meta-sovereign 0.53.0 → 0.53.2

package/README.md

@@ -61,7 +61,7 @@ The hosted app is the default UI: `serve` prints its address, <https://link-foun
 
 On macOS, interactive `serve` now handles the full setup: it protects this installation’s TLS key with Secure Enclave, detects existing certificate trust, requests trust only when needed, and opens the GitHub Pages app. For a headless launch use `node js/bin/meta-sovereign.js serve --trust=true --open=true`. `--trust=false` and `--open=false` opt out. The Swift helper needs the macOS Command Line Tools; `--hardware-key=false` explicitly opts into a file key on unsupported Macs. Hardware protection applies to the key on disk; Node uses it in memory. See [local server setup and security](docs/LOCAL-SERVER-SECURITY.md) for the exact access rules and limits.
 
-Open conversations load first and show loading or retry status until their history is ready. All / Private / Groups / Channels filters remain available inside every Telegram folder. Drag the vertical dividers to resize columns; widths are remembered. Calls is in the main menu after Chat, and Telegram account editing is under Profile. The default dark controls use white line icons. The JS server keeps its store under your OS user: `~/Library/Application Support/Meta Sovereign/store` on macOS, `%APPDATA%/Meta Sovereign/store` on Windows, and `${XDG_CONFIG_HOME:-~/.config}/Meta Sovereign/store` on Linux. Starting `serve` from an older checkout migrates its `.meta-sovereign` store once, preserving messages, contacts, sessions, media and certificate; a compatibility link preserves old paths. Restarts and a different working directory reuse the same store. `--store` or `META_SOVEREIGN_STORE_DIR` override it. See [chat readiness and data storage](docs/CHAT-READINESS.md).
+Open conversations load first. History loads automatically on scroll, with a compact indicator inside the message list while requesting or retrying; no history status panel or manual loading button is shown. Earlier history loads automatically on scroll in Chat and Operator. Message selection and menus work across the full row; unread cards use refreshed Telegram counters and retain cached data during connection failures. All / Private / Groups / Channels filters remain available inside every Telegram folder. Drag the vertical dividers to resize columns; widths are remembered. Calls is in the main menu after Chat, and Telegram account editing is under Profile. The default dark controls use white line icons. Buttons and action links have nonzero spacing and aligned control padding. Stories is off by default; Settings → Stories enables its display and requests. The JS server keeps its store under your OS user: `~/Library/Application Support/Meta Sovereign/store` on macOS, `%APPDATA%/Meta Sovereign/store` on Windows, and `${XDG_CONFIG_HOME:-~/.config}/Meta Sovereign/store` on Linux. Starting `serve` from an older checkout migrates its `.meta-sovereign` store once, preserving messages, contacts, sessions, media and certificate; a compatibility link preserves old paths. Restarts and a different working directory reuse the same store. `--store` or `META_SOVEREIGN_STORE_DIR` override it. See [chat readiness and data storage](docs/CHAT-READINESS.md).
 
