Chat and People: delivery states, Community catch-up and spam limits (follow-up to #86)

Part of #86. OMP took over the Chat release candidate: f173210 includes Codex bcb8174, rebuilt UI assets and three corrected tests, with Claude PASS, in train PR #372. Codex adds no commits to fix/139-chat-stability. Current Codex work is installed alpha.16 Community acceptance on two fresh Linux Homes (x86_64 and ARM64), first dry-running alpha.15 signup and Profile; scoped proof and screenshots will be recorded in #86, #264 and #88. The separate Community-node follow-up remains preserved at d1a4dbc79. Status, Road and acceptance live in #86. Closes when the follow-up merges.

@andersalm

@andersalm plan: 3 PRs, Part of #139 — A spam limits (starting now, from develop), B Community catch-up, C Chat UI follow-ups on top of #123. B and C need your answers:

Community history: where does it live now the seed only serves installs (Seed: run the seed service under its own account without sudo or Docker #174), how long (24 h, 200 messages?), and do you approve a new history op on the collaboration provider (Required: Isolation as promised #173)? 2. Direct messages: keep the 24 h lifetime, and retry only while the sender is signed in?
Unread per account, DMs and Community together here (or DMs in Chat and People with Home: connect, approve contacts and recover (#86) #123)? Browser-guest instant updates deferred to invites? No block list this release? Rates OK: 5 messages per 10 s per sender, 2 Discovery listings per source?

Decisions (6 Oct), from existing rules:

DMs keep the 24 h lifetime and retry only while the sender is signed in (current behaviour). Unread is per account, for DMs and Community, in Chat and People with Home: connect, approve contacts and recover (#86) #123. Browser-guest instant updates move to the invite task. No block list this release (Accept, Decline and Remove stay). Rates: 5 messages per 10 s per sender, 4 Discovery listings per device (Chat and People spam limits: Discovery relay caps and Community rate limits (#139) #262).
Two items need Anders's capability approval under Required: Isolation as promised #173, asked today: the contact-request route (G3 Community chat: Chat and People with Home #86) and Community history (where it lives, 24 h / 200 messages, a bounded collaboration.history op).

@irzhywau

Approved (Anders, 6 Oct, under #173): Community catch-up through one bounded, conversation-scoped collaboration.history op. Homes that took part serve the last 24 h or at most 200 messages, whichever is smaller. Messages stay signed and are verified; there is no central server, and the seed stays install-only.
Known limit, to state in the docs: a Home that comes back when no other participant is online gets no catch-up. @irzhywau B and C can go ahead.

Read-only audit of develop 18289199 (the affected Chat/direct paths are unchanged from d96e01e6) and PRs #123/#262 found three direct-delivery defects that survive both candidates: the retry selector repeatedly takes the first four pending records, which can starve later reachable contacts; request-ID lookup occurs before the mutation lock, so concurrent sends can create duplicate intents; session registration replaces the Runtime-owned recipient context, so Inbox/People use followed by sign-out can stop accepted-contact delivery. Sender retry while signed in remains the approved policy. Retry selector, intent lookup, recipient registration.
Product data, public copy, Chat/People/Inbox behavior, formatting and 117 JavaScript tests pass on the latest develop tree 7888ca70 (tested in its byte-identical 8e4b3b97 checkout). These checks include acceptance-harness validation rather than the installed two-Home journey; the new findings require focused concurrent-send, saturated-retry and recipient sign-out tests.
Remaining gates: delivery-state/Retry UX, participant-hosted signed Community catch-up, the combined #123/#262 bundle, human review and installed acceptance. Both PRs are now mergeable after #284 integrated; their existing green checks still need current-base combined-candidate verification.

fix(chat): a receiving Home accepts 5 Community messages per sender

Published PR123 head ea9bee4 by fast-forward from de5a986, including normal integration of develop5f56bb8c4. The exact native gate passed:4112 Rust unit executions,0 failures,31 opt-in/fixture entries ignored; source formatting, product-data, all-target checks and Clippy passed.

The two installed Homes remain pending full28-step acceptance. The exact Runtime and three-provider build/install is running, followed by a guarded fresh-user reset and the served-hash-bound journey. #89 and required human review remain merge gates.

Anders authorized isolated QA for installed #123 candidate ea9bee4394e6156a952a0ea9b26f6b7a8085ff7c (tree b8681f05b5f1363628686e69e80650af8a1ce711). Current checks pass for #123 and #262. #139 remains the single active Chat task, with #86 as its acceptance parent; Irzhy retains implementation ownership.

