release: prepare PeerSpeak 0.6.7

CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to PeerSpeak are documented here.
 
 ## [Unreleased]
 
+## [0.6.7] — 2026-08-22
+
+### Changed
+- **All system audio is now the safe screen-share choice.** On supported
+  PixelPass builds, the single **All system audio** row shares ordinary desktop
+  sound while excluding PeerSpeak's own call playback. There is no longer a
+  second, technical-sounding desktop-audio choice to understand before sharing.
+
+### Fixed
+- **Sharing desktop audio no longer sends the call back to its listeners.**
+  PeerSpeak marks every playback path it owns, passes the active echo-canceller
+  identity to PixelPass, and uses a fail-closed PipeWire fan-out so voice,
+  watched shares, and notification sounds cannot enter the screen-share mix.
+- **Screen-share audio failures are visible without becoming unsafe.** Missing,
+  unsupported, or newly unsafe streams stay out of the capture and produce a
+  useful warning; warnings clear again when the condition or share ends.
+- **Stopped and failed shares clean up promptly.** Remote viewers and their
+  players are reaped when a stream ends, and leaving a call tears down the
+  PixelPass host, capture graph, and viewer processes instead of leaving a
+  stale sharing state or warning behind.
+
+### Packaging
+- **The Linux AppImage bundles the matching PixelPass helper.** The one-file
+  build therefore carries the desktop-audio exclusion capability it advertises
+  rather than depending on an unrelated system PixelPass version.
+
+### Compatibility
+- **Wire-compatible with 0.6.6.** This release changes local screen-share audio
+  routing and lifecycle behavior; no PeerSpeak audio, friends, files, or gossip
+  protocol version changed.
+
+[0.6.7]: https://gitbutter.xyz/mollusk/peerspeak/releases/tag/v0.6.7
+
 ## [0.6.6] — 2026-07-19
 
 ### Fixed
@@ -25,6 +58,8 @@ All notable changes to PeerSpeak are documented here.
   connection before anything else kicked in. Smooth still honors the value you
   choose, since a deep buffer is the point of that mode.
 
+[0.6.6]: https://gitbutter.xyz/mollusk/peerspeak/releases/tag/v0.6.6
+
 ## [0.6.5] — 2026-07-19
 
 ### Added
@@ -51,6 +86,8 @@ All notable changes to PeerSpeak are documented here.
   now presents decoded frames immediately; Smooth mode retains timestamp pacing
   when keeping shared-video audio and video synchronized matters more.
 
+[0.6.5]: https://gitbutter.xyz/mollusk/peerspeak/releases/tag/v0.6.5
+
 ## [0.6.4] — 2026-07-18
 
 ### Added

Cargo.lock

@@ -2262,9 +2262,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.14"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -4871,7 +4871,7 @@ checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
 
 [[package]]
 name = "peerspeak"
-version = "0.6.6"
+version = "0.6.7"
 dependencies = [
  "anyhow",
  "async-trait",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "peerspeak"
-version = "0.6.6"
+version = "0.6.7"
 edition = "2024"
 description = "Decentralized peer-to-peer voice chat (Rust/iroh/PipeWire/Opus/iced)"
 license = "MIT"

docs/screenshare-audio-exclusion-impl-plan.md

@@ -1,6 +1,6 @@
 # Implementation plan: whole-desktop screen-share audio without self-echo
 
