Add :nostore build scripts that disable Firebase for one Android or iOS build without changing the Firebase-on default.

FIREBASE_ENABLED=false now becomes the FIREBASE_ENABLED=NO build setting for both build and archive, and an opt-out build removes stale GoogleService-Info.plist copies from the app and the embedded extension.

.cursor/rules/app/timesafari_development.mdc

@@ -11,7 +11,7 @@
 
 # Web (development)
 
-npm run build:web
+npm run dev
 
 # Mobile
 

.cursor/rules/app/timesafari_platforms.mdc

@@ -13,7 +13,7 @@
 
 - **File System**: Limited browser APIs
 
-- **Build**: `npm run build:web` (development build)
+- **Build**: `npm run dev` (development server), `npm run build:web` (production build into `dist/`)
 
 ### Mobile (Capacitor)
 
@@ -59,7 +59,7 @@
 
 # Web (development)
 
-npm run build:web
+npm run dev
 
 # Mobile
 

.cursor/rules/architecture/build_architecture_guard.mdc

@@ -63,7 +63,7 @@ follow proper review, testing, and documentation procedures.
 
 - **CI/CD Pipeline**: GitHub Actions, build validation scripts
 
-- **Service Worker Assembly**: `sw_scripts/`, `sw_combine.js`, WASM copy steps
+- **WASM Assembly**: WASM copy steps
 
 ## Change Authorization Requirements
 

.cursor/rules/architecture/build_testing.mdc

@@ -39,7 +39,7 @@
 
 ### Rollback Verification
 
-- **Web**: `npm run build:web:dev` and `npm run build:web:prod`
+- **Web**: `npm run dev` and `npm run build:web:prod`
 
 - **Mobile**: `npm run build:android:test` and `npm run build:ios:test`
 

.cursor/rules/architecture/build_validation.mdc

@@ -19,7 +19,7 @@
 
 ### After Build System Change
 
-- [ ] **Web Platform**: Does `npm run build:web:dev` work?
+- [ ] **Web Platform**: Does `npm run dev` work?
 
 - [ ] **Mobile Platforms**: Do iOS/Android builds succeed?
 
@@ -33,9 +33,9 @@
 
 ### Web Platform
 
-- **Development**: `npm run build:web:dev` - serve and load app
+- **Development**: `npm run dev` - serve and load app
 
-- **Production**: `npm run build:web:prod` - verify SW and WASM present
+- **Production**: `npm run build:web:prod` - verify WASM present
 
 ### Mobile Platforms
 
@@ -98,13 +98,11 @@
   verify single-instance,
   icons, signing
 
-### Service Worker / WASM
+### WASM
 
-- **Trigger**: `sw_combine.js`, WASM copy path
+- **Trigger**: WASM copy path
 
-- **Validation**: Verify combined SW exists and is injected; page loads offline;
-
-  WASM present
+- **Validation**: WASM present
 
 ### Docker
 

.env.test

@@ -5,7 +5,7 @@ VITE_LOG_LEVEL=info
 
 # iOS doesn't like spaces in the app title.
 TIME_SAFARI_APP_TITLE="TimeSafari_Test"
-VITE_APP_SERVER=https://test.timesafari.app
+VITE_APP_SERVER=https://test.`
 # This is the claim ID for actions in the BVC project, with the JWT ID on this environment (not
 # This is the claim ID for actions in the BVC project, with the JWT ID on this environment (not production).
 

.gitignore

@@ -5,8 +5,6 @@ dist-electon-build
 node_modules
 dist
 signature.bin
-# generated during `npm run build`
-sw_scripts-combined.js
 *.pem
 verified.txt
 myenv

AGENTS.md

@@ -2,16 +2,18 @@
 
 ## Android Build — Google Play Services / FOSS Compatibility
 
-**Firebase is opt-in. Do NOT enable it accidentally.**
+**Firebase is on by default for Android and iOS builds.** Do not turn it off unless the build is an exceptional FOSS/F-Droid artifact.
 
-`android/google-services.json` is gitignored and may be present on disk for push notification development, but Firebase is only activated when you explicitly pass `-PfirebaseEnabled` to Gradle:
+`android/app/google-services.json` is required when Firebase is enabled. It does not decide the switch: a missing file fails the build, and a file on disk is ignored when Firebase is explicitly disabled.
 
-- **FOSS / APK / Aurora / Zapstore / F-Droid builds**: just `./gradlew assembleRelease` — Firebase stays off even if `google-services.json` is on disk.
-- **Firebase / FCM / Play Store builds**: `./gradlew bundleRelease -PfirebaseEnabled` — explicitly opt in.
+- **Default (local, test, production, Play Store)**: `./gradlew assembleRelease` or `./gradlew bundleRelease` — do not pass `-PfirebaseEnabled`.
+- **Opt out (F-Droid / FOSS)**: `./gradlew assembleRelease -PfirebaseEnabled=false`, or an npm `:nostore` script such as `npm run build:android:test:nostore:run`. Those set `FIREBASE_ENABLED=false`, which forwards `-PfirebaseEnabled=false`. `:nostore` disables Firebase only; it does not remove every Play Services dependency.
 
-This guard is in `android/app/build.gradle`. Do NOT change this conditional to activate Firebase unconditionally based on file presence alone — that was the bug that broke FOSS distribution in June 2026.
+iOS builds bundle `ios/App/App/GoogleService-Info.plist` by default (`ios/App/scripts/bundle-firebase-config.sh`, run from `scripts/build-ios.sh` and as an Xcode build phase). Opt out with `FIREBASE_ENABLED=false` (the build script forwards that to both the build and archive `xcodebuild` invocations), `npm run build:ios:prod:nostore`, or the Xcode build setting `FIREBASE_ENABLED=NO`. A missing plist fails an enabled build; the file's presence does not enable Firebase on its own.
 
-`google-services.json` is intentionally excluded from git (`android/.gitignore`). Never commit it.
+The guard is in `android/app/build.gradle`. Do NOT activate Firebase from file presence alone — that was the bug that broke FOSS distribution in June 2026.
+
+Never commit `google-services.json`.
 
 Full details, incident history, and F-Droid notes: `doc/android-firebase-gms.md`
 

BUILDING.md

@@ -9,9 +9,9 @@ This guide explains how to build TimeSafari for different platforms using the co
 ```bash
 # 🖥️ Web Development
 npm install                          # setup -- and pkgx.dev `dev` command before this will set environment with npm, etc
-npm run build:web:serve -- --test    # Start with test endorser server
-npm run build:web:dev                # Start development server with hot reload with local endorser server
-npm run build:web:prod               # Production build
+npm run dev                          # Start development server with hot reload with local endorser server
+npm run build:web:serve:test         # Test build served from dist/ (test endorser server)
+npm run build:web                    # Production build into dist/
 
 # 📱 Mobile Development
 npm run build:ios              # iOS build (opens Xcode)
@@ -44,7 +44,7 @@ npm run test:web               # Run web tests to verify setup
 
 ```bash
 # Start web development server
-npm run build:web:dev          # Opens http://localhost:8080
+npm run dev                    # Opens http://localhost:8080
 
 # For mobile development
 npm run build:ios              # Opens Xcode with iOS project
@@ -219,36 +219,41 @@ Install dependencies:
 npm install
 ```
 
-## Web Development
+## Web Development & Deployment
 
 ### Web Development Commands
 
 ```bash
 # Local development
-npm run build:web:dev               # Start development server with hot reload
+npm run dev                         # Start development server with hot reload (writes nothing to dist/)
 
-# Web builds
-npm run build:web                   # Development build (starts dev server with hot reload)
+# Web builds (each one writes dist/)
+npm run build:web                   # Production build (same as build:web:prod)
 npm run build:web:test              # Test environment build (optimized for testing)
 npm run build:web:prod              # Production build (optimized for production)
-npm run build:web:serve             # Build and serve locally for production testing
+
+# Build, then serve dist/ locally
+npm run build:web:serve             # Production build, then serve
+npm run build:web:serve:test        # Test build, then serve
 
 # Docker builds
-npm run build:web:docker            # Development build with Docker containerization
+npm run build:web:docker            # Production build with Docker containerization
 npm run build:web:docker:test       # Test build with Docker containerization
 npm run build:web:docker:prod       # Production build with Docker containerization
 ```
 
 ### Local Development
 
-Start the development server using `npm run build:web:dev` or `npm run build:web` (both start the development server with hot reload).
+Start the development server with hot reload using `npm run dev`. Open it at `http://localhost:8080/`, not at a wildcard address such as `http://[::]:8080/` or `http://0.0.0.0:8080/`: browsers only allow the cryptography the app needs on HTTPS, `localhost`, `127.0.0.1`, or `[::1]`, so any other plain-HTTP address shows a "Cannot Start Here" page.
 
 ### Web Build for Server
 
-1. Run the production build using `npm run build:web:prod`
+1. Run the production build using `npm run build:web` (or `npm run build:web:test` for the test server)
 2. The built files will be in the `dist` directory
 3. To test the production build locally, use `npm run build:web:serve` (builds then serves)
 
+`dist/` is shared with the Android, iOS, Electron, and Capacitor builds, which overwrite it with non-web output. Run the web build immediately before deploying, and confirm that the browser console reports `Loading TimeSafari for platform: web`.
+
 **Why Use `serve`?**
 - **Production Testing**: Test your optimized production build locally before deployment
 - **SPA Routing Validation**: Verify deep linking and navigation work correctly (handles routes like `/discover`, `/account`)
@@ -1069,6 +1074,9 @@ npm run build:ios:prod              # Production build (builds for production en
 npm run build:ios:test:run          # Test build with auto-run (builds then runs on simulator)
 npm run build:ios:prod:run          # Production build with auto-run (builds then runs on simulator)
 
+# Firebase off (`:nostore` sets FIREBASE_ENABLED=false, forwarded to xcodebuild as FIREBASE_ENABLED=NO)
+npm run build:ios:prod:nostore      # Same as prod, without Firebase
+
 # Debug and release builds
 npm run build:ios:debug             # Debug build (builds debug app bundle)
 npm run build:ios:debug:run         # Debug build with auto-run (builds then runs on simulator)
@@ -1146,7 +1154,7 @@ export GEM_PATH=$shortened_path
 ##### 1. Bump the version in package.json & CHANGELOG.md for `MARKETING_VERSION`, then `grep CURRENT_PROJECT_VERSION ios/App/App.xcodeproj/project.pbxproj` and add 1 for the numbered version here:
 
 ```bash
-cd ios/App && xcrun agvtool new-version 72 && perl -p -i -e "s/MARKETING_VERSION = .*;/MARKETING_VERSION = 1.4.6;/g" App.xcodeproj/project.pbxproj && cd -
+cd ios/App && xcrun agvtool new-version 75 && perl -p -i -e "s/MARKETING_VERSION = .*;/MARKETING_VERSION = 1.4.9;/g" App.xcodeproj/project.pbxproj && cd -
 # Unfortunately this edits Info.plist directly.
 #xcrun agvtool new-marketing-version 0.4.5
 ```
@@ -1332,6 +1340,10 @@ npm run build:android:test:run       # Test build with auto-run (builds then run
 npm run build:android:prod:run       # Production build with auto-run (builds then runs on emulator)
 # Auto-run targets the one connected device; with none or several it prompts, or exits 9 without a terminal
 
+# Firebase off (`:nostore` sets FIREBASE_ENABLED=false, which passes -PfirebaseEnabled=false)
+npm run build:android:test:nostore:run  # Same as test:run, without Firebase
+npm run build:android:prod:nostore      # Same as prod, without Firebase
+
 # Debug and release builds
 npm run build:android:debug          # Debug build (builds debug APK)
 npm run build:android:debug:run      # Debug build with auto-run (builds then runs on emulator)
@@ -1434,8 +1446,8 @@ The recommended way to build for Android is using the automated build script:
 ##### 1. Bump the version in package.json, then update these versions & run:
 
 ```bash
-perl -p -i -e 's/versionCode .*/versionCode 72/g' android/app/build.gradle
-perl -p -i -e 's/versionName .*/versionName "1.4.6"/g' android/app/build.gradle
+perl -p -i -e 's/versionCode .*/versionCode 75/g' android/app/build.gradle
+perl -p -i -e 's/versionName .*/versionName "1.4.9"/g' android/app/build.gradle
 ```
 
 ##### 2. Build
@@ -1446,13 +1458,13 @@ perl -p -i -e 's/versionName .*/versionName "1.4.6"/g' android/app/build.gradle
 npm run build:android:prod
 ```
 
-##### 3. Open the project in Android Studio
+##### 2.1. (Optional) Open the project in Android Studio
 
 ```bash
 npx cap open android
 ```
 
-##### 4. Use Android Studio to build and run on emulator or device
+##### 3. Use Android Studio to build and run on emulator or device
 
 #### Android Build from the console
 
@@ -1460,13 +1472,7 @@ npx cap open android
 
 * Note that this currently fails: `./gradlew build`
 
-To create the `aab` file, `bundle` instead of `build` (but not signed and not usable in Play Store):
-
-```bash
-./gradlew bundleDebug -Dlint.baselines.continue=true
-```
-
-So, to create a signed `aab` release:
+To create a signed `aab` release:
 
 - Setup by adding the app/gradle.properties.secrets file (see properties at top
   of app/build.gradle) and the app/time-safari-upload-key-pkcs12.jks file
@@ -1474,11 +1480,19 @@ So, to create a signed `aab` release:
 
 ```bash
 # if you use pkgx: pkgx +openjdk.org /bin/zsh
-./gradlew bundleRelease -Dlint.baselines.continue=true -PfirebaseEnabled
+./gradlew bundleRelease -Dlint.baselines.continue=true
 ```
 
+Firebase is on by default (`firebaseEnabled=true` in `android/gradle.properties`). Do not pass `-PfirebaseEnabled` for a normal release. F-Droid and other builds that must omit Firebase use `-PfirebaseEnabled=false`, or an npm `:nostore` script (`FIREBASE_ENABLED=false`). `:nostore` only disables Firebase. It does not remove other store-linked dependencies, such as the ML Kit barcode scanner's Play Services library, and it does not by itself make the app run on every device outside the Play Store.
+
 ... and find your `aab` file at app/build/outputs/bundle/release
 
+To create an unsigned debugging bundle (not usable in Play Store):
+
+```bash
+./gradlew bundleDebug -Dlint.baselines.continue=true
+```
+
 * Gradle packages whatever web bundle was last synced into
   `android/app/src/main/assets/public`, even one from a `--test` build. Before
   uploading, confirm it has production server defaults:
@@ -1486,8 +1500,6 @@ So, to create a signed `aab` release:
 * `build-android.sh` runs `./gradlew clean`, which deletes any earlier `aab`, so
   run `bundleRelease` after the build script finishes.
 
-* Note that F-Droid builds should omit `-PfirebaseEnabled`.
-
 At play.google.com/console:
 
 - Go to Production or the Closed Testing and either Create Track or Manage Track.
@@ -1603,8 +1615,7 @@ Use the commands above to check and fix code quality issues.
 
 1. **Environment Setup**: Load platform-specific environment variables
 2. **Asset Building**: Vite builds optimized web assets
-3. **PWA Generation**: Service worker and manifest creation
-4. **Output**: Production-ready files in `dist/` directory
+3. **Output**: Production-ready files in `dist/` directory
 
 ### Electron Build Process
 
@@ -1856,38 +1867,21 @@ npm run build:android:assets
 
 ### Build Process Overview
 
-TimeSafari's build system follows a multi-stage process that prepares assets,
-combines scripts, and generates platform-specific outputs.
+TimeSafari's build system follows a multi-stage process that prepares assets
+and generates platform-specific outputs.
 
-#### Pre-Build Preparation
-
-##### 1. Service Worker Script Preparation
-
-```bash
-# Optional: Format third-party service worker scripts
-npx prettier --write ./sw_scripts/
-```
-
-**What this does:**
-
-- Formats cryptographic libraries (`nacl.js`, `noble-curves.js`,
- `noble-hashes.js`, etc.)
-- These scripts are automatically combined during the build process
-- Improves readability and makes version control diffs cleaner
-- **Note**: This is optional and only needed when updating third-party scripts
-
-**2. Automatic Pre-Build Steps**
-The `prebuild` script automatically runs before any build:
+#### Pre-Build Script
 
 ```json
-"prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node sw_combine.js && node scripts/copy-wasm.js"
+"prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node scripts/copy-wasm.js"
 ```
 
-**What happens automatically:**
+npm runs `prebuild` only before a script named `build`. This project defines
+no `build` script, so none of the `build:*` commands trigger it.
 
-- **ESLint**: Checks and fixes code formatting in `src/`
-- **Script Combination**: `sw_combine.js` combines all `sw_scripts/*.js` files
-  into `sw_scripts-combined.js`
+**What it does when run:**
+
+- **ESLint**: Checks code formatting in `src/`
 - **WASM Copy**: `copy-wasm.js` copies SQLite WASM files to `public/wasm/`
 
 #### Build Process Architecture
@@ -1895,11 +1889,10 @@ The `prebuild` script automatically runs before any build:
 **Web Build Process:**
 
 ```text
-1. Pre-Build: ESLint + Script Combination + WASM Copy
-2. Environment Setup: Load .env files, set NODE_ENV
-3. Vite Build: Bundle web assets with PWA support
-4. Service Worker: Inject combined scripts into PWA
-5. Output: Production-ready files in dist/
+1. Environment Setup: Load .env files, set NODE_ENV
+2. Type Check: tsc --noEmit (test and production modes)
+3. Vite Build: Bundle web assets
+4. Output: Production-ready files in dist/
 ```
 
 **Electron Build Process:**
@@ -1922,34 +1915,6 @@ The `prebuild` script automatically runs before any build:
 5. Package Creation: APK/IPA generation
 ```
 
-#### Service Worker Architecture
-
-**Script Organization:**
-
-- `sw_scripts/` - Individual third-party scripts
-- `sw_combine.js` - Combines scripts into single file
-- `sw_scripts-combined.js` - Combined service worker (317KB, 10K+ lines)
-- `vite.config.utils.mts` - PWA configuration using combined script
-
-**PWA Integration:**
-
-```typescript
-// vite.config.utils.mts
-pwaConfig: {
-  strategies: "injectManifest",
-  filename: "sw_scripts-combined.js",  // Uses our combined script
-  // ... manifest configuration
-}
-```
-
-**What Gets Combined:**
-
-- `nacl.js` - NaCl cryptographic library
-- `noble-curves.js` - Elliptic curve cryptography (177KB)
-- `noble-hashes.js` - Cryptographic hash functions (91KB)
-- `safari-notifications.js` - Safari-specific notifications
-- `additional-scripts.js` - Additional service worker functionality
-
 #### Process Environment Configuration
 
 **Environment Files:**
@@ -2002,10 +1967,13 @@ device)
 ```folders
 dist/
 ├── index.html              # Main HTML file
-├── assets/                 # Bundled JavaScript/CSS
-├── sw.js                   # Service worker (injected)
-├── manifest.webmanifest    # PWA manifest
-└── wasm/                   # SQLite WASM files
+├── assets/                 # Bundled JavaScript, CSS, and SQLite WASM
+├── img/                    # Static images (copied from public/)
+├── models/                 # Static model files (copied from public/)
+├── favicon.ico
+├── manifest.webmanifest    # Web app manifest, incl. share_target (copied from public/)
+├── robots.txt
+└── sw.js                   # Service worker for the Web Share Target (copied from public/)
 ```
 
 **Electron Build:**
@@ -2027,17 +1995,14 @@ electron/
 **Manual Steps (Developer Responsibility):**
 
 - Database migration testing
-- Service worker script formatting (optional)
 - Version updates and changelog
 - Environment-specific builds
 
 **Automatic Steps (Build System):**
 
-- Code linting and formatting
-- Script combination
+- Type checking (test and production builds)
 - Asset optimization
 - Package creation
-- Service worker injection
 
 This architecture ensures consistent builds across all platforms while providing
 flexibility for platform-specific optimizations and manual quality assurance steps.
@@ -2062,31 +2027,34 @@ environment setup, Vite build, and optional Docker containerization.
 