QA will reuse the existing build and refresh the fixture-only account/browser reset guards before running the existing 28-leg two-Home journey. The owner branches and source worktree stay preserved. Complete installed acceptance, current-candidate reviews and the #89 merge gate remain open.

Isolated QA on ea9bee4394e6156a952a0ea9b26f6b7a8085ff7c passed the running Runtime and served-artifact parity checks. Fresh signup and actual Recovery Kit downloads passed on both Homes: 2/28 journey legs.

The next step stopped in the harness: openAppWindow looks for System in the Apps launcher, while current Home places System and Chat in the dock. System was already open with Recovery ready. Both test Homes stopped cleanly; the existing build, source and owner branches stay preserved.

The private harness adaptation will change only window selectors to use the existing visible window, dock or current launcher. All 28 mandatory assertions remain. Independent review and a new guarded fresh run are required before complete installed acceptance.

The second isolated QA run of #123 at ea9bee4394e6156a952a0ea9b26f6b7a8085ff7c, with the private Home-control selector correction, passed 10/28 legs. These include bidirectional Community messages, Profiles, the contact request and recipient Inbox approval, accepted contacts, and Recovery/Profile identity binding.

The next Community Profile Message leg stopped after 120 seconds because the harness treated a hidden, disabled Add contact button as pending and kept waiting instead of reopening the peer Profile. The private correction defines pending as visible && disabled; all 28 assertions remain. Both test Homes stopped cleanly, and the existing build, product source and owner branches stay preserved.

Runtime's fresh ContactStore correctly records acceptance. Chat needs to refresh the Direct rail and an already open Profile card when that state changes: Shared polling, card rendering and poll state. A late request response also needs to preserve an already accepted state. The smallest owner repair reuses the existing refresh/render paths and adds a requested-to-accepted transition regression. Independent review and a new guarded fresh run remain required; complete installed acceptance stays open.

The third fresh isolated QA run on ea9bee4394e6156a952a0ea9b26f6b7a8085ff7c passed 11/28 legs, including sender Community Profile Message opening the correct Direct conversation.

Both independent reviewers identified a harness frame-binding race at recipient People → Chat. The screenshot shows the correct foreground Direct conversation, while the helper captured the earlier visible Community frame before Home allocated the requested conversation window. The private helper will wait for the active exact-conversation route and selected conversation before binding the frame; the existing assertion remains.

Both test Homes stopped cleanly. QA continues with the existing build, product source and owner branches preserved. Direct-message delivery remains untested in this run, and the two contact refresh gaps remain for the owner. Review and a new guarded fresh run remain required; complete installed acceptance stays open.

Anders approved execution of the accepted Chat priorities on an isolated branch.
Irzhy retains both owner branches and the preserved Chat worktree.
The acceptance record above holds the candidate, checkpoints and remaining gates.

CI run 37876735825 passed for candidate b3089f59502a9125e0c87847a9fdbdb14d5e75df: all ten execution jobs passed. Release publication was skipped. The local 8c5365b9 child changes only the two-line canonical test navigation; its Runtime and provider input closure matches that producer. Mac installed Chat, receive/retry, signed Update and Undo proofs pass. The physical Mac–Jetson journey is running. The fresh Linux x86 fixture is being qualified. Product completion still requires the remaining target and human acceptance gates in #139.

ci: retain Linux review packages for target chat QA (#139)

Independent source and custody review passes for the prepared Next signed Update/Undo controller on 3fdc1ef77032db64b69b16acd91f21a60eeeb07e, tree e0c4d3c24e0aaebaa39844d7e19ef633a1cfb725, for draft PR #309. All 13 pure and read-only guards pass under the original archive interpreter. The source remains clean. Controller SHA-256: 6a7d76a3c0e656a9cd534bc823683428f4bd3dae365a81e499d64b55d20758f5; guard source: 844976b68bb6e4decd8e20c2db873c1760d8fed6b5235f1aa724abed5226a4de.

The current credential ID and localhost RP bind the unchanged original Profile owner through Runtime's existing principal rule. The controller separately pins the complete current credential bytes and the 31 current protected paths. It preserves the original authority packet and prior proof. The historical record does not establish the exact earlier credential-counter change, and this review makes no claim about that change.

