[LATER]`

| Task | Size | Files |
|------|------|-------|
| 4.5.1 Business-name lookup (OpenCNAM existing + Google Places optional) | M | `data/remote/BusinessLookup.kt` |
| 4.5.2 Business logo (Clearbit / Google Favicon). Cache aggressively | M | overlay UI |
| 4.5.3 Cache enrichment in Room with TTL | M | new `data/local/ContactEnrichmentDao.kt` |

### 4.6 Accessibility `[NEXT]`

| Task | Size | Files |
|------|------|-------|
| 4.6.1 Full TalkBack audit. `contentDescription` on all interactive elements (claimed 100+, audit to confirm) | L | all screens |
| 4.6.2 Dynamic-type at 200% font scale | M | `Theme.kt`, screens |
| 4.6.3 WCAG AA color-contrast audit on Catppuccin Mocha tokens | M | `Theme.kt` |
| 4.6.4 48 dp × 48 dp touch-target audit (claimed; verify) | M | screens |
| 4.6.5 Predictive-back full preview (Android 14+, polished in 16) [src 28] | M | `MainActivity.kt`, screens |

### 4.7 Localization `[LATER]`

| Task | Size | Files |
|------|------|-------|
| 4.7.2 Translate to ES, FR, DE, PT, JA, KO. Plus **TR, ES-MX, IT, NL, PL, RU** based on top OSS-app reach. Each L. | many | `res/values-{lang}/strings.xml` |
| 4.7.3 RTL layout (Arabic, Hebrew) | M | layouts |

> **2026-08-04 research note (4.7. This is a zero, not a partial):** `res/` contains **no `values-<lang>` directory at all**, and `res/xml/locales_config.xml` lists only `en`. Everything else already exists. 1,103 strings, 30 `<plurals>`, `ui/AppLanguage.kt`, the in-app language picker, `autoStoreLocales`, `docs/TRANSLATING.md`, and `scripts/check_translations.py` wired into `verifyPipelineTests`. So the first locale is a data drop, not an engineering task, and it unblocks the whole tranche. Landing one locale end-to-end also proves the gate: `check_translations.py` fails on format-specifier drift, missing plural quantities, and any locale absent from `locales_config.xml`. None of which can be exercised today. Priority is not cosmetic: "US-centric, useless outside North America" is a recurring reason users abandon this app category (F-Droid forum "Best call blocker" thread).

### 4.8 Spam Trends Dashboard `[NEXT]`

| Task | Size | Files |
|------|------|-------|
| 4.8.1 Time-series chart. Daily/weekly/monthly (Vico or custom Canvas) | L | `StatsScreen.kt` rewrite |
| 4.8.2 Source-breakdown pie | M | `StatsScreen.kt` |
| 4.8.3 Geographic heat map (depends on 3.5.3) | XL | new `SpamMapScreen.kt` |
| 4.8.4 Trend indicators with historical comparison | M | `StatsScreen.kt` |

---

## Phase 5 (Scale & Partnerships)

### 5.1 Carrier Integration `[LATER]`

T-Mobile Scam Shield, AT&T ActiveArmor, Verizon Call Filter. All require business-development engagement [src 30]. Track but do not staff.

### 5.2 Federated Learning `[?]`

Roadmap retains as long-horizon. **Differential-privacy noise injection** is a hard requirement; small per-user spam-call counts (~20/month [src research]) make naive FL leak. Likely won't ship before 2027.

### 5.3 gRPC API `[LATER]` (depends on 3.1)

### 5.4 Monetization & Audit `[?]`

| Task | Size | Files |
|------|------|-------|
| 5.4.1 Premium tier. Google Play Billing, feature gating ⚠ partial conflict with FOSS philosophy: F-Droid build must remain feature-complete; premium = Play-only convenience features (cloud sync, multi-device, priority support) | L | `data/billing/BillingManager.kt` |
| 5.4.2 Feature flags for premium | M | `domain/FeatureFlags.kt` |
| 5.4.3 Third-party security audit | XL | external |
| 5.4.4 White-label SDK for carrier integration | XL | new `sdk/` module |

---

## Cross-Cutting Concerns

### Database Migrations
v5+ are explicit; v1 to 4 use `fallbackToDestructiveMigration()`. **Acceptable for spam-numbers (re-syncable) but unacceptable** after FeedbackEntry (2.5.2), CallGraph (2.4.1), ContactEnrichment (4.5.3). Add `Migration` objects in lockstep with each new entity.

