@chipmobilesdk/rn-notification 0.4.1 → 0.6.0

package/src/channel/migrate.ts

@@ -74,192 +74,202 @@ export function createChannels(deps: ChannelDependencies) {
 	// has to follow, or it would retire with the old channel.
 	const writer = createScheduleWriter(deps.engine);
 
-	return {
-		/**
-		 * Applies a tone configuration, migrating any tone whose version moved.
-		 *
-		 * Applying an unchanged configuration performs no work at all: no channel
-		 * is recreated and no migration is triggered.
-		 */
-		async apply(
-			tones: readonly ToneDeclaration[],
-			groups: readonly ChannelGroup[] = [],
-		): Promise<ChannelApplyResult> {
-			// Validation completes before the first engine call, so a rejected
-			// declaration leaves the device exactly as it was — the same order the
-			// scheduler has always used.
-			validateToneDeclarations(tones);
+	const applyTones = async (
+		tones: readonly ToneDeclaration[],
+		groups: readonly ChannelGroup[],
+	): Promise<ChannelApplyResult> => {
+		// Validation completes before the first engine call, so a rejected
+		// declaration leaves the device exactly as it was — the same order the
+		// scheduler has always used.
+		validateToneDeclarations(tones);
 
-			const now = deps.now();
+		const now = deps.now();
 
-			const created: string[] = [];
-			const migrated: { toneId: string; from: number; to: number }[] = [];
-			const labelsRefreshed: string[] = [];
-			const retired: string[] = [];
-			const reHomed: string[] = [];
-			const cancelled: string[] = [];
-			const bypassUnavailable: string[] = [];
-			const repeatUnavailable: string[] = [];
-			const unchanged: string[] = [];
+		const created: string[] = [];
+		const migrated: { toneId: string; from: number; to: number }[] = [];
+		const labelsRefreshed: string[] = [];
+		const retired: string[] = [];
+		const reHomed: string[] = [];
+		const cancelled: string[] = [];
+		const bypassUnavailable: string[] = [];
+		const repeatUnavailable: string[] = [];
+		const unchanged: string[] = [];
 
-			if (groups.length > 0) {
-				await deps.engine.declareGroups(groups);
-			}
+		if (groups.length > 0) {
+			await deps.engine.declareGroups(groups);
+		}
+
+		const capabilities = await deps.engine.getCapabilities();
 
-			const capabilities = await deps.engine.getCapabilities();
+		for (const tone of tones) {
+			const previous = ledgerFor(deps.state, tone.id);
+			const resolved = resolveTone(tone);
+			const fingerprint = toneLabelFingerprint(tone);
 
-			for (const tone of tones) {
-				const previous = ledgerFor(deps.state, tone.id);
-				const resolved = resolveTone(tone);
-				const fingerprint = toneLabelFingerprint(tone);
+			// Refusals are reported for every tone that asked, whether or not
+			// anything else about it moved. A platform declining an attribute
+			// says nothing about whether the channel is new.
+			if (tone.bypassDoNotDisturb === true && !capabilities.supportsDoNotDisturbBypass) {
+				// Reported honestly rather than silently dropped — a consumer that
+				// asked for a bypass deserves to know the platform refused.
+				bypassUnavailable.push(tone.id);
+				emit(
+					DIAGNOSTIC_CODES.DND_BYPASS_UNAVAILABLE,
+					`Tone "${tone.id}" requested a Do Not Disturb bypass, which this platform does not permit.`,
+					{ toneId: tone.id },
+				);
+			}
 