 ```bash
 # Direct script usage
-./scripts/build-web.sh                    # Development build
-./scripts/build-web.sh --dev              # Development build (explicit)
+./scripts/build-web.sh                    # Production build into dist/
+./scripts/build-web.sh --prod             # Production build (explicit)
 ./scripts/build-web.sh --test             # Test environment build
-./scripts/build-web.sh --prod             # Production environment build
-./scripts/build-web.sh --docker           # Build with Docker containerization
+./scripts/build-web.sh --dev              # Start Vite dev server (no dist/)
+./scripts/build-web.sh --docker           # Production build + Docker image
 ./scripts/build-web.sh --docker:test      # Test environment + Docker
 ./scripts/build-web.sh --docker:prod      # Production environment + Docker
-./scripts/build-web.sh --serve            # Build and serve locally
+./scripts/build-web.sh --serve            # Production build, then serve dist/
 ./scripts/build-web.sh --help             # Show help
 ./scripts/build-web.sh --verbose          # Enable verbose logging
 
 # NPM Script Equivalents
-npm run build:web                         # Development build
+npm run dev                               # Vite dev server
+npm run build:web                         # Production build
 npm run build:web:test                    # Test environment build
 npm run build:web:prod                    # Production environment build
-npm run build:web:docker                  # Docker build
+npm run build:web:docker                  # Production Docker build
 npm run build:web:docker:test             # Test Docker build
 npm run build:web:docker:prod             # Production Docker build
+npm run build:web:serve                   # Production build, then serve
+npm run build:web:serve:test              # Test build, then serve
 ```
 
 **Build Modes**:
 
-- **Development**: Starts Vite dev server with hot reload (default)
+- **Production**: Optimized for production with full minification (default)
 - **Test**: Optimized for testing with minimal minification
-- **Production**: Optimized for production with full minification
+- **Development**: Starts Vite dev server with hot reload (`--dev` alone); with `--serve` or `--docker`, builds `dist/` in development mode
 
 **Script Features**:
 
@@ -2407,7 +2375,7 @@ npm run clean:electron         # Electron only
 # Clean and rebuild
 npm run clean:all
 npm install
-npm run build:web:dev
+npm run dev
 ```
 
 ## Appendix B: Vite Configuration Files Reference
@@ -2439,9 +2407,7 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
   const appConfig = await loadAppConfig();
   const isCapacitor = platform === "capacitor";
   const isElectron = platform === "electron";
-  const isNative = isCapacitor || isElectron;
 
-  // Set platform - PWA is always enabled for web platforms
   process.env.VITE_PLATFORM = platform;
 
   return {
@@ -2457,7 +2423,6 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
       assetsDir: 'assets',
       chunkSizeWarningLimit: 1000,
       rollupOptions: {
-        external: isNative ? ['@capacitor/app'] : [],
         output: {
           format: 'esm',
           generatedCode: { preset: 'es2015' },
@@ -2489,12 +2454,7 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
         '@jlongster/sql.js',
         'absurd-sql',
         // ... additional dependencies
-      ],
-      exclude: isNative ? [
-        'register-service-worker',
-        'workbox-window',
-        // ... native exclusions
-      ] : []
+      ]
     }
   };
 }
@@ -2517,98 +2477,23 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
 
 **File**: `vite.config.web.mts`
 **Author**: Matthew Raymer
-**Description**: Vite configuration for web platform with PWA support
+**Description**: Vite configuration for the web platform
 
-**Purpose**: Configures Vite for web builds with environment-specific
-optimizations and PWA features.
+**Purpose**: Configures Vite for web builds by delegating to the common
+configuration with the `web` platform.
+
+**Configuration Structure**:
+
+```typescript
+export default defineConfig(async () => createBuildConfig('web'));
+```
 
 **Key Features**:
 
-- **Environment-Specific Configuration**: Different settings for dev/test/prod
-- **PWA Integration**: Progressive Web App support with service worker
-- **Build Optimization**: Manual chunk splitting for better caching
-- **Source Maps**: Environment-specific source map configuration
-- **Caching Strategies**: Production-specific API caching
-
-**Environment Configurations**:
-
-**Development Mode**:
-
-```typescript
-{
-  build: {
-    minify: false,
-    sourcemap: true,
-    rollupOptions: { output: { manualChunks: undefined } }
-  },
-  define: {
-    __DEV__: true,
-    __TEST__: false,
-    __PROD__: false
-  }
-}
-```
-
-**Test Mode**:
-
-```typescript
-{
-  build: {
-    minify: false,
-    sourcemap: true,
-    rollupOptions: { output: { manualChunks: undefined } }
-  },
-  define: {
-    __DEV__: false,
-    __TEST__: true,
-    __PROD__: false
-  }
-}
-```
-
-**Production Mode**:
-
-```typescript
-{
-  build: {
-    minify: 'terser',
-    sourcemap: false,
-    rollupOptions: {
-      output: {
-        manualChunks: {
-          vendor: ['vue', 'vue-router', 'pinia'],
-          utils: ['luxon', 'ramda', 'zod'],
-          crypto: ['@ethersproject/wallet', '@ethersproject/hdnode'],
-          sql: ['@jlongster/sql.js', 'absurd-sql']
-        }
-      }
-    }
-  },
-  define: {
-    __DEV__: false,
-    __TEST__: false,
-    __PROD__: true
-  }
-}
-```
-
-**PWA Configuration**:
-
-```typescript
-VitePWA({
-  registerType: 'autoUpdate',
-  manifest: appConfig.pwaConfig?.manifest,
-  devOptions: { enabled: true, type: 'classic' },
-  workbox: {
-    cleanupOutdatedCaches: true,
-    skipWaiting: true,
-    clientsClaim: true,
-    sourcemap: mode !== 'production',
-    maximumFileSizeToCacheInBytes: 10 * 1024 * 1024,
-    runtimeCaching: mode === 'production' ? [/* API caching */] : []
-  }
-})
-```
+- **Minimal Configuration**: Inherits all settings from `vite.config.common.mts`
+- **Mode Selection**: `--mode test` or `--mode production` (passed by
+  `scripts/build-web.sh`) selects the matching `.env.*` file
+- **Output**: Writes to `dist/`
 
 ### B.3 vite.config.electron.mts
 
@@ -2699,7 +2584,6 @@ export default defineConfig(async () => createBuildConfig('capacitor'));
 
 - **Minimal Configuration**: Inherits all settings from common config
 - **Mobile Platform**: Automatically configures for mobile-specific settings
-- **PWA Disabled**: Progressive Web App features disabled for native apps
 - **Native Dependencies**: Handles Capacitor-specific dependencies
 
 ### B.5 vite.config.utils.mts
@@ -2708,51 +2592,15 @@ export default defineConfig(async () => createBuildConfig('capacitor'));
 **Author**: Matthew Raymer
 **Description**: Utility functions for Vite configuration
 
-**Purpose**: Provides shared configuration loading and PWA manifest generation.
+**Purpose**: Provides the shared alias configuration and strict ESBuild settings.
 
 **Key Functions**:
 
-**loadPackageJson()**: Loads and parses package.json for app configuration
+**loadAppConfig()**: Returns the alias configuration used by the common and
+optimized configs
 
-**loadAppConfig()**: Loads complete application configuration including PWA settings
-
-**PWA Configuration**:
-
-```typescript
-interface PWAConfig {
-  registerType: string;
-  strategies: string;
-  srcDir: string;
-  filename: string;
-  manifest: {
-    name: string;
-    short_name: string;
-    theme_color: string;
-    background_color: string;
-    icons: ManifestIcon[];
-    share_target: ShareTarget;
-  };
-}
-```
-
-**Manifest Icons**:
-
-- Android Chrome 192x192 PNG
-- Android Chrome 512x512 PNG
-- Maskable icons for adaptive UI
-
-**Share Target Configuration**:
-
-```typescript
-share_target: {
-  action: "/share-target",
-  method: "POST",
-  enctype: "multipart/form-data",
-  params: {
-    files: [{ name: "photo", accept: ["image/*"] }]
-  }
-}
-```
+**getStrictESBuildConfig()**: Returns ESBuild settings that fail the build on
+syntax and duplicate-declaration errors
 
 **Alias Configuration**:
 
@@ -2820,8 +2668,7 @@ All scripts use consistent error handling:
 
 **Web Platform**:
 
-- PWA features enabled
-- Service worker injection
+- Requires a secure context (HTTPS, `localhost`, `127.0.0.1`, or `[::1]`)
 - Browser-specific optimizations
 
 **Electron Platform**:

CHANGELOG.md

@@ -6,6 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [Unreleased]
+### Changed
+- `npm run build:web` builds production into `dist/` instead of starting the dev server.
+- `npm run build:web:serve` builds production (instead of development) before serving.
+- `npm run build:web:docker` builds production (instead of development) before creating the image.
+- `npm run build:native` builds with the Capacitor Vite config instead of a bare `vite build`.
+### Removed
+- `npm run build:web:dev` is removed; use `npm run dev` for the dev server.
+- Leftover service-worker build code (`sw_scripts/`, the unused PWA config, and the `register-service-worker` package) is removed.
+### Fixed
+- The daily starred-project check (Android and iOS) remembers the newest change it found, so it no longer reports the same changes again the next day.
+- Sharing a photo into the installed web app (Web Share Target) works again.
+- `npm run docker:up:test` and `npm run docker:up:prod` run, instead of failing on a missing `build:web:build` script.
+
+
+## [1.4.9] - 2026.10.11
+### Fixed
+- Startup DB error for new installations
+### Changed
+- Allow in-app notifications on production (as an advanced feature)
+- Allow modification of image server URL
+- Terms & conditions and privacy policy
+
+
 ## [1.4.6] - 2026.09.27
 ### Fixed
 - Incorrect 'test' server URLs on production.

Dockerfile

@@ -21,13 +21,13 @@
 #   Using npm scripts (recommended):
 #   Production: npm run build:web:docker:prod
 #   Test: npm run build:web:docker:test
-#   Development: npm run build:web:docker
+#   Development: ./scripts/build-web.sh --docker --dev
 #   
 #   Manual workflow:
-#   1. Build web assets: npm run build:web:build -- --mode production
+#   1. Build web assets: npm run build:web:prod
 #   2. Build Docker: docker build -t timesafari:latest .
 #   
-#   Note: For development, use npm run build:web directly (no Docker needed)
+#   Note: For development, use npm run dev directly (no Docker needed)
 #
 # Build Arguments:
 #   BUILD_MODE: development, test, or production (default: production)

README.md

@@ -20,7 +20,7 @@ npm install
 ### Web
 
 ```bash
-npm run build:web:dev
+npm run dev
 ```
 
 Then go to [the test page](http://localhost:8080/test) and click "Become User 0" to take action on the platform.
@@ -98,16 +98,16 @@ TimeSafari supports configurable logging levels via the `VITE_LOG_LEVEL` environ
 
 ```bash
 # Show only errors
-VITE_LOG_LEVEL=error npm run build:web:dev
+VITE_LOG_LEVEL=error npm run dev
 
 # Show warnings and errors
-VITE_LOG_LEVEL=warn npm run build:web:dev
+VITE_LOG_LEVEL=warn npm run dev
 
 # Show info, warnings, and errors (default)
-VITE_LOG_LEVEL=info npm run build:web:dev
+VITE_LOG_LEVEL=info npm run dev
 
 # Show all log levels including debug
-VITE_LOG_LEVEL=debug npm run build:web:dev
+VITE_LOG_LEVEL=debug npm run dev
 ```
 
 ### Available Levels
@@ -121,7 +121,7 @@ See [Logging Configuration Guide](doc/logging-configuration.md) for complete det
 
 ## Notification Debug Panel (dev builds)
 
-In non-production bundles (for example `vite dev` or a Vite build whose mode is not `production`), the **Notification Debug Panel** at `/dev/notifications` helps you test notification registration, backend refresh, WAKEUP_PING handling, and local schedule inspection on native builds.
+In non-production bundles (for example `vite dev` or a Vite build whose mode is not `production`), the **Notification Debug Panel** at `/dev/notifications` helps you test FCM token registration, AlertSearch authorization upload, FCM wakeup delivery (`/debug/send-wakeup`), and local schedule inspection on native builds. The app no longer consumes `WAKEUP_PING` to call `/notifications/refresh` or schedule `api_*` notifications.
 
 **Access:** **Account** → enable **Show All General Advanced Functions** → **Notification Debug Panel**.
 
@@ -147,7 +147,7 @@ Platform-specific end-to-end guides:
 
 # Then restart your development server
 npm run build:electron:dev  # For Electron
-npm run build:web:dev       # For Web
+npm run dev                 # For Web
 ```
 
 ### What It Does
@@ -339,7 +339,7 @@ The application uses a platform-agnostic database layer with Vue mixins for serv
 
 **Architecture Decision**: The project uses Vue mixins over Composition API composables for platform service access. See [Architecture Decisions](doc/architecture-decisions.md) for detailed rationale.
 
-## 📁 Project Structure
+### 📁 Project Structure
 