### Backward Compatibility
Hot-list sync and community reports use hardcoded GitHub-raw URLs on `master`. Phase 3 must keep these endpoints serving for v1.2.x clients indefinitely. That's the legacy contract.

### Privacy Architecture
Phases 2.5 (feedback), 3.4 (honeypot), 5.2 (federated) introduce data collection. Each requires explicit opt-in toggle, plain-language privacy disclosure, and a retention cap. No exceptions.

### Dependency Refresh Cadence
Quarterly dependency audit. v1.7.6 cleared the Kotlin/KSP, AGP, Room, and OkHttp tranche; v1.7.7 locked the resolved dependency graph and added the reproducible-build runbook; v1.7.8 cleared the DataStore 1.2.1 upgrade and optional-key backup boundary; v1.7.9 cleared the WorkManager 2.11.2 refresh with schedule-contract tests; v1.7.10 cleared the Compose BOM 2026.05.00 refresh and the newly enforced Compose resource-read lint. Addendum B.U continues with localization, predictive-back, widget, and Room driver follow-ups.

---

## Addendum A (Peer-Inspired Track (preserved))

Round-1/2/3 borrows from SpamBlocker (aj3423), YetAnotherCallBlocker (xynngh), BlackList (kaliturin), Saracroche (cbouvat), spam-call-blocker-app (adamff-dev), Fossify Phone.

| ID | Item | Status |
|----|------|--------|
| A1 | Priority-sorted `IChecker` pipeline | `[DONE]` v1.6.0 |
| A2 | Budget-aware lookup race (`Race.kt`) | `[DONE]` v1.6.0/1.7.1 |
| A3 | Push-alert / notification-context bridge (`PushAlertChecker`, `PushAlertRegistry`) + allowlist editor + revoke-on-next-ring feedback | `[DONE]` v1.6.0/1.7.1 |
| A4 | System block-list bridge (`BlockedNumberContract` read-only) | `[DONE]` v1.6.0 |
| A5 | Hash-wildcard / range patterns (`#` length-locked) | `[DONE]` v1.6.0 |
| A6 | Schedule-aware rules (days mask + hour window with overnight wrap) | `[DONE]` v1.6.0 |
| A7 | STIR trusted-caller allow + auto-mute low-confidence | `[DONE]` v1.7.0 |

---

## Addendum B (Round-3 Research Track (new, 2026-05-06))

Harvested from a 30-source sweep (see Appendix). Scoped to NEW signal not already covered above. Each item carries impact (1 to 5), effort (1 to 5), source ref.

