Settle successfully sent PWA read receipts

Author: code4bones

pwa/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@code4bones/branch-pwa",
-  "version": "0.1.0-beta.151",
+  "version": "0.1.0-beta.152",
   "private": true,
   "type": "module",
   "scripts": {

pwa/package.json

@@ -59,10 +59,10 @@ export const deliveryReceiptControlDescriptor: ApplicationControlDescriptor<Deli
 const receiptRegistry = createApplicationControlRegistry([deliveryReceiptControlDescriptor]);
 
 /**
- * Sends one signed receipt.  The default target dedup protects the live
- * delivered-receipt path from duplicate inbound envelopes.  A durable local
- * read-presentation record may explicitly make a bounded re-attempt; that
- * creates a fresh, signed and independently replay-protected control.
+ * Sends one signed receipt. Target dedup protects the live delivered- and
+ * read-receipt paths from duplicate inbound envelopes. A failed local send
+ * releases its dedup key, so the durable read outbox can make a later bounded
+ * retry without emitting a second control after successful hand-off.
  */
 export async function sendDeliveryReceipt(options: {
   readonly kind: DeliveryReceiptKind;
@@ -71,15 +71,14 @@ export async function sendDeliveryReceipt(options: {
   readonly recipientPeerId: string;
   readonly recipientHpkePublicKey: string;
   readonly attached: boolean;
-  readonly allowTargetRetry?: boolean;
 }): Promise<DeliveryReceiptSendResult> {
   if (!options.attached || !validDeliveryId(options.targetDeliveryId)) return "skipped";
   const keys = getLocalIdentityKeys();
   if (keys === null) return "skipped";
   const now = Date.now();
   prune(now);
   const emittedKey = `${options.kind}\n${options.recipientPeerId}\n${options.targetDeliveryId}`;
-  if (!options.allowTargetRetry && emittedReceiptTargets.has(emittedKey)) return "skipped";
+  if (emittedReceiptTargets.has(emittedKey)) return "skipped";
   let unsigned: ReturnType<typeof prepareOutboundApplicationControl<DeliveryReceiptBody>>;
   try {
     unsigned = prepareOutboundApplicationControl({
@@ -96,7 +95,7 @@ export async function sendDeliveryReceipt(options: {
       isKnownContact: (peerId) => peerId === options.recipientPeerId,
       isAllowed: () => true,
       consumeRateLimit: () => {
-        if (!options.allowTargetRetry && emittedReceiptTargets.has(emittedKey)) return false;
+        if (emittedReceiptTargets.has(emittedKey)) return false;
         if (emittedReceiptTargets.size >= maxReplayEntries) {
           const oldest = emittedReceiptTargets.keys().next().value;
           if (oldest !== undefined) emittedReceiptTargets.delete(oldest);

pwa/src/connectivity/delivery-receipt-control.ts

@@ -116,16 +116,16 @@ async function run(runtime: ReadReceiptRuntime): Promise<void> {
           recipientPeerId: contact.peerId,
           recipientHpkePublicKey: contact.hpkePublicKey,
           attached: true,
-          allowTargetRetry: true
         });
         if (result === "sent") {
-          // Local admission to the attachment does not prove the recipient
-          // received the control. Retain this device-local presentation fact
-          // for a small bounded retry window; a later signed read remains
-          // the sender's sole proof for rendering Read.
-          const next = nextRetryAt(Date.now(), expiresAt);
-          runtime.retryAtByTarget.set(entry.targetDeliveryId, next);
-          nextAttemptAt = earliest(nextAttemptAt, next);
+          // A successful hand-off has consumed this local work item. Retrying
+          // it with a fresh signed control makes a healthy recipient see an
+          // otherwise-valid duplicate after it has already consumed the
+          // delivery mapping, which is indistinguishable from an unmatched
+          // receipt. Failures below remain bounded retries because the send
+          // routine releases its local dedup key before it throws.
+          runtime.retryAtByTarget.delete(entry.targetDeliveryId);
+          state.settleReadReceipt(entry.targetDeliveryId);
           state.recordTransportTrace("delivery receipt: read_attempt_sent");
           continue;
         }

pwa/src/connectivity/read-receipt-runtime.ts

@@ -843,7 +843,8 @@ void test("PWA persists active-chat read presentation locally and drains opted-i
   assert.match(runtime, /attachment-driven, never presence-driven/);
   assert.match(runtime, /deliveryReceiptControlTTLms/);
   assert.match(runtime, /readReceiptRetryDelayMs = 30_000/);
-  assert.match(runtime, /allowTargetRetry: true/);
+  assert.match(runtime, /state\.settleReadReceipt\(entry\.targetDeliveryId\)/);
+  assert.doesNotMatch(runtime, /allowTargetRetry/);
   assert.match(runtime, /read_attempt_sent/);
   assert.match(runtime, /read_expired/);
   assert.match(runtime, /read_failed_\$\{readReceiptFailure/);

pwa/tests/app-shell.test.ts

@@ -95,11 +95,11 @@ void test("receipt body has a closed deterministic shape", () => {
   assert.throws(() => encodeReceiptBody({ kind: "read", targetDeliveryId: "wrong" }));
 });
 
-void test("read receipt sender keeps default duplicate suppression but exposes only an explicit retry escape hatch", async () => {
+void test("read receipt sender deduplicates a successfully handed-off target", async () => {
   const source = await readFile(resolve(process.cwd(), "src/connectivity/delivery-receipt-control.ts"), "utf8");
-  assert.match(source, /readonly allowTargetRetry\?: boolean/);
-  assert.match(source, /!options\.allowTargetRetry && emittedReceiptTargets\.has\(emittedKey\)/);
-  assert.match(source, /!options\.allowTargetRetry && emittedReceiptTargets\.has\(emittedKey\)\) return false/);
+  assert.match(source, /if \(emittedReceiptTargets\.has\(emittedKey\)\) return "skipped"/);
+  assert.match(source, /if \(emittedReceiptTargets\.has\(emittedKey\)\) return false/);
+  assert.doesNotMatch(source, /allowTargetRetry/);
 });
 
 async function signedReceipt(