 ## Connect the SPA to your server
 

package/js/src/crm/reengage.js

@@ -22,6 +22,10 @@ import {
   definedOnly,
   defaultAddressRules,
 } from './address-form.js';
+import {
+  telegramChatUrl,
+  isTelegramWebUrl,
+} from '../sources/telegram-chat-url.js';
 import { addressFormOf } from './person-learn.js';
 import {
   batchStopReason,
@@ -300,12 +304,18 @@ export const templateFor = (templates, form) =>
  * where the platform documents one; `null` elsewhere (copy the text).
  *
  * - e-mail: RFC 6068 `mailto:<addr>?body=` (line breaks as %0D%0A).
- * - Telegram: `tg://user?id=<id>` opens the chat with that user (Bot
- *   API docs); the text still has to be pasted, because Telegram has no
- *   pre-fill parameter for a user chat.
+ * - Telegram: documented username/phone links can prefill text; numeric-only
+ *   peers open the specific chat in Telegram Web (sign-in may be required).
  * - VK: `https://vk.com/im?sel=<peer>` opens the dialog with a user.
  */
-export const prefillLinkFor = ({ source, contact, chat, text }) => {
+export const prefillLinkFor = ({
+  source,
+  contact,
+  chat,
+  text,
+  username,
+  phone,
+}) => {
   const id = String(contact ?? '');
   const peer = String(chat ?? id);
   if (source === 'email' && /^[^\s@]+@[^\s@]+$/.test(id)) {
@@ -319,7 +329,10 @@ export const prefillLinkFor = ({ source, contact, chat, text }) => {
   }
   const tg = source === 'telegram' ? id.match(/^(?:user)?(\d+)$/) : null;
   if (tg) {
-    return { url: `tg://user?id=${tg[1]}`, prefillsText: false };
+    const url = telegramChatUrl({ source, chat: tg[1], username, phone, text });
+    return url
+      ? { url, prefillsText: Boolean(text) && !isTelegramWebUrl(url) }
+      : null;
   }
   return null;
 };

package/js/src/replies/reply-cache.js

@@ -289,30 +289,34 @@ export const createReplyCache = ({
  * none — three at most, as the strip shows them.
  */
 export const mergeSuggestions = (local, remote, { limit = 8 } = {}) => {
-  if (!local) {
-    return remote ?? { stage: 'none', suggestions: [] };
-  }
-  if (!remote?.suggestions?.length) {
-    return local;
-  }
-  const whole = (list) => list.filter((s) => s.kind !== 'word');
-  const shown = new Set(
-    whole(local.suggestions).map((s) => normalizeMessage(s.text))
-  );
-  const added = whole(remote.suggestions).filter(
-    (s) => !shown.has(normalizeMessage(s.text))
-  );
-  const wholes = [...whole(local.suggestions), ...added].slice(0, limit);
-  const taken = new Set(wholes.map((s) => normalizeMessage(s.text)));
-  const wordsOf = (result) =>
-    result.suggestions.filter(
-      (s) => s.kind === 'word' && !taken.has(normalizeMessage(s.text))
-    );
-  const known = wordsOf(local);
-  const words = (known.length > 0 ? known : wordsOf(remote)).slice(
-    0,
-    Math.min(3, limit - wholes.length)
-  );
-  const suggestions = [...wholes, ...words];
-  return { ...local, stage: suggestions[0]?.kind ?? 'none', suggestions };
+  const base = local ?? remote ?? { stage: 'none', suggestions: [] };
+  const seen = new Set();
+  const unique = (list) =>
+    list.filter((suggestion) => {
+      const key = normalizeMessage(suggestion.text);
+      if (!key || seen.has(key)) {
+        return false;
+      }
+      seen.add(key);
+      return true;
+    });
+  const localItems = local?.suggestions ?? [];
+  const remoteItems = remote?.suggestions ?? [];
+  const whole = unique(
+    [...localItems, ...remoteItems].filter((s) => s.kind !== 'word')
+  ).slice(0, limit);
+  const knownWords = localItems.filter((s) => s.kind === 'word');
+  const words = unique(
+    knownWords.length
+      ? knownWords
+      : remoteItems.filter((s) => s.kind === 'word')
+  ).slice(0, Math.min(3, limit - whole.length));
+  const suggestions = [...whole, ...words];
+  return {
+    ...base,
+    stage: suggestions.length
+      ? (suggestions[0]?.kind ?? base.stage ?? 'none')
+      : 'none',
+    suggestions,
+  };
 };