### B.NOW (Now (1 to 2 releases))

| ID | Item | Impact | Effort | Source | Notes |
|----|------|-------:|-------:|--------|-------|
| B.U.1 | OkHttp 4.12 → **5.x** | 4 | 2 | [18] | `[DONE]` v1.7.6: upgraded to OkHttp 5.3.2 and kept the shared-client/derived-client contract. |
| B.U.2 | Room 2.6 → **2.8.4** | 3 | 2 | [research] | `[DONE]` v1.7.6: upgraded Room to 2.8.4 and updated the legacy destructive-migration overload. |
| B.U.3 | Kotlin 2.1 → **2.2.21** | 3 | 2 | [20] | `[DONE]` v1.7.6: upgraded AGP to 8.10.1 for Kotlin 2.2 R8 compatibility, aligned Kotlin/KSP to 2.2.21, and moved JVM target configuration to the compilerOptions DSL. |
| B.U.4 | DataStore 1.1 → **1.2.1** + Tink `AeadSerializer` | 4 | 3 | [21] | `[DONE]` v1.7.8: upgraded DataStore to 1.2.1; no deprecated encrypted-preferences path exists, so no unused Tink serializer was introduced; optional AbstractAPI key now migrates into private no-backup DataStore |
| B.U.5 | WorkManager 2.10 → **2.11.2** | 2 | 1 | [16] | `[DONE]` v1.7.9: upgraded WorkManager to 2.11.2, refreshed locks, and added schedule-contract tests for `SyncWorker`, `HotListSyncWorker`, and `DigestWorker` |
| B.U.6 | Compose BOM 2024.12 → latest stable (Compose Foundation 1.11+) | 3 | 2 | [17] | `[DONE]` v1.7.10: upgraded to Compose BOM 2026.05.00, refreshed locks across debug/release/unit-test configurations, and fixed Compose resource-read lint with `stringResource`, `pluralStringResource`, and `LocalResources` |
| B.D.4 | **Obtainium** spec. Already supported via GitHub Releases; document the workflow + add SHA256 sidecar files to release artifacts | 2 | 1 | [research] | `[DONE]` v1.7.7: CI emits APK `.sha256` sidecars, local signed releases use `scripts/write-release-sha256.ps1`, and the hash workflow is documented. |
| B.F.1 | **Per-SIM filtering rules** (dual-SIM aware) | 4 | 3 | [SpamBlocker #59] | Top community ask; enables work/personal SIM split |
| B.F.2 | **Rule replay / debug mode**. Re-run any logged call/SMS through the current ruleset | 4 | 2 | [SpamBlocker #386] | Power-user feature; cheap to add via `IChecker` registry already present |
| B.F.3 | **Strict (AND) vs Relaxed (OR) rule mode** | 3 | 2 | [SpamBlocker #377] | Replaces Inclusive/Exclusive terminology; clearer semantics |
| B.F.4 | **Auto-add regex-blocked numbers to local DB** for review | 3 | 1 | [SpamBlocker #355] | One-line change in pipeline |
| B.F.5 | **App-foreground context rule**. Allow calls when banking / delivery app is active | 4 | 3 | [SpamBlocker #218] | UsageStatsManager + (existing) PushAlertChecker pattern |
| B.F.6 | **System-notification context rule** (delivery notification present → allow) | 3 | 2 | [SpamBlocker #350] | Already partially via PushAlertChecker; broaden source taxonomy |
| B.F.7 | **External blocklist URL subscription** (Pi-hole "gravity" model). CSV/TXT/JSON URLs, scheduled refresh, merged into local DB with attribution | 5 | 3 | [26] | Architecturally aligns with our hot-list pattern |
| B.F.8 | **Spam-SMS auto-forward to 7726 (SPAM)**. Opt-in carrier reporting | 3 | 1 | [15] | Pure UX win; FCC-recommended |
| B.U.7 | **Number formatting localization** via `PhoneNumberUtils.formatNumber()` or `libphonenumber` | 3 | 2 | [research] | Belongs in P1.8.3 |
| B.O.1 | **"Explain this decision" drawer**. Tap any log entry to see rules triggered, in priority order, with confidence | 4 | 2 | [research] | Cheap with existing `IChecker` returning `BlockResult` reasons |
| B.U.8 | Predictive back full preview (where missing) | 2 | 2 | [28] | Polish for Android 14+ |
| B.S.2 | Certificate pinning for **all** API endpoints (existing `network_security_config.xml` covers cleartext only) | 4 | 2 | [research] | `[DONE]` v1.7.6: central OkHttp `CertificatePinner` covers GitHub, Cloudflare Worker, URLhaus, AbstractAPI, and caller-ID enrichment hosts. |
| B.U.9 | `androidx.glance` widget rewrite (current widget is `RemoteViews`); pin Glance ≥ 1.1.1 against **CVE-2024-7254** | 3 | 3 | [22] | **2026-08-04: defer.** Glance stable is *still* 1.1.1; 1.2.0 has sat at `rc01` since 2025-12-03 with no promotion while 1.3.0-alpha moved on to Wear widgets. Every reason to do the rewrite. `providePreview`/`setWidgetPreview`, `MultiProcessGlanceAppWidget`, `previewSize`. Lives only in the RC. An 8-month-stalled RC is not a dependency to ship on. |