 ```text
 timesafari/
@@ -354,6 +354,45 @@ timesafari/
 └── 📄 doc/README-BUILD-GUARD.md # Guard system documentation
 ```
 
+### Building an APK for Android 6 (API 23)
+
+App versions up to 1.4.6 support Android 6.0 (API 23); later versions require Android 7.0 (API 24) or newer. To run the app on an Android 6 device, build your own APK from the 1.4.6 release commit (`6183afc2`, "bump version to 1.4.6").
+
+Prerequisites: git, Node.js 20 (see `.nvmrc`), Java 21, and the Android SDK with `ANDROID_HOME` set (see [Android Emulator Without Android Studio](BUILDING.md#android-emulator-without-android-studio-command-line-only) for an SDK setup that skips Android Studio). With [pkgx](https://pkgx.dev), prefix the commands with `pkgx`, e.g. `pkgx npm ci`.
+
+1. Get the 1.4.6 source:
+
+   ```bash
+   git clone https://gitea.anomalistdesign.com/trent_larson/crowd-funder-for-time-pwa.git
+   cd crowd-funder-for-time-pwa
+   git checkout 6183afc2
+   ```
+
+2. Confirm the minimum SDK is 23:
+
+   ```bash
+   grep minSdkVersion android/variables.gradle   # expect: minSdkVersion = 23
+   ```
+
+3. Install dependencies and build a production APK:
+
+   ```bash
+   npm ci
+   npm run build:android:prod -- --apk
+   ```
+
+   `npm ci` installs the exact dependency versions locked for 1.4.6. `build:android:prod -- --apk` builds the web app with production server settings, syncs it into the Android project, and runs `./gradlew assembleDebug`. The result is signed with your local Android debug key, so it installs on any device without a release keystore.
+
+4. Find the APK at `android/app/build/outputs/apk/debug/app-debug.apk` and install it, either with `adb install android/app/build/outputs/apk/debug/app-debug.apk` (USB debugging enabled on the phone) or by copying the file to the phone and opening it (allow "Install unknown apps" for the file manager).
+
+Notes:
+
+* **Back up your identity first.** A self-built APK has a different signature from the Play Store app, so Android refuses to install it over the store version. Uninstalling the store version deletes the app's local data, including your identifier keys. Back up your seed phrase (Profile page → "Backup Identifier Seed") before uninstalling, then import it into the self-built app.
+* This build has Firebase disabled, so push notifications through Google's FCM service are off.
+* The daily notification plugin calls `java.time`, which Android provides only from 8.0 (API 26). On Android 6, scheduling a daily reminder can crash the app; leave daily reminders off. See [doc/plugin-feedback-android-6-api23-zoneid-fix.md](doc/plugin-feedback-android-6-api23-zoneid-fix.md).
+* Barcode scanning uses Google Play Services; on devices without them, scanning fails while the rest of the app works.
+* A self-built APK does not auto-update.
+
 ## 🤝 Contributing
 
 1. **Follow the Build Architecture Guard** - Update BUILDING.md when modifying build files

android/app/build.gradle

@@ -29,6 +29,8 @@ android {
     compileSdk rootProject.ext.compileSdkVersion
 
     compileOptions {
+        // Backports java.time (API 26+) to older Android; the daily notification plugin uses it.
+        coreLibraryDesugaringEnabled true
         sourceCompatibility JavaVersion.VERSION_21
         targetCompatibility JavaVersion.VERSION_21
     }
@@ -37,8 +39,8 @@ android {
         applicationId "app.timesafari.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 72
-        versionName "1.4.6"
+        versionCode 75
+        versionName "1.4.9"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
@@ -101,6 +103,7 @@ repositories {
 }
 
 dependencies {
+    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:2.1.5"
     implementation fileTree(include: ['*.jar'], dir: 'libs')
     implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
     implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
@@ -130,20 +133,32 @@ dependencies {
 
 apply from: 'capacitor.build.gradle'
 
-// Firebase / Google Play Services are opt-in. Pass -PfirebaseEnabled to any Gradle command
-// to activate Firebase (FCM push notifications). Without this flag the build works on
-// F-Droid, Aurora, Zapstore, and plain APK sideloading even when google-services.json
-// is present on disk (it is gitignored; see AGENTS.md for the full story).
-try {
-    def servicesJSON = file('google-services.json')
-    if (servicesJSON.exists() && servicesJSON.text && project.hasProperty('firebaseEnabled')) {
-        apply plugin: 'com.google.gms.google-services'
-        logger.info("Firebase enabled: google-services plugin applied")
-    } else if (servicesJSON.exists() && !project.hasProperty('firebaseEnabled')) {
-        logger.info("google-services.json present but firebaseEnabled not set — skipping Firebase plugin (pass -PfirebaseEnabled to enable)")
-    } else {
-        logger.info("google-services.json not found — Firebase plugin not applied")
+// Firebase is on for every build. Opt out only with -PfirebaseEnabled=false
+// (F-Droid / other builds that must not apply the google-services plugin).
+// The config file does not decide the switch: when Firebase is on, a missing
+// file fails the build; when it is off, a file on disk is ignored.
+def firebaseEnabledRaw = project.findProperty('firebaseEnabled')
+def firebaseEnabled = true
+if (firebaseEnabledRaw != null) {
+    def normalized = firebaseEnabledRaw.toString().trim().toLowerCase()
+    if (normalized == 'false' || normalized == '0' || normalized == 'no') {
+        firebaseEnabled = false
     }
-} catch(Exception e) {
-    logger.info("google-services plugin not applied: ${e.message}")
+}
+
+if (!firebaseEnabled) {
+    logger.lifecycle('Firebase disabled (-PfirebaseEnabled=false): google-services plugin not applied')
+} else {
+    def servicesJSON = file('google-services.json')
+    def servicesBody = servicesJSON.isFile() ? servicesJSON.getText('UTF-8') : ''
+    if (!servicesBody.trim() || !servicesBody.contains('mobilesdk_app_id')) {
+        throw new GradleException(
+            'Firebase is enabled, but android/app/google-services.json is missing, empty, or has no mobilesdk_app_id.\n' +
+            'Download it from the Firebase console (Project settings → Your apps → Android app)\n' +
+            'and place it at android/app/google-services.json.\n' +
+            'To build without Firebase (F-Droid / FOSS), pass -PfirebaseEnabled=false.'
+        )
+    }
+    apply plugin: 'com.google.gms.google-services'
+    logger.lifecycle('Firebase enabled: google-services plugin applied')
 }

android/app/src/main/AndroidManifest.xml

@@ -3,6 +3,8 @@
     <application
         android:name=".TimeSafariApplication"
         android:allowBackup="true"
+        android:fullBackupContent="@xml/backup_rules"
+        android:dataExtractionRules="@xml/data_extraction_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

android/app/src/main/assets/capacitor.config.json

@@ -36,8 +36,8 @@
 			"splashFullScreen": true,
 			"splashImmersive": true
 		},
-		"CapSQLite": {
-			"iosDatabaseLocation": "Library/CapacitorDatabase",
+		"CapacitorSQLite": {
+			"iosDatabaseLocation": "Documents",
 			"iosIsEncryption": false,
 			"iosBiometric": {
 				"biometricAuth": false,

android/app/src/main/java/app/timesafari/TimeSafariNativeFetcher.java

@@ -311,23 +311,25 @@ public class TimeSafariNativeFetcher implements NativeNotificationContentFetcher
         return prefs.getString(KEY_LAST_ACKED_JWT_ID, null);
     }
 
+    /**
+     * Store the newest JWT ID in the response (the highest ULID), so the next fetch
+     * asks only for later changes. The server lists them newest first, so the last
+     * item is the oldest.
+     */
     private void updateLastAckedJwtIdFromResponse(String responseBody) {
         try {
             JsonObject root = JsonParser.parseString(responseBody).getAsJsonObject();
             if (!root.has("data")) return;
             JsonArray dataArray = root.getAsJsonArray("data");
             if (dataArray == null || dataArray.size() == 0) return;
-            JsonObject lastItem = dataArray.get(dataArray.size() - 1).getAsJsonObject();
             String jwtId = null;
-            if (lastItem.has("jwtId")) {
-                jwtId = lastItem.get("jwtId").getAsString();
-            } else if (lastItem.has("plan")) {
-                JsonObject plan = lastItem.getAsJsonObject("plan");
-                if (plan.has("jwtId")) {
-                    jwtId = plan.get("jwtId").getAsString();
+            for (int i = 0; i < dataArray.size(); i++) {
+                String itemJwtId = extractJwtIdFromItem(dataArray.get(i).getAsJsonObject());
+                if (itemJwtId != null && !itemJwtId.isEmpty() && (jwtId == null || itemJwtId.compareTo(jwtId) > 0)) {
+                    jwtId = itemJwtId;
                 }
             }
-            if (jwtId != null && !jwtId.isEmpty()) {
+            if (jwtId != null) {
                 prefs.edit().putString(KEY_LAST_ACKED_JWT_ID, jwtId).apply();
             }
         } catch (Exception e) {

android/app/src/main/java/app/timesafari/notifications/NotificationInspectorPlugin.java

@@ -15,8 +15,8 @@ public class NotificationInspectorPlugin extends Plugin {
   }
 
   /**
-   * Whether this build carries a Firebase config, i.e. was built with
-   * -PfirebaseEnabled. Without it, PushNotifications.register() throws on the
+   * Whether this build carries a Firebase config. Normal builds do.
+   * -PfirebaseEnabled=false omits it. Without it, PushNotifications.register() throws on the
    * Capacitor plugin thread and kills the app, so JS must check this first.
    * The google-services Gradle plugin generates the google_app_id resource,
    * which is what Firebase's own auto-initialization looks for.

android/app/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Backup rules for Android 11 and lower; data_extraction_rules.xml has the same
+  exclusions for Android 12 and higher. Everything not excluded is backed up.
+
+  The SQLite plugin's encrypted preferences are tied to an Android Keystore key,
+  and Keystore keys are never backed up. Restoring the preferences without the
+  key makes the plugin fail to load on every launch.
+-->
+<full-backup-content>
+    <exclude domain="sharedpref" path="sqlite_encrypted_shared_prefs.xml" />
+    <exclude domain="sharedpref" path="__androidx_security_crypto_encrypted_prefs_key_keyset__.xml" />
+</full-backup-content>

android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Backup and device-transfer rules for Android 12 and higher; backup_rules.xml
+  has the same exclusions for Android 11 and lower. Everything not excluded is
+  backed up and transferred, including the database (which holds the user's keys).
+
+  The SQLite plugin's encrypted preferences are tied to an Android Keystore key,
+  and Keystore keys never leave the device. Restoring the preferences without
+  the key makes the plugin fail to load on every launch.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="sharedpref" path="sqlite_encrypted_shared_prefs.xml" />
+        <exclude domain="sharedpref" path="__androidx_security_crypto_encrypted_prefs_key_keyset__.xml" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="sharedpref" path="sqlite_encrypted_shared_prefs.xml" />
+        <exclude domain="sharedpref" path="__androidx_security_crypto_encrypted_prefs_key_keyset__.xml" />
+    </device-transfer>
+</data-extraction-rules>

android/gradle.properties

@@ -22,3 +22,8 @@ org.gradle.jvmargs=-Xmx1536m --add-opens=jdk.compiler/com.sun.tools.javac.api=AL
 # https://developer.android.com/topic/libraries/support-library/androidx-rn
 android.useAndroidX=true
 android.suppressUnsupportedCompileSdk=36
+
+# Firebase/FCM is on for every Gradle build (Android Studio, ./gradlew, npm scripts).
+# Opt out with -PfirebaseEnabled=false. android/app/google-services.json does not
+# toggle this; a missing file fails the build while Firebase is enabled.
+firebaseEnabled=true

android/variables.gradle

@@ -1,5 +1,5 @@
 ext {
-    minSdkVersion = 23
+    minSdkVersion = 24
     compileSdkVersion = 36
     targetSdkVersion = 36
     androidxActivityVersion = '1.8.0'

capacitor.config.json

@@ -30,7 +30,7 @@
 			"splashImmersive": true
 		},
 		"CapacitorSQLite": {
-			"iosDatabaseLocation": "Library/CapacitorDatabase",
+			"iosDatabaseLocation": "Documents",
 			"iosIsEncryption": false,
 			"iosBiometric": {
 				"biometricAuth": false,

capacitor.config.ts

@@ -34,8 +34,10 @@ const config: CapacitorConfig = {
       splashFullScreen: true,
       splashImmersive: true
     },
-    CapSQLite: {
-      iosDatabaseLocation: 'Library/CapacitorDatabase',
+    // The key must match the plugin's registered name or every setting here is ignored.
+    CapacitorSQLite: {
+      // Installed iOS apps keep their database in Documents; changing this strands existing data.
+      iosDatabaseLocation: 'Documents',
       iosIsEncryption: false,
       iosBiometric: {
         biometricAuth: false,

doc/CHANGES/PLAN-contacts-without-did.md

@@ -0,0 +1,409 @@
+# Plan: Contacts Without a DID ("Placeholder Contacts")
+
+## Goal
+
+Let a user record a gift (or offer) given by or to a person who has not
+installed the app, under that person's name, and later swap that person's real
+DID into those claims once they join.
+
+Requirements:
+
+1. A locally saved name for a person with no DID, plus everything a real
+   contact can hold locally: phone numbers and other contact methods, notes,
+   and labels, edited through the same screens.
+2. That person can be picked as the giver or recipient in the gift dialogs,
+   the same way a real contact is.
+3. The app keeps a local list of every claim that names the person, so the
+   claims can be found again without a server search.
+4. When the person joins, the user links the placeholder to the person's real
+   contact, and the app edits each linked claim so the real DID appears
+   where the placeholder was.
+5. Nothing that identifies a placeholder — its name or its local key — is
+   sent to the endorser server or shared with other users.
+6. When the app links contacts to the device's address book, a placeholder
+   links the same way a real contact does, and the link survives the
+   placeholder becoming a real contact.
+
+## Relevant constraints in the current schema
+
+These come from `src/db-sql/migration.ts` and
+`src/utils/PlatformServiceMixin.ts`.
+
+| Constraint | Where | Effect on this feature |
+|---|---|---|
+| `contacts.did TEXT NOT NULL` | migration 008 | A contact row must have some DID value. |
+| `UNIQUE INDEX idx_contacts_did ON contacts(did)` | migration 008 | Every contact's DID must be distinct. (SQLite allows multiple NULLs in a unique index, so the index alone would not block NULL DIDs; `NOT NULL` does.) |
+| `contact_labels.did ... REFERENCES contacts(did) ON DELETE CASCADE` | migration 008 | Labels are keyed by DID. There is no `ON UPDATE` action, so `UPDATE contacts SET did = ...` fails with `FOREIGN KEY constraint failed` while the contact has labels (verified with the `sqlite3` CLI), when foreign keys are enforced on the connection. |
+| `$insertContact` uses `INSERT OR REPLACE` | `PlatformServiceMixin.ts` | REPLACE deletes the conflicting row before inserting. With foreign keys enforced, that delete cascades and wipes the contact's labels. The new row also gets a new `id`, because `id` is not in the insert's column list (both verified with the `sqlite3` CLI). Any table that references `contacts(did)` with `ON DELETE CASCADE` inherits the first hazard, and anything that references `contacts.id` inherits the second. Callers: `ContactsView`, `InviteOneView`, `MeetingMembersList`, `BulkMembersDialog`. |
+| `Contact.did: string` (required) | `src/db/tables/contacts.ts` | Every view, lookup (`contactForDid`, `didInfo`), and mixin method (`$getContact`, `$updateContact`, `$deleteContact`, label methods) is keyed by DID string. |
+| `isDid(s)` is `s.startsWith("did:")` | `src/libs/endorserServer.ts` | Any string starting with `did:` is treated as a real DID by import validation, display logic, and server calls. |
+
+Whether foreign keys are enforced at runtime depends on whether a
+`PRAGMA foreign_keys = ON` took effect on the current connection; nothing
+outside the migrations sets it. The plan below assumes they may be enforced
+and must work either way.
+
+## Recommended: local placeholder key in `contacts`, no DID in the claim
+
+### Summary
+
+- A placeholder is an ordinary row in `contacts` whose `did` column holds a
+  local-only key: `local:` followed by a random UUID, e.g.
+  `local:3f0c9a8e-5d2b-4c1e-9b7a-2e6f1d0c4a11`.
+- The key deliberately does **not** start with `did:`, so `isDid()` is false
+  for it and every existing DID-only code path rejects it instead of treating
+  it as real.
+- Claims naming a placeholder carry **no** agent/recipient DID in that slot —
+  the same shape the gift dialog already sends for "Unnamed".
+- A new table records which claims involve which placeholder, so they can be
+  edited when the real DID is known.
+
+The only schema change is one additive `CREATE TABLE`. The `contacts` and
+`contact_labels` tables are untouched, so no table rebuild is needed (a
+rebuild is the risky part of migration 008).
+
+### Schema change (migration 012)
+
+```sql
+-- Claims that name a placeholder contact (contacts.did LIKE 'local:%') in place of a DID,
+-- kept so they can be edited to carry the real DID once that person joins.
+CREATE TABLE placeholder_claims (
+  contactKey TEXT NOT NULL,      -- contacts.did: the placeholder key, or the real DID after linking
+  claimHandleId TEXT NOT NULL,   -- handleId from the server; stays the same across edits
+  role TEXT NOT NULL CHECK (role IN ('agent', 'recipient')),
+  claimType TEXT NOT NULL,       -- eg. 'GiveAction', 'Offer'
+  issuerDid TEXT NOT NULL,       -- only this identity can edit the claim
+  apiServer TEXT NOT NULL,       -- the server the claim was sent to
+  dateCreated TEXT NOT NULL,
+  dateAssigned TEXT,             -- set when the claim has been edited to carry the real DID
+  PRIMARY KEY (contactKey, claimHandleId, role)
+);
+CREATE INDEX idx_placeholder_claims_key ON placeholder_claims(contactKey);
+```
+
+The column is named for the contact rather than the placeholder because
+linking rekeys it to the real DID along with every other contact-keyed column (see
+*Linking when the person joins*). A row with a real DID and
+`dateAssigned IS NULL` is a claim still waiting to be edited.
+
+No foreign key to `contacts`: a cascade would let any `INSERT OR REPLACE` of
+the placeholder contact silently delete its claim links (see the
+`$insertContact` row above), and those links are the only record of which
+claims to fix. Orphan cleanup happens in code when a placeholder is deleted
+on purpose.
+
+The `role` column is part of the key because one claim can name the same
+placeholder as both giver and recipient.
+
+### Code changes
+
+**Prerequisite: make `$insertContact` an upsert that keeps the row**
+
+Change `INSERT OR REPLACE` to an `UPDATE ... WHERE did = ?`, followed by an
+`INSERT` only when no row was updated. That keeps the row's `id` and leaves
+its labels and other contact-keyed rows alone. An `INSERT ... ON CONFLICT(did)
+DO UPDATE` does the same in one statement, but needs SQLite 3.24+ on every
+platform's driver, and that hasn't been checked. This fixes an existing
+label-loss hazard and is worth shipping first, on its own.
+
+**Identity helpers** (`src/libs/endorserServer.ts`)
+
+- `PLACEHOLDER_KEY_PREFIX = "local:"`, `isPlaceholderKey(s)`, and
+  `newPlaceholderKey()` (uses `crypto.randomUUID()`).
+- `didInfoForContact`: a placeholder contact displays its name, with a marker
+  such as "(not on Time Safari yet)", and `known: true`.
+
+**Creating a placeholder**
+
+- Contacts view: an "Add someone without the app" action that asks only for
+  a name (notes and contact methods optional) and saves a contact with a new
+  placeholder key.
+- Gift dialog entity picker: the same action inline, so a user can create a
+  placeholder while recording a gift.
+- Device address book (once that integration exists): pick a person from the
+  phone's contacts. The placeholder is created with that name and phone
+  number filled in and already linked to the device contact.
+
+**Phone numbers, notes, and labels**
+
+These need no new storage. `ContactEditView` (`/contact-edit/:did`) edits
+`contactMethods` (the JSON column holding phone numbers, emails, and so
+on), `notes`, and labels through `contact_labels`, all keyed by the
+`contacts.did` value and with no server calls. A placeholder key in that
+route parameter works as-is. Changes needed:
+
+- Hide the server-backed parts of contact pages (visibility, registration,
+  the DID/key display) for placeholders. The edit form itself stays as it
+  is.
+- Store phone numbers in a normalized form (E.164, e.g. `+18015550100`)
+  alongside what the user typed, so they can be compared for matching when
+  the person joins (see *Linking*). Normalizing on save is cheaper than
+  normalizing on every comparison.
+
+**Device address-book links**
+
+Whatever table holds the link between an app contact and a device contact
+(Android lookup key / iOS `CNContact` identifier) is keyed by the
+`contacts.did` value, the same as `contact_labels`. That gives real contacts
+and placeholders one shared mechanism, and linking rekeys the link along
+with everything else. Two rules for that table:
+
+- No `ON DELETE CASCADE` foreign key to `contacts`, for the same reason as
+  `placeholder_claims`. Code cleans up these rows when a contact is
+  deleted on purpose.
+- Device identifiers mean nothing on another device, so a backup restored
+  elsewhere either leaves these rows out or re-checks them against that
+  device's address book.
+
+**One contact-keyed registry**
+
+Every table with a column holding a `contacts.did` value is listed in one
+constant, e.g. `CONTACT_KEYED_COLUMNS = [["contact_labels", "did"],
+["placeholder_claims", "contactKey"], ...]`, which `rekeyContact` and
+`deleteContact` iterate over. A test compares that list with the live
+schema: every foreign key to `contacts(did)` (from `PRAGMA
+foreign_key_list`), plus any column named `contactKey`. A table added later
+and left out of the list fails the test, so it can't be orphaned by a
+rekey.
+
+**Recording a claim** (`GiftedDialog`, offer dialog, `hydrateGive`, `hydrateOffer` callers)
+
+- When the chosen giver or recipient is a placeholder, pass `undefined` for
+  that DID to `createAndSubmitGive` / `createAndSubmitOffer`.
+- On success, insert a `placeholder_claims` row with the returned `handleId`,
+  the role, the active DID as issuer, and the API server.
+- If the submission succeeds but the local insert fails, show an error that
+  names the claim, because the link would otherwise be lost silently.
+- A placeholder on both sides is allowed: the server accepts a give with no
+  agent, no recipient, and no project.
+
+**Choosing a giver or recipient** (`EntityGrid`, `EntitySelectionStep`, `PersonCard`)
+
+Placeholders appear in the picker in alphabetical order, searchable by name,
+mixed in with real contacts. Because a placeholder is a row in `contacts`,
+this needs almost no list-merging work:
+
+- `GiftedDialog` passes `$contactsByDateAdded()` to `EntityGrid`, which
+  already builds both sections from that one array: "Recently Added" (the
+  first rows, newest by `id`) and "Everyone" (sorted by
+  `(name || did).toLowerCase()` with `localeCompare`). Placeholders land in
+  both sections with no extra query and no merge step.
+- `performContactSearch` filters the same array by name and DID substring
+  and sorts it the same way, so placeholders are searchable automatically.
+
+What does need care:
+
+- **Require a name.** Both sorts fall back to the DID when the name is blank,
+  which would put a nameless placeholder under "L" for `local:`. Saving a
+  placeholder requires a non-blank, trimmed name.
+- **Don't match on the key.** Searching "local" or a UUID fragment would
+  match every placeholder. In `performContactSearch`, compare against the
+  DID only when `!isPlaceholderKey(contact.did)`.
+- **One comparator.** The sort is written out twice (`alphabeticalContacts`
+  and `performContactSearch`). Pull it into one exported function, e.g.
+  `compareContactsByName`, so a placeholder tiebreak only has to be added
+  once. For a tie, put real contacts before placeholders and then compare
+  keys, so a real "Bob" and a placeholder "Bob" always come out in the same
+  order.
+- **Mark placeholders on the card.** `PersonCard` shows a small badge or
+  subtitle ("not on Time Safari yet"), and `EntityIcon` shows a fixed
+  "person without the app" icon rather than an identicon built from the
+  key. This matters most when two people share a name.
+- **Create from search.** When a contact search finds nothing (the
+  `filteredEntities.length === 0` message), offer "Add “<term>” as someone
+  without the app". The new placeholder is selected immediately and the
+  dialog moves to the next step. Next to the "Unnamed" `SpecialEntityCard`,
+  an "Add someone without the app" card covers the case where nothing has
+  been typed yet.
+- **Keep the selection key-based.** `handlePersonSelected` and
+  `isPersonConflicted` compare `did` strings, and the placeholder key works
+  there unchanged. Convert key → `undefined` only at submission time (see
+  *Recording a claim*), never in the picker, or two placeholders would
+  look identical to the conflict check.
+- **Filter where a real DID is required.** `ProjectRepresentativeDialog`
+  uses the same grid to pick someone who will act on the server, so it gets
+  `allContacts.filter(c => !isPlaceholderKey(c.did))`. The same goes for any
+  other picker whose choice is sent to the server as a DID.
+
+The `EntityGrid` doc comment says arrays must be sorted by date added
+(newest first). That holds for placeholders because they get ordinary
+autoincrement `id`s.
+
+**Guards: a placeholder key must never reach the server or another user**
+
+Every place that sends a contact's DID somewhere needs to skip or refuse
+placeholders. From the current code, that includes:
+
+- Visibility toggles and checks (`setVisibilityUtil`, "sees me" refresh)
+- Registration (`register`) and invite flows
+- Contact sharing: QR/JWT URL generation, CSV export (`CONTACT_CSV_HEADER`),
+  "copy selected contacts", `contactImportPayload`
+- Server-side give/offer totals per contact in `ContactsView` (`loadGives`)
+- The `/did/:did` route (`DIDView`), which queries the server: placeholders
+  open a local-only detail page instead
+- Meeting member flows (`MeetingMembersList`, `BulkMembersDialog`)
+
+As a backstop, `createAndSubmitClaim` throws if the serialized claim contains
+any `local:` key, so a missed guard fails loudly rather than publishing the
+key.
+
+**Backups**: the full data export (DataExportSection / backup) **includes**
+placeholders and the `placeholder_claims` table, since they exist only on
+this device. Contact sharing with other users **excludes** them.
+
+**Linking when the person joins**
+
+The placeholder's row **becomes** the real contact: its `did` value is
+rekeyed from the `local:` key to the real DID. Its `id`, phone numbers,
+notes, labels, device link, and claim rows all stay with it. Two contact
+rows are never kept for one person.
+
+1. The person's DID arrives the usual way (QR scan, contact link). Before
+   inserting it, the app checks for placeholders that match: the same
+   normalized phone number, the same device-contact link, or the same name.
+   It asks "Is this <name>, whom you recorded without the app?" The user can
+   also start from the placeholder's page ("This person joined") and pick a
+   contact that already exists.
+2. `rekeyContact(fromKey, toDid)`, in one transaction:
+   1. Read every contact-keyed row (from the registry) for both `fromKey`
+      and `toDid`.
+   2. If a contact row with `toDid` already exists, copy its server-derived
+      fields (`publicKeyBase64`, `nextPubKeyHashB64`, `seesMe`,
+      `registered`, `profileImageUrl`) onto the placeholder row, and fill
+      any other field the placeholder left empty. Then delete that row's
+      dependent rows and the row itself.
+   3. Delete the dependent rows for `fromKey`.
+   4. `UPDATE contacts SET did = toDid WHERE did = fromKey`.
+   5. Re-insert the union of both sets of dependent rows under `toDid`
+      (`INSERT OR IGNORE`, so a label both rows had is kept once).
+
+   Dependent rows are deleted before the update and re-inserted after it
+   because `UPDATE contacts SET did` fails while `contact_labels` rows
+   reference the old value and foreign keys are enforced. This order works
+   whether or not they are enforced, so it doesn't rely on
+   `PRAGMA defer_foreign_keys`. (That pragma also works, verified with the
+   `sqlite3` CLI, but only inside an explicit transaction.)
+3. Before any edits, warn about confirmations. Editing a claim does not
+   carry its confirmations over to the edited version, so the app lists the
+   linked claims that have confirmations (from the same data the claim
+   detail view shows) and says those confirmations will have to be given
+   again. The user can go ahead or cancel.
+4. For each `placeholder_claims` row for this contact with
+   `dateAssigned IS NULL`:
+   - skip it, with a message, if `issuerDid` is not the active identity
+     (the server accepts edits only from the claim's issuer; the message
+     names which of this device's accounts to switch to, if any), or if its
+     `apiServer` differs from the active one;
+   - fetch the current claim by handle ID, call `editAndSubmitGive` /
+     `editAndSubmitOffer` with the real DID in the row's role, keeping every
+     other field;
+   - set `dateAssigned` on success.
+5. When every row is assigned, its `placeholder_claims` rows can be
+   deleted; the contact itself stays, as an ordinary real contact. Any
+   unassigned rows stay listed on the contact's page with a retry button,
+   since some edits may need another account or a network connection.
+6. Prompt the user to tell the person. Once at least one claim is assigned,
+   offer to share a message (through the share sheet, or a contact method
+   saved on the placeholder) saying their earlier gifts are recorded under
+   their identity, with a link to their gifts.
+
+`hydrateGive` / `hydrateOffer` only set agent/recipient when a DID is passed
+and never clear them. That is correct for this flow (it only ever adds a
+DID), but a test should pin it so a later "clear when blank" change does not
+break assignment.
+
+### Tests
+
+- Migration test (`src/test/migrations.test.ts`): 012 applies on a database
+  that already has contacts and labels, and leaves them unchanged.
+- `createAndSubmitClaim` rejects a claim containing a `local:` key.
+- `$insertContact` on an existing DID keeps the row's `id` and its labels,
+  with foreign keys both on and off.
+- `rekeyContact`, with foreign keys both on and off: labels, claim rows,
+  and device links move to the real DID; the row's `id` is unchanged; when
+  a row for the real DID already existed, it is folded in and its labels
+  are kept.
+- Registry coverage: every foreign key to `contacts(did)` and every
+  `contactKey` column in the migrated schema appears in
+  `CONTACT_KEYED_COLUMNS`.
+- Each guard listed above returns early (or hides the control) for a
+  placeholder.
+
+## Rejected
+
+### Make `contacts.did` nullable and key contacts by `contacts.id`
+
+The relationally clean model: a contact without a DID is just a row with
+`did IS NULL`.
+
+- Requires rebuilding `contacts` (dropping `NOT NULL` is not possible with
+  `ALTER TABLE` in SQLite) and rebuilding `contact_labels` to reference
+  `contacts.id` — the same backup/drop/recreate pattern that made migration
+  008 fail on every startup for some users.
+- `Contact.did` becomes optional, which breaks type-checking at every lookup,
+  route, and mixin method keyed by DID across roughly 70 files, and every
+  `WHERE did = ?` method needs an `id` variant.
+- Gains nothing functional over the placeholder key: the key is a surrogate
+  ID that happens to live in the existing column.
+- Its one real advantage is that linking a DID never rekeys child rows. That
+  advantage depends on `id` being stable, and it isn't: `INSERT OR REPLACE`
+  gives the row a new `id`, and contact export/import doesn't keep `id`, so
+  ids don't match across devices. The `rekeyContact` registry gets the same
+  safety without a table rebuild.
+
+Worth revisiting only if contacts get rekeyed by `id` for some other reason.
+
+### A separate, permanent `contactKey` column on `contacts`
+
+Add `contacts.contactKey TEXT UNIQUE` that never changes (the `local:` key
+for placeholders, the DID for everyone else), and key every child table by
+it, so linking only sets `did`. It is additive for new tables, but
+`contact_labels` references `contacts(did)`, so moving it to the new key is
+a table rebuild. Every DID-keyed lookup would also need to decide which key
+it means. It costs more than the rekey function it replaces.
+
+### Separate `placeholder_people` table outside `contacts`
+
+No risk to existing tables, but every picker and list (gift dialog entity
+grid, contacts list, labels, search) must merge two sources of different
+types, and labels need a second mapping table. The recommended option gets
+those UIs for free because a placeholder is a contact.
+
+### Fake DID written into the published claim
+
+E.g. `did:none:<uuid>` or a random `did:ethr:` with no key behind it, sent
+to the server as the agent/recipient.
+
+- Publishes a dangling identifier that other users see as "Someone Visible
+  But Not In Your Contact List"; it never resolves.