-				// Refusals are reported for every tone that asked, whether or not
-				// anything else about it moved. A platform declining an attribute
-				// says nothing about whether the channel is new.
-				if (tone.bypassDoNotDisturb === true && !capabilities.supportsDoNotDisturbBypass) {
-					// Reported honestly rather than silently dropped — a consumer that
-					// asked for a bypass deserves to know the platform refused.
-					bypassUnavailable.push(tone.id);
+			if (tone.repeatAlert !== undefined) {
+				if (!capabilities.supportsRepeatingAlert) {
+					repeatUnavailable.push(tone.id);
 					emit(
-						DIAGNOSTIC_CODES.DND_BYPASS_UNAVAILABLE,
-						`Tone "${tone.id}" requested a Do Not Disturb bypass, which this platform does not permit.`,
+						DIAGNOSTIC_CODES.REPEAT_ALERT_UNAVAILABLE,
+						`Tone "${tone.id}" requested a repeating alert, which this platform does not offer. The notification still delivers and still sounds once.`,
+						{ toneId: tone.id },
+					);
+				} else if (!deps.engine.hasBackgroundDeliveryHandler()) {
+					// Said out loud at declaration time, because the alternative is a
+					// user meeting it as a phone that will not stop ringing.
+					emit(
+						DIAGNOSTIC_CODES.REPEAT_STOP_HANDLER_MISSING,
+						`Tone "${tone.id}" declares a repeating alert, but no background notification handler is registered. Its alert will not stop on its own while the app is not running. Call registerBackgroundNotificationHandler at module scope in index.js.`,
 						{ toneId: tone.id },
 					);
 				}
+			}
 
-				if (tone.repeatAlert !== undefined) {
-					if (!capabilities.supportsRepeatingAlert) {
-						repeatUnavailable.push(tone.id);
-						emit(
-							DIAGNOSTIC_CODES.REPEAT_ALERT_UNAVAILABLE,
-							`Tone "${tone.id}" requested a repeating alert, which this platform does not offer. The notification still delivers and still sounds once.`,
-							{ toneId: tone.id },
-						);
-					} else if (!deps.engine.hasBackgroundDeliveryHandler()) {
-						// Said out loud at declaration time, because the alternative is a
-						// user meeting it as a phone that will not stop ringing.
-						emit(
-							DIAGNOSTIC_CODES.REPEAT_STOP_HANDLER_MISSING,
-							`Tone "${tone.id}" declares a repeating alert, but no background notification handler is registered. Its alert will not stop on its own while the app is not running. Call registerBackgroundNotificationHandler at module scope in index.js.`,
-							{ toneId: tone.id },
-						);
-					}
-				}
-
-				const versionMoved = previous !== undefined && previous.appliedVersion !== tone.version;
-
-				if (previous !== undefined && !versionMoved) {
-					// The version is the same, so nothing the platform freezes has
-					// changed. Only the labels can still be stale — and correcting
-					// those must cost the user nothing, so the platform is touched
-					// only when the fingerprint actually moved.
-					if (previous.labelFingerprint === fingerprint) {
-						unchanged.push(tone.id);
-						continue;
-					}
-
-					const outcome = await deps.engine.declareTone(resolved);
-					if (outcome === 'created') {
-						// The channel was gone — deleted by the user, or lost with the
-						// app's data — so this is a first declaration rather than a
-						// refresh, whatever our ledger believed.
-						created.push(resolved.android.channelId);
-					} else if (outcome === 'labelsRefreshed') {
-						labelsRefreshed.push(tone.id);
-						emit(
-							DIAGNOSTIC_CODES.TONE_LABELS_REFRESHED,
-							`Tone "${tone.id}" had its name and description updated in place. No channel was recreated, so every setting the user adjusted on it is untouched.`,
-							{ toneId: tone.id },
-						);
-					} else {
-						unchanged.push(tone.id);
-					}
+			const versionMoved = previous !== undefined && previous.appliedVersion !== tone.version;
 
-					recordApplied(deps.state, tone, now, undefined, fingerprint);
+			if (previous !== undefined && !versionMoved) {
+				// The version is the same, so nothing the platform freezes has
+				// changed. Only the labels can still be stale — and correcting
+				// those must cost the user nothing, so the platform is touched
+				// only when the fingerprint actually moved.
+				if (previous.labelFingerprint === fingerprint) {
+					unchanged.push(tone.id);
 					continue;
 				}
 
 				const outcome = await deps.engine.declareTone(resolved);
 				if (outcome === 'created') {
+					// The channel was gone — deleted by the user, or lost with the
+					// app's data — so this is a first declaration rather than a
+					// refresh, whatever our ledger believed.
 					created.push(resolved.android.channelId);
+				} else if (outcome === 'labelsRefreshed') {
+					labelsRefreshed.push(tone.id);
+					emit(
+						DIAGNOSTIC_CODES.TONE_LABELS_REFRESHED,
+						`Tone "${tone.id}" had its name and description updated in place. No channel was recreated, so every setting the user adjusted on it is untouched.`,
+						{ toneId: tone.id },
+					);
+				} else {
+					unchanged.push(tone.id);
 				}
 