### B.NEXT (Next (3 to 6 releases))

| ID | Item | Impact | Effort | Source | Notes |
|----|------|-------:|-------:|--------|-------|
| B.F.9 | **ICS / iCal calendar-based scheduling**. Parse iCal subscription URL into dynamic allow windows (shift workers, on-call) | 3 | 4 | [SpamBlocker #359] | Builds on existing per-rule schedule (A6) |
| B.F.10 | **DID range fuzzy matching**. Allow numbers within ±N of a saved contact's number | 2 | 2 | [SpamBlocker #554] | **2026-08-04: raise impact to 4.** SpamBlocker shipped this as "Contact Prefix" in v5.7 (contact `xxxxxxx111` auto-allows `xxxxxxx000 to 999`). It is the cheapest available cut in the highest-cost false-positive class. Clinic/PBX/school switchboards that rotate the last digits. Which is one of the best-documented harm classes for call blockers. Prefer the prefix/length-locked form over ±N; it composes with the existing `HashWildcardMatcher`. |
| B.F.11 | **Family DB sharing**. Opt-in mesh-share local user blocklist with N trusted devices via QR-paired keys | 4 | 4 | [SpamBlocker #549] | ⚠ Privacy: end-to-end encrypted; no server involvement |
| B.F.12 | **Wi-Fi SSID / geofence rule profiles**. Corporate SSID = work rules, home SSID = relaxed | 3 | 3 | [research, NetGuard pattern] | Builds on existing BlockingProfiles |
| B.F.13 | **Bidirectional blocklist subscription**. Publish your local list as a stable URL others can subscribe to (Pi-hole / OPML model) | 3 | 4 | [26] | Pairs with B.F.7 |
| B.F.14 | **Local REST API on loopback** for Tasker / Macrodroid / automation: `GET /api/stats/summary`, `POST /api/report`, `GET /api/log` | 3 | 3 | [26] | Pi-hole pattern; keep auth-by-shared-secret |
| B.O.2 | **Rule-coverage analytics**. % of incoming calls handled by each rule; identify dead rules | 3 | 2 | [research] | Reuses BlockReasoning |
| B.O.3 | **Advanced call-log filter**. By rule, number pattern, type, date range, confidence, source | 3 | 3 | [research] | Compose pre-existing log refactor |
| B.O.4 | **Diagnostic-report export**. One-tap CSV/JSON of log + rules + model version + device info for bug reports | 3 | 2 | [NetGuard PRO] | Ships with redaction option |
| B.D.5 | **Wear OS / Galaxy Watch tile**. Last blocked call + one-tap temporary allow | 3 | 4 | [research] | Reuse Glance widget |
| B.M.1 | **TinyML audio fingerprint**. Perceptual hash of first ~2 s of call audio (post-answer if user answers; opt-in only); compare to local hash set of known robocall recordings | 4 | 4 | [research, robocall fingerprinting lit] | ⚠ Audio capture must be opt-in, on-device only, and easy to disable. Aligns with the no-cloud-audio philosophy as long as features stay local |
| B.M.2 | **On-device Bayesian feedback model**. Per-user weights learned from "Was this spam?" responses, blends into existing GBT score | 4 | 3 | [research] | Continuous personalization without leaking data |
| B.M.3 | **Campaign-detection alerts**. Proactive notification when new burst is detected on user's number range | 3 | 2 | [research, FCC traceback] | Reuses existing CampaignDetector |
| B.S.3 | **Play Integrity Standard request** for community-report submission (`appAccessRiskVerdict` to detect overlay/screen-cap during submit) | 3 | 3 | [13] | ⚠ GMS-only; feature-flag for non-Play builds. Don't gate detection. Only contribution |
| B.U.10 | Migrate to **Room SQLiteDriver** path (`room-sqlite-wrapper` from 2.7+). Sets up future KMP support | 3 | 4 | [research] | Lays groundwork for P4.1 |

### B.LATER (Later)

| ID | Item | Impact | Effort | Source | Notes |
|----|------|-------:|-------:|--------|-------|
| B.E.1 | **Enterprise / MDM edition**. Managed config, zero-touch enrollment, fleet allow/block list, audit-log export | 3 | 5 | [7] | Saracroche's differentiator; valuable revenue path under 5.4 monetization |
| B.E.2 | Android Work Profile awareness. Separate rule sets per profile | 2 | 3 | [research] | Pairs with B.E.1 |
| B.S.4 | **Oblivious HTTP (OHTTP) relay** for enrichment lookups. Server never sees user IP | 4 | 4 | [research] | Cloudflare/Fastly run public relays. Privacy maxima |
| B.M.4 | **Voice deepfake / synthetic-voice detection** (post-answer, on-device) | 4 | 5 | [Hiya 2025, FCC AI ban] | ⚠ Compute-heavy; only if a usable open model lands. Must run on-device. Otherwise reject |
| B.M.5 | Voice-print similarity scoring across rotating numbers | 3 | 5 | [research] | ⚠ Privacy: voice-print derivation only on opt-in opted calls; never persist raw audio |
| B.M.6 | **Automated call summarization & transcription** for screened calls | 3 | 5 | [Hiya AI Phone] | Only viable on-device with a small Whisper-class model; gate to higher-end devices |

### B.UNDER (Under Consideration (decide before staffing))

| ID | Item | Source | Decision Needed |
|----|------|--------|-----------------|
| B.?.1 | **AI Answer Bot** that engages spam callers to waste their time | [9 RoboKiller] | Legal/ethical: TCPA + state recording-consent laws; harassment exposure. Lean reject for now |
| B.?.2 | **Audio CAPTCHA screening** ("press 1 to connect") | [10 YouMail] | UX cost vs spam-reduction; pilot opt-in for unknown callers |
| B.?.3 | **Visual voicemail with spam-priority sorting** | [10 YouMail] | Scope creep. Replaces dialer/voicemail. Keep in mind for a separate sister app |
| B.?.4 | **Auto-attendant / IVR for first-time callers** | [10 YouMail] | Same scope concern as B.?.3 |
| B.?.5 | **Truecaller-style B2B verified-caller display** | [29 Truecaller] | Requires partnerships; conflicts with on-device-first |

---

## Rejected (with reasoning)

| Item | Why rejected |
|------|--------------|
| Cloud upload of address book / contacts (Truecaller core) | Breaks **on-device-first** and **no-accounts** philosophy. |
| Cloud audio analysis for deepfake / transcription | Breaks **no-cloud-audio** philosophy. On-device variants of B.M.4 to 6 only. |
| Required sign-in / per-user cloud profile | Breaks **no-accounts** philosophy. |
| Always-on cloud reputation gating | Breaks **on-device-first**. Every layer must work offline. |
| Hosts-file-style monetary blocklist (paid feeds) | Breaks **FOSS** philosophy. Free user-supplied URLs only (B.F.7 / B.F.13). |
| Built-in ads, ad-supported tier | Hard no. Incompatible with sysadmin-grade tool positioning. |
| `fullBackupContent="true"` exposing API keys | Mitigated in v1.7.8 by moving the optional AbstractAPI key out of backed-up public DataStore and into a private DataStore under `noBackupFilesDir`; backups remain enabled for Room data and public settings. |

---

## Effort Summary

| Phase / Track | Tasks | Status |
|---|---|---|
| Phase 1. Foundation | 35 | 1.1-1.6, 1.7.1-7, and 1.8.1-2 shipped; 1.8.3 remains |
| Phase 2. Detection Quality | 22 | 2.1, 2.6.1 shipped; 2.3 partial; rest open |
| Phase 3. Realtime Pipeline | 15 | open; 3.3 (bloom filter) is the next high-value tranche |
| Phase 4. Platform & UX | 24 | open; 4.2 + 4.6 are the next high-value tranches |
| Phase 5. Scale & Partnerships | 11 | open; treat as long-horizon |
| Addendum A. Peer track | 7 | shipped |
| **Addendum B. Research track** | **45** | **new. See B.NOW for the next-release shortlist** |

**Total: ~155 tracked items.** Phase ordering is a guideline; B.NOW items can land in parallel with Phase 1 tasks because most are isolated upgrades or self-contained features.

