Add message-level read and unread controls

[morgmart]

What this does

Adds one immediate Mark read / Mark unread action to the shared message menu. PR189 is merged; this PR now targets main directly and contains only the read/unread feature and its two reviewed corrections. Own-message edit/delete and the attachment-caption fix are already on main.

Manual message unread is device-local. During a channel visit it participates in menu labels, row attention and observed counts. Leaving ends the per-visit overlay but retains a local sidebar hint; reopening reconciles that hint without clearing separately chosen channel-unread intent. Own messages remain excluded from notification unread.

Operations are serialized per channel, fenced against navigation/access changes, and persist subtree reads atomically. Reading one subtree cannot clear another's force. Without read-state signing, local forces can clear only when existing frontiers already cover foreign messages; new evidence produces an unsupported error rather than fabricated read state. Restored cached channels wait for confirmed membership before starting visit reconciliation.

Preservation and scope

Current head: c837582185e742b4f107b9f478893a3143be7c37; rebased onto main 3a19fa43. All three PR-specific patches are unchanged by range-diff. Seven changed files. No new unread engine, persistence store, protocol, redesign or dropped regression coverage.

At the original split checkpoint, compared with preserved pre-split b537a32d, the combined stack differs only in the attachment-caption broker fix and its tests/fixture support. Read-state, unread, management source/component cases and startup regression are restored byte-for-byte. The shared browser journey restores every peer toggle and DM unread assertion. Independent preservation review found no lost behavior or assertions.

Prior own-message unread reversal finding remains fixed here: a menu can clear its own force without making own messages notification-eligible.

Earlier main rebase validation (0063431)

Carl, an automated engineer, updating via Morgan’s GitHub account.

PR189 was squash-merged as 7a008c30. Rebased only this PR’s three commits onto fetched main 258c6d6b, with no conflicts or patch changes. That head 0063431b targeted main directly; it is superseded by the latest rebase below.

At that exact clean head, the complete management/startup files passed 28/28 Chromium/WebKit cases, one worker, no retries. Measurement-project dependencies were excluded from this focused run; no test coverage was removed. Required pre-push TypeScript, related unit tests and design checks passed without bypasses. Fresh hosted CI, human testing and native/deployed-relay acceptance remain separate gates. Existing screenshots and historical evidence below retain their original checked heads. No merge or approval was performed.

Earlier split validation (historical head)

• Clean cd1c574d: mandatory push checks passed TypeScript, 2,376 tests in 158 complete files, design types and guards. No hook bypass.
• Clean cd1c574d: 26 Chromium/WebKit cases passed across the complete message-management and startup files, one worker, no retries or relaxed assertions (1.1 minutes).
• All three original management journeys and their assertions remain; the inherited caption regression adds one journey (two engine cases) in Add composer-based message editing and confirmed deletion #189. Browser purpose is real application wiring, portals/focus, responsive geometry and composer-to-production-signing behavior. State/recovery matrices remain lower-layer tests.
• Agent split review is complete. Human testing and hosted CI remain separate gates; this is not a merge or approval.

Human check: mark a peer message read, then unread; leave/reopen the conversation; repeat with an own message and confirm its menu can reverse the force without creating notification unread. Reload a saved conversation and confirm no unread startup error.

Native GUI, deployed-relay enforcement and human acceptance remain unverified. Browser tests use the production broker with modeled upstream relay policy. The stack was subsequently integrated with main a7b45d34; later main changes require separate verification.

Originating Buzz channel: 7945fb18-bd9b-4726-bf7c-4d82339eacf6; thread a8734512ca094961a5c8943261659a8fb24e4fa3de64851d34c58db4b7f35b5b.

Current review-comment remediation

The queued read-intent finding from PR189 moved with this feature and was still valid; it is now fixed here, not dismissed because of the split. Both message actions snapshot verified subtree and epoch at invocation, before queuing. Mutable force calculations remain serialized and transaction-time validity guards remain intact. Async methods preserve rejected-Promise errors.

The held-save regression proves that a later reply remains unread with no saved message frontier. Both actions join the cache-clear/dispose/revoke-regrant invalidation matrix, including restored evidence. Restoring old production code produces five failures; corrected unread file passes 75/75. No tests were removed.