+- `did:none:` is the server's hidden-DID namespace (`did:none:HIDDEN`);
+  reusing the prefix risks the server treating it as hidden or rejecting it.
+- The claim still has to be edited when the person joins, so it saves no
+  work; the only gain is finding claims by server search, which the local
+  table already provides.
+
+### Custodial key: generate a real identity for the person
+
+The app creates a real keypair for the placeholder and uses its DID in claims;
+when the person joins, they import that key, so no claims need editing.
+
+- The user's device holds another person's private key, and every claim
+  "about" them was made while someone else held their identity.
+- The person may already have an identity, or may install on a device
+  without a way to receive the key; then the claims need editing anyway.
+- Handing over a seed phrase is a security-sensitive step this app's
+  onboarding does not have.
+
+### Put the person's name in the claim (`agent: { name: "..." }`)
+
+- Publishes a name for someone who has not consented to being on the
+  platform; server visibility rules hide DIDs, not free-text names.
+- Still needs the local record to assign the DID later.
+- Server acceptance of an agent without `identifier` is unverified.
+
+### Store linked claim IDs as a JSON column on `contacts`
+
+An `ALTER TABLE contacts ADD COLUMN placeholderClaims TEXT` is also additive,
+but role, issuer, server, and assignment status per claim fit a table
+better, and any whole-row rewrite of the contact (such as `INSERT OR
+REPLACE` from a stale copy) could overwrite the list.

doc/CHANGES/PLAN-restore-web-push.md

@@ -0,0 +1,167 @@
+# Plan: Web Push on the Web Build
+
+## Goal
+
+A user of the web build (browser tab or installed web app) can turn on the
+Daily Reminder and New Activity notifications and receive them, matching what
+native builds deliver.
+
+Requirements:
+
+1. A `DIRECT_NOTIFICATION` push shows its message as sent.
+2. A `DAILY_CHECK` push shows the count of new activity for the active
+   identity, using the same Endorser query the native fetcher uses.
+3. The service worker never holds a long-lived credential: it holds only
+   day-scoped JWTs, the same pool native builds hand to their background
+   fetcher.
+4. The Notifications section of the Account view works on the web build.
+
+## Can FCM replace Web Push?
+
+No. Firebase Cloud Messaging on the web (the `firebase/messaging` SDK) is a
+layer over the browser Push API: `getToken()` requires a registered service
+worker (`firebase-messaging-sw.js` by default), and that worker must display the
+notification, the same as a plain Web Push worker. FCM changes only the
+sending side — the push server would call the FCM HTTP v1 API instead of
+sending VAPID-signed Web Push requests — and it adds a Google dependency and
+Firebase config to the web build. It removes none of the work below.
+
+## Current state
+
+- `public/sw.js` is registered by `src/main.web.ts` on the web platform. It
+  handles only the Web Share Target POST; it has no `push` or
+  `notificationclick` handler.
+- The Notifications section of the Account view renders only on native
+  (`v-if="isNativePlatform"`, `src/views/AccountViewView.vue:81`), and the
+  "Notification Push Server" setting is hidden with `v-if="false"`
+  (`src/views/AccountViewView.vue:719`). Web users cannot subscribe.
+- `src/components/PushNotificationPermission.vue` contains the web
+  subscription flow:
+  - GET `{pushUrl}/web-push/vapid` for the VAPID key (`:242`);
+  - `pushManager.subscribe({ userVisibleOnly: true, ... })` (`:538`);
+  - POST of the subscription to the relative URL `/web-push/subscribe`
+    (`:583`), so the web host must proxy that path to the push server;
+  - `askPermission()` sends the worker the placeholder secret
+    `"temporary-secret"` via `SEND_LOCAL_DATA`, which nothing reads.
+- The push server sends a JSON payload whose `title` is `DAILY_CHECK` (run the
+  new-activity check) or `DIRECT_NOTIFICATION` (show `message` as-is).
+- Account data lives in SQLite through absurd-sql, which a service worker
+  cannot open. The worker therefore cannot decrypt the identity and sign its
+  own JWTs.
+- Native builds solve the same problem with `mintBackgroundJwtTokenPool()`
+  (`src/libs/crypto/backgroundJwtPool.ts`): 100 JWTs, each valid for one UTC
+  day, stored at index `epochDay % 100`, handed to the background fetcher by
+  `configureNativeFetcherIfReady()`
+  (`src/services/notifications/nativeFetcherConfig.ts`). Passkey (`did:peer`)
+  identities cannot mint the pool and raise
+  `BackgroundJwtUnsupportedIdentityError`.
+
+## Work
+
+### 1. Service worker push handling (`public/sw.js`)
+
+- `push`: parse the JSON payload.
+  - `DIRECT_NOTIFICATION`: `showNotification("Direct Message", { body: message })`.
+  - `DAILY_CHECK` (and any other title): take the token for today's slot from the
+    pool, GET `{apiServer}/api/v2/report/claims` with it, count claims newer
+    than the stored `lastNotifiedClaimId`, store the newest ID, and show "There
+    is 1 new activity" / "There are N new activities".
+- `notificationclick`: close the notification, focus an open app window or open
+  `/`.
+- Worker state (token pool, `apiServer`, `activeDid`, `lastNotifiedClaimId`)
+  lives in the worker's own IndexedDB database, never in the app's SQLite
+  database.
+
+### 2. Hand the token pool to the worker
+
+- On app start, identity change, and pool expiry, mint the pool with
+  `mintBackgroundJwtTokenPool()` and `postMessage` it to the worker together
+  with `apiServer` and `activeDid`. Reuse the trigger points in
+  `src/services/notifications/notificationAuthLifecycle.ts`
+  (`onNotificationAuthMayBeReady`).
+- Delete the `SEND_LOCAL_DATA` / placeholder-secret path in
+  `PushNotificationPermission.vue`.
+- Passkey identities: do not offer New Activity notifications (the Daily
+  Reminder needs no token).
+
+### 3. Empty daily checks
+
+Chrome requires every push received with `userVisibleOnly: true` to show a
+notification. A `DAILY_CHECK` that finds nothing new must show one anyway, or
+Chrome eventually shows its own "This site has been updated in the background"
+notice. Choose one (see Open questions):
+
+- show a quiet "No new activity" notification and close it after a short delay;
+- have the push server skip pushes when there is nothing new, which requires
+  the server to query Endorser on the user's behalf.
+
+### 4. Re-enable the UI on the web build
+
+- Render the Notifications section on web when `"PushManager" in window` and a
+  service worker is registered, instead of only on native.
+- Restore the "Notification Push Server" setting for web.
+- iOS Safari delivers Web Push only to web apps added to the Home Screen
+  (iOS 16.4+). `public/manifest.webmanifest` is linked from `index.html` and
+  makes the app installable; the UI must explain the Home Screen requirement on
+  iOS.
+
+### 5. Hosting
+
+- Confirm each web host (test, production, Docker `docker/*.conf`) proxies
+  `/web-push/subscribe` to the push server, or change the client to POST to
+  `{pushUrl}/web-push/subscribe`.
+- Serve `sw.js` with `Cache-Control: no-cache` so worker updates reach users
+  promptly.
+
+### 6. Tests
+
+- Playwright: register the worker, then deliver pushes with the Chrome DevTools
+  Protocol `ServiceWorker.deliverPushMessage` and assert on the shown
+  notification (`registration.getNotifications()`), for both payload types.
+- Unit-test the claim-counting function, extracted so it runs outside the
+  worker.
+
+## Estimate
+
+Two to four days of work, plus push-server and nginx checks (low confidence:
+the push server's current behavior and routing are not visible from this
+repository).
+
+## Open questions
+
+- Empty daily checks: silent-notification workaround, or server-side filtering?
+- Does the push server serve `/web-push/vapid` and accept
+  `/web-push/subscribe`, and does it send `DAILY_CHECK` daily?
+- Should New Activity on web use the same Endorser query as the native fetcher
+  (starred-plan changes) rather than `/api/v2/report/claims`, so both platforms
+  report the same thing?
+
+## Rejected
+
+- **FCM for web:** still needs a service worker; adds a Google dependency to the
+  web build and a server-side switch to the FCM API. See "Can FCM replace Web
+  Push?".
+- **Reviving the old worker scripts (`sw_scripts/safari-notifications.js`):**
+  they read the Dexie `TimeSafari` IndexedDB database, which no longer holds
+  accounts, and decrypted the identity inside the worker using a secret passed
+  from the page, shipping NaCl and noble crypto libraries into the worker. The
+  day-scoped token pool needs neither.
+
+## History
+
+- 2025-02-18 (`2746b8fe`): the Vite config reorganization switched the web build
+  to a Workbox-generated worker, so the custom push, notification-click, and
+  share-target handlers stopped shipping.
+- 2025-07-18 (`8bc1c521`): VitePWA and the generated worker were removed; the
+  web manifest stopped being generated and linked.
+- The leftover `sw_scripts/` files and PWA config were deleted, and
+  `public/sw.js` was added for the Web Share Target only.
+
+## Checklist
+
+- [ ] Decide the empty-daily-check behavior
+- [ ] Confirm push-server endpoints and routing per environment
+- [ ] `push` and `notificationclick` handlers in `public/sw.js`
+- [ ] Token-pool handoff to the worker; remove the placeholder secret
+- [ ] Re-enable the web Notifications UI, with the iOS Home Screen note
+- [ ] Playwright push-delivery tests

doc/CHANGES/PLAN-startup-db-failure-recovery.md

@@ -0,0 +1,129 @@
+# Plan: Startup Database Failure — Diagnostics and Degraded Mode
+
+## Goal
+
+When the local database cannot be opened, a user should (1) get a useful
+report to the developers with one tap, and (2) keep using whatever
+parts of the app do not need local storage, with a clear path to recovery.
+
+Requirements:
+
+1. A failure report reaches the developers without the user composing an email,
+   and it carries enough to identify the cause on the first report.
+2. The report is sent only with the user's consent and holds no keys, seed
+   phrases, or contact data.
+3. A user whose database is down can browse public content (feed, projects,
+   claims) instead of being held on the recovery screen.
+4. Every action that needs the database or an identity is visibly disabled with
+   the real reason, and points to the recovery screen.
+5. Recovery steps never delete the database without keeping a copy.
+
+## Startup failure behavior
+
+- `CapacitorPlatformService._initialize()`
+  (`src/services/platforms/CapacitorPlatformService.ts`) opens the database in
+  three steps: "create connection", "open database", "run migrations". A
+  failure throws `Failed to initialize database (step: <step>): <cause>`.
+- `src/utils/startupError.ts` recognizes that error by its message and hands it
+  to `StartView` through `sessionStorage`.
+- Three places catch it and redirect to `/start`: the router `errorHandler`
+  and `beforeEach` guard (`src/router/index.ts:344`, `:363-454`), and the Vue
+  global error handler (`src/main.common.ts`).
+- The guard calls `retrieveAccountDids()` for every route except the
+  identity-setup routes, so with the database down every route except
+  `/account`, `/test` and `/logs` lands on `/start`.
+- `StartView` shows the recovery screen: Try Again, Email/Copy Details,
+  "Save a Copy of My Data" (`shareDatabaseFile()`), and "Start Over"
+  (`resetDatabase()`, which copies the file aside before deleting it).
+- API reads work without an identity: `getHeaders()`
+  (`src/libs/endorserServer.ts:430`) omits the Authorization header when there
+  is no DID.
+- Every path that creates, saves, or signs with an identity reads the `secret`
+  and `accounts` tables (`src/libs/util.ts`: `saveNewIdentity`,
+  `retrieveFullyDecryptedAccount`), so no action that needs a DID can work while
+  the database is down.
+
+## Part A: One-tap diagnostics report
+
+Contents of the report:
+
+- the startup error message (step and cause) and stack
+- app version, platform, OS version, device model
+- Android: WebView version and installer package (`getInstallerPackageName`)
+- whether a database file existed before the first connection attempt of this
+  process, which shows whether Android restored a backup at install time
+- whether the SQLite plugin loaded (a plugin load failure surfaces as a
+  `CapacitorSQLitePlugin:` prefix on the cause)
+- the `migrations` table contents, when the database opens far enough to read it
+
+Delivery: a POST to an endpoint on a server the project runs. The recovery
+screen shows the exact payload and a Send button; the email option stays for
+users who decline.
+
+The database-existed flag needs a native-side or `Filesystem.stat` check before
+`createConnection`; `databaseDirectoryUri()` already resolves the directory on
+Android and iOS.
+
+## Part B: Degraded mode
+
+- Change the router guard so that a database startup error records the error
+  and lets read-only routes through: home feed, projects, project and claim
+  views, and discovery. Identity-setup routes and anything that writes stay
+  redirected to `/start`.
+- Show a persistent banner on every page while in degraded mode: "Your
+  device's storage isn't working. You can look around, but you can't act yet.
+  Fix it →", linking to the recovery screen.
+- Disable buttons that need a DID or the database (give, offer, create project,
+  confirm, invite, contacts) with that same reason, instead of the
+  "someone must register you" text an unregistered user sees.
+- Default `apiServer` in every settings fallback. `$accountSettings()`
+  (`src/utils/PlatformServiceMixin.ts:1071-1136`) returns `defaultSettings` or
+  the caller's `defaults` (often `{}`) on its early-return and error paths, so
+  `apiServer` can be undefined; `HomeView` works around this on its own.
+- Order the recovery screen as a ladder: Try Again → Send Diagnostics → Save a
+  Copy → Start Over.
+
+## Part C (optional): An identity that does not need SQLite
+
+Key generation is pure (`generateSeed` → `deriveAddress` → `newIdentifier`).
+In degraded mode the app could generate an identity, require the user to write
+down the seed phrase, and keep the mnemonic in `@capacitor/preferences`
+(installed, and independent of SQLite). The user would then have a DID someone
+can register. When the database opens again, the app imports the identity from
+Preferences and deletes the Preferences copy.
+
+Trade-off: the mnemonic sits unencrypted in Preferences, about the same
+protection as the database's secret stored next to the data it encrypts.
+Worth building only if startup failures keep being reported with the plugin's
+encryption setting (`androidIsEncryption: false`) in effect.
+
+## Open questions
+
+- Which server and endpoint receive diagnostics, and how long reports are kept.
+- Whether to quarantine a corrupt database automatically ("file is not a
+  database", "malformed") and start fresh. Automatic quarantine trades a
+  visible failure for a silent switch to a new identity, and some "malformed"
+  databases are recoverable with `REINDEX` or `.recover`; the manual Start Over
+  button covers this case.
+- Whether Android backup should include `databases/`. Including it restores a
+  user's identity on a new phone; it also gives the Google backup a copy of the
+  keys together with the secret that decrypts them. The backup rules
+  (`android/app/src/main/res/xml/backup_rules.xml`,
+  `data_extraction_rules.xml`) include it.
+
+## Rejected
+
+- An IndexedDB (absurd-sql) database as a fallback inside the Capacitor
+  WebView: untested there, and two stores that both hold keys risk losing an
+  identity when they disagree.
+
+## Checklist
+
+- [ ] A1. Decide the diagnostics endpoint and payload retention.
+- [ ] A2. Capture "database file existed before first connection" during startup.
+- [ ] A3. Build the report payload and the Send Diagnostics button with preview.
+- [ ] B1. Let read-only routes through the router guard on a database startup error.
+- [ ] B2. Degraded-mode banner and disabled-action reasons.
+- [ ] B3. Default `apiServer` in all `$accountSettings()` fallbacks.
+- [ ] B4. Reorder the recovery screen.
+- [ ] C1. (Optional) Preferences-backed identity with import on recovery.

doc/CHANGES/history/fix-startup-db-crash.md

@@ -0,0 +1,124 @@
+# Fix: Startup Database Error on Android
+
+## Symptom
+
+On some Android installs from the Play Store, the app showed a "Startup
+Error" on every launch:
+
+```
+[CapacitorPlatformService] Failed to initialize database
+```
+
+Reinstalling did not help. The failure never appeared on developer devices
+installed through adb or Android Studio. Full symptom report:
+`startup-db-error-symptoms.md`.
+
+## Causes
+
+### 1. The SQLite plugin ignored its configuration (main cause)
+
+`capacitor.config.ts` listed the SQLite settings under the key `CapSQLite`.
+The plugin registers as `CapacitorSQLite` and reads only that key, so every
+setting under `CapSQLite` was ignored and the plugin defaults applied:
+
+- **Android:** `isEncryption` defaults to true, so on every launch the plugin
+  created an Android Keystore master key and opened an
+  `EncryptedSharedPreferences` file (`sqlite_encrypted_shared_prefs`) to hold a
+  database passphrase. If that step throws, the plugin fails to load and every
+  `createConnection` call is rejected.
+- **iOS:** the database location defaults to `Documents`, not the configured
+  `Library/CapacitorDatabase`.
+- **Electron:** the plugin reads `plugins.CapacitorSQLite` directly, so a
+  bundled config with the wrong key would throw at plugin startup.
+
+The Keystore step fails on Android in two ways:
+
+- **Restore without the key.** Android Auto Backup and device-to-device
+  transfer restore the encrypted preferences file, but Keystore keys never
+  leave the device. The restored file can't be decrypted, so the plugin fails on
+  every launch, and a reinstall from Play restores the same file again.
+- **Device Keystore bugs.** Some manufacturers' Keystore implementations fail
+  without any restore.
+
+The app never used plugin encryption: it opens the database with
+`encrypted = false` and mode `"no-encryption"`, and never stores a passphrase.
+The Keystore setup protected nothing.
+
+### 2. A migration could be applied but not recorded
+
+The migration runner ran each migration's SQL in one transaction and recorded
+its name in the `migrations` table in a second one. If the app died between the
+two, the migration ran again on the next launch. Migration 001's
+`INSERT INTO secret (id, ...) VALUES (1, ...)` then failed with
+`UNIQUE constraint failed: secret.id` on every launch. The window is
+milliseconds, but once hit the failure is permanent, and Auto Backup carries it
+to a reinstall.
+
+## Changes
+
+| Area | Change |
+|---|---|
+| `capacitor.config.ts`, `electron/capacitor.config.ts`, `android/app/src/main/assets/capacitor.config.json` | Key renamed to `CapacitorSQLite`, so `androidIsEncryption: false` takes effect and the Keystore step never runs. `iosDatabaseLocation` set to `Documents`, the location every iOS install uses. |
+| `capacitor.config.json`, `electron/capacitor.config.json` | `iosDatabaseLocation` set to `Documents` to match. These files already used the correct key. |
+| `src/services/platforms/CapacitorPlatformService.ts` | `databaseDirectoryUri()` points at `Documents` on iOS, so "Save a Copy of My Data" and "Start Over" find the real database file. |
+| `src/services/migrationService.ts` | Each migration's `INSERT INTO migrations` is appended to its own statement batch, which the native plugin runs as one transaction. |
+| `src/db-sql/migration.ts` | Migration 001 uses `INSERT OR IGNORE` for the `secret` and `settings` rows, so a re-run never replaces the existing secret. |
+| `android/app/src/main/AndroidManifest.xml`, `res/xml/backup_rules.xml`, `res/xml/data_extraction_rules.xml` | Cloud backup and device transfer exclude the plugin's encrypted preference files. Everything else is backed up, including the database. |
+| `src/test/migrations.test.ts` | Tests for a crash right after a migration commits, and for a re-run of 001 keeping the secret. |
+| `src/test/capacitorConfig.test.ts` | Fails if the plugin config key or the iOS location is wrong. |
+
+## Security
+
+Encryption of user keys is unchanged. The identity and seed phrase are encrypted
+by the app (`simpleEncrypt` with the random secret from migration 001) and stored
+in `accounts`. The plugin's encryption flag only controlled whole-database
+SQLCipher encryption, which the app never used; the database file was plain
+SQLite before and after this change. App sandboxing keeps the file private to
+the app on both platforms.
+
+## Compatibility with existing installs
+
+- **Android:** the database has no password whether plugin encryption is on or
+  off, so it opens the same way. The leftover encrypted preferences file is
+  never read again.
+- **iOS:** the database stays in `Documents`. Setting the location back to
+  `Library/CapacitorDatabase` would not be safe: the plugin moves databases into
+  a custom location only when that folder does not exist yet, and installs from
+  between May and August 2025 have that folder with an outdated database in it.
+- **Migrations:** existing installs already have 001 recorded, so its edit
+  never runs for them. The recording change affects only migrations that have
+  not run.
+
+## Verification
+
+- **Reproduced before the fix** on an Android emulator: run the app once, copy
+  `shared_prefs` out with `run-as app.timesafari.app`, uninstall (which deletes
+  the Keystore key), reinstall, put the copied `shared_prefs` back, and launch.
+  The startup error appeared.
+- **Unit tests:** `pkgx npm run test:unit -- src/test/migrations.test.ts
+  src/test/capacitorConfig.test.ts`. The two migration tests fail on the
+  earlier code and pass on the fixed code.
+- **Android resources:** `./gradlew :app:processDebugResources` builds, and
+  the merged manifest carries both backup-rule attributes.
+- **After the fix:** run the same emulator steps on a fixed build, and also
+  restore `shared_prefs` captured from a pre-fix build. The app should start
+  normally either way.
+
+## Follow-up
+
+The one-tap diagnostics report and a degraded mode for users without a working
+database are planned in `doc/CHANGES/PLAN-startup-db-failure-recovery.md`.
+
+## History
+
+- 2025-05-27: `capacitor.config.json` set `iosDatabaseLocation` to
+  `Library/CapacitorDatabase` under the correct `CapacitorSQLite` key
+  (commit 7b4f9d65).
+- 2025-08-14: the config moved to `capacitor.config.ts` under the key
+  `CapSQLite`, which the plugin does not read (commit a2840675). Plugin
+  encryption setup ran on Android from then on, and iOS databases moved to the
+  default `Documents` location.
+- 2026-10-10: commit d6ccf0e4 added the failed step and underlying cause to the
+  startup error, made migration 008 tolerate duplicate contact DIDs and labels
+  pointing at deleted contacts, and added the recovery screen.
+- 2026-10-10: this fix (config key, atomic migration records, backup rules).

doc/README-BUILD-GUARD.md

@@ -104,9 +104,7 @@ Build Scripts:
 ├── scripts/**             # All build and automation scripts
 ├── electron/**            # Electron build files
 ├── android/**             # Android build configuration
-├── ios/**                 # iOS build configuration
-├── sw_scripts/**          # Service worker scripts
-└── sw_combine.js          # Service worker combination
+└── ios/**                 # iOS build configuration
 
 Deployment:
 ├── Dockerfile             # Docker configuration

doc/android-firebase-gms.md

@@ -2,49 +2,47 @@
 
 ## Overview
 
-The app is designed to work on Android devices with and without Google Play Services (GMS). Firebase/FCM push notifications are an opt-in feature at build time; all other functionality works on GMS-less devices (F-Droid, LineageOS without OpenGApps, etc.).
+The app is designed to work on Android devices with and without Google Play Services (GMS). Firebase/FCM is **on by default** for local, test, and production builds. GMS-less devices still run the app; FCM degrades when Play Services is absent. F-Droid and other builds that must omit Firebase opt out explicitly.
 
-## How the opt-in guard works
+## How the switch works
 
-`android/app/build.gradle` applies the `com.google.gms.google-services` Gradle plugin only when **both** conditions are true:
+`android/app/build.gradle` applies `com.google.gms.google-services` unless `firebaseEnabled` is `false`. `android/gradle.properties` sets `firebaseEnabled=true`, so Android Studio, `./gradlew`, and `scripts/build-android.sh` all pick it up. `-PfirebaseEnabled` and `-PfirebaseEnabled=true` stay on. The config file does not decide the switch.
 
-1. `android/google-services.json` is present on disk
-2. The Gradle property `firebaseEnabled` is explicitly passed
+When Firebase is on, `android/app/google-services.json` must exist, be non-empty, and contain `mobilesdk_app_id`. Otherwise configuration fails with an error that names that path. When Firebase is off, the file is ignored even if it is on disk.
 
-```groovy
-if (servicesJSON.exists() && servicesJSON.text && project.hasProperty('firebaseEnabled')) {
-    apply plugin: 'com.google.gms.google-services'
-}
-```
+`scripts/build-android.sh` forwards an opt-out: `FIREBASE_ENABLED=false` adds `-PfirebaseEnabled=false` to its Gradle commands. Default npm scripts leave Firebase on. A `:nostore` script sets `FIREBASE_ENABLED=false` and reuses that script (`npm run build:android:test:nostore:run`).
 
-This means the file can live on disk for development purposes without accidentally activating Firebase.
+iOS uses the same default. `ios/App/scripts/bundle-firebase-config.sh` copies `ios/App/App/GoogleService-Info.plist` into the app and the share extension. `scripts/build-ios.sh` runs it with `--check` before a device build, and both Xcode targets run it as a build phase. The build and archive `xcodebuild` commands both receive `FIREBASE_ENABLED`. `FIREBASE_ENABLED=false` becomes `FIREBASE_ENABLED=NO` and skips the plist. A `:nostore` script sets that variable (`npm run build:ios:prod:nostore`). A missing or empty plist fails the build when Firebase is on.
+
+`:nostore` disables Firebase only. It does not strip other store-linked dependencies (the ML Kit barcode scanner still pulls in Play Services) and does not guarantee the build will run on every device outside the Play Store.
 
 ## Build commands
 
 | Target | Command | Firebase |
 |---|---|---|
-| APK / sideload / Zapstore | `./gradlew assembleRelease` | off |
-| Aurora / Play Store without FCM | `./gradlew bundleRelease` | off |
-| Play Store with FCM push notifications | `./gradlew bundleRelease -PfirebaseEnabled` | on |
-| F-Droid | `./gradlew assembleRelease` | off (required) |
+| Local / test / production APK or AAB | `./gradlew assembleRelease` or `bundleRelease` | on |
+| Play Store with FCM | `./gradlew bundleRelease` | on |
+| iOS (Xcode or `scripts/build-ios.sh`) | default | on |
+| F-Droid / FOSS Android | `./gradlew assembleRelease -PfirebaseEnabled=false` or `npm run build:android:test:nostore` | off |
+| iOS without Firebase | `FIREBASE_ENABLED=false` or `npm run build:ios:prod:nostore` | off |
 
 ## Behavior on non-GMS devices
 
-When built with `-PfirebaseEnabled`, Firebase SDKs check for GMS availability at startup and degrade gracefully if it is absent:
+When Firebase is enabled (the default), Firebase SDKs check for GMS availability at startup and degrade gracefully if it is absent:
 
 - Firebase initializes but detects no GMS
 - FCM skips token registration silently (no token, no notifications)
 - The app continues to work normally
 
-This means a single Play Store AAB (`bundleRelease -PfirebaseEnabled`) covers both GMS and non-GMS users. GMS users get push notifications; non-GMS users get a fully functional app without them.
+This means a single Play Store AAB (`bundleRelease`, Firebase on by default) covers both GMS and non-GMS users. GMS users get push notifications; non-GMS users get a fully functional app without them.
 
-**Aurora Store** pulls the exact APK from Play Store servers, so Aurora users get whichever variant was uploaded. The Play Store AAB built with `-PfirebaseEnabled` is correct for Aurora.
+**Aurora Store** pulls the exact APK from Play Store servers, so Aurora users get whichever variant was uploaded. The default Play Store AAB (Firebase on) is the one to upload.
 
-**F-Droid** is stricter: their build policy rejects any APK with GMS dependencies at the binary level, even with graceful degradation. F-Droid submission would require a separate `assembleRelease` build (no flag) and a dedicated F-Droid listing.
+**F-Droid** is stricter: their build policy rejects any APK with GMS dependencies at the binary level, even with graceful degradation. F-Droid submission would require a separate `assembleRelease -PfirebaseEnabled=false` build and a dedicated F-Droid listing.
 
 ## Push registration in builds without Firebase
 
-A build without `-PfirebaseEnabled` contains the `@capacitor/push-notifications` plugin, but no Firebase config. In that build, `PushNotifications.register()` throws `Default FirebaseApp is not initialized` on the Capacitor plugin thread, which kills the app; a JS `try/catch` cannot intercept it.
+A build with `-PfirebaseEnabled=false` contains the `@capacitor/push-notifications` plugin, but no Firebase config. In that build, `PushNotifications.register()` throws `Default FirebaseApp is not initialized` on the Capacitor plugin thread, which kills the app; a JS `try/catch` cannot intercept it.
 
 The JS therefore asks native code first. `NotificationInspector.isFirebaseConfigured()` (`android/app/src/main/java/app/timesafari/notifications/NotificationInspectorPlugin.java`) reports whether the `google_app_id` string resource exists; the google-services Gradle plugin generates that resource only when Firebase is enabled, and it is the same signal Firebase's auto-initialization uses. `firebaseMessagingClient.ts` skips `register()` on Android when it is absent (or when the check fails), logging `No Firebase config in this Android build; skipping push registration`. Listener setup and the notification permission request run either way, since local daily notifications need that permission.
 
@@ -56,7 +54,8 @@ Any code that calls `PushNotifications.register()` or other `FirebaseMessaging`
 
 - Gitignored (`android/.gitignore` line 80) — never commit it
 - Contains Firebase project credentials (project number, app ID, API key)
-- Safe to leave on disk; has no effect unless `-PfirebaseEnabled` is passed
+- Required for the default (Firebase on) build. Place it at `android/app/google-services.json`
+- Ignored when you pass `-PfirebaseEnabled=false`; leaving it on disk does not re-enable Firebase
 - Obtain from the Firebase console: Project Settings → Your apps → Android app → Download `google-services.json`
 
 ## Known GMS dependency: MLKit barcode scanner

doc/local-android-testing-analysis.md

@@ -2,9 +2,9 @@
 
 **Created:** 2026-06-02  
 **Source document:** [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md)  
-**Purpose:** Plan a future **Android** counterpart guide by mapping what can be reused from the iOS ngrok workflow and what must be written for Android-specific push, permissions, and OS behavior.
+**Status:** Planning snapshot from 2026-06-02. Several iOS-guide assumptions (app **Refresh Notifications**, Simulate WAKEUP, `applyNotificationRefreshPayload`, WAKEUP_PING → `/notifications/refresh` → `api_*`) are **retired**. For current Android procedure see [local-android-testing-ngrok.md](./local-android-testing-ngrok.md). Do not treat the reuse tables below as the live app path.
 
-**Status:** Planning only — does not replace or modify the iOS guide.
+**Purpose:** Plan a future **Android** counterpart guide by mapping what can be reused from the iOS ngrok workflow and what must be written for Android-specific push, permissions, and OS behavior.
 
 ---
 

doc/local-android-testing-ngrok.md

@@ -1,8 +1,10 @@
 # Local Android Testing with ngrok (notification-wakeup-service)
 
-**Last updated:** 2026-06-02 (verification checklist, end-to-end test)  
+**Last updated:** 2026-09-24 (retired WAKEUP_PING → refresh → `api_*` consumption)  
 **Audience:** Developers on **crowd-funder-for-time-pwa**, **daily-notification-plugin**, and **notification-wakeup-service**  
-**Goal:** Exercise FCM wakeup (`WAKEUP_PING`), FCM token registration, and notification refresh against a Mac-hosted backend reachable from a physical Android device.
+**Goal:** Exercise FCM token registration and FCM wakeup **delivery** (`WAKEUP_PING` via `/debug/send-wakeup`) against a Mac-hosted backend reachable from a physical Android device.
+
+> **Retired (do not expect this in the app):** `WAKEUP_PING` → `POST /notifications/refresh` → `applyNotificationRefreshPayload()` → `api_*` local schedules. The app logs ignored push types and does not refresh or schedule from wakeup. `/debug/send-wakeup` remains an FCM diagnostic. Mac `curl` of `/notifications/refresh` only tests the backend. Local schedules come from Static Daily Reminder, New Activity / dual, and the native fetcher.
 
 **See also:** [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md) for the iOS workflow (APNs, Xcode). [android-physical-device-guide.md](./android-physical-device-guide.md) for USB debugging and build/run commands.
 
@@ -10,7 +12,7 @@
 
 ## Architecture overview
 
-End-to-end flow when testing New Activity / silent wake on a physical Android phone:
+End-to-end flow when testing FCM registration and wakeup **delivery** on a physical Android phone:
 
