docs: record 1.7.31 Cordn UX, outbox and splash

AGENTS.md

@@ -1592,6 +1592,16 @@ session with **no other memory of this project**. So:
   tombstone, not a relay hard-delete; automatic read receipts are silent-signer
   only (Amber would prompt). Live benchmark (`scripts/cordn-benchmark.ts`, 30
   msgs): ~489ms/send, ~20ms/fetch, snapshot ~13.8KB (~460 B/message).
+- **Cordn room UX + resilience (2026-10-29):** `/messages` has a **Private
+  rooms** section with Community + every crew MLS room, Open/Set up state, and
+  local unread dots (`hooks/useCordnRoomRead.ts` + `lib/cordnRoomRead.ts`; only
+  rooms actually opened record `latestAt/seenAt`, so a dot is never invented).
+  The panel has per-room mute (`useDmMute` key `cordn:<gid>`), in-room search,
+  Chat-vs-Private guidance, coordinator **last checked**, and confirmations for
+  approve/remove. Failed sends persist in a per-account/room device-local outbox
+  (`lib/cordnOutbox.ts`) and auto-retry up to 3 times when online, then stay for
+  explicit Retry/Discard. Background unread for rooms never opened still needs a
+  global poller; there is deliberately no background decrypt.
 - **Cordn join-request push (2026-10-28):** `scripts/cordn-join-watcher.ts`
   runs every minute (user timer) and polls the coordinator for known crew gids.
   New requests become (a) a **NIP-17 DM** to the founder/admins (push service
@@ -2341,6 +2351,12 @@ The committed `package-lock.json` (from commit `f25fc2b`) had entries stripped o
 - **Versioning**: `package.json` `version` is the single source of truth; `scripts/sync-android-version.mjs` syncs it to `versionName`/`versionCode` (e.g. `1.4.5` → `10405`) during the build. Bump **only** `package.json`.
 - **Signing**: secrets live in the gitignored `keystore.properties`; `scripts/inject-signing-config.mjs` injects a managed block into `android/app/build.gradle` (runs in `android:init`/`android:sync`/`android:build`). The authoritative keystore is **`/home/sovereignsk8/skatespots-release.jks`** (alias `skatespots`). An older repo-root copy had a wrong password and was retired to `~/.backups/keystore/`.
 - `android/` is **generated and gitignored**; recreate with `npm run android:init`.
+- **Launch splash:** `resources/splash.png` is the orange brand wheel. Capacitor's
+  generated drawables used a stock blue placeholder, so `scripts/make-android-splash.mjs`
+  (sharp) regenerates all portrait/landscape densities from the tracked source;
+  `android:init`/`android:sync`/`android:build` all run it. The web splash
+  (`components/SplashScreen.tsx`) uses `public/images/icon-1024.png` with a roll-in,
+  rolling spin and CSS sparks; `prefers-reduced-motion` falls back to a static mark.
 - Preflight: `cd android && ./gradlew :app:signingReport` confirms the signing config resolves.
 
 ### Version bump + release notes
@@ -2594,6 +2610,15 @@ Rules:
       with the new device) and added the bot’s 30/hour approval brake plus daily
       30-snapshot local/restic state backups. APK sha256 `51dfe67e…`, versionCode
       10730. Web forced live at `bde3d2484`.
+    - **1.7.31 (2026-10-29):** animated orange-wheel launch splash (roll-in +
+      spin + sparks; reduced-motion static), native Android splash regenerated
+      from `resources/splash.png` instead of the stock blue placeholder, Cordn
+      **Private rooms** in Messages (Community + crews, Open/Set up, local
+      unread dots), per-room mute, in-room search, coordinator last-checked,
+      Chat-vs-Private explainer, approve/remove confirmations, and a device-local
+      Cordn outbox with bounded auto-retry. APK sha256 `d84b57de…`, versionCode
+      10731. Web forced live (manual `netlify deploy`; the release-script deploy
+      hit a transient build failure).
 
 ### Relay archive (dataset backup)
 - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**