package/js/src/server/live-subset.js

@@ -0,0 +1,46 @@
+/** Keep a small derived set current without rescanning the entire archive. */
+export const createLiveSubset = (store, matches) => {
+  if (typeof store.subscribe !== 'function') {
+    return () => store.query(matches);
+  }
+  const records = new Map();
+  let pending = null;
+  let loaded = false;
+  let during = [];
+  const apply = (event) => {
+    if (event.type === 'delete') {
+      records.delete(event.id ?? event.link?.id);
+    }
+    if (event.type === 'put') {
+      if (matches(event.link)) {
+        records.set(event.link.id, event.link);
+      } else {
+        records.delete(event.link.id);
+      }
+    }
+  };
+  store.subscribe?.((event) => {
+    if (loaded) {
+      apply(event);
+    } else {
+      during.push(event);
+    }
+  });
+  return async () => {
+    if (!loaded) {
+      pending ??= Promise.resolve()
+        .then(() => store.query(matches))
+        .then((links) => {
+          links.forEach((link) => records.set(link.id, link));
+          during.forEach(apply);
+          during = [];
+          loaded = true;
+        })
+        .finally(() => {
+          pending = null;
+        });
+      await pending;
+    }
+    return [...records.values()];
+  };
+};

package/js/src/server/local-tls.js

@@ -20,7 +20,7 @@ import crypto from 'node:crypto';
 import { promises as fs } from 'node:fs';
 import net from 'node:net';
 import path from 'node:path';
-import tls from 'node:tls';
+import http2 from 'node:http2';
 import { DIR_MODE, tighten, writeFileDurable } from '../storage/durable.js';
 import {
   certificateFingerprint,
@@ -265,8 +265,19 @@ export const listenHttpAndHttps = (
   host = '127.0.0.1'
 ) =>
   new Promise((resolve, reject) => {
-    const secure = tls.createServer({ key, cert }, (socket) =>
-      httpServer.emit('connection', socket)
+    // Multiplex API calls, media and event streams over HTTPS. HTTP/1's six
+    // browser connections can otherwise all wait behind long media downloads.
+    const secure = http2.createSecureServer(
+      { key, cert, allowHTTP1: true },
+      (req, res) => {
+        // Keep the existing strict Host and Origin checks for HTTP/2 too.
+        req.headers.host ??= req.headers[':authority'];
+        httpServer.emit('request', req, res);
+      }
+    );
+    secure.requestTimeout = httpServer.requestTimeout;
+    secure.on('upgrade', (req, socket, head) =>
+      httpServer.emit('upgrade', req, socket, head)
     );
     // A browser that does not trust the certificate yet hangs up.
     secure.on('tlsClientError', () => {});

package/js/src/server/routes-automations.js

@@ -41,6 +41,7 @@
  * chat menu can test an edited automation before saving it.
  */
 
+import { createLiveSubset } from './live-subset.js';
 import { bodyFailure, json, readBody } from './util.js';
 import { confirmed } from './confirmations.js';
 import { previewFields } from '../sources/telegram-link-preview.js';
@@ -441,9 +442,16 @@ const POST = {
 
 // Only typing links are read (asked every few seconds: copying the
 // whole store each time cost memory and time).
+const typingByStore = new WeakMap();
 const typingNow = async (store, q) => {
+  if (!typingByStore.has(store)) {
+    typingByStore.set(
+      store,
+      createLiveSubset(store, (link) => link?.id?.startsWith('typing:'))
+    );
+  }
   const now = Date.now();
-  return (await store.query((l) => l?.id?.startsWith('typing:'))).filter(
+  return (await typingByStore.get(store)()).filter(
     (l) =>
       (!q.get('source') || l.source === q.get('source')) &&
       (!q.has('chat') || String(l.chat) === q.get('chat')) &&

package/js/src/server/routes-derived.js

@@ -71,40 +71,56 @@ const facts = async (store) => {
   return extractFacts(messages, patterns);
 };
 