 ```text
 ┌─────────────────────┐     HTTPS      ┌──────────────────────┐
@@ -19,7 +21,7 @@ End-to-end flow when testing New Activity / silent wake on a physical Android ph
 │  wakeup-service     │                └──────────┬───────────┘
 └──────────┬──────────┘                           │
            │                                      │ fetch
-           │ POST /notifications/refresh          │ POST /notifications/register
+           │                                      │ POST /notifications/register
            │                                      ▼
            │                             ┌──────────────────────┐
            │                             │  crowd-funder-for-   │
@@ -28,7 +30,7 @@ End-to-end flow when testing New Activity / silent wake on a physical Android ph
            │                             └──────────┬───────────┘
            │                                        │
            │  FCM data message (WAKEUP_PING)        │ daily-notification-plugin
-           ▼                                        ▼ (local schedule replace)
+           ▼                                        ▼ (Daily Reminder / dual / fetcher)
 ┌─────────────────────┐                ┌──────────────────────┐
 │  Firebase Cloud     │ ──FCM────────► │  Android device      │
 │  Messaging          │  direct        │  app.timesafari.app  │
@@ -41,18 +43,16 @@ Unlike iOS, Android does **not** use APNs. FCM delivers directly to the app via
 
 | Repo | Role |
 |------|------|
-| **notification-wakeup-service** | HTTP API: device registration, refresh payload (`nextNotifications`), health, debug wakeup send |
-| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register` & `/refresh`, handles `WAKEUP_PING` push |
-| **daily-notification-plugin** | Native Android: clear + reschedule local notifications from refresh timestamps |
+| **notification-wakeup-service** | HTTP API: device registration, health, debug wakeup send; may still expose `/notifications/refresh` for the backend |
+| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register`; logs `WAKEUP_PING` without refresh/`api_*` scheduling |
+| **daily-notification-plugin** | Native Android: Daily Reminder, New Activity / dual, native fetcher; Phase 4 `clearApiNotifications()` |
 
-### Android wakeup flow (production path)
+### Android wakeup flow (current)
 
-1. **notification-wakeup-service** (or `/debug/send-wakeup`) sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
+1. **notification-wakeup-service** `/debug/send-wakeup` sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
 2. FCM delivers to the device (best-effort; see [Android Platform Notes](#8-android-platform-notes) and [Battery Optimization Caveats](#9-battery-optimization-caveats)).
 3. Capacitor `pushNotificationReceived` fires → `handleCapacitorPushNotificationReceived()` in `NativeNotificationService.ts`.
-4. Handler calls `refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" })`, which `POST`s `{backend}/notifications/refresh` with `testMode` from the debug config.
-5. Backend returns `nextNotifications: [{ timestamp }, ...]`.
-6. App calls `applyNotificationRefreshPayload()` → **daily-notification-plugin** clears existing local alarms and schedules new ones.
+4. Handler logs `[Notifications] push handler ignored type=WAKEUP_PING`. It does **not** POST `/notifications/refresh` or schedule `api_*` notifications.
 
 Console and debug panel lines are prefixed with **`[Notifications]`** (see `NotificationDebugEvents.ts`).
 
@@ -240,7 +240,7 @@ Complete this section once before your first physical-device push test. If Fireb
 
 2. The repo gitignores this file — each developer keeps a local copy; never commit it.
 
-3. Rebuild so Gradle applies the Google Services plugin (`android/app/build.gradle` applies `com.google.gms.google-services` when the file exists). If the file is missing, the build logs: *google-services.json not found, google-services plugin not applied. Push Notifications won't work*.
+3. Rebuild. Firebase is on by default, so Gradle applies the Google Services plugin. If `android/app/google-services.json` is missing or empty, the build stops and names that path. Opt out only with `-PfirebaseEnabled=false` or `FIREBASE_ENABLED=false`.
 
 4. Sync Capacitor if you changed native config:
 
@@ -290,12 +290,11 @@ For a full panel reference (configuration, URL resolution order, authentication,
 | Control | Purpose |
 |---------|---------|
 | **Notification Backend URL** | Paste ngrok HTTPS URL → **Save Backend URL** (changes target server only) |
-| **Test Mode** | Sends `testMode: true/false` in register/refresh JSON bodies (default on when unset in storage) |
+| **Test Mode** | Sends `testMode: true/false` in register / send-wakeup JSON bodies (default on when unset in storage) |
 | **Skip JWT Authentication (Local Development Only)** | When on, omits `Authorization` headers for local servers that accept unauthenticated requests (default **off**) |
 | **Register Token Now** | `POST /notifications/register` with current FCM token and `platform: "android"` |
-| **Refresh Notifications** | `POST /notifications/refresh` (same as post-wakeup flow) |
-| **Simulate WAKEUP_PING (Local)** | Calls refresh API directly (no FCM) — quick backend + ngrok test |
-| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup` on the backend override URL; server sends a real FCM `WAKEUP_PING` to the panel’s current FCM token (see below) |
+| **Upload AlertSearch Authorization** | Uploads AlertSearch delegated JWTs (`/notifications/alert-authorization`) |
+| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; FCM delivery diagnostic only (no app-side refresh/`api_*` scheduling) |
 | **Event Log** | Shared `[Notifications]` panel log (100 entries) |
 
 Persistence: `localStorage` keys `notificationDebug.backendBaseUrl`, `notificationDebug.testMode`, and `notificationDebug.bypassAuth` (`NotificationDebugConfig.ts`).
@@ -314,19 +313,13 @@ For **local ngrok / localhost**: set the backend URL to your tunnel or `http://1
 
 ### testMode
 
-When **Test Mode** is on (default if never saved), register and refresh requests include `"testMode": true`. The backend can route dev traffic separately from production. Turn it off in the panel only if you intentionally want production-mode API behavior against your tunnel.
+When **Test Mode** is on (default if never saved), register and send-wakeup requests include `"testMode": true`. The backend can route dev traffic separately from production. Turn it off in the panel only if you intentionally want production-mode API behavior against your tunnel.
 
