@ours.network/messenger-server 1.0.21 → 1.0.22

package/README.md

@@ -191,12 +191,27 @@ subscription. On iOS, install the site to the Home Screen before enabling push.
 
 Delivery jobs are durable, identity-scoped metadata keyed by authenticated
 sender CID, wire ID, and event kind. They never persist message text or file
-contents. Each attempt re-reads the canonical SDK projection; restart resumes
-pending work, duplicate watcher events converge to one job, 404/410 responses
-prune dead bindings, and transient network/429/5xx responses use bounded
-backoff with jitter and expiry. Push failures do not stop the watcher.
-
-An absent `push.json` is initialized on first run. An existing file that is
+contents. Each attempt re-reads the canonical SDK projection; restart restores
+pending or crash-interrupted work, duplicate watcher events converge to one
+job, 404/410 responses prune dead bindings, and transient network/429/5xx
+responses use bounded backoff with jitter and expiry. A successful delivery
+deletes the full job immediately and leaves only a 15-minute dedupe tombstone;
+tombstones are capped at 256 and delivery totals live in separate counters.
+
+Messenger persists a byte checkpoint for the daemon's separate durable,
+content-free notification log. A new installation primes at the current tip;
+after that, restart and reconnect resume from the committed checkpoint. A page
+checkpoint stores only bounded start/end, digest, count, and next-index metadata.
+It advances with durable admission, so an oversized page can pause at capacity
+and resume at the refused event without replaying its admitted prefix after old
+tombstones expire. Health/state surfaces expose saturation and cumulative
+admission failures. Messenger never scans unread message/file history to
+synthesize pushes.
+
+An absent `push.json` is initialized on first run. Version-2 state migrates
+atomically: valid pending/retry work is preserved, recent terminal rows are
+compacted into the small tombstone budget, and obsolete terminal history is
+removed while its totals move to counters. An existing file that is
 unreadable, malformed, or schema-invalid aborts startup without rewriting keys,
 bindings, or jobs; the error identifies the preserved path and requires the
 operator to restore it or explicitly move it aside before a new state is made.

package/dist/chunks/{chunk-7KB5SIFJ.js → chunk-WNFB2E2A.js}

@@ -37,7 +37,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_MESSENGER_BUILD_INFO_default;
 var init_define_MESSENGER_BUILD_INFO = __esm({
   "<define:__MESSENGER_BUILD_INFO__>"() {
-    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.21", sha: "b7ebcacc569c05f8c0dab75f77290530866f6f55", dirty: false };
+    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.22", sha: "db9ae1582a88989af3ef317c73a6f93c2465e2a3", dirty: false };
   }
 });