-// Every page that looks for the server asks /api/status, and reading
-// and verifying the whole store takes seconds on a big one: the answer
-// is kept until the store changes, and requests that come while it is
-// being worked out share it.
+// Full statistics may take seconds on a large store. Discovery uses the
+// constant-cost probe below; statistics callers share one in-flight snapshot,
+// even when background sync writes while that snapshot is being computed.
 const statuses = new WeakMap();
 const cachedStatus = (store) => {
   let entry = statuses.get(store);
   if (!entry) {
-    entry = { value: null, watched: typeof store.subscribe === 'function' };
+    entry = {
+      value: null,
+      pending: null,
+      revision: 0,
+      watched: typeof store.subscribe === 'function',
+    };
     statuses.set(store, entry);
     store.subscribe?.(() => {
       entry.value = null;
+      entry.revision += 1;
     });
   }
-  if (!entry.value || !entry.watched) {
-    const value = (async () =>
-      computeStatus(await store.query(), (await store.verify?.()) ?? []))();
-    entry.value = value;
-    value.catch(() => {
-      if (entry.value === value) {
-        entry.value = null;
-      }
-    });
+  if (entry.pending) {
+    return entry.pending;
   }
-  return entry.value;
+  if (entry.value && entry.watched) {
+    return entry.value;
+  }
+  const revision = entry.revision;
+  entry.pending = (async () => {
+    try {
+      const value = computeStatus(
+        await store.query(),
+        (await store.verify?.()) ?? []
+      );
+      if (entry.revision === revision) {
+        entry.value = value;
+      }
+      return value;
+    } finally {
+      entry.pending = null;
+    }
+  })();
+  return entry.pending;
 };
 
 const HANDLERS = {
   '/api/contacts': async (store) =>
     aggregateContacts(await store.query(), { people: true }),
-  '/api/status': async (store) => ({
-    service: 'meta-sovereign',
-    ...(await cachedStatus(store)),
-  }),
+  '/api/status': async (store, url) =>
+    url.searchParams.get('probe') === '1'
+      ? { service: 'meta-sovereign', discovery: true }
+      : { service: 'meta-sovereign', ...(await cachedStatus(store)) },
   '/api/autocomplete': async (store, url) =>
     completionsFor(
       await store.query(),
@@ -135,7 +151,7 @@ const HANDLERS = {
     } = ctx.storeHealth?.() ?? {};
     return {
       ok: true,
-      links: (await store.query()).length,
+      links: (await store.size?.()) ?? (await store.query()).length,
       time: new Date().toISOString(),
       disk: await diskHealth(ctx.storeDir ?? '.', ctx.diskFree),
       store: { degraded, queuedBytes },

package/js/src/server/routes-events.js

@@ -69,7 +69,7 @@ export const handleEventRoutes = (store, req, res, p, ctx) => {
   res.writeHead(200, {
     'content-type': 'text/event-stream; charset=utf-8',
     'cache-control': 'no-cache, no-transform',
-    connection: 'keep-alive',
+    ...(req.httpVersionMajor === 2 ? {} : { connection: 'keep-alive' }),
     'x-accel-buffering': 'no',
   });
   // Reconnect quickly after the server restarts.

package/js/src/server/routes-telegram.js

@@ -502,6 +502,13 @@ const searchWords = (q) =>
 const LANG = /^[a-z]{2}$/;
 
 const POSTS = {
+  'dialog-state': async (account, body) => [
+    200,
+    (await account.dialogState?.({ chat: body.chat })) ?? {
+      ok: false,
+      supported: false,
+    },
+  ],
   sync: async (account, body) => [
     200,
     await account.sync({ full: Boolean(body.full), reason: 'manual' }),

package/js/src/sources/telegram-account.js

@@ -28,6 +28,7 @@
  * chat ids and the account's public name only.
  */
 
+import { createDialogState } from './telegram-dialog-state.js';
 import { buildMessageLink } from './link.js';
 import { personLink } from './live-links.js';
 import { accountOf, gramjsClientFactory } from './telegram-mtproto.js';
@@ -583,7 +584,6 @@ export const pinnedRanks = (listed) => {
   return ranks;
 };
 
-// What Telegram knows about a chat's reading and draft, as listed.
 const dialogReadLink = (chat, dialog, rank) => {
   const state = dialog.dialog ?? {};
   const draft = state.draft;
@@ -1123,10 +1123,15 @@ const createMessaging = (env) => {
     return { ok: true };
   };
 