 ### WAKEUP_PING debug controls
 
-Three panel actions exercise different segments of the wakeup pipeline. Use them to bisect failures (see [Troubleshooting §14](#fcm-message-not-received)).
+**Send Real WAKEUP_PING** is the remaining panel control for wakeup. Mock refresh, Simulate WAKEUP_PING, Wakeup Ping Simulator, and Flood Test were removed with the retired refresh pipeline.
 
-| Button | Behavior |
-|--------|----------|
-| **Backend Testing → Simulate WAKEUP_PING (Local)** | Skips FCM; calls refresh API only (ngrok path test) |
-| **Backend Testing → Send Real WAKEUP_PING** | Full pipeline: backend `/debug/send-wakeup` → FCM → Capacitor listener → refresh (see below) |
-| **Wakeup Ping Simulator** (lower on panel) | Runs production handler with synthetic `WAKEUP_PING` payload (no FCM, no backend wakeup call) |
-
-Use **Simulate WAKEUP_PING (Local)** to verify ngrok + refresh; use **Wakeup Ping Simulator** to verify handler + refresh chaining without FCM; use **Send Real WAKEUP_PING** for end-to-end FCM delivery on device.
+Use **Send Real WAKEUP_PING** to confirm backend → FCM → Capacitor listener delivery. Do not expect `/notifications/refresh` or `api_*` rescheduling.
 
 ### Send Real WAKEUP_PING
 
@@ -337,9 +330,9 @@ Use **Simulate WAKEUP_PING (Local)** to verify ngrok + refresh; use **Wakeup Pin
 1. Reads the **Current FCM Token** shown in the panel (same token used by **Register Token Now**). If no token is available, the action fails with a panel status message.
 2. `POST`s to `{backend override}/debug/send-wakeup` with `deviceId`, `fcmToken`, `platform: "android"`, and `testMode` from the panel config (`NotificationDebugService.sendRealWakeupPing()`).
 3. On HTTP success, the **notification-wakeup-service** enqueues a real FCM **data** message with `data.type = "WAKEUP_PING"` to that device.
-4. When FCM delivers the message to the app, Capacitor fires `pushNotificationReceived` → `handleCapacitorPushNotificationReceived()` → `refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" })` → `POST /notifications/refresh` → `applyNotificationRefreshPayload()` (clear + reschedule via **daily-notification-plugin**).
+4. When FCM delivers the message to the app, Capacitor fires `pushNotificationReceived` → `handleCapacitorPushNotificationReceived()`, which logs `push handler ignored type=WAKEUP_PING`. There is no `refreshNotificationsWithDiagnostics` and no `applyNotificationRefreshPayload`.
 
-That exercises the full **backend → FCM → Capacitor push listener → refresh request → notification rescheduling** path on Android without manual `curl` on the Mac.
+That exercises **backend → FCM → Capacitor push listener** on Android without manual `curl` on the Mac. It does **not** reschedule local notifications.
 
 **Prerequisites:** ngrok backend override saved, **Test Mode** as needed, notification permission granted, **Register Token Now** succeeded, app **backgrounded** (Home — not force-stop) before expecting FCM delivery ([§8](#8-android-platform-notes)).
 
@@ -348,27 +341,24 @@ That exercises the full **backend → FCM → Capacitor push listener → refres
 Filter logcat (prefix is always `[Notifications]`):
 
 ```bash
-adb logcat | grep -E '\[Notifications\].*(Real WAKEUP_PING|pushNotificationReceived|WAKEUP_PING|Refresh started|Refresh completed)'
+adb logcat | grep -E '\[Notifications\].*(Real WAKEUP_PING|push handler ignored)'
 ```
 
-On a **successful end-to-end** run (HTTP success from the panel, then FCM delivery within ~30–120s), expect these key lines in order:
+On a **successful FCM delivery** run (HTTP success from the panel, then FCM delivery within ~30–120s), expect these key lines in order:
 
 ```
 [Notifications] Real WAKEUP_PING requested
 [Notifications] Real WAKEUP_PING success
-[Notifications] pushNotificationReceived type=WAKEUP_PING
-[Notifications] WAKEUP_PING handler — invoking refresh
-[Notifications] Refresh started (WAKEUP_PING)
-[Notifications] Refresh completed (WAKEUP_PING) in …ms (scheduled N)
+[Notifications] push handler ignored type=WAKEUP_PING
 ```
 
-Intermediate lines (e.g. `WAKEUP_PING received — will trigger refresh`, `Schedule replacement: …`, `Using authenticated notification request` or auth bypass messages when **Skip JWT Authentication** is on) are normal. ngrok should also show a new `POST /notifications/refresh` after the push is handled.
+Auth bypass messages when **Skip JWT Authentication** is on are normal. ngrok should **not** show a new `POST /notifications/refresh` from the app after the push.
 
-#### Send Real WAKEUP_PING vs end-to-end success
+#### Send Real WAKEUP_PING vs delivery success
 
-The panel status **“Real WAKEUP_PING sent via backend.”** and the Event Log line **`Real WAKEUP_PING success`** only confirm that the backend **accepted the request and attempted FCM delivery**. They do **not** prove the device received the push or ran refresh.
+The panel status **“Real WAKEUP_PING sent via backend.”** and the Event Log line **`Real WAKEUP_PING success`** only confirm that the backend **accepted the request and attempted FCM delivery**. They do **not** prove the device received the push.
 
-**Successful end-to-end delivery** is confirmed only when the subsequent **`pushNotificationReceived`**, **`WAKEUP_PING handler`**, and **`Refresh started (WAKEUP_PING)`** / **`Refresh completed (WAKEUP_PING)`** lines appear in logcat (or Event Log) within the delivery window. If you see `Real WAKEUP_PING success` but not those lines, treat it as an FCM delivery problem ([FCM message not received](#fcm-message-not-received)), not a backend enqueue failure.
+**Successful delivery** is confirmed when **`push handler ignored type=WAKEUP_PING`** appears in logcat (or Event Log) within the delivery window. If you see `Real WAKEUP_PING success` but not that line, treat it as an FCM delivery problem ([FCM message not received](#fcm-message-not-received)), not a backend enqueue failure.
 
 ### Programmatic override (optional)
 
@@ -455,15 +445,11 @@ On **API 33+**, `POST_NOTIFICATIONS` is a runtime permission ([section 7](#7-and
 
 ### Network connectivity
 
-FCM and your ngrok-backed refresh both need network:
-
-- Device must reach **Google’s FCM endpoints** (mobile data or Wi‑Fi).
-- After wake, the app must reach the **ngrok HTTPS URL** for `POST /notifications/refresh`.
-- Airplane mode, captive portals, VPNs, or flaky Wi‑Fi cause “server sent wakeup but app never refreshed” symptoms even when FCM eventually arrives.
+FCM needs network to Google’s endpoints. Registration needs the ngrok HTTPS URL for `POST /notifications/register`. Airplane mode, captive portals, VPNs, or flaky Wi‑Fi cause “server sent wakeup but app never logged ignored type” symptoms even when FCM eventually arrives.
 
 ### Physical device vs emulator
 
-Doze, App Standby, and OEM battery menus are weak or absent on many emulators. Use a **physical device** for wakeup SLA testing; emulators are fine for panel-only register/refresh smoke tests.
+Doze, App Standby, and OEM battery menus are weak or absent on many emulators. Use a **physical device** for wakeup SLA testing; emulators are fine for panel-only register smoke tests.
 
 ### Logcat
 
@@ -471,7 +457,7 @@ Doze, App Standby, and OEM battery menus are weak or absent on many emulators. U
 adb logcat | grep -E '\[Notifications\]|\[FirebaseMessaging\]|\[NativeNotificationService\]'
 ```
 
-Expect `pushNotificationReceived type=WAKEUP_PING` and `WAKEUP_PING handler — invoking refresh` after a successful wake. For a panel-driven test, use **Send Real WAKEUP_PING** ([§6](#send-real-wakeup_ping)) instead of manual `curl`.
+Expect `push handler ignored type=WAKEUP_PING` after a successful wake. For a panel-driven test, use **Send Real WAKEUP_PING** ([§6](#send-real-wakeup_ping)) instead of manual `curl`.
 
 ---
 
@@ -499,7 +485,7 @@ Apps used infrequently move to **standby** buckets with reduced background netwo
 
 ### Manufacturer-specific restrictions
 
-OEMs add layers on top of AOSP. Aggressive battery management can delay **WAKEUP_PING** delivery or prevent the refresh `fetch` from running promptly.
+OEMs add layers on top of AOSP. Aggressive battery management can delay **WAKEUP_PING** delivery.
 
 | Vendor | Where to look (names vary by OS version) |
 |--------|------------------------------------------|
@@ -515,8 +501,8 @@ If wakeup works on a **Pixel** but fails on an OEM phone, assume battery policy
 
 1. Server accepts `/debug/send-wakeup` → FCM enqueue succeeds.
 2. Device may **hold** the message until Doze maintenance or OEM policy allows delivery.
-3. `pushNotificationReceived` runs → `refreshNotificationsWithDiagnostics()` → ngrok `POST /notifications/refresh`.
-4. Any step can lag under battery savers; use **Simulate WAKEUP_PING (Local)** in the debug panel to separate FCM delay from refresh/API issues; use **Send Real WAKEUP_PING** for the full FCM path ([§6](#send-real-wakeup_ping)).
+3. `pushNotificationReceived` runs → `push handler ignored type=WAKEUP_PING`.
+4. Any step can lag under battery savers; use **Send Real WAKEUP_PING** for the FCM path ([§6](#send-real-wakeup_ping)).
 
 ---
 
@@ -528,12 +514,10 @@ If wakeup works on a **Pixel** but fails on an OEM phone, assume battery policy
 4. Grant notification permission when prompted (or enable in Settings).
 5. Open **Notification Debug Panel** → paste ngrok URL → **Save Backend URL**; confirm **Test Mode** is on; enable **Skip JWT Authentication** only if your local backend accepts unauthenticated requests.
 6. Tap **Register Token Now** → confirm ngrok `POST /notifications/register` and `[Notifications] Token registration success` in Event Log / logcat.
-7. Tap **Refresh Notifications** → confirm `POST /notifications/refresh` and `Refresh completed in Nms (scheduled X)` in Event Log.
-8. Optional: tap **Simulate WAKEUP_PING (Local)** to verify ngrok + refresh without FCM.
-9. Background the app (Home), then tap **Send Real WAKEUP_PING** (or from the Mac, call **`/debug/send-wakeup`** — see [curl examples](#13-sample-curl-commands)) with the registered `deviceId` / token as required by **notification-wakeup-service**.
-10. Watch logcat for `WAKEUP_PING` and `Refresh completed (WAKEUP_PING)` lines ([expected output](#expected-logcat-output)).
-11. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate HTTP traffic.
-12. Use **Pending Notification Inspector** on the panel to confirm locally scheduled fires after refresh.
+7. Background the app (Home), then tap **Send Real WAKEUP_PING** (or from the Mac, call **`/debug/send-wakeup`** — see [curl examples](#13-sample-curl-commands)) with the registered `deviceId` / token as required by **notification-wakeup-service**.
+8. Watch logcat for `push handler ignored type=WAKEUP_PING` ([expected output](#expected-logcat-output)).
+9. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate HTTP traffic (register and send-wakeup; not app-initiated refresh).
+10. Use **Pending Notification Inspector** for Daily Reminder / New Activity / dual schedules — not for retired `api_*` refresh.
 
 For a formal pass/fail sequence, use the [Verification Checklist](#11-verification-checklist) below.
 
@@ -549,12 +533,12 @@ Use this checklist during development or QA sign-off. Each step lists **actions*
 | 2 | Device → backend override | §2 |
 | 3 | FCM token registered | §3 |
 | 4 | Device record in wakeup service | §4 |
-| 5 | Refresh returns schedule data | §5 |
-| 6 | Locals scheduled | §6 |
+| 5 | Optional backend `/notifications/refresh` curl | §5 (backend only; app does not call this) |
+| 6 | Locals scheduled | §6 (Daily Reminder / dual / fetcher — not refresh) |
 | 7 | Manual wakeup sends FCM | §7 |
-| 8 | WAKEUP_PING → refresh | §8 |
-| 9 | Replace after refresh | §9 |
-| 10 | Test mode frequent refreshes | §10 |
+| 8 | WAKEUP_PING delivered | §8 |
+| 9 | _(retired)_ Replace after refresh | skipped |
+| 10 | _(retired)_ Test mode frequent refreshes | skipped |
 
 ### 1. Backend reachable through ngrok
 
@@ -578,7 +562,7 @@ curl -sS -w "\nHTTP %{http_code}\n" "$BASE/health"
 3. Confirm **Backend Status → URL** matches the saved ngrok host.
 4. Enable **Test Mode** if using dev backend behavior.
 
-**Expected outcome:** **Active** URL in the panel equals your ngrok `https://…` host. Subsequent app requests use that base (not the default `DEFAULT_NOTIFY_API_SERVER`) for `/notifications/register` and `/notifications/refresh`.
+**Expected outcome:** **Active** URL in the panel equals your ngrok `https://…` host. Subsequent app requests use that base (not the default `DEFAULT_NOTIFY_API_SERVER`) for `/notifications/register` and `/debug/send-wakeup`.
 
 ---
 
@@ -611,12 +595,11 @@ curl -sS -w "\nHTTP %{http_code}\n" "$BASE/health"
 
 ---
 
-### 5. Refresh endpoint returns schedule data
+### 5. Refresh endpoint (backend only; app does not call this)
 
 **Actions:**
 
-1. Tap **Refresh Notifications** in the panel (or curl below).
-2. Inspect ngrok response body.
+Mac-side curl against **notification-wakeup-service** if you need to confirm the backend still answers. The app has no **Refresh Notifications** button and does not schedule from this payload.
 
 ```bash
 curl -sS -X POST "$BASE/notifications/refresh" \
@@ -624,18 +607,18 @@ curl -sS -X POST "$BASE/notifications/refresh" \
   -d '{"platform":"android","testMode":true}'
 ```
 
-**Expected outcome:** HTTP **200**; JSON includes `nextNotifications` array with at least one `{ "timestamp": <number> }` in the **future** (epoch ms). Event Log: `Refresh completed in …ms (scheduled N)` with **N ≥ 1**. If `scheduled 0` or empty array, fix backend auth, DID/native fetcher, or `testMode` handling before scheduling tests.
+**Expected outcome:** HTTP **200** from the **service** if that route is still deployed. Do **not** expect Event Log `Refresh completed` or `api_*` schedules in the app.
 
 ---
 
-### 6. Local notifications are scheduled
+### 6. Local notifications are scheduled (not from refresh)
 
 **Actions:**
 
-1. After a successful refresh (step 5), open **Pending Notification Inspector** → **Refresh** (list button).
-2. Optionally cross-check logcat for `Schedule replacement applied (N timestamp(s))`.
+1. Configure Static Daily Reminder and/or New Activity (dual) in the app, or rely on the native fetcher.
+2. Open **Pending Notification Inspector** → **Refresh** (list button).
 
-**Expected outcome:** Inspector lists **N** pending item(s) matching refresh count; each row has a **future** `nextTriggerDate` / wall-clock time. No `Schedule replacement aborted` or `skipped (no valid timestamps)` in Event Log.
+**Expected outcome:** Inspector lists pending Daily Reminder / dual / fetcher items. Do not expect `api_*` identifiers after Phase 4 startup cleanup. There is no `Schedule replacement applied` from WAKEUP_PING.
 
 ---
 
@@ -656,11 +639,11 @@ curl -sS -X POST "$BASE/debug/send-wakeup" \
 
 3. Check **notification-wakeup-service** logs for FCM send success (no Admin SDK / token errors).
 
-**Expected outcome:** HTTP **200** (or documented success code) from `/debug/send-wakeup`; Event Log / logcat: `Real WAKEUP_PING success` when using the panel button; server logs indicate FCM message enqueued/sent with `data.type = "WAKEUP_PING"`. This step alone does not prove device delivery (see step 8 and [Send Real WAKEUP_PING vs end-to-end success](#send-real-wakeup_ping-vs-end-to-end-success)).
+**Expected outcome:** HTTP **200** (or documented success code) from `/debug/send-wakeup`; Event Log / logcat: `Real WAKEUP_PING success` when using the panel button; server logs indicate FCM message enqueued/sent with `data.type = "WAKEUP_PING"`. This step alone does not prove device delivery (see step 8 and [Send Real WAKEUP_PING vs delivery success](#send-real-wakeup_ping-vs-delivery-success)).
 
 ---
 
-### 8. WAKEUP_PING triggers refreshNotifications()
+### 8. WAKEUP_PING is delivered (no refresh)
 
 **Actions:**
 
@@ -669,42 +652,28 @@ curl -sS -X POST "$BASE/debug/send-wakeup" \
 3. Filter logcat:
 
