[brow]

Search and invite recovery read a community's open-channel directory (every open, listed channel's kind 39000 metadata) from the relay, and match names on the device. Until now the app kept that directory in memory for 30 seconds only, so every search session after that, and the first search after every launch, downloaded the whole directory again. This follows #9466 directory-only search load and #9457 directory keeps message times, which made each of those downloads cheaper; this one makes most of them unnecessary.

Now the directory is saved in a file per community and account, next to the image cache, and search reads it from there:

• First read. The first time search opens, the app downloads the whole directory, as before, and saves it.
• Catch-up. When search opens later, it shows the saved copy at once. At most once a minute, it asks the relay in the background only for directory changes since the newest saved one (less a minute of overlap), and merges them in. A catch-up that brings back nothing new saves nothing and leaves the list alone, and a search opened while a background read is still running shares it rather than starting another.
• Daily full read. Once the last full read is a day old, the next check downloads the whole directory in the background and replaces the saved copy, which drops channels that became private or unlisted or were deleted. A catch-up can't see those: the relay never serves them to a non-member.
• Gone on open. Opening a saved result that the relay no longer serves (private or deleted) drops it from the directory at once, and a background read already in flight does not bring it back.
• Invite recovery still downloads the whole directory, as on main: it needs fresh memberships, and its read also refreshes the saved copy.
• Cleanup. Signing out of a community, replacing its account, or leaving it deletes the file.

The saved events omit signatures (the relay signed them; the copy is a cache of what it served). The file's JSON is encoded and decoded off the UI isolate, and an unavailable caches directory (or one that takes over 3 seconds) just means no saved copy. A file that is unreadable, from another version, or over 20,000 channels or 16 MiB is discarded and read again from the relay. There is no relay change. CONTEXT.md gains an "Open-channel directory" entry.

Validation

Workflow (small community, 63 open channels)	Directory bytes before	Directory bytes after
First search after install	39.5 KB (2 requests)	39.5 KB (2 requests)
Search again 2 minutes later	39.5 KB (2 requests)	0.6 KB (2 requests)
Relaunch, then search	39.5 KB (2 requests)	0.6 KB (2 requests)

Measured on an iOS simulator signed in to a test community, with a temporary local counter on each relay query response (not part of this PR), main at 6974237 vs this branch. The full read grows with the number of open channels (about 600 bytes each); the catch-up grows only with what changed. Search results were identical on both builds, and opening an unjoined result from the saved directory still showed its preview with Join.

Tests:

• A journey test drives the real channel list against a fake relay that honors since, with a real file and a fake clock: the first reader saves the directory without signatures; more readers within a minute ask nothing; a minute later a reader asks only for changes since the newest saved one less a minute; after a relaunch the saved copy serves at once and the catch-up starts from it; a channel that turned private stays until the daily full read replaces the copy; the search status never shows loading for the background reads; a catch-up of only held events leaves the list identical and the file unwritten; a second search a minute into a slow full read shares it; and opening a channel the relay no longer serves drops it, even with a read in flight. Each guard was checked by breaking it: removing the once-a-minute limit, dropping since, never doing the full read, merging the full read instead of replacing, removing the drop-on-open, the no-change check, the shared in-flight read, or the in-flight drop fence each fail the test.
• Storage tests: the round trip omits signatures; unusable data is discarded; a directory over the bounds leaves no stale copy; a closed store neither reads nor writes; cleanup keeps only each community's current account.
• The community test now also checks that replacing an account deletes the old account's saved directory (fails without the cleanup call).
• Full mobile test suite and flutter analyze pass.

No visible change, so no screenshots: the same results appear, just without a download on later searches.

Regressions

• A channel that turns private or is deleted can still appear in search for up to a day, until the daily full read, unless you open it (opening drops it at once, and the relay withholds its content). Before, it disappeared from the next search at least 30 seconds later.
• A channel that turns unlisted can also appear in search for up to a day. Opening it does not drop it, and its content stays readable, because the relay serves an unlisted open channel to anyone who names it.
• A channel created while search is open appears the next time search opens, not while it stays open. That was already the case within the 30-second window.
• The saved file costs some disk per community (about 30 KB for 63 channels, roughly 0.5 KB per channel), deleted on sign-out or leaving.

[brow]

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-15T02:38:06.051072Z	e3a4400	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 7307d0f0ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".