-				if (previous === undefined) {
-					recordApplied(deps.state, tone, now, undefined, fingerprint);
-					continue;
-				}
+				recordApplied(deps.state, tone, now, undefined, fingerprint);
+				continue;
+			}
 
-				// A version moved, so this is a migration rather than a first
-				// declaration. Re-home before retiring: the reverse order would leave
-				// live notifications attached to a channel that no longer exists.
-				emit(
-					DIAGNOSTIC_CODES.CHANNEL_MIGRATION_REQUIRED,
-					`Tone "${tone.id}" moved from version ${previous.appliedVersion} to ${tone.version}. Android channels are immutable, so a new channel was created and the old one is being retired.`,
-					{ toneId: tone.id, from: previous.appliedVersion, to: tone.version },
-				);
+			const outcome = await deps.engine.declareTone(resolved);
+			if (outcome === 'created') {
+				created.push(resolved.android.channelId);
+			}
 
-				const pending = await deps.engine.getPending();
-				const affected = pending.filter(entry => entry.tone === tone.id);
+			if (previous === undefined) {
+				recordApplied(deps.state, tone, now, undefined, fingerprint);
+				continue;
+			}
 
-				for (const entry of affected) {
-					await writer.write({
-						request: {
-							id: entry.id,
-							content: entry.content,
-							tone: entry.tone,
-							moment: { at: entry.resolvedAt, anchoring: entry.anchoring },
-							routing: entry.routing,
-							actions: entry.actions,
-							ownerTag: entry.ownerTag,
-							groupTag: entry.groupTag,
-						},
-						resolvedAt: entry.resolvedAt,
-						tone: resolved,
-						// Re-homing changes the channel, not the anchoring — preserve it.
-						anchoringGeneration: entry.anchoringGeneration,
-						approximate: entry.mayBeDelayed,
-						seriesId: entry.seriesId,
-						pushCreated: entry.pushCreated,
-					});
-					reHomed.push(entry.id);
-				}
+			// A version moved, so this is a migration rather than a first
+			// declaration. Re-home before retiring: the reverse order would leave
+			// live notifications attached to a channel that no longer exists.
+			emit(
+				DIAGNOSTIC_CODES.CHANNEL_MIGRATION_REQUIRED,
+				`Tone "${tone.id}" moved from version ${previous.appliedVersion} to ${tone.version}. Android channels are immutable, so a new channel was created and the old one is being retired.`,
+				{ toneId: tone.id, from: previous.appliedVersion, to: tone.version },
+			);
 
-				const didRetire = await deps.engine.retireTone(previous.channelId);
-				if (didRetire) {
-					retired.push(previous.channelId);
-				}
+			const pending = await deps.engine.getPending();
+			const affected = pending.filter(entry => entry.tone === tone.id);
 
-				// A version move outranks a label change: the new channel simply
-				// carries the new labels, and reporting it as a refresh would hide a
-				// migration the consumer needs to know about.
-				migrated.push({ toneId: tone.id, from: previous.appliedVersion, to: tone.version });
-				recordApplied(deps.state, tone, now, previous.channelId, fingerprint);
+			for (const entry of affected) {
+				await writer.write({
+					request: {
+						id: entry.id,
+						content: entry.content,
+						tone: entry.tone,
+						moment: { at: entry.resolvedAt, anchoring: entry.anchoring },
+						routing: entry.routing,
+						actions: entry.actions,
+						ownerTag: entry.ownerTag,
+						groupTag: entry.groupTag,
+					},
+					resolvedAt: entry.resolvedAt,
+					tone: resolved,
+					// Re-homing changes the channel, not the anchoring — preserve it.
+					anchoringGeneration: entry.anchoringGeneration,
+					approximate: entry.mayBeDelayed,
+					seriesId: entry.seriesId,
+					pushCreated: entry.pushCreated,
+				});
+				reHomed.push(entry.id);
 			}
 