-  return { post, setTyping, markRead, saveDraft };
+  return {
+    post,
+    setTyping,
+    markRead,
+    saveDraft,
+    dialogState: createDialogState(env, userChat),
+  };
 };
 
-// The user's connection, opened again if it was dropped.
 const reopenerOf = (store, connection) => async () => {
   const creds = await readTelegramCredentials(store);
   if (creds?.kind === 'user') {

package/js/src/sources/telegram-backfill.js

@@ -23,7 +23,7 @@
  */
 
 import { getHeapStatistics } from 'node:v8';
-import { historyLinkId } from './telegram-history.js';
+import { historyLinkId, floodSeconds } from './telegram-history.js';
 
 export const BACKFILL_EVERY_MS = 5000;
 export const BACKFILL_PAGE = 100;
@@ -271,10 +271,11 @@ export const createBackfill = ({
       // Nothing to read now; new chats may come with the list.
       base = paceAfter(did, everyMs);
     } catch (error) {
-      failures += 1;
+      const wait = floodSeconds(error);
+      failures = wait ? 0 : failures + 1;
       log({
-        level: 'warn',
-        event: 'telegram_backfill_failed',
+        level: wait ? 'info' : 'warn',
+        event: wait ? 'telegram_backfill_waits' : 'telegram_backfill_failed',
         code: error?.code ?? null,
         error: error?.message,
       });

package/js/src/sources/telegram-business-bots.js

@@ -90,7 +90,7 @@ const botOf = (connectedBot, users) => {
 
 // Telegram's PeerSettings, as the bar over a managed chat reads them.
 export const barOf = (settings, users) => {
-  if (settings?.businessBotId === undefined) {
+  if (!/^[1-9]\d*$/.test(String(settings?.businessBotId ?? ''))) {
     return null;
   }
   const user = (users ?? []).find(

package/js/src/sources/telegram-chat-info.js

@@ -377,6 +377,11 @@ const extrasOf = (user, full) => ({
 const botRevenueOf = (user, full) =>
   user.bot && full.canViewRevenue ? { canViewStarsRevenue: true } : {};
 
+const contactReach = (user) => ({
+  username: user.username ?? null,
+  phone: user.phone ?? null,
+});
+
 const fetchUser = async (client, Api, helpers, inputPeer, peers, chat) => {
   const storedPeer = inputPeer ?? (await peers.input(chat));
   const id = inputUserOf(Api, helpers, storedPeer, chat);
@@ -389,7 +394,7 @@ const fetchUser = async (client, Api, helpers, inputPeer, peers, chat) => {
     title: nameOf(user),
     members: 1,
     online,
-    username: user.username ?? null,
+    ...contactReach(user),
     about: full.about ?? null,
     photo: hasPhoto(user.photo),
     pinned: full.pinnedMsgId ?? null,

package/js/src/sources/telegram-chat-url.js

@@ -0,0 +1,34 @@
+// Normal Telegram clients ignore tg://user?id (a Bot API abstraction).
+// Use documented username/phone/message links; numeric-only peers use Web A's
+// signed-in chat route instead of launching a native app without a destination.
+// References: core.telegram.org/api/links; Ajaxy/telegram-tt src/util/routing.ts.
+export const telegramChatUrl = ({
+  source,
+  chat,
+  username,
+  phone,
+  lastId,
+  text,
+} = {}) => {
+  if (source !== 'telegram' || !/^-?[1-9]\d*$/.test(String(chat))) {
+    return null;
+  }
+  const handle = String(username ?? '').replace(/^@/, '');
+  const number = String(phone ?? '').replace(/[\s()+-]/g, '');
+  const native = /^[a-zA-Z][a-zA-Z0-9_]{3,31}$/.test(handle)
+    ? `https://t.me/${handle}`
+    : /^[1-9]\d{6,14}$/.test(number)
+      ? `https://t.me/+${number}`
+      : null;
+  if (native) {
+    return text ? `${native}?text=${encodeURIComponent(text)}` : native;
+  }
+  const id = String(chat);
+  if (/^-100\d+$/.test(id) && /^[1-9]\d*$/.test(String(lastId))) {
+    return `https://t.me/c/${id.slice(4)}/${lastId}`;
+  }
+  return `https://web.telegram.org/a/#${id}`;
+};
+
+export const isTelegramWebUrl = (url) =>
+  String(url ?? '').startsWith('https://web.telegram.org/a/#');