 ```bash
-adb logcat | grep -E 'WAKEUP_PING|pushNotificationReceived|Refresh completed'
+adb logcat | grep -E 'WAKEUP_PING|push handler ignored'
 ```
 
 **Expected outcome (within ~30–120s, longer under Doze/OEM):**
 
-1. `pushNotificationReceived type=WAKEUP_PING` / `WAKEUP_PING received`
-2. `WAKEUP_PING handler — invoking refresh`
-3. `Refresh started (WAKEUP_PING)`
-4. ngrok: new `POST /notifications/refresh`
-5. `Refresh completed (WAKEUP_PING) in …ms (scheduled N)`
+1. `Real WAKEUP_PING success` (panel path)
+2. `push handler ignored type=WAKEUP_PING`
+3. ngrok: **no** app-initiated `POST /notifications/refresh`
 
-**Isolation:** **Wakeup Ping Simulator** on the panel should produce lines 2–5 without FCM. **Simulate WAKEUP_PING (Local)** proves refresh only (no handler, source `WAKEUP_PING simulation`). Full expected logcat for **Send Real WAKEUP_PING**: [§6](#expected-logcat-output).
+Full expected logcat for **Send Real WAKEUP_PING**: [§6](#expected-logcat-output).
 
 ---
 
 ### 9. Existing notifications are replaced after refresh
 
-**Actions:**
-
-1. Note pending count and identifiers in **Pending Notification Inspector**.
-2. Tap **Refresh Notifications** again (or trigger step 8).
-3. Refresh inspector; compare IDs/times to step 1.
-
-**Expected outcome:** Event Log shows `clearAllNotifications` or `cancelAllNotifications` then `Schedule replacement applied`; pending list reflects **new** timestamps (old alarms not accumulated). Total pending count should match latest refresh `N`, not double from duplicate refreshes unless backend returned more slots.
+**Retired.** The app no longer replaces local schedules from `/notifications/refresh`. Pending list changes come from Daily Reminder / dual / native fetcher, or from Phase 4 `clearApiNotifications()`.
 
 ---
 
 ### 10. Test mode produces frequent notification refreshes
 
-**Actions:**
-
-1. Confirm **Test Mode** checked; **Backend Status → testMode: true**.
-2. Call refresh twice (panel or curl) with `testMode: true`.
-3. Compare `nextNotifications` timestamps in ngrok responses.
-
-**Expected outcome:** With **testMode: true**, **notification-wakeup-service** returns **dev-friendly** schedule data—typically **sooner** fire times than production mode (shorter horizons). Pending Inspector updates to nearer triggers after each refresh. With Test Mode **off**, timestamps should be farther out (production-like); use that contrast to confirm the flag is wired end-to-end.
+**Retired.** `testMode` still goes on register and send-wakeup bodies. It does not drive app-side `api_*` refresh cadences.
 
 ---
 
@@ -739,31 +708,23 @@ npm run dev
 
 8. Paste `BASE` → **Save Backend URL**; enable **Test Mode**.
 
-### Phase C — Register and schedule
+### Phase C — Register
 
 9. **Register Token Now** → Event Log success; ngrok `POST /notifications/register` **200**; copy `deviceId` from ngrok request body.
 
 10. Confirm device in **notification-wakeup-service** (logs/DB per that repo).
 
-11. **Refresh Notifications** → Event Log `scheduled N`, N ≥ 1; ngrok refresh **200** with `nextNotifications`.
+### Phase D — FCM wakeup delivery
 
-12. **Pending Notification Inspector** → **Refresh** → future alarm(s) listed.
+11. Background app (Home).
 
-### Phase D — FCM wakeup path
+12. Tap **Send Real WAKEUP_PING** in the panel (or Mac: `curl -X POST "$BASE/debug/send-wakeup" -H "Content-Type: application/json" -d '{"deviceId":"…","testMode":true}'`) → panel `Real WAKEUP_PING success` and server FCM enqueue success.
 
-13. Background app (Home).
+13. Within 30–120s (longer if unplugged/Doze): logcat shows `push handler ignored type=WAKEUP_PING`; ngrok does **not** show an app `POST /notifications/refresh`.
 
-14. Tap **Send Real WAKEUP_PING** in the panel (or Mac: `curl -X POST "$BASE/debug/send-wakeup" -H "Content-Type: application/json" -d '{"deviceId":"…","testMode":true}'`) → panel `Real WAKEUP_PING success` and server FCM enqueue success.
+### Phase E — Optional local notification proof
 
-15. Within 30–120s (longer if unplugged/Doze): logcat shows `pushNotificationReceived` → `Refresh completed (WAKEUP_PING)`; ngrok shows second `POST /notifications/refresh`.
-
-16. Pending Inspector **Refresh** → timestamps updated (replacement, not duplicate stack).
-
-### Phase E — Optional delivery proof
-
-17. If `testMode` returned a trigger within a few minutes, wait for wall-clock fire with app backgrounded; confirm notification appears (permission + channel + exact alarm rules).
-
-18. If FCM step 15 failed but step 11 passed: run **Simulate WAKEUP_PING (Local)** then **Wakeup Ping Simulator** to bisect FCM vs handler; see [Troubleshooting](#14-troubleshooting) and [Send Real WAKEUP_PING vs end-to-end success](#send-real-wakeup_ping-vs-end-to-end-success).
+14. Enable Daily Reminder or New Activity; wait for wall-clock fire with app backgrounded; confirm the OS notification is **not** the retired generic `api_*` “Reminder” copy.
 
 ### End-to-end pass criteria
 
@@ -771,9 +732,9 @@ npm run dev
 |-------|------|
 | A | Health OK local + ngrok |
 | B | Override URL + testMode active |
-| C | Register + refresh + pending list populated |
-| D | Wakeup curl OK → logcat refresh chain → pending updated |
-| E | Optional visible notification at scheduled time |
+| C | Register succeeded |
+| D | Wakeup curl/panel OK → logcat ignored-type line |
+| E | Optional visible Daily Reminder / New Activity notification |
 
 ---
 
@@ -804,7 +765,7 @@ curl -sS -X POST "$BASE/notifications/register" \
   }'
 ```
 
-### Refresh (mirror app payload)
+### Refresh (backend only; app does not consume)
 
 ```bash
 curl -sS -X POST "$BASE/notifications/refresh" \
@@ -815,19 +776,7 @@ curl -sS -X POST "$BASE/notifications/refresh" \
   }'
 ```
 
-Example success body shape (actual fields may vary by service version):
-
-```json
-{
-  "shouldNotify": true,
-  "nextNotifications": [
-    { "timestamp": 1710000000000 },
-    { "timestamp": 1710003600000 }
-  ]
-}
-```
-
-The app schedules those timestamps via **daily-notification-plugin** (`applyNotificationRefreshPayload` in `NativeNotificationService.ts`).
+This exercises **notification-wakeup-service** only. The app does **not** call `applyNotificationRefreshPayload` or schedule `api_*` from the response.
 
 ### Send wakeup push (debug)
 
@@ -842,7 +791,7 @@ curl -sS -X POST "$BASE/debug/send-wakeup" \
   }'
 ```
 
-Confirm parameters (token vs `deviceId`, auth headers) in that repo’s README or OpenAPI spec. The server must send FCM data including `type: "WAKEUP_PING"` to match `handleCapacitorPushNotificationReceived`.
+Confirm parameters (token vs `deviceId`, auth headers) in that repo’s README or OpenAPI spec. The server may still send FCM data including `type: "WAKEUP_PING"`; the app logs it as ignored and does not refresh.
 
 ---
 
@@ -899,35 +848,28 @@ Compare with panel **Backend Status** and Event Log error text.
 
 ### Refresh endpoint failures
 
-**Symptoms:** **Refresh Notifications** fails; Event Log HTTP error; no `scheduled X` line; ngrok missing `POST /notifications/refresh`.
+**Symptoms:** Mac `curl` of `/notifications/refresh` fails; ngrok missing that path. This is a **backend** issue. The app does not POST refresh.
 
-**Likely causes:** Stale ngrok URL; backend down; 404/wrong path; JWT/native fetcher not configured; refresh auth failure.
+**Verification:** `curl` health and refresh from the Mac; confirm the service still ships that route.
 
-**Verification:**
-
-1. **Simulate WAKEUP_PING (Local)** — if this fails, problem is ngrok/refresh API, not FCM.
-2. ngrok inspect for refresh status code and response body.
-3. Logcat: `refreshNotifications failed` or JWT errors from `configureNativeFetcherIfReady()`.
-
-**Fixes:** Fix backend URL and health; ensure active DID and endorser settings ([notification-from-api-call.md](./notification-from-api-call.md)); confirm `testMode` if backend requires it.
+**Fixes:** Fix backend URL and health. App scheduling uses Daily Reminder / dual / native fetcher, not this payload.
 
 ---
 
 ### FCM message not received
 
-**Symptoms:** `/debug/send-wakeup` or panel **Send Real WAKEUP_PING** shows success (`Real WAKEUP_PING success` in Event Log); no `pushNotificationReceived` / `WAKEUP_PING` in logcat within 2 minutes; refresh never triggered.
+**Symptoms:** `/debug/send-wakeup` or panel **Send Real WAKEUP_PING** shows success (`Real WAKEUP_PING success` in Event Log); no `push handler ignored type=WAKEUP_PING` in logcat within 2 minutes.
 
 **Likely causes:** Force-stopped app; wrong FCM token on server; Doze/OEM delay; no Google Play services; payload missing `data.type = "WAKEUP_PING"`; device offline.
 
-**Note:** `Real WAKEUP_PING success` only means the backend accepted and sent the FCM request. Missing downstream refresh logs indicates a **delivery** failure, not a failed wakeup API call ([§6](#send-real-wakeup_ping-vs-end-to-end-success)).
+**Note:** `Real WAKEUP_PING success` only means the backend accepted and sent the FCM request. Missing the ignored-type log indicates a **delivery** failure, not a failed wakeup API call ([§6](#send-real-wakeup_ping-vs-delivery-success)).
 
 **Verification:**
 
 1. App **backgrounded** (Home), not force-stopped.
 2. Panel FCM token matches token used by server/register.
-3. **Simulate WAKEUP_PING (Local)** works → isolates FCM path from refresh/API.
-4. Wait 30–120s (longer on Doze/OEM).
-5. Battery **Unrestricted** and OEM autostart enabled for test device.
+3. Wait 30–120s (longer on Doze/OEM).
+4. Battery **Unrestricted** and OEM autostart enabled for test device.
 
 **Fixes:** Re-register token; relaunch app; relax battery settings ([section 9](#9-battery-optimization-caveats)); confirm **notification-wakeup-service** message format; test on Pixel vs suspect OEM policy.
 
@@ -947,30 +889,28 @@ Compare with panel **Backend Status** and Event Log error text.
 
 ### Notifications not appearing
 
-**Symptoms:** Refresh succeeds (`scheduled X` in log) but no visible notification at fire time; Pending Inspector empty or stale.
+**Symptoms:** Daily Reminder or New Activity configured but no visible notification at fire time; Pending Inspector empty or stale.
 
 **Likely causes:** Permission denied (display blocked); exact alarm permission on Android 12+; timestamps in past; plugin schedule error; DND/channel settings.
 
 **Verification:**
 
 1. Permission granted ([section 7](#7-android-notification-permissions)).
-2. Pending Notification Inspector after refresh.
-3. Logcat: `Schedule replacement applied` vs aborted messages.
-4. Confirm `nextNotifications` timestamps are in the future (curl refresh response).
+2. Pending Notification Inspector for Daily Reminder / dual identifiers (not `api_*` after Phase 4 cleanup).
 
-**Fixes:** Grant `POST_NOTIFICATIONS`; check `SCHEDULE_EXACT_ALARM` / alarm permission per plugin docs; fix refresh payload; test with nearer timestamps via backend `testMode`.
+**Fixes:** Grant `POST_NOTIFICATIONS`; check `SCHEDULE_EXACT_ALARM` / alarm permission per plugin docs. Do not expect wakeup refresh payloads to populate the inspector.
 
 ---
 
 ### Duplicate notifications
 
-**Symptoms:** Multiple identical local notifications; Event Log shows repeated refresh lines.
+**Symptoms:** Multiple identical local notifications.
 
-**Likely causes:** Multiple `WAKEUP_PING` deliveries; repeated manual **Refresh**; flood test; separate Daily Reminder vs New Activity schedules.
+**Likely causes:** Separate Daily Reminder vs New Activity schedules; duplicate dual config; leftover `api_*` before Phase 4 cleanup.
 
-**Verification:** Event Log count of refresh completions; ngrok inspect for duplicate `POST /notifications/refresh`.
+**Verification:** Pending Inspector identifiers; see [notification-new-activity-lay-of-the-land.md](./notification-new-activity-lay-of-the-land.md) for product-level double-schedule issues.
 
-**Fixes:** Each refresh should **replace** schedule (clear + schedule)—if duplicates persist, check plugin logs; see [notification-new-activity-lay-of-the-land.md](./notification-new-activity-lay-of-the-land.md) for product-level double-schedule issues.
+**Fixes:** Confirm Daily Reminder vs dual settings. WAKEUP_PING no longer stacks `api_*` refreshes.
 
 ---
 
@@ -988,11 +928,11 @@ Compare with panel **Backend Status** and Event Log error text.
 
 ### Gradle: Push Notifications won't work
 
-**Symptoms:** Build log: `google-services.json not found, google-services plugin not applied`.
+**Symptoms:** Build fails: `android/app/google-services.json is missing, empty, or has no mobilesdk_app_id`.
 
 **Likely causes:** Missing `android/app/google-services.json`.
 
-**Verification:** File exists on disk; rebuild shows Google Services plugin applied.
+**Verification:** File exists on disk and the build log says `Firebase enabled: google-services plugin applied`.
 
 **Fixes:** Download from Firebase Console (package `app.timesafari.app`); place in `android/app/`; `npx cap sync android` and rebuild.
 
@@ -1006,7 +946,7 @@ Compare with panel **Backend Status** and Event Log error text.
 | `src/services/notifications/NotificationDebugEvents.ts` | Panel event log + `logNotification()` |
 | `src/services/notifications/notificationLog.ts` | Structured log helpers |
 | `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
-| `src/services/notifications/NativeNotificationService.ts` | `refreshNotifications`, `WAKEUP_PING`, `applyNotificationRefreshPayload` |
+| `src/services/notifications/NativeNotificationService.ts` | Push delivery hook (logs ignored types; no refresh) |
 | `src/services/notifications/firebaseMessagingClient.ts` | Capacitor push listeners, permission, token registration |
 | `src/components/dev/NotificationDebugPanel.vue` | Dev UI |
 | `src/main.capacitor.ts` | Native push init at startup |

doc/local-ios-testing-ngrok.md

@@ -1,14 +1,16 @@
 # Local iOS Testing with ngrok (notification-wakeup-service)
 
-**Last updated:** 2026-05-18  
+**Last updated:** 2026-09-24 (retired WAKEUP_PING → refresh → `api_*` consumption)  
 **Audience:** Developers on **crowd-funder-for-time-pwa**, **daily-notification-plugin**, and **notification-wakeup-service**  
-**Goal:** Exercise silent push wake (`WAKEUP_PING`), FCM token registration, and notification refresh against a Mac-hosted backend reachable from a physical iPhone.
+**Goal:** Exercise FCM token registration and silent-push **delivery** (`WAKEUP_PING` via `/debug/send-wakeup`) against a Mac-hosted backend reachable from a physical iPhone.
+
+> **Retired (do not expect this in the app):** `WAKEUP_PING` → `POST /notifications/refresh` → `applyNotificationRefreshPayload()` → `api_*` local schedules. The app logs ignored push types and does not refresh or schedule from wakeup. `/debug/send-wakeup` remains an FCM/APNs diagnostic. Mac `curl` of `/notifications/refresh` only tests the backend.
 
 ---
 
 ## Architecture overview
 
-End-to-end flow when testing New Activity / silent wake on a physical iPhone:
+End-to-end flow when testing FCM registration and wakeup **delivery** on a physical iPhone:
 
 ```text
 ┌─────────────────────┐     HTTPS      ┌──────────────────────┐
@@ -17,7 +19,7 @@ End-to-end flow when testing New Activity / silent wake on a physical iPhone:
 │  wakeup-service     │                └──────────┬───────────┘
 └──────────┬──────────┘                           │
            │                                        │ fetch
-           │ POST /notifications/refresh            │ POST /notifications/register
+           │                                        │ POST /notifications/register
            │                                        ▼
            │                             ┌──────────────────────┐
            │                             │  crowd-funder-for-     │
@@ -26,7 +28,7 @@ End-to-end flow when testing New Activity / silent wake on a physical iPhone:
            │                             └──────────┬───────────┘
            │                                        │
            │  FCM data message (WAKEUP_PING)        │ daily-notification-plugin
-           ▼                                        ▼ (local schedule replace)
+           ▼                                        ▼ (Daily Reminder / dual / fetcher)
 ┌─────────────────────┐                ┌──────────────────────┐
 │  Firebase Cloud      │ ──APNs──────► │  iPhone (physical)   │
 │  Messaging           │  silent push  │  app.timesafari      │
@@ -37,18 +39,16 @@ End-to-end flow when testing New Activity / silent wake on a physical iPhone:
 
 | Repo | Role |
 |------|------|
-| **notification-wakeup-service** | HTTP API: device registration, refresh payload (`nextNotifications`), health, debug wakeup send |
-| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register` & `/refresh`, handles `WAKEUP_PING` push |
-| **daily-notification-plugin** | Native iOS/Android: clear + reschedule local notifications from refresh timestamps |
+| **notification-wakeup-service** | HTTP API: device registration, health, debug wakeup send; may still expose `/notifications/refresh` |
+| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register`; logs `WAKEUP_PING` without refresh/`api_*` scheduling |
+| **daily-notification-plugin** | Native iOS/Android: Daily Reminder, New Activity / dual, native fetcher; Phase 4 `clearApiNotifications()` |
 
-### Silent wake sequence (production path)
+### Silent wake sequence (current)
 
-1. Backend (or `/debug/send-wakeup`) sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
+1. Backend `/debug/send-wakeup` sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
 2. APNs delivers to the device (best-effort; see iOS caveats below).
 3. Capacitor `pushNotificationReceived` fires → `handleCapacitorPushNotificationReceived()`.
-4. App calls `POST {backend}/notifications/refresh` with `testMode` (from debug config).
-5. Backend returns `nextNotifications: [{ timestamp }, ...]`.
-6. App calls `applyNotificationRefreshPayload()` → plugin clears and schedules new local alarms.
+4. Handler logs `[Notifications] push handler ignored type=WAKEUP_PING`. It does **not** POST `/notifications/refresh` or schedule `api_*` notifications.
 
 Console and debug panel lines are prefixed with **`[Notifications]`** (see `NotificationDebugEvents.ts`).
 
@@ -297,12 +297,11 @@ For a full panel reference (configuration, URL resolution order, authentication,
 | Control | Purpose |
 |---------|---------|
 | **Notification Backend URL** | Paste ngrok HTTPS URL → **Save Backend URL** (changes target server only) |
-| **Test Mode** | Sends `testMode: true/false` in register/refresh JSON bodies (default on when unset in storage) |
+| **Test Mode** | Sends `testMode: true/false` in register / send-wakeup JSON bodies (default on when unset in storage) |
 | **Skip JWT Authentication (Local Development Only)** | When on, omits `Authorization` headers for local servers that accept unauthenticated requests (default **off**) |
 | **Register Token Now** | `POST /notifications/register` with current FCM token |
-| **Refresh Notifications** | `POST /notifications/refresh` (same as post-wakeup flow) |
-| **Simulate WAKEUP_PING (Local)** | Calls refresh API directly (no FCM) — quick backend test |
-| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; server sends real FCM `WAKEUP_PING` (Android doc has full flow) |
+| **Upload AlertSearch Authorization** | Uploads AlertSearch delegated JWTs |
+| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; FCM/APNs delivery diagnostic only |
 | **Event Log** | Shared `[Notifications]` panel log (100 entries) |
 
 Persistence: `localStorage` keys `notificationDebug.backendBaseUrl`, `notificationDebug.testMode`, and `notificationDebug.bypassAuth` (`NotificationDebugConfig.ts`).
@@ -352,7 +351,7 @@ This section is a quick verification checklist for the detailed Firebase/APNs se
 | **GoogleService-Info.plist** | Present in the iOS target if using Firebase iOS SDK paths in your build |
 | **FCM token** | Confirm **Register Token Now** succeeds in the debug panel and ngrok shows `POST /notifications/register` |
 
-Silent/data pushes used for wake typically use a **content-available** style payload; confirm **notification-wakeup-service** and Firebase message format match what `handleCapacitorPushNotificationReceived` expects (`data.type === "WAKEUP_PING"`).
+Silent/data pushes used for wake typically use a **content-available** style payload; confirm **notification-wakeup-service** and Firebase message format. The app logs `WAKEUP_PING` as ignored and does not refresh.
 
 ---
 
@@ -378,14 +377,9 @@ Silent/data pushes used for wake typically use a **content-available** style pay
 - **Low Power Mode** can reduce background execution.
 - **Focus / Do Not Disturb** may affect notification presentation (separate from silent data wake, but confusing during tests).
 
-### Two “Simulate WAKEUP_PING” buttons
+### Send Real WAKEUP_PING (FCM/APNs diagnostic)
 
-| Button | Behavior |
-|--------|----------|
-| **Backend Testing → Simulate WAKEUP_PING** | Skips FCM; calls refresh API only (ngrok path test) |
-| **Wakeup Ping Simulator** (lower on panel) | Runs production handler with synthetic `WAKEUP_PING` payload |
-
-Use the backend button to verify ngrok + refresh; use the simulator to verify handler + refresh chaining.
+**Send Real WAKEUP_PING** posts `/debug/send-wakeup`. Delivery is confirmed by `push handler ignored type=WAKEUP_PING`. Mock refresh, Simulate WAKEUP_PING, and Wakeup Ping Simulator were removed.
 
 ---
 
@@ -395,11 +389,10 @@ Use the backend button to verify ngrok + refresh; use the simulator to verify ha
 2. Start **ngrok** and copy the HTTPS URL.
 3. Set URL + **Test Mode** in the Notification Debug Panel; confirm **Backend Status**.
 4. Tap **Register Token Now** → confirm ngrok request and `[Notifications] Token registration success`.
-5. Tap **Refresh Notifications** → confirm `Refresh completed in Nms (scheduled X)` in Event Log and ngrok `POST /notifications/refresh`.
-6. From the backend, call **`/debug/send-wakeup`** (see curl below) with the registered `deviceId` / FCM token as required by that service.
-7. Watch **Xcode console** for `[Notifications] pushNotificationReceived type=WAKEUP_PING` and refresh timing lines.
-8. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate requests.
-9. Use **Pending Notification Inspector** on the panel to see locally scheduled fires after refresh.
+5. From the backend, call **`/debug/send-wakeup`** (see curl below) with the registered `deviceId` / FCM token as required by that service, or tap **Send Real WAKEUP_PING**.
+6. Watch **Xcode console** for `[Notifications] push handler ignored type=WAKEUP_PING`.
+7. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate requests (register and send-wakeup; not app-initiated refresh).
+8. Use **Pending Notification Inspector** for Daily Reminder / dual / fetcher schedules.
 