---

## Appendix (Source Index)

| # | Source | Type |
|---|--------|------|
| 1 | https://github.com/aj3423/SpamBlocker | OSS competitor (1,489★, MIT, Kotlin) |
| 2 | https://github.com/aj3423/SpamBlocker/issues?q=sort:comments-desc | Community feature requests |
| 3 | https://gitlab.com/xynngh/YetAnotherCallBlocker | OSS competitor (GPLv3, Java) |
| 4 | https://github.com/adamff-dev/spam-call-blocker-app | OSS competitor (185★, GPLv3, Kotlin) |
| 5 | https://github.com/kaliturin/BlackList | OSS competitor (Apache, unmaintained ~2020) |
| 6 | https://github.com/FossifyOrg/Phone | OSS adjacent (privacy-first dialer, no internet) |
| 7 | https://codeberg.org/cbouvat/saracroche-ios | OSS competitor (4-target, Enterprise/MDM) |
| 8 | https://hiya.com/ | Commercial. Branded Call, AI Phone (deepfake detect, transcription) |
| 9 | https://robokiller.com/ | Commercial. Answer Bot, 1.5 B-number DB |
| 10 | https://youmail.com/ | Commercial. Visual voicemail, audio CAPTCHA, auto-attendant |
| 11 | https://nomorobo.com/ | Commercial. 350 K honeypot sensors |
| 12 | https://developer.android.com/reference/android/telecom/CallScreeningService.CallResponse.Builder | Android API surface |
| 13 | https://developer.android.com/google/play/integrity/overview | Play Integrity verdicts (`appAccessRiskVerdict` etc.) |
| 14 | https://www.rfc-editor.org/rfc/rfc8225 | IETF. PASSporT JWT |
| 15 | https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts | FCC. STIR/SHAKEN, AI-voice ban, 7726 SPAM |
| 16 | https://developer.android.com/jetpack/androidx/releases/work | WorkManager 2.11.2 changelog |
| 17 | https://developer.android.com/jetpack/androidx/releases/compose-foundation | Compose Foundation 1.11.1 / Compose BOM 2026.05.00 |
| 18 | https://square.github.io/okhttp/changelogs/changelog/ | OkHttp 5.x changelog |
| 19 | https://kotlinlang.org/docs/whatsnew21.html | Kotlin 2.1.0 release |
| 20 | https://kotlinlang.org/docs/whatsnew22.html | Kotlin 2.2.0 release (context parameters, stable Base64) |
| 21 | https://developer.android.com/jetpack/androidx/releases/datastore | DataStore 1.2.1 + Tink `AeadSerializer` |
| 22 | https://developer.android.com/jetpack/androidx/releases/glance | Glance 1.1.1 (CVE-2024-7254) + 1.2 widget preview |
| 23 | https://accrescent.app/ | Distribution channel. Key pinning, signed metadata |
| 24 | https://f-droid.org/en/docs/Inclusion_Policy/ | F-Droid inclusion (fastlane, reproducible) |
| 25 | https://github.com/M66B/NetGuard | OSS adjacent. Per-app firewall patterns |
| 26 | https://github.com/pi-hole/pi-hole | OSS adjacent. Gravity blocklist subscription, REST API |
| 27 | https://developer.android.com/about/versions/15/features | Android 15. `FLAG_STOPPED`, Private Space, 16 KB pages |
| 28 | https://developer.android.com/about/versions/16 | Android 16. `Notification.ProgressStyle`, `SDK_INT_FULL` |
| 29 | https://truecaller.com/ | Commercial. B2B verified-caller, OTP-less verification SDK |
| 30 | https://www.t-mobile.com/scam-shield · https://www.att.com/security/active-armor/ · https://www.verizon.com/solutions-and-services/call-filter/ | Carrier. STIR/SHAKEN integration, paid add-ons |
| 31 | https://github.com/google/dagger/releases/tag/dagger-2.58 · https://github.com/google/dagger/releases/tag/dagger-2.59 | Dagger/Hilt. 2.58 held back AGP 9 support; 2.59 requires AGP 9 for the Hilt Gradle plugin |
| 32 | https://dagger.dev/hilt/gradle-setup | Hilt Gradle/KSP setup |
| 33 | https://developer.android.com/jetpack/androidx/releases/hilt · https://developer.android.com/training/dependency-injection/hilt-jetpack | AndroidX Hilt Work. Stable 1.3.0 line and WorkManager `HiltWorkerFactory` setup |

Plus RFC 8588 (SHAKEN profile), RFC 9027 (Traceback), Apache SpamAssassin / rspamd (architectural pattern), CVE-2024-7254 (NVD), academic robocall-fingerprinting literature (Georgia Tech / Stony Brook 2019 to 2022) cited inline in research notes.