-			// Anything left on a retired channel would be an orphan — a notification
-			// the user can no longer control from system settings.
-			const orphans = await findOrphans(deps, tones);
-			if (orphans.length > 0) {
-				await deps.engine.cancelMany(orphans);
-				cancelled.push(...orphans);
-				emit(
-					DIAGNOSTIC_CODES.CHANNEL_ORPHANS_FOUND,
-					`${orphans.length} notification(s) remained on a retired channel and were cancelled, rather than left uncontrollable from system settings.`,
-					{ count: orphans.length },
-				);
+			const didRetire = await deps.engine.retireTone(previous.channelId);
+			if (didRetire) {
+				retired.push(previous.channelId);
 			}
 
-			return {
-				created,
-				migrated,
-				labelsRefreshed,
-				retired,
-				reHomed,
-				cancelled,
-				bypassUnavailable,
-				repeatUnavailable,
-				unchanged,
-			};
+			// A version move outranks a label change: the new channel simply
+			// carries the new labels, and reporting it as a refresh would hide a
+			// migration the consumer needs to know about.
+			migrated.push({ toneId: tone.id, from: previous.appliedVersion, to: tone.version });
+			recordApplied(deps.state, tone, now, previous.channelId, fingerprint);
+		}
+
+		// Anything left on a retired channel would be an orphan — a notification
+		// the user can no longer control from system settings.
+		const orphans = await findOrphans(deps, tones);
+		if (orphans.length > 0) {
+			await deps.engine.cancelMany(orphans);
+			cancelled.push(...orphans);
+			emit(
+				DIAGNOSTIC_CODES.CHANNEL_ORPHANS_FOUND,
+				`${orphans.length} notification(s) remained on a retired channel and were cancelled, rather than left uncontrollable from system settings.`,
+				{ count: orphans.length },
+			);
+		}
+
+		return {
+			created,
+			migrated,
+			labelsRefreshed,
+			retired,
+			reHomed,
+			cancelled,
+			bypassUnavailable,
+			repeatUnavailable,
+			unchanged,
+		};
+	};
+
+	return {
+		/**
+		 * Applies a tone configuration, migrating any tone whose version moved.
+		 *
+		 * Applying an unchanged configuration performs no work at all: no channel
+		 * is recreated and no migration is triggered.
+		 */
+		apply(
+			tones: readonly ToneDeclaration[],
+			groups: readonly ChannelGroup[] = [],
+		): Promise<ChannelApplyResult> {
+			// The declared channels are read once for the whole apply rather than once
+			// per tone, when the engine can hold them (NOT-08).
+			const run = () => applyTones(tones, groups);
+			return deps.engine.withChannelSnapshot ? deps.engine.withChannelSnapshot(run) : run();
 		},
 
 		/** Which version of each tone this device actually holds. */
@@ -278,8 +288,16 @@ async function findOrphans(
 	tones: readonly ToneDeclaration[],
 ): Promise<readonly string[]> {
 	const declared = new Set(tones.map(tone => tone.id));
+	// Only tones this package once applied can leave orphans (NOT-05). An entry
+	// with no tone metadata was scheduled by other code through the same engine,
+	// and a tone the ledger has never seen is not ours to judge either: cancelling
+	// on "not in this call's list" silently deleted other libraries' notifications,
+	// and a feature module's own when it applied only its subset of tones.
+	const onceApplied = new Set(deps.state.read().migrationLedger.map(entry => entry.toneId));
 	const pending = await deps.engine.getPending();
-	return pending.filter(entry => !declared.has(entry.tone)).map(entry => entry.id);
+	return pending
+		.filter(entry => entry.tone !== '' && onceApplied.has(entry.tone) && !declared.has(entry.tone))
+		.map(entry => entry.id);
 }
 