 ---
 
@@ -430,7 +423,7 @@ curl -sS -X POST "$BASE/notifications/register" \
   }'
 ```
 
-### Refresh (mirror app payload)
+### Refresh (backend only; app does not consume)
 
 ```bash
 curl -sS -X POST "$BASE/notifications/refresh" \
@@ -441,19 +434,7 @@ curl -sS -X POST "$BASE/notifications/refresh" \
   }'
 ```
 
-Example success body shape (actual fields may vary by service version):
-
-```json
-{
-  "shouldNotify": true,
-  "nextNotifications": [
-    { "timestamp": 1710000000000 },
-    { "timestamp": 1710003600000 }
-  ]
-}
-```
-
-The app schedules those timestamps via **daily-notification-plugin** (`applyNotificationRefreshPayload` in `NativeNotificationService.ts`).
+This exercises **notification-wakeup-service** only. The app does **not** call `applyNotificationRefreshPayload` or schedule `api_*` from the response.
 
 ### Send wakeup push (debug)
 
@@ -478,8 +459,8 @@ Confirm parameters (token vs deviceId, auth headers) in that repo’s README or
 
 | Symptom | Checks |
 |---------|--------|
-| Network error in Event Log | ngrok running? URL saved without typo/trailing slash? |
-| HTTP 404 | Tunnel port matches backend `PORT`; path is `/notifications/refresh` |
+| Mac `curl` of `/notifications/refresh` fails | ngrok running? URL saved without typo/trailing slash? |
+| HTTP 404 | Tunnel port matches backend `PORT`; path is `/notifications/refresh` (backend route; the app does not call it) |
 | CORS (web only) | Native Capacitor fetch usually avoids browser CORS; if testing in Safari PWA, configure CORS on the service |
 | ngrok browser warning | Free tier may show an interstitial for browser clients; native `fetch` from the app is usually unaffected |
 
@@ -495,15 +476,15 @@ Confirm parameters (token vs deviceId, auth headers) in that repo’s README or
 - App **backgrounded**, not force-quit
 - Physical device, correct provisioning profile
 - APNs key uploaded to Firebase; bundle ID matches
-- FCM message includes `data.type = "WAKEUP_PING"` (see `NativeNotificationService.ts`)
+- FCM message includes `data.type = "WAKEUP_PING"` (logged as ignored in `NativeNotificationService.ts`)
 - Server actually sent to the **same** FCM token shown in the debug panel
 - Wait 30–120s — delivery is not instant
-- Try **Simulate WAKEUP_PING** (refresh API) to isolate app/plugin from FCM/APNs
+- Confirm Xcode shows `push handler ignored type=WAKEUP_PING` (there is no Simulate WAKEUP_PING / refresh API in the app)
 
 ### Notifications duplicating
 
-- Multiple refresh calls (flood test, repeated wakeups) each **replace** schedule via clear + schedule — check Event Log for repeated refreshes
-- Separate issue: Daily Reminder vs New Activity both scheduling — see `doc/notification-new-activity-lay-of-the-land.md`
+- Daily Reminder vs New Activity both scheduling — see `doc/notification-new-activity-lay-of-the-land.md`
+- Leftover `api_*` before Phase 4 cleanup (startup `clearApiNotifications()`)
 
 ### Stale ngrok URL
 
@@ -525,7 +506,7 @@ Confirm parameters (token vs deviceId, auth headers) in that repo’s README or
 | `src/services/notifications/NotificationDebugEvents.ts` | Panel event log + `logNotification()` |
 | `src/services/notifications/notificationLog.ts` | Structured log helpers |
 | `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
-| `src/services/notifications/NativeNotificationService.ts` | Refresh, `WAKEUP_PING`, schedule replace |
+| `src/services/notifications/NativeNotificationService.ts` | Push delivery hook (logs ignored types; no refresh) |
 | `src/services/notifications/firebaseMessagingClient.ts` | Capacitor push listeners |
 | `src/components/dev/NotificationDebugPanel.vue` | Dev UI |
 | `src/main.capacitor.ts` | Native push init at startup |

doc/notification-debug-panel.md

@@ -1,16 +1,16 @@
 # Notification Debug Panel
 
 **Created:** 2026-07-07  
-**Updated:** 2026-07-22  
-**Audience:** Developers testing notification registration, refresh, and WAKEUP_PING flows on native (iOS/Android) dev builds.
+**Updated:** 2026-09-24  
+**Audience:** Developers testing notification registration, AlertSearch authorization upload, and FCM delivery diagnostics on native (iOS/Android) dev builds.
 
-The **Notification Debug Panel** is a dev-only UI for exercising the same notification orchestration paths the production app uses: FCM token registration, backend refresh, wakeup handling, and local schedule inspection. It does not duplicate scheduling logic.
+The **Notification Debug Panel** is a dev-only UI for FCM token registration, AlertSearch authorization upload, FCM wakeup delivery diagnostics (`/debug/send-wakeup`), and local schedule inspection. It does not schedule notifications from `WAKEUP_PING`. The production `WAKEUP_PING` → `/notifications/refresh` → `api_*` path was retired; leftover `api_*` schedules are cleared once at startup (Phase 4).
 
 ---
 
 ## Notification API base URL
 
-Notification HTTP calls (`/notifications/register`, `/notifications/refresh`, `/debug/send-wakeup`, etc.) do **not** use `APP_SERVER`. They use a dedicated Notification API host, resolved at runtime by `getNotificationApiBaseUrl()` in `NotificationDebugConfig.ts`.
+Notification HTTP calls (`/notifications/register`, `/notifications/alert-authorization`, `/debug/send-wakeup`, etc.) do **not** use `APP_SERVER`. They use a dedicated Notification API host, resolved at runtime by `getNotificationApiBaseUrl()` in `NotificationDebugConfig.ts`. The app does not call `/notifications/refresh`.
 
 ### Configuration constants
 
@@ -65,7 +65,7 @@ Settings persist in `localStorage` via `NotificationDebugConfig.ts`:
 | `notificationDebug.testMode` | `true` | Sent in JSON request bodies (`testMode: true/false`) |
 | `notificationDebug.bypassAuth` | `false` | When `true`, omit JWT `Authorization` headers on notification API calls |
 
-All notification API requests (`/notifications/register`, `/notifications/refresh`, `/debug/send-wakeup`, etc.) obtain headers through `getNotificationApiHeaders()` in `notificationApiAuth.ts`.
+All notification API requests (`/notifications/register`, `/notifications/alert-authorization`, `/debug/send-wakeup`, etc.) obtain headers through `getNotificationApiHeaders()` in `notificationApiAuth.ts`.
 
 ### Notification Backend URL
 
@@ -75,7 +75,7 @@ Leave empty to use the configured build default (`DEFAULT_NOTIFY_API_SERVER`, fr
 
 ### Test Mode
 
-When enabled (default if never saved), register and refresh requests include `"testMode": true` in the JSON body. The backend can use this to return dev-friendly schedules or route test traffic separately from production.
+When enabled (default if never saved), register and send-wakeup requests include `"testMode": true` in the JSON body. The backend can use this to route test traffic separately from production.
 
 Test Mode is **independent of authentication**. It does not control whether `Authorization` headers are sent.
 
@@ -124,9 +124,8 @@ Example: `https://abc123.ngrok-free.app` or `http://127.0.0.1:3000`
 | Action | What it does |
 |--------|----------------|
 | **Register Token Now** | `POST {backend}/notifications/register` with current FCM token, `deviceId`, `platform`, and `testMode`. Forces re-registration (bypasses duplicate-token skip). |
-| **Refresh Notifications** | `POST {backend}/notifications/refresh` — same path used after a real WAKEUP_PING. Applies returned schedule to the native plugin. |
-| **Simulate WAKEUP_PING (Local)** | Calls the refresh API directly (no FCM). Quick test of backend URL + auth + refresh parsing without push delivery. |
-| **Send Real WAKEUP_PING** | `POST {backend}/debug/send-wakeup`; server sends a real FCM data message with `data.type = "WAKEUP_PING"`. Exercises backend → FCM → Capacitor listener → refresh → reschedule. Background the app before expecting delivery. |
+| **Upload AlertSearch Authorization** | Mints and uploads delegated AlertSearch JWTs (`POST /notifications/alert-authorization`). Requires an active `did:ethr` identity; Test Mode is not used. |
+| **Send Real WAKEUP_PING** | `POST {backend}/debug/send-wakeup`; server sends a real FCM data message with `data.type = "WAKEUP_PING"`. FCM delivery diagnostic only — the app logs `push handler ignored type=…` and does **not** call `/notifications/refresh` or schedule `api_*` notifications. Background the app before expecting delivery. |
 
 **Current FCM Token** displays the last token from Capacitor/Firebase registration. **Event Log** shows the last 100 `[Notifications]` messages (also visible in logcat / Xcode console on native).
 
@@ -136,12 +135,8 @@ Example: `https://abc123.ngrok-free.app` or `http://127.0.0.1:3000`
 
 | Section | Purpose |
 |---------|---------|
-| **Mock Timing Presets** | Interval for mock refresh timestamps (30 sec – 10 min). |
-| **Trigger Mock Refresh** | Applies synthetic future timestamps locally — no backend call. |
-| **Wakeup Ping Simulator** | Runs the production push handler with a synthetic `WAKEUP_PING` payload (no FCM, no backend). |
-| **Flood Test** | Runs 20 sequential mock refreshes (stress test). |
-| **Pending Notification Inspector** | Lists locally scheduled notifications (iOS; Android may show unavailable). |
-| **Clear Notifications** | Clears/cancels all plugin-scheduled notifications on native. |
+| **Pending Notification Inspector** | Lists locally scheduled notifications (Daily Reminder, New Activity / dual, and any leftover `api_*` until Phase 4 cleanup). |
+| **Clear Notifications** | Clears/cancels plugin-scheduled notifications on native. Does not replace the one-time `api_*` startup cleanup. |
 
 ---
 
@@ -198,11 +193,11 @@ The app deferred registration because JWT could not be built (no active DID or e
 
 Same as above. Confirm the **Active** URL in the panel matches your running tunnel or local server port.
 
-### Register succeeds but Send Real WAKEUP_PING does not trigger refresh
+### Register succeeds but Send Real WAKEUP_PING does not show delivery
 
-**Real WAKEUP_PING success** only means the backend accepted the wakeup request and attempted FCM delivery. Missing `pushNotificationReceived` / `Refresh completed (WAKEUP_PING)` indicates an FCM delivery or background execution issue — not necessarily a bad wakeup API call.
+**Real WAKEUP_PING success** only means the backend accepted the wakeup request and attempted FCM delivery. It does **not** schedule local `api_*` notifications. Delivery is confirmed when logcat / Event Log shows `push handler ignored type=WAKEUP_PING` (the retired refresh chain is gone).
 
-**Checks:** App backgrounded (not force-stopped); FCM token matches registration; **Simulate WAKEUP_PING (Local)** works (isolates FCM from refresh API).
+**Checks:** App backgrounded (not force-stopped); FCM token matches registration; Firebase / Play services available.
 
 See platform-specific guides for extended ngrok and FCM workflows:
 
@@ -222,7 +217,7 @@ See platform-specific guides for extended ngrok and FCM workflows:
 | `src/services/notifications/notificationApiDebugMode.ts` | Auth bypass gate |
 | `src/services/notifications/NotificationDebugService.ts` | Panel action handlers |
 | `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
-| `src/services/notifications/NativeNotificationService.ts` | `POST /notifications/refresh`, WAKEUP_PING handler |
+| `src/services/notifications/NativeNotificationService.ts` | Push delivery hook (logs ignored types; no refresh) |
 
 ---
 

doc/qr-code-implementation-guide.md

@@ -175,7 +175,6 @@ export async function createBuildConfig(mode: string) {
   return defineConfig({
     define: {
       'process.env.VITE_PLATFORM': JSON.stringify(mode),
-      // PWA is automatically enabled for web platforms via build configuration
       __IS_MOBILE__: JSON.stringify(isCapacitor),
       __USE_QR_READER__: JSON.stringify(!isCapacitor)
     },

docker-compose.yml

@@ -5,10 +5,9 @@
 # IMPORTANT: Build web assets first using npm scripts before running docker-compose
 #
 # Usage:
-#   Development: npm run build:web:build -- --mode development && docker-compose up dev
-#   Test: npm run build:web:build -- --mode test && docker-compose up test
-#   Production: npm run build:web:build -- --mode production && docker-compose up production
-#   Custom: BUILD_MODE=test npm run build:web:build -- --mode test && docker-compose up custom
+#   Test: npm run docker:up:test (runs npm run build:web:test && docker-compose up test)
+#   Production: npm run docker:up:prod (runs npm run build:web:prod && docker-compose up production)
+#   Custom: npm run build:web:test && BUILD_MODE=test docker-compose up custom
 #
 # Environment Variables:
 #   BUILD_MODE: development, test, or production (default: production)
@@ -16,7 +15,7 @@
 #   PORT: port to expose (default: 80 for production, 8080 for test)
 #   ENV_FILE: environment file to use (default: .env.production)
 #
-# Note: For development, use npm run build:web directly (no Docker needed)
+# Note: For development, use npm run dev directly (no Docker needed)
 
 version: '3.8'
 

docker/README.md

@@ -103,7 +103,6 @@ The Dockerfile supports these build arguments:
 | `BUILD_MODE` | `production` | Build mode: development, staging, or production |
 | `NODE_ENV` | `production` | Node.js environment |
 | `VITE_PLATFORM` | `web` | Vite platform type |
-| PWA | `enabled` | Automatically enabled for web platforms |
 
 ### Environment Variables
 
@@ -114,7 +113,6 @@ Docker Compose supports these environment variables:
 | `BUILD_MODE` | `production` | Build mode |
 | `NODE_ENV` | `production` | Node environment |
 | `VITE_PLATFORM` | `web` | Vite platform |
-| PWA | `enabled` | Automatically enabled for web platforms |
 | `DEV_PORT` | `5173` | Development port |
 | `STAGING_PORT` | `8080` | Staging port |
 | `PROD_PORT` | `80` | Production port |
@@ -219,13 +217,12 @@ BUILD_MODE=staging NODE_ENV=staging ./docker/run.sh custom
 docker build \
   --build-arg BUILD_MODE=staging \
   --build-arg NODE_ENV=staging \
-  
-  -t timesafari:staging-no-pwa .
+  -t timesafari:staging .
 
 # Run with custom configuration
 docker run -d -p 9000:80 \
   -e VITE_APP_SERVER=https://test.example.com \
-  timesafari:staging-no-pwa
+  timesafari:staging
 ```
 
 ### Docker Compose with Custom Variables

docker/run.sh

@@ -13,7 +13,6 @@
 #   BUILD_MODE: development, staging, or production
 #   NODE_ENV: node environment
 #   VITE_PLATFORM: vite platform
-#   PWA: automatically enabled for web platforms
 #   PORT: port to expose
 #   ENV_FILE: environment file to use
 
@@ -71,7 +70,6 @@ show_usage() {
     echo "  BUILD_MODE: development, staging, or production"
     echo "  NODE_ENV: node environment"
     echo "  VITE_PLATFORM: vite platform"
-    echo "  PWA: automatically enabled for web platforms"
     echo "  PORT: port to expose"
     echo "  ENV_FILE: environment file to use"
 }
@@ -86,7 +84,6 @@ show_build_args() {
             echo "  BUILD_MODE: development"
             echo "  NODE_ENV: development"
             echo "  VITE_PLATFORM: web"
-            echo "  PWA: enabled (web platform)"
             echo "  Target: development"
             echo "  Port: 5173"
             ;;
@@ -94,7 +91,6 @@ show_build_args() {
             echo "  BUILD_MODE: staging"
             echo "  NODE_ENV: staging"
             echo "  VITE_PLATFORM: web"
-            echo "  PWA: enabled (web platform)"
             echo "  Target: staging"
             echo "  Port: 80 (mapped to 8080)"
             ;;
@@ -102,7 +98,6 @@ show_build_args() {
             echo "  BUILD_MODE: production"
             echo "  NODE_ENV: production"
             echo "  VITE_PLATFORM: web"
-            echo "  PWA: enabled (web platform)"
             echo "  Target: production"
             echo "  Port: 80"
             ;;
@@ -110,7 +105,6 @@ show_build_args() {
             echo "  BUILD_MODE: \${BUILD_MODE:-production}"
             echo "  NODE_ENV: \${NODE_ENV:-production}"
             echo "  VITE_PLATFORM: \${VITE_PLATFORM:-web}"
-            echo "  PWA: enabled for web platforms"
             echo "  Target: \${BUILD_TARGET:-production}"
             echo "  Port: \${CUSTOM_PORT:-8080}:\${CUSTOM_INTERNAL_PORT:-80}"
             ;;

electron/capacitor.config.json

@@ -30,7 +30,7 @@
 			"splashImmersive": true
 		},
 		"CapacitorSQLite": {
-			"iosDatabaseLocation": "Library/CapacitorDatabase",
+			"iosDatabaseLocation": "Documents",
 			"iosIsEncryption": false,
 			"iosBiometric": {
 				"biometricAuth": false,

electron/capacitor.config.ts

@@ -31,8 +31,9 @@ const config: CapacitorConfig = {
       splashFullScreen: true,
       splashImmersive: true
     },
-    CapSQLite: {
-      iosDatabaseLocation: 'Library/CapacitorDatabase',
+    // The key must match the plugin's registered name or every setting here is ignored.
+    CapacitorSQLite: {
+      iosDatabaseLocation: 'Documents',
       iosIsEncryption: false,
       iosBiometric: {
         biometricAuth: false,

index.html

@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/favicon.ico" />
+    <link rel="manifest" href="/manifest.webmanifest" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover, user-scalable=no, interactive-widget=overlays-content" />
     
     <!-- CORS headers removed to allow images from any domain -->

ios/App/App.xcodeproj/project.pbxproj

@@ -19,8 +19,6 @@
 		C86585DF2ED456DE00824752 /* TimeSafariShareExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = C86585D52ED456DE00824752 /* TimeSafariShareExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		C8C56E142EE0474B00737D0E /* SharedImageUtility.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8C56E132EE0474B00737D0E /* SharedImageUtility.swift */; };
 		C8C56E162EE064CB00737D0E /* SharedImagePlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8C56E152EE064CA00737D0E /* SharedImagePlugin.swift */; };
-		C8E73DD12FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */; };
-		C8E73DD22FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */; };
 		E9F1A0022EE05A8B00737D01 /* NotificationInspectorPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = E9F1A0012EE05A8B00737D01 /* NotificationInspectorPlugin.swift */; };
 /* End PBXBuildFile section */
 
@@ -185,10 +183,11 @@
 				504EC3001FED79650016851F /* Sources */,
 				504EC3011FED79650016851F /* Frameworks */,
 				504EC3021FED79650016851F /* Resources */,
+				F1REBA5E000000000000A001 /* Bundle Firebase Config */,
 				012076E8FFE4BF260A79B034 /* Fix Privacy Manifest */,
 				96A7EF592DF3366D00084D51 /* Fix Privacy Manifest */,
 				C86585E02ED456DE00824752 /* Embed Foundation Extensions */,
-				04A558C9E2DEC92B5B2AFBE4 /* [CP] Embed Pods Frameworks */,
+				2B3F98670AF3508A35AC3248 /* [CP] Embed Pods Frameworks */,
 			);
 			buildRules = (
 			);
@@ -207,6 +206,7 @@
 				C86585D12ED456DE00824752 /* Sources */,
 				C86585D22ED456DE00824752 /* Frameworks */,
 				C86585D32ED456DE00824752 /* Resources */,
+				F1REBA5E000000000000A002 /* Bundle Firebase Config */,
 			);
 			buildRules = (
 			);
@@ -270,7 +270,6 @@
 				50379B232058CBB4000EE86E /* capacitor.config.json in Resources */,
 				504EC30D1FED79650016851F /* Main.storyboard in Resources */,
 				2FAD9763203C412B000D30F8 /* config.xml in Resources */,
-				C8E73DD12FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -278,7 +277,6 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				C8E73DD22FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -305,7 +303,7 @@
 			shellScript = "\"${PROJECT_DIR}/app_privacy_manifest_fixer/fixer.sh\" \n";
 			showEnvVarsInLog = 0;
 		};
-		04A558C9E2DEC92B5B2AFBE4 /* [CP] Embed Pods Frameworks */ = {
+		2B3F98670AF3508A35AC3248 /* [CP] Embed Pods Frameworks */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -342,6 +340,48 @@
 			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
 			showEnvVarsInLog = 0;
 		};
+