@glyphteck/veyl 0.77.1 → 0.78.0

package/docs/validation.md

@@ -6,6 +6,14 @@ This document records the product boundary and measured evidence. It is not a cl
 
 ## Shared-owner boundary
 
+### disposable lifecycle check — september 14, 2026
+
+seven temporary production-realm accounts used REGTEST bitcoin only. account/vault creation, encrypted group text, photo and audio delivery/decryption, reactions, and confirmed peer transfers worked. call media and participants reached readiness; a complete live call and native screenshot capture were not performed. both temporary groups and all seven accounts were subsequently deleted through ordinary sdk commands. an independent read verified that all seven Firebase Auth users and public profiles were absent, and the temporary local profiles/cache were removed.
+
+the run exposed and corrected four lifecycle boundaries: account deletion must scan persistent inbox slots once rather than wait for them to disappear; byte-identical vault snapshots must retain the same authority during password verification; deletion must wait through listener reconnects before remote phases; and stable-id sdk chat commands must hydrate the private owner instead of acting on a cached list row. pending message requests remain admission decisions and do not require an already-admitted owner. cleanup now reconciles each discovered chat's membership before choosing its retirement action, with phase diagnostics that omit private data.
+
+the older group's missed-transition failure exposed a rules defect: membership changes add retirement metadata to retained encrypted settings, but reads accepted only the active record shape. the firestore emulator reproduced a denied settings read after an actual membership/media transition; the corrected rule passes that regression while preserving immutability, strict active writes, and denial after chat deletion. production firestore rules were deployed with `bun make db`. the original accounts were already deleted, so a fresh live multi-transition catch-up remains in `totest.md`; successful cleanup does not prove that full scenario. the sdk/chat suite passes 296 tests, the firestore suite passes six, and focused lint and sdk packaging pass. the run procedure and identity rules live in [bot contracts](../../../guidelines/bots.md#traffic-verification).
+
 The Node SDK composes the same framework-free owners as web and iOS:
 
 | Product area | Shared owner used by the SDK | Node adaptation |

package/package.json

@@ -54,5 +54,5 @@
         "start": "node src/cli.js",
         "lint": "eslint src --quiet"
     },
-    "version": "0.77.1"
+    "version": "0.78.0"
 }