 export type Channels = ReturnType<typeof createChannels>;

package/src/channel/tone-map.ts

@@ -13,6 +13,7 @@
  */
 
 import type { ResolvedTone, ToneDeclaration, ToneUrgency } from '../contract/channel';
+import { fnv1a, hex8 } from '../contract/hash';
 
 type AndroidImportance = ResolvedTone['android']['importance'];
 type IosInterruption = ResolvedTone['ios']['interruptionLevel'];
@@ -109,16 +110,7 @@ export function toneLabelFingerprint(tone: ToneDeclaration): string {
 	// of the two would never get its correction.
 	const source = `${tone.name}\u0000${tone.description ?? ''}`;
 
-	// FNV-1a. Bitwise operators are the algorithm, not a micro-optimisation:
-	// arithmetic equivalents would not wrap to 32 bits and the hash would drift.
-	/* eslint-disable no-bitwise */
-	let hash = 0x811c9dc5;
-	for (let index = 0; index < source.length; index += 1) {
-		hash ^= source.codePointAt(index) ?? 0;
-		hash = Math.imul(hash, 0x01000193) >>> 0;
-	}
-	return (hash >>> 0).toString(16).padStart(8, '0');
-	/* eslint-enable no-bitwise */
+	return hex8(fnv1a(source));
 }
 
 /** Builds a lookup over a declared configuration. */

package/src/contract/errors.ts

@@ -11,6 +11,10 @@
  * See `specs/009-rn-notification-package/contracts/errors.md`.
  */
 
+import { SdkError } from '@chipmobilesdk/rn-core';
+
+import { redactContext } from '../diagnostics/redact';
+
 export const DIAGNOSTIC_CODES = {
 	// --- Validation: raised before any platform call -------------------------
 	INVALID_ID_EMPTY: 'INVALID_ID_EMPTY',
@@ -66,7 +70,15 @@ export const DIAGNOSTIC_CODES = {
 	// --- Persisted state -----------------------------------------------------
 	STATE_CORRUPT_REBUILT: 'STATE_CORRUPT_REBUILT',
 	STATE_WRITE_FAILED: 'STATE_WRITE_FAILED',
+	/** The durable store could not open; state lasts for this session only. */
+	STATE_STORE_DEGRADED: 'STATE_STORE_DEGRADED',
 	STATE_CAP_EVICTED: 'STATE_CAP_EVICTED',
+	/**
+	 * A ledger holds more live entries than its cap (0.6.0). They are all kept:
+	 * dropping a live series or channel record would lose a migration or reset a
+	 * series count. Reported so the cap can be raised or the app's use reviewed.
+	 */
+	STATE_CAP_EXCEEDED: 'STATE_CAP_EXCEEDED',
 
 	// --- Volume --------------------------------------------------------------
 	BURST_THRESHOLD_EXCEEDED: 'BURST_THRESHOLD_EXCEEDED',
@@ -91,16 +103,18 @@ export const ALL_DIAGNOSTIC_CODES: readonly DiagnosticCode[] = Object.freeze(
  * a rule, the *shape* of the violation is reported — a length, a character
  * position — rather than the value itself.
  */
-export class NotificationError extends Error {
-	readonly code: DiagnosticCode;
+export class NotificationError extends SdkError<DiagnosticCode> {
 	readonly context?: Readonly<Record<string, unknown>>;
 
 	constructor(code: DiagnosticCode, message: string, context?: Readonly<Record<string, unknown>>) {
-		super(message);
+		super('rn-notification', code, { message });
 		this.name = 'NotificationError';
-		this.code = code;
-		this.context = context;
-		Object.setPrototypeOf(this, NotificationError.prototype);
+		// Redacted on the way in: an error object reaches crash reporters, which
+		// never run with verbose diagnostics.
+		const redacted = redactContext(context, false);
+		if (redacted !== undefined) {
+			this.context = redacted;
+		}
 	}
 }
 