-**Status:** 🟢 **v4 — three review rounds applied.** *Progress as of 2026-08-21:* phases 0a, 0b,
+**Status:** 🟢 **v4 — three review rounds applied.** *Progress as of 2026-08-22:* phases 0a, 0b,
 0c step 1, 1, 2, 3, 3r, 4 and 5 are merged, and the **phase-5 major gate PASSED on 2026-07-26**
 (§1). The two pre-Phase-6 decisions are now **closed** in design v3.8 §6.9: the conservative
 same-device hardware bridge is built and validated, and the 2 s readiness budget passed
@@ -25,8 +25,10 @@ built, validated and committed locally in PixelPass (`e027bc6`), completing Phas
 and committed locally in PixelPass (`792f2bd`).** **Phase 8's PeerSpeak capability negotiation,
 picker/argv integration and causal status surface are built, validated and committed locally
 (`2c2b861`).** **Phase 9's PN correlation/xrun rig is implemented and live-qualified locally in
-PixelPass (`98bb78f`, hardened by `360d711`); the field matrix remains open, and nothing has
-been released. Phase 9 is still the current front and ship gate.**
+PixelPass (`98bb78f`, hardened by `360d711`). The two-direction release-prep field slice passed
+on cazen and dopedart with the exact AppImage described in plan §7; the broader variance rows
+listed there are not silently claimed by that slice. Nothing has been released, and Phase 9
+remains the current front and ship gate until those rows are dispositioned.**
 **Date:** 2026-07-21 (v4); status line refreshed 2026-08-22
 **Design of record:** [`screenshare-audio-exclusion-plan.md`](screenshare-audio-exclusion-plan.md) v3.8, round 11.
 **Scope:** *ordering, gates and acceptance criteria only.*
@@ -1073,6 +1075,40 @@ The reachable newly-created mid-share taint roots are: **a notification sound pl
 mpv/VLC (`screenshare/mod.rs:768-775`). Those are the transition-window field tests. Owned-AEC
 mid-share load stays a **synthetic** test until a second `enable` site or hot reload arms it.
 
+### 7.1 Two-machine release-prep slice — PASSED 2026-08-22
+
+The exact artifact was the thin AppImage built from PeerSpeak `0823f617` and bundled PixelPass
+`ce909afc`, SHA-256
+`f094a665dbd719929d6def32c8fd3d4943e4b88b6290e371e57b127c4e91ec45`. Application Manager
+installed the cazen copy as `/home/mollusk/Applications/PeerSpeak`; the byte-identical artifact
+was copied to dopedart and its checksum was verified before launch.
+
+Both directions passed the declared release-prep checks:
+
+- **cazen host → dopedart viewer:** the PeerSpeak host launched PixelPass with
+  `--audio-mode=desktop-excluding --aec=pulse-module:536870916`; GStreamer used hardware
+  `vah264enc`. Strawberry desktop music was heard clearly on dopedart while speech from the call
+  was not heard through the share. No exclusion warning appeared on either machine; a supplied
+  screenshot of the live participant/share surface also showed no warning.
+- **dopedart host → cazen viewer:** the host used
+  `--audio-mode=desktop-excluding --aec=off --no-hwencode`; GStreamer used software `x264enc`.
+  Desktop audio was heard, neither call voice echoed, no warning appeared, and the explicit
+  all-checks confirmation included the single **All system audio** picker choice.
+- **Stop Share while the call remained live:** cazen's host PixelPass, GStreamer process and
+  `pixelpass_capture_*` sink disappeared; dopedart's viewer PixelPass and mpv disappeared. Both
+  PeerSpeak processes and cazen's call AEC remained, proving share teardown did not tear down the
+  call.
+- **Host leaves while sharing:** dopedart's PixelPass, software GStreamer process and capture
+  sink disappeared; cazen's viewer PixelPass and mpv disappeared; both PeerSpeak applications
+  remained open in their expected call/home states.
+- **Final room leave:** process, Pulse module/sink/source, and `pw-dump` scans on both machines
+  found no PixelPass capture object, PeerSpeak AEC/call node, viewer, player, or GStreamer residue.
+
+This closes the two-direction acceptance matrix in `docs/release-0.6.7-prep.md`. It does **not**
+retroactively claim unrun rows from the full matrix above, including simultaneous host+viewer,
+EasyEffects, device switching, daemon restart, and real-sink format/CPU variance. Those rows must
+either be run, satisfied by named existing evidence, or explicitly re-scoped before publication.
+
 ---
 
 ## 8. Open questions — final status

packaging/windows/peerspeak.iss

@@ -12,7 +12,7 @@
 ; (x86_64-pc-windows-gnu, statically linked -- no extra DLLs needed).
 
 #define MyAppName "PeerSpeak"
-#define MyAppVersion "0.6.6"
+#define MyAppVersion "0.6.7"
 #define MyAppPublisher "mollusk"
 #define MyAppExeName "peerspeak.exe"