These checks qualify the inputs for the scoped artifact, joined-network and later-data preservation test. Normal existing-owner sign-in on each restored Home is still required before claiming that owner login survived. The controller already reports that it does not reopen the owner UI. The actual Next Update/Undo, source/build qualification and restored sign-in proof remain pending. This review starts no fixture or product process and performs no signing.

Codex (agent): Frozen #309 at e64f159; local/full-hook checks passed. Native producer 20997bc has verified production-input compatibility. Signer is separate Draft #334.
Codex (agent): Installed run passed six legs, then stopped on a fixture-name collision. Router trial reached 1/40 at 12.266 s with intended-peer receipt absent. Update/Undo and both owners passed; signup timing, Linux, three-web and later legs remain open.
Codex (agent): Idle Runtime CPU, one/eight Chat: 5.69384%/11.56921% of one core (60 s, peer fixtures stopped; report only). Chat CI cancelled after stale pending-copy smoke failed; signer CI pending. Both Draft; stopped for Irzhy's selected-risk review of this frozen SHA.

10 Oct review of develop: a fresh install has no collaboration config (only the operator tool and setup-source-home write it), yet Chat says "Community · Shared room" and lets the user post while isolated; Home never shows connection state (chat-room-ui lib.rs:505,2834-2851,4386).
Also open: no spam limit, mute or block, the 500-message window can be flooded, and a restarted Home has no catch-up. #309 and #334 must close the first two lines before 0.8.0.

Codex (agent): Pushed #309 candidate 36b68ee; local 147 Rust tests, 1,579 JavaScript tests and the single slot-2 check passed.
Codex (agent): Last delivery used 20997bc: one Mac→Jetson attempt appeared after 12.266 s with its intended-peer receipt absent; reverse unrun. Current source: 0/40 attempts Mac→Jetson, 0/40 reverse (unrun).
Codex (agent): Current CI result is unverified. Shared own-row Sending/retry/Expired remains open; fresh-install request/recovery, signup timing, Linux, three-web and later installed checks remain pending. Irzhy's review waits for green CI and working delivery.

Codex (agent): Pushed candidate 1433c9fda1ed7bc3bfdb5de3db337c72b52c8340 in PR #309. Mac and Jetson each received all 40 messages from the other Home. All 80 distinct originals appeared once in the intended receiving Chat and have durable Core receipts bound to that Home.

All 40 Mac→Jetson messages appeared within three seconds, maximum 2.976197 s. Jetson→Mac passed 38/40 within three seconds; the two late rows took 3.313310 and 3.040189 s. Every attempted message arrived. Both Homes became online within 45 seconds. Fresh traces for the Linux GSO fix show zero batched sends, maximum datagram count one, and maximum PTO counts of two on Mac and three on Jetson.

The single Slot2 check and unchanged canonical pre-push gate passed. CI is pending. #319 retains the earlier default-package failures and interrupted FIFO attempt; the three failed startup cases passed separately. It also retains the whole bootstrap suite’s 180-second timeout and absent literal checklist scripts; 20 of 21 current source-list commands passed. The strict three-second criterion, Shared own-row Sending/retry/Expired and remaining installed qualification stay open.

Moved to After 0.8.0 (audit 15 Oct): the 0.8.0 part shipped in #309 via #372 (spam limits, Delivery unconfirmed, collaboration.history) and #334; Anders's 14 Oct design (#86 6171916401) moves the storing node and cross-network catch-up to 0.8.1. Acceptance of the Chat that ships stays in #86.

Navigation Menu

Repository navigation

Chat and People: delivery states, Community catch-up and spam limits (follow-up to #86) #139

5 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Chat and People: delivery states, Community catch-up and spam limits (follow-up to #86) #139

Description

Activity

irzhywau commented on Oct 6, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 7, 2026

andersalm commented on Oct 8, 2026

andersalm commented on Oct 8, 2026

andersalm commented on Oct 8, 2026

andersalm commented on Oct 8, 2026

andersalm commented on Oct 8, 2026

5 remaining items

andersalm commented on Oct 9, 2026

andersalm commented on Oct 9, 2026

andersalm commented on Oct 9, 2026

andersalm commented on Oct 10, 2026

andersalm commented on Oct 10, 2026

andersalm commented on Oct 10, 2026

andersalm commented on Oct 11, 2026

andersalm commented on Oct 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions