Add verified Inbox evidence and exact edit closure

docs/inbox.md

@@ -0,0 +1,107 @@
+# Inbox: in-progress port
+
+Inbox is currently a bundled placeholder page (`buzz.inbox/inbox`). This
+stacked PR's session evidence is not displayed until the dependent Inbox UI PR.
+No new navigation behavior is part of this evidence slice.
+
+## Evidence slice (stacked with Inbox UI)
+
+PR3 adds no Inbox UI. The subsequent Inbox page uses `session.unread.inbox()` as
+its single conversation projection and `session.inboxFeed` as bounded addressed
+history demand. These changes are one launch batch, not a separately shippable
+backend feature. Ordinary channel and thread readers, read-state storage and
+outbox retain their existing ownership. No projects, approvals or reminders.
+
+## Ownership and limits
+
+`session.unread.inbox()` / `subscribeInbox()` own retained verified unread
+evidence and read actions. `session.inboxFeed` owns finite, verified addressed
+history demand and exact incomplete-target metadata, not a row cache. Finite
+results and live arrivals, edits and deletions use the existing session admission
+and shared unread fold, so own/deleted messages stay absent and unresolved roots
+never become duplicate conversations. Current membership gates the feed's
+completeness targets and unread's rows; joining alone does not materialize
+pre-membership history without fresh shared admission. Inbox renders those shared
+conversation rows directly; there is no second project/approval row merge or
+feed-owned reconciliation buffer and deletion-count abort. PR4 owns only
+presentation, filtering and selection. No parallel signing or persistence is
+added. Optional profile enrichment belongs to PR4; access, cache clear and
+session retirement fence these projections. Opening Inbox does not mark rows
+read; selecting an unread row does. Canonical Messages keeps its own reading
+behavior.
+
+DM read clears the channel through its newest retained evidence. Thread read
+advances the thread prefix, including earlier unshown replies, plus individually
+represented top-level mentions and local message marks, but not unrelated
+messages. Participation follows the shared unread owner's direct-parent policy,
+including its existing bounded lookups for replies whose membership is undecided.
+Fetched roots and participation witnesses remain structural, never extra Inbox rows.
+A lookup-only root uses the existing exact-message manual-unread target until counted
+root evidence arrives; its known root still supplies grouping and read-through.
+Relevant replies remain thread activity even when the root cannot be fetched.
+Multiple steps are not atomic: failures leave remaining evidence retryable. Manual unread is local to this device. Hosts without frontier-sync
+disable read mutations. Saved frontiers are not proof of remote reconciliation.
+
+This is **bounded recent evidence**, not a complete historical inbox. Unread
+retains at most 4,096 events / 8 MiB, observing up to 500 recent events per
+128-channel roster batch. A lazy addressed query returns up to 50 kind-9/40002
+messages. For those exact IDs and unresolved failed targets, general `#e`
+queries page signed kind-40003 edits and kind-5/9005 deletions, then deletions
+of the edits; `include_aux` on an ordinary `#p` query is not a supported relay
+contract. Both auxiliary stages must finish before the feed is ready. Retained
+unread evidence can be provisionally admitted between queries, but exact target
+IDs are marked incomplete **before** unread subscribers are notified. The
+consumer must not show their body as current while incomplete; failures retain
+that metadata and offer retry. This is a completeness signal, not atomic content
+admission or a second message fold. A target outside the latest 50 addressed
+rows is not discovered; if a failed target falls outside a later page its
+bounded auxiliary check still runs before its incomplete flag is cleared.
+Incomplete obligations survive disconnect and unrelated access revocation while
+the corresponding readable unread evidence survives; full cache/session retirement
+clears both. Tombstone checks include retained author edits even if a later relay
+query omits their soft-deleted rows. If reference visibility withholds an auxiliary
+event, the finite attempt stays failed/incomplete rather than treating the filtered
+page as exhausted history. Explicit Retry can settle it once existing shared
+readers have admitted the missing reference; Inbox adds no reference-resolution loop.
+Auxiliary reads cap retained results at 2,000 events / 4 MiB per stage; the shared reader
+keeps its existing per-request deadline and cancellation. Missing roots,
+participation or older activity can omit rows; an empty Inbox does not prove
+complete history. No polling, independent row source or channel window is
+opened for the feed. Access/cache/disconnect/disposal fence pending reads; local
+read intent remains with unread. Packaged/native acceptance and human visual
+feedback remain separate.
+
+Reminders and their NIP-ER lifecycle are **not included** in this change.
+The unfinished reminder prototype is preserved separately for later work,
+not shipped in the Inbox source or broker routes. Follow/mute Inbox policy,
+full backlog discovery and nonchat activity are outside this slice. Project and
+approval queries, grouping, routing and detail presentation are deliberately
+excluded rather than presented as partial parity. Native/ACP packaged acceptance and human visual feedback
+remain open. Do not treat this as the full OG Inbox port.
+
+## Verification status
+
+`inbox-feed.test.ts` exercises the real session reader/visibility/unread owners
+with signed ephemeral events, including the first-admission subscriber ordering,
+held edit and tombstone reads, failure/retry, reentrant access removal and cache
+reset, root regrouping, and an edited addressed target older than 500 ordinary
+messages. `unread.test.ts` retains the current main read/catch-up behavior and
+adds Inbox projection/read-state cases. Neither file establishes browser paint,
+real relay persistence or packaged/native acceptance. PR4 must cover the
+per-row pending/failed presentation contract and exact inline previews.
+
+
+### Review repairs
+
+Incomplete obligations now survive lifecycle changes that retain readable evidence.
+Closure includes retained author edits omitted by later relay queries and fails
+visibly on withheld auxiliary evidence. Shared unread remains the sole row owner;
+the unused feed row copy and its 70-deletion abort were removed with explicit
+approval. A prepared channel-read intent lets the dependent UI retry the original
+cutoff and manual-clear keys. Tests retain all prior scenarios, distinguish both
+finite retention guards, and prove 71 admitted author deletions do not resurrect
+rows or require a second reconciliation buffer.
+
+Prior local tests and review cover the repairs on the combined tree; this PR's
+updated head requires its own checks. No human/live/native acceptance or shipping
+readiness is claimed.