@mmmbuto/nexuscrew 0.9.64 → 0.9.65

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.9.65 — 2026-10-09
+
+- **Notifications from a remote node can be cleared locally, one voice or all at once.** Every imported notice offers the same close action asks already have: one request dismisses a single notice or the whole visible set of an owner. The dismissal travels to the owner over the authorized routes and is judged by the origin's view; the owner records it and publishes one `notify-closed` closure per cleared notice, so every receiver empties, including the ones that were not part of the clear. When the owner cannot take it — unreachable, or without the notices surface — the request still succeeds: the node records the intent durably, as pending with a bounded retry or as blocked until the pairing changes, and the record, not the browser, is what keeps the card down. A reload or a restart of the receiving node does not bring a cleared notice back, and once the owner takes the dismissed intent he stops serving those notices himself. "Clear" means the whole visible set of that owner on this node: every notice currently shown for him, cleared in one request inside the owner's per-request budget.
+- **A dismissal queue that cannot persist says so.** The queue still honours a cleared notice in memory when the disk refuses the write, but the operator's answer no longer looks like the durable success: queued answers (the single dismiss and the pending/blocked outcomes of clear-all) carry `durable: false` and a `degraded` reason (`queue-write-failed`, `queue-oversize`, `queue-read-failed`, `queue-schema`) when the queue cannot be written or read. The loss is real and now visible: after a restart the cleared card can come back, and the answer warns about it before that happens. A healthy write clears the flag again, and the answer returns to its normal shape.
+- **A queue file that cannot be read is never overwritten with a partial list.** When the queue file is unreadable, foreign or oversize at the first read, the node retries the read before any write, merges what the disk holds with the dismissals accepted in the meantime, and replays them in order on top of the disk. The queue keeps its bounds (200 records, 64 KiB, 15 minutes): when it is full the oldest records leave, never the dismissal just accepted. While the disk stays unreadable the answers keep declaring `durable: false` and the reason.
+- **A missed closure heals at the next read.** A browser that misses a notice's live closure frame kept the card on screen even after a fresh, complete feed-state read no longer listed the notice. For every owner whose view is fresh and authoritative, the notice panel now reconciles against that read: what the owner no longer serves goes, and a card that arrived while the read was in flight stays. Stale, incomplete or resync-flagged views keep their cards as before.
+- **An owner with a full window is no longer refused as incomplete.** A snapshot page cut exactly at its cap (50 notifications, 100 asks) was marked as incomplete on every full page, so a receiving node refused the snapshot of an owner with a full window, imported nothing and never opened the stream. The marker now means that the source had more entries than the page holds; a page exactly at the cap is whole and accepted, and a page over the cap or flagged for resync is still refused.
+
 ## 0.9.64 — 2026-10-07
 
 - **The active quick list hides stopped cells.** The active mode keeps only live cells and active degraded rows, regardless of each node's saved all or pinned preference; ordering and pins remain intact.

package/docs/NOTIFICATIONS.md

@@ -119,6 +119,40 @@ browser, keeps the app fully usable, and never changes the other side's push
 setup. Turning it back on requires the same button, so a device that was asked
 to stay silent does not re-subscribe itself.
 
+## Clearing imported notifications
+
+An imported notice can be closed like a local one, for a single notice or for
+the whole visible set of one owner with a single request. The closure is not a
+browser-side hide; the protocol keeps every view of that owner honest:
+
+- **The owner records it.** The dismissal travels the authorized routes to the
+  owner, is judged by the origin's view, and is answered by one `notify-closed`
+  closure frame per cleared notice. Closures enter the owner's feed history, so
+  a receiver that was offline recovers them from the backlog; the receiving
+  side never turns a closure into a card.
+- **Every receiver empties.** Once the owner has recorded the dismissal he
+  stops serving those notices, so no node that holds a view of him keeps
+  showing them, whether it was live during the clear or reloads afterwards.
+- **The intent survives when the owner cannot take it.** If the owner is
+  unreachable the clear still succeeds: the node records the intent durably
+  (a bounded local queue, retries with backoff, one delivery attempt per owner
+  at a time) and hands it over when the owner is back. If the owner has no
+  notices surface at all the record stays blocked until the pairing changes.
+  In both cases the record — not the browser — is what keeps the card down: a
+  reload or a restart of the node does not bring it back. If the queue cannot
+  write (disk refusal), the intent is still honoured in memory but it cannot
+  survive a restart: the answer declares it with `durable: false` and the
+  degradation reason, instead of looking like the durable success.
+- **A browser that misses a closure heals at the next read.** The closure
+  frame travels live; a browser that never received it (offline, tab asleep)
+  catches up at the next fresh feed-state read, which reconciles the panel
+  with what the owner still serves. Views that are stale, incomplete or
+  flagged for resync never reconcile, so a degraded feed cannot silently
+  empty the panel.
+- **"Clear" is the whole visible set of that owner.** It closes every notice
+  currently shown for him on this node, in one request inside the owner's
+  per-request budget — never one request per card.
+
 ## Platform notes
 
 | Platform | Expected behavior |