It was a plain in-memory field on the trust object. The switch set it, nothing
wrote it down, and the phase it was read back from defaulted to false — so
somebody who turned it on was protected until they next closed the app, and
nothing told them it had lapsed. The switch simply read off again.
A security control that quietly disarms itself is worse than one that was never
offered, because the person is relying on it.
iOS has persisted this in UserDefaults all along. Android now stores it beside
the other device preferences, restores it into the trust object at sign-in, and
seeds the phase from the same value so the switch shows what is actually being
enforced rather than disagreeing with it.
Still off by default, which is deliberate and unchanged: a relay older than the
transparency log has no log to prove anything against, and enforcing it there
would refuse every peer for a reason the user cannot fix.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
