monal-rebuild/UX-IMPLEMENTATION-RESULTS.md

UX packages 0–3 — implementation evidence

2026-10-07, blunix, Sol High. Packages 0–3 are implemented in separate reviewable commits; the operator also authorized release to chat.0ff.space. Existing audit findings remain historical evidence in UX-AUDIT-REPORT.md. No protocol namespace, cryptographic format, dependency, room privacy, LLDAP configuration or personal account was changed.

Changes

• Package 0 (40f8d3b): configurable origins and candidate expectations, private reusable profiles, revision/build identification and failure exit codes. Candidate mode excludes the old manual cache deletion. Follow-up 6e4f6be retires deliberately added devices and fixes the scroll setup.
• Package 1 (0977c0e): validated legacy PEP device events, account-scoped caches, five-minute freshness and reconnect invalidation. Non-roster peers refresh at conversation/send-burst start (ten seconds idle); concurrent refreshes coalesce. Explicit empty lists are distinct from malformed or unavailable responses. Known OMEMO peers cannot silently become plaintext recipients. Existing identities and ratchets remain.
• Package 2 (e17a02d): visible readable incoming messages determine outgoing cumulative displayed markers. Local badge clearing is independent. Later readable messages advance past unreadable gaps without changing stored decrypt errors. Remote markers advance cumulatively and monotonically. Ticks expose accessible “Displayed” labels; errors offer explanatory help.
• Package 3 (bf93174): Session owns conversation media capability. File selection, paste, drop, recording and programmatic sending fail before upload/microphone access when unsupported or uncertain. Capability is rechecked at upload boundaries. Joined group uploads and cancellation work.

Marker policy was recorded in README.md before package 2 code was changed. It uses XEP-0333 cumulative reports rather than asserting human reading or successful decryption of every earlier message. The existing database read status stays compatible; its user-facing label changes.

Candidate verification

Ran npm run check (zero errors/warnings), npm test, npm test -- --test-isolation=none (57 passing tests), npm run build, runner syntax checks and git diff --check. Added tests cover PEP validation, account isolation, freshness/request counts, non-roster bursts, reconnect, concurrent refreshes, a newer event racing an older fetch, failure/empty lists, changed peer/own encryption targets and real ratchet decryption. Status tests cover visible candidates, unreadable gaps, local badges, own-device cumulative sync, out-of-order external markers and retained errors. Upload tests cover zero slots/PUTs on rejection, revocation after a slot, supported upload and cancellation before network activity.

Sequential one-worker Chromium 152 / Linux WebKit 26.5 runs used http://127.0.0.1:4173 and the production-built candidate, 402 × 874 CSS pixels, existing dedicated A/B accounts and the existing audit room. No concurrent build/browser runs. Build: assets/index-B41Jitwn.js, SHA-256 13e5c4265d1a006c1d3b028f227ef64d31ef7d9673a4e01b724d4d6601ec9fd6.

Private evidence (credentials, profiles and captures never enter Git):

• Original candidate reproducer: /tmp/chat-ux-runner/results/direct-pwa-chromium-1791389739800/report.json. New B could not decrypt, but A showed “read”. Later healthy checks failed without the historical intervention, as expected.
• Package 1 additions passed independently in Chromium and WebKit: direct-pwa-chromium-1791389950620 and direct-pwa-webkit-1791390150675.
• Package 2 failed-message/later-readable-message policy passed in both: direct-pwa-chromium-1791390512931 and direct-pwa-webkit-1791390546658.
• Combined candidate runs passed: direct-pwa-chromium-1791390917997, direct-pwa-webkit-1791391115192 and direct-pwa-chromium-1791391707447 (fresh B device plus removal/cleanup). All are under /tmp/chat-ux-runner/results/.
• Unsupported direct selection, paste and drop: zero slot requests, zero PUTs. Chromium voice entry: disabled, zero microphone requests. WebKit's Linux runtime has no recording control; native recording is not certified.
• Group file/image upload works. Chromium additionally verified cancellation during a held PUT; both verified cancellation while awaiting a slot causes zero PUTs. WebKit's first HTTP-route cancellation probe failed to intercept a worker-handled request; using the WebSocket slot boundary made the cancellation deterministic. That failed harness report remains historical.
• WebKit scroll setup is now conclusive: 500 px from bottom before navigation, 0 afterward (direct-pwa-webkit-1791391654086). Position preservation remains package 4, outside this implementation scope.
• Temporary B devices 363053480, 1653794215, 1682378312 and 365948477 were removed through Settings. A/B stable profiles remain for ordinary retests.

Remaining validation boundaries

Current physical Monal interoperability was not rerun: no actual Monal client is controlled by this host. Legacy wire/ratchet compatibility tests pass, and the earlier deployed Monal acceptance remains historical evidence, not a fresh package-1 interop result. Actual iPhone safe areas/keyboard, background/lock, trusted OS push/open, large text and VoiceOver also remain native-device checks. Linux WebKit emulation is not iOS certification. No packages 4–9 were implemented; the old pre-device encrypted backlog continues to be intentionally unreadable on a newly added device.

Rollout

Client source pushed through 6e4f6be. The isolated blunix lock update is 0de30ba on the existing capability-layout branch, preserving all pending handoff edits. Deployment and post-release evidence are recorded below once verified.

Verified release: generation 548, active system /nix/store/9r48rc31k0fimd2yznvdycfzrrlhxqyw-nixos-system-blunix-26.11.20260910.8ce4ef6. The active nginx root is /nix/store/znp4ysxgmaz8hrbqinpl2mjbmcld5nwl-0ff-chat-0.1.0. Live HTTPS returns 200 with the expected CSP and the same JS asset/hash as the candidate. nginx, Prosody, Traefik, LLDAP, Dex, Headscale, Forgejo, GoToSocial, sshd and Tailscale were active, with zero failed units. Only nginx restarted in the switch. Previous generation 547 retains the pre-release system (dmw37zhy01457x6sl134gmc8klbp2gds); rollback remains available.

Full deployed Chromium/WebKit regression reports: /tmp/chat-ux-runner/results/direct-pwa-chromium-1791391946961/report.json and /tmp/chat-ux-runner/results/direct-pwa-webkit-1791392088226/report.json. Both verified the actually executing asset, current strict CSP, fresh B device readability without cache manipulation, correct delivered/displayed transitions, the unreadable-gap policy, zero unsupported-media slots/PUTs, group file/image decoding, cancellation before PUT and the real HTTPS service worker. Chromium also verified zero microphone requests; WebKit recording remains unavailable in this Linux runtime. Fresh B devices were removed afterward and the sender cache reflected each removal. Live Chromium/WebKit runs sampled at least 1526/1318 MiB available RAM. Stable profiles retain separate identities per origin; ordinary retests reuse them.

Later commits only add audit documentation and runner instrumentation; they do not change the deployed application bundle or require another input bump.

Post-release push-handler simulation also passed within its limits: /tmp/chat-ux-runner/results/direct-pwa-chromium-1791392245466/report.json. CDP delivered a synthetic push to the real HTTPS worker, which created the notification; a synthetic click routed to the right conversation. The browser rejected focus for the untrusted click (expected test limitation). No actual push relay, OS delivery or trusted phone click is certified.