package/js/src/sources/telegram-dialog-state.js

@@ -0,0 +1,60 @@
+import { readLink } from './telegram-account-live.js';
+
+const refreshForum = async (env, chat, read) => {
+  if (!read?.forum) {
+    return;
+  }
+  await env.actions?.forumTopics?.({ chat: String(chat), fresh: true });
+};
+
+/** Refresh one peer's counters without sending any read acknowledgement. */
+export const createDialogState =
+  (env, userChat) =>
+  async ({ chat } = {}) => {
+    if (!/^-?\d+$/.test(String(chat ?? ''))) {
+      return { ok: false, code: 'bad-request' };
+    }
+    const target = await userChat(chat);
+    if (!target) {
+      return { ok: false, supported: false };
+    }
+    const { client, Api } = target;
+    const id = `read:telegram:${chat}`;
+    const before = await env.store.get(id);
+    const result = await env.queue.run(`dialog-state:${chat}`, 'view', () =>
+      env.connection.withPeer(client, String(chat), (peer) =>
+        client.invoke(
+          new Api.messages.GetPeerDialogs({
+            peers: [new Api.InputDialogPeer({ peer })],
+          })
+        )
+      )
+    );
+    const dialog = result?.dialogs?.[0];
+    if (!dialog || !Number.isFinite(dialog.unreadCount)) {
+      return { ok: false, code: 'dialog-unavailable' };
+    }
+    await refreshForum(env, chat, before);
+    const latest = await env.store.get(id);
+    // An update that arrived while Telegram answered is newer than this request.
+    if (JSON.stringify(latest) !== JSON.stringify(before)) {
+      return { ok: true, read: latest, changed: true };
+    }
+    const read = {
+      ...before,
+      ...readLink(String(chat), {
+        inboxMaxId: dialog.readInboxMaxId,
+        outboxMaxId: dialog.readOutboxMaxId,
+        unreadCount: dialog.unreadCount,
+        unreadTopId: dialog.topMessage,
+        unreadMark: Boolean(dialog.unreadMark),
+        unreadMentions: dialog.unreadMentionsCount,
+        unreadReactions: dialog.unreadReactionsCount,
+        muteUntil: Number(dialog.notifySettings?.muteUntil ?? 0),
+        folder: Number(dialog.folderId ?? 0),
+      }),
+      checkedAt: new Date(env.now()).toISOString(),
+    };
+    await env.store.put(read);
+    return { ok: true, read };
+  };

package/js/src/sources/telegram-forum.js

@@ -73,6 +73,44 @@ const lastOf = (link) =>
       }
     : null;
 