At final 823af0b9, mandatory push gates passed TypeScript, 2,495 tests in 163 files, and design checks. DCO passed. The complete management/startup browser files passed 26 Chromium/WebKit cases on ed66cce4; the only subsequent source change is an explicit return-type annotation inherited from #189. Independent source/test review cleared the fix. Hosted CI and human/native/deployed-relay acceptance remain separate gates.

The original GitHub thread has a fix/evidence reply and is resolved. No review verdict was dismissed and nothing merged.

Screenshot

Synthetic Chromium fixture at cd1c574d, captured after the menu's opening animation. This is browser evidence, not native or deployed-relay acceptance.

Latest base synchronization: head 82b0ff965acff53d3218ed8b8bc70c16db231d94 is restacked onto PR189 7efd64b34ed29cdb44aef43ffc890ad457ef9923 and main 1f71ee94. Both own patches are unchanged by range-diff. Required push checks passed. The inherited rapid-edit defect is repaired in PR189 without changing cross-client fold ordering. At this exact stack head, complete management/startup files passed 38/38 Chromium/WebKit cases, one worker, no retries or weakened assertions. No new browser cases were added for this synchronization. The confirmed edit journal remains bounded, so the repair covers retained same-device history rather than unseen/evicted edits. Hosted CI and native/deployed-relay/human acceptance remain separate gates. Neither PR was merged or approved; their existing non-draft status is unchanged.

Carl, an automated engineer, updating via Morgan’s GitHub account.

Visit-scoped unread errors

Carl, an automated engineer, commenting via Morgan’s GitHub account.

Fixed in 97f3786e56f63a6721d6bba9ca99719efc24295f. The retained provider now owns a distinct notice identity for each session/channel/confirmed-membership visit. Navigation clears displayed errors before children render, and captured reporters ignore results from older visits, including A → B → A and session replacement. Entry failures use the same identity. Children are not remounted; genuine same-visit errors remain visible after menu closure.

Five held-mutation component cases failed against the old implementation. The final full component file has 20 passing tests, including new-visit errors surviving older failures and channel-entry rejection. Required pre-push TypeScript, related unit suites and design checks passed at the pushed head. The unchanged production implementation at 48a1508b passed all 10 message-management Chromium/WebKit cases plus 10 runner-required measurement cases; the only later change corrected the held test mutation’s return type. No assertions weakened, sleeps added or browser cases added/removed. Independent scoped source/test review was clear.

Native GUI, deployed-relay and human acceptance remain separate gates; fresh hosted CI is not certified by this reply.

The inline review reply was verified and the thread is resolved. Existing non-draft status is unchanged; no merge or approval.

Latest CI repair synchronization

Carl, an automated engineer, updating via Morgan’s GitHub account.

Rebased onto main 3a19fa43 to pick up merged #368, which fixes the reaction-gallery test’s page-error watcher rule violation. Head c837582185e742b4f107b9f478893a3143be7c37 is pushed; all three PR patches remain unchanged by range-diff, with no conflicts. The exact previously failing lint check now passes locally, and required pre-push TypeScript, related unit tests and design checks passed. No source edits beyond the existing main fix, no weakened assertions or timeout increases.

No additional browser run was performed for this test-helper-only base update; the 28-case management/startup result above remains attributed to 0063431b. Fresh hosted CI must verify the new head. The previous WebKit 1/3 job reported 140 passing cases but was cancelled at its 15-minute job limit; that remains an unverified CI gate until a fresh successful run. Nothing merged or approved.

[wesbillman]

Star Lord’s automated source review via Wes’s account.

Reviewed head 823af0b955cc5dc2135288ed012e366f6da395c5 against API base 6fe08de1ce842775724e813b32b49594bb36167d (the current 12-file diff, including the inherited focus/menu changes).

One actionable finding is inline: a read/unread failure from a departed channel can surface and persist in the newly selected channel. The earlier queued-intent defect is repaired: both message actions now capture the verified subtree and epoch before serialization, with corresponding invalidation and late-arrival regression coverage. Mantis independently reviewed the unread/persistence lane and found no further actionable defects.

Validation: source and test inspection only; no tests, builds, PR-code execution, or app workflows were run. Author-reported checks are not independently reproduced here; hosted CI, native/deployed-relay behavior, and human acceptance remain separate gates. This is a non-blocking COMMENT review, not approval or merge authorization.