@@ -121,6 +135,7 @@ export const NON_FAILURE_CODES: readonly DiagnosticCode[] = Object.freeze([
 	DIAGNOSTIC_CODES.PAYLOAD_VERSION_SKEW,
 	DIAGNOSTIC_CODES.PAYLOAD_DUPLICATE,
 	DIAGNOSTIC_CODES.STATE_CAP_EVICTED,
+	DIAGNOSTIC_CODES.STATE_CAP_EXCEEDED,
 	DIAGNOSTIC_CODES.STATE_CORRUPT_REBUILT,
 	DIAGNOSTIC_CODES.BACKGROUND_RESTRICTION_UNKNOWN,
 	DIAGNOSTIC_CODES.DND_BYPASS_UNAVAILABLE,

package/src/contract/hash.ts

@@ -0,0 +1,26 @@
+/**
+ * FNV-1a, 32-bit: the package's one hash (NOT-19). Deterministic,
+ * dependency-free, and stable across releases.
+ *
+ * Bitwise operators are the algorithm, not a micro-optimisation: arithmetic
+ * equivalents would not wrap to 32 bits. Stability matters: a marker id or a
+ * label fingerprint that changed between releases would orphan every marker
+ * already scheduled, or refresh every channel label once more.
+ */
+export const FNV_OFFSET_BASIS = 0x811c9dc5;
+
+/* eslint-disable no-bitwise */
+export function fnv1a(value: string, basis: number = FNV_OFFSET_BASIS): number {
+	let hash = basis;
+	for (let index = 0; index < value.length; index += 1) {
+		hash ^= value.codePointAt(index) ?? 0;
+		hash = Math.imul(hash, 0x01000193) >>> 0;
+	}
+	return hash >>> 0;
+}
+/* eslint-enable no-bitwise */
+
+/** Eight lowercase hex digits. */
+export function hex8(value: number): string {
+	return value.toString(16).padStart(8, '0');
+}

package/src/diagnostics/events.ts

@@ -7,6 +7,8 @@
  * or stays silent.
  */
 
+import { createDiagnosticChannel } from '@chipmobilesdk/rn-core';
+
 import type { DiagnosticEvent, DiagnosticSeverity, EventSink } from '../contract/diagnostics';
 import type { DiagnosticCode } from '../contract/errors';
 import { isNonFailure } from '../contract/errors';
@@ -18,6 +20,8 @@ export interface EmitterOptions {
 	readonly now?: () => number;
 }
 
+const channel = createDiagnosticChannel<DiagnosticCode>('rn-notification');
+
 export class DiagnosticEmitter {
 	private sink?: EventSink;
 	private verbose: boolean;
@@ -47,12 +51,17 @@ export class DiagnosticEmitter {
 		context?: Readonly<Record<string, unknown>>,
 		severity?: DiagnosticSeverity,
 	): void {
+		const resolvedSeverity = severity ?? (isNonFailure(code) ? 'info' : 'error');
+		// The app's SDK sinks (`installSdkSink`, CORE-08) never get content, even
+		// with verbose diagnostics on: verbose is for this package's own sink.
+		channel.emit(code, resolvedSeverity, redactContext(context, false));
+
 		// No sink means no work at all — not a buffer that grows until one appears.
 		if (this.sink === undefined) return;
 
 		const event: DiagnosticEvent = {
 			code,
-			severity: severity ?? (isNonFailure(code) ? 'info' : 'error'),
+			severity: resolvedSeverity,
 			message,
 			at: this.now(),
 			context: redactContext(context, this.verbose),

package/src/diagnostics/redact.ts

@@ -10,6 +10,8 @@
  * — which is what actually helps someone debug a validation failure anyway.
  */
 
+import { createRedactor } from '@chipmobilesdk/rn-core';
+
 /** Keys whose values are never emitted at any verbosity below verbose. */
 const REDACTED_KEYS = new Set([
 	'title',
@@ -26,17 +28,12 @@ const REDACTED_KEYS = new Set([
 	'data',
 ]);
 