+// Forum dialogs can retain a nonzero aggregate after every topic was read.
+// Only a complete topic list can replace that aggregate with an exact count.
+const saveTopicUnread = async (store, chat, topics, count, baseline) => {
+  if (!Number.isFinite(count) || count < 0 || count > topics.length) {
+    return false;
+  }
+  const before = await store.get(`read:telegram:${chat}`);
+  if (
+    ['inboxMaxId', 'unreadTopId', 'unreadCount'].some(
+      (key) => before?.[key] !== baseline?.[key]
+    )
+  ) {
+    return false;
+  }
+  const unreadCount = topics.reduce(
+    (sum, topic) => sum + Math.max(0, topic.unread),
+    0
+  );
+  const top = Math.max(
+    Number(before?.unreadTopId ?? 0),
+    ...topics.map((topic) => topic.top),
+    0
+  );
+  await store.put({
+    ...before,
+    id: `read:telegram:${chat}`,
+    tokens: ['read', 'telegram', chat],
+    source: 'telegram',
+    chat,
+    forum: 1,
+    forumUnreadCount: unreadCount,
+    forumUnreadTopId: top,
+    forumDialogUnreadCount: Number(before?.unreadCount ?? 0),
+    forumReadInboxMaxId: Number(before?.inboxMaxId ?? 0),
+  });
+  return true;
+};
+
 /**
  * `env` is the account's; `userClient()` the user client or null;
  * `dialogOf(chat)` the chat as listed; `tools` its `toLinks` and
@@ -92,6 +130,7 @@ export const createForum = (
       return { ok: false, supported: false };
     }
     const { Api } = await env.importer();
+    const baseline = await env.store.get(`read:telegram:${target}`);
     let answer;
     try {
       answer = await env.queue.run(`forum-topics:${target}`, 'view', () =>
@@ -126,7 +165,15 @@ export const createForum = (
         .map((t) => topicOf(t, lastOf(byId.get(Number(t?.topMessage)))))
         .filter(Boolean)
     );
-    const result = { ok: true, forum: true, topics };
+    const count = Number(answer?.count);
+    const complete = await saveTopicUnread(
+      env.store,
+      target,
+      topics,
+      count,
+      baseline
+    );
+    const result = { ok: true, forum: true, topics, count, complete };
     kept.set(target, { at: now(), answer: result });
     return result;
   };

package/js/src/storage/app-directory.js

@@ -2,6 +2,7 @@
 import os from 'node:os';
 import path from 'node:path';
 import { promises as fs } from 'node:fs';
+import { renameDurable } from './durable.js';
 import { acquireStoreLock } from './store-lock.js';
 
 export const defaultStoreDir = ({
@@ -55,9 +56,9 @@ export const resolveUserStore = async ({
     await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
     if (await exists(target)) {
       // Preserve even an unused desktop folder; never delete user files.
-      await fs.rename(target, `${target}.before-migration-${Date.now()}`);
+      await renameDurable(target, `${target}.before-migration-${Date.now()}`);
     }
-    await fs.rename(legacy, target);
+    await renameDurable(legacy, target);
     try {
       await fs.symlink(
         target,
@@ -66,7 +67,7 @@ export const resolveUserStore = async ({
       );
     } catch (error) {
       // Restore the old location when a compatibility link cannot be made.
-      await fs.rename(target, legacy);
+      await renameDurable(target, legacy);
       throw error;
     }
     await fs.chmod(target, 0o700);

package/js/src/storage/dual-store.js

@@ -94,6 +94,12 @@ export const createDualStore = ({ binary, text }) => ({
     return { put: stale.length, deleted: extra.length };
   },
   async verify() {
+    // A live mirror delegates both reads to this very same text store, as
+    // reconcile() recognises above. There cannot be a logical difference;
+    // serialising both copies blocks large stores for seconds for no benefit.
+    if (binary.mirrors === text) {
+      return [];
+    }
     const a = await binary.query();
     const b = await text.query();
     const aMap = new Map(a.map((l) => [l.id, l]));

package/js/src/storage/secret-store.js

@@ -61,6 +61,7 @@ export const wrapSecretStore = ({ inner, passphrase }) => {
     rawStore: inner,
     logFile: inner.logFile,
     flushLog: inner.flushLog,
+    size: inner.size ? () => inner.size() : undefined,
     async put(link) {
       if (isSecret(link)) {
         const sealed = sealLink(link, passphrase);
@@ -83,7 +84,11 @@ export const wrapSecretStore = ({ inner, passphrase }) => {
       return inner.delete(id);
     },
     async query(filter) {
-      const all = await inner.query();
+      // Apply non-secret filters before cloning the archive. A typing or health
+      // poll must not allocate a copy of every stored message.
+      const all = await inner.query(
+        filter ? (link) => isSecret(link) || filter(link) : undefined
+      );
       const opened = all.map((l) =>
         l.id.startsWith(SECRET_PREFIX) && l.enc ? openLink(l, passphrase) : l
       );