Duncan 323bf68107 fix(sidebar): make outbox records write-once so foreign reclaim is race-free ...

The per-window token/recheck reclamation still performed a non-atomic
compare-then-delete on a mutable foreign key: a live owner could rewrite
its key between the reclaim decision-read and the removeItem, and the
whole-blob `queuedAt <= head.created_at` gate dropped same-second and
legacy `queuedAt=0` records that had not provably lost LWW.

Records are now write-once: a key is `<prefix>:<pubkey>:<relay>:<nonce>:<seq>`
and is never rewritten. A new edit writes a new key (next zero-padded seq)
then deletes its own older keys (write-before-delete, so a crash leaves at
least one record). Foreign reclamation reads an immutable record, proves it
reclaimable against durable relay evidence, and deletes it with no recheck.
Whole-blob supersession is strict (`queuedAt < head.created_at`); replay runs
before reclamation in every hook so a same-second record is consumed into
pending first; the legacy v1 shared key is only ever replayed, never deleted.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-26 20:57:11 -04:00

..

app

highlight search terms in results and messages (#6702)

2026-08-25 16:22:12 +00:00

features

fix(sidebar): make outbox records write-once so foreign reclaim is race-free

2026-08-26 20:57:11 -04:00

shared

feat(desktop): persist agent addressing across composer messages (#6714)

2026-08-25 18:44:25 +00:00

testing

highlight search terms in results and messages (#6702)

2026-08-25 16:22:12 +00:00

types

…

features-manifest.d.ts

feat(model-capabilities): drive model capabilities and labels from one manifest (#5597)

2026-08-17 11:23:28 -04:00

jdenticon.d.ts

…

main.tsx

Add font size and conversation density preferences (#5644)

2026-08-18 15:24:09 -07:00

upng-js.d.ts

…

vite-env.d.ts

…