-const REDACTED = '[redacted]';
-
-function describe(value: unknown): string {
-	if (value === null) return '[null]';
-	if (value === undefined) return '[undefined]';
-	if (typeof value === 'string') return `[string:${value.length}]`;
-	if (typeof value === 'number' || typeof value === 'boolean') return REDACTED;
-	if (Array.isArray(value)) return `[array:${value.length}]`;
-	if (typeof value === 'object') return `[object:${Object.keys(value).length}]`;
-	return REDACTED;
-}
+/**
+ * rn-core's redactor: the keys above are replaced by their shape (a length, a
+ * type), and every other string is pattern-redacted, so a token or an e-mail
+ * address under an innocent key such as `reason` does not get through either.
+ */
+const redactor = createRedactor({ shapeKeys: REDACTED_KEYS });
 
 /**
  * Strips content values from a diagnostic context.
@@ -49,21 +46,7 @@ export function redactContext(
 	context: Readonly<Record<string, unknown>> | undefined,
 	verbose: boolean,
 ): Readonly<Record<string, unknown>> | undefined {
-	if (context === undefined) return undefined;
-	if (verbose) return context;
-
-	const walk = (value: unknown, depth: number): unknown => {
-		if (depth > 6 || value === null || typeof value !== 'object') return value;
-		if (Array.isArray(value)) return value.map(item => walk(item, depth + 1));
-
-		const output: Record<string, unknown> = {};
-		for (const [key, inner] of Object.entries(value as Record<string, unknown>)) {
-			output[key] = REDACTED_KEYS.has(key) ? describe(inner) : walk(inner, depth + 1);
-		}
-		return output;
-	};
-
-	return walk(context, 0) as Readonly<Record<string, unknown>>;
+	return verbose ? context : redactor.context(context);
 }
 
 /** True when a key would be redacted. Exported so tests can assert the policy directly. */

package/src/diagnostics/snapshot.ts

@@ -9,6 +9,8 @@
  * into a bug report.
  */
 
+import { describeShape } from '@chipmobilesdk/rn-core';
+
 import type { StateSnapshot } from '../contract/diagnostics';
 import type { PendingEntry } from '../contract/notification';
 import type { PermissionReport, RestrictionReport } from '../contract/permission';
@@ -30,6 +32,35 @@ export interface SnapshotDependencies {
 	readonly lastMaintenance: () => MaintenanceResult | undefined;
 	/** Presence only — never the value. */
 	readonly hasPushToken: () => boolean;
+	/**
+	 * Whether verbose diagnostics are on. Off (the default), pending entries carry
+	 * the shape of their content and routing (`[string:12]`), not the values.
+	 */
+	readonly verbose?: () => boolean;
+}
+
+/**
+ * A pending entry with content replaced by its shape. A snapshot is the thing
+ * most likely to be pasted into a bug report, so it never carries notification
+ * text or routing values unless verbose diagnostics is on (NOT-14).
+ */
+function withoutContent(entry: PendingEntry): PendingEntry {
+	const { content, routing } = entry;
+	return {
+		...entry,
+		content: {
+			title: describeShape(content.title),
+			body: describeShape(content.body),
+			...(content.subtitle === undefined ? {} : { subtitle: describeShape(content.subtitle) }),
+		},
+		...(routing === undefined
+			? {}
+			: {
+					routing: Object.fromEntries(
+						Object.entries(routing).map(([key, value]) => [key, describeShape(value)]),
+					),
+				}),
+	};
 }
 
 export function createSnapshot(deps: SnapshotDependencies) {
@@ -52,7 +83,9 @@ export function createSnapshot(deps: SnapshotDependencies) {
 					appliedVersion: tone.appliedVersion,
 				})),
 				pendingCount: pending.length,
-				pending: pending as readonly PendingEntry[],
+				pending: deps.verbose?.()
+					? (pending as readonly PendingEntry[])
+					: pending.map(entry => withoutContent(entry as PendingEntry)),
 				lastReconcile: deps.lastReconcile(),
 				lastMaintenance: maintenance,
 				discrepancy,