---

*Roadmap maintained alongside `CHANGELOG.md`. Update on every minor release; full re-research pass per major.*

## Research-Driven Additions

*No actionable research-driven items remain. See `Roadmap_Blocked.md` for blocked items awaiting external action.*

## Research-Driven Additions

## Research-Driven Additions (2026-07-20 pass (anchored to v1.7.13))

Fresh 30+ source sweep (SpamBlocker 2026 releases + issue tracker, SpamBlocker Extended, Fossify, Hiya/Truecaller, Google Phone/Messages security posts, FCC 2025 branding FNPRM, Android 16/17 behavior changes, dependency changelogs, NVD). Only NEW signal not already covered by Phases 1-5, Addendum A/B, or `Roadmap_Blocked.md`. Prior-pass local trust-hardening backlog (UI digit sanitization, bounded bodies, SMS redaction, URLhaus privacy mode, permission degraded-mode matrix, selective backup, external-blocklist subscription, temp allow/block) is verified SHIPPED and intentionally omitted.

### P1

### P0 (the deployed Cloudflare Worker is still stale (re-confirmed 2026-08-08))

The public report endpoint still runs a pre-v1.7.29 build. Two things are wrong with the
repo state and both must be fixed in the same pass:

1. `worker/wrangler.toml` still carries `id = "REPLACE_WITH_KV_NAMESPACE_ID"`. With no real
   namespace the rate-limit and dedup guards are permissive rather than merely racy.
2. Every queued report still arrives without `reporter_bucket` and without the `_rand`
   filename segment, which is the observable proof the deployed build predates v1.7.29.
   `generate_hot_list.py` skips bucket-less reports, so the 30-minute hot-list fast path is
   silently dead for **all** community reports.

**Cannot be done unattended.** `wrangler` reports "You are not authenticated", there is no
`wrangler-account.json` or `CLOUDFLARE_*` credential on this machine, and `wrangler login`
is an interactive OAuth flow. Steps once signed in:

```bash
cd worker
npx wrangler login
npx wrangler kv namespace create RATE_LIMIT   # paste the returned id into wrangler.toml
npx wrangler deploy
```

Verify afterwards by posting one report and confirming the queued file has both
`reporter_bucket` and a `_rand` segment.

### P2

### P3

## Research-Driven Additions (2026-07-20 pass 2 (code audit + distribution/a11y/i18n sweep))

Second same-day pass. Adds verified code-correctness bugs (grounded in file:line reads) plus distribution, security-CVE, accessibility, and i18n signal not covered by the earlier pass, Phases 1-5, Addendum A/B, or `Roadmap_Blocked.md`. No duplicates of the pass-1 items above.

### P1

### P2

### P3

## Deep-Audit Findings (2026-07-20 (not fixed this pass))

## Deep-Audit (Considered and Rejected (do not re-investigate))

- Blocking private/loopback/link-local hosts in `ExternalBlocklistParser.validateHttpUrl` (SSRF-shaping): REJECTED. The URL is user-entered and the body is not reflected; blocking private IPs would break the legitimate use case of subscribing to a LAN-hosted blocklist (e.g. a self-hosted NAS at 192.168.x). Impact on a mobile app is negligible.

## Research-Driven Additions (2026-07-21 pass (anchored to v1.7.16))

Fresh sweep on under-covered angles: OEM background-execution survival, distribution policy, service-rebind reliability, and testability. All items verified against current code (v1.7.16). The prior-pass correctness/hardening backlog is now shipped and intentionally omitted. Wear OS (B.D.5) and CNAP name-*trust* (the "Region / CNAP-based rules" item) already exist and are not duplicated; the block-by-name item below is the inverse (blocklist) direction and cross-references it.

### P1

### P2

### P3

## Research-Driven Additions (2026-07-21 pass 3 (distribution survival + detection reality-check, anchored to v1.7.18))

Focus areas not covered by prior passes: the Developer-Verification survival path (Accrescent, which self-registered. The option F-Droid can't offer), release-signing hygiene, model-retrain reproducibility, and closing an infeasible detection tranche. The reliability/survival backlog from the 2026-07-21 (v1.7.16) pass is now shipped (v1.7.17 to v1.7.18).

### P1

### P2

### P3

## Research-Driven Additions

### P0
### P1

### P2

## Deep-Audit Backlog (2026-07-22 pass (anchored to v1.7.23; found, not fixed))

## Audit Findings (2026-07-28 (anchored to v1.7.23, versionCode 51; found, not fixed))

Baseline at audit time: `testDebugUnitTest`, `ktlintCheck`, `detekt`, `lintDebug` all green (BUILD SUCCESSFUL, zero-baseline gates hold). No pre-existing failures. Every item below was traced to reachable code and cross-checked against the 2026-07-22 backlog, Roadmap_Blocked.md, and recent commits (9d3ce18/3bb393f/139430b etc.) to avoid duplicates. No emulator was available: UI findings marked Likely/Needs-repro need on-device visual confirmation.

### P1

### P2

### P3 (correctness / reliability)

### P3 (performance / UX / visual)

### P3 (maintainability / testing / docs)

### Unaudited (needs a pass)

## Audit Findings (2026-07-30 (anchored to v1.7.27, versionCode 55; found, not fixed))

Baseline at audit time: all gates green. This session fixed ~40 findings across the worker, data pipeline, detection core, services, and UI (see CHANGELOG v1.7.27). The items below were verified real but deferred. Each needs an operator action, a design decision, or a disproportionate refactor.

## Audit Findings (2026-07-30 second pass (audit-only; anchored to v1.7.27, versionCode 55; found, NOT fixed))

Baseline at audit time: full JVM suite green at HEAD 2f250f1 (949 tests, exit 0); all static gates were green at this same commit earlier today. No pre-existing failures. Every item below was traced to reachable code (or measured against shipped data) during this pass and cross-checked against all prior audit sections, Roadmap_Blocked.md, CHANGELOG v1.7.27, and git history to avoid duplicates. No device/emulator was available: items needing on-device confirmation are marked Needs-repro or Likely.

### Unaudited this pass (needs a later pass)


## Security Scan (2026-07-30 (anchored to v1.7.29, rev 4bbe71d; found, NOT fixed))

Whole-repository security scan, production code prioritized over tests/fixtures. **The scan was halted before its verification stage ran, so every item below is an unverified researcher candidate. Confirm each against the code before acting.** 30 raw candidates deduplicated to 18. One item (the Cloudflare account blob) was independently confirmed against git history during triage and is marked Verified. Items that restate an already-tracked entry are cross-referenced rather than duplicated.

### P1

### P2

### P3

## Research-Driven Additions (2026-08-02 exhaustive source sweep)

Only incomplete, implementation-ready items from the research pass are listed here. Authenticated feeds, deployment credentials, and product-policy decisions remain in `Roadmap_Blocked.md` and are not duplicated.

### P0 (safety and data integrity)

### P1 (open feeds and explainable detection)

### P2 (SMS, regional, and optional enrichment)

### P3 (evaluation and maintainability)

## Research-Driven Additions (2026-08-04 pass (anchored to v1.7.33, versionCode 61, rev 2834d0b))

Sweep focused on angles the 2026-08-02 source/feed pass did not cover: release delivery, the app's own runtime data plane, Android 16/17 behavior changes, OSS competitor releases through SpamBlocker v5.14, dependency currency + advisories, explainability UX prior art, and the FCC/WCAG obligations a blocker inherits. Every item below was verified against code, data files, published artifacts, or a primary source during this pass, and cross-checked against Phases 1-5, Addendum A/B, all prior Research-Driven and Audit sections, and `Roadmap_Blocked.md`. Items that restate a tracked entry are annotated inline above rather than duplicated here. Baseline at audit time: `testDebugUnitTest` = 991 tests, **1 failing** (`DirectBootScreeningStoreTest:27`).

### P0 (delivery and data integrity)

### P1 (safety floors, auditability, and currency)

### P2 (trust surfaces, hygiene, and platform polish)

### P3 (evaluation, docs, and a longer bet)

## Research-Driven Additions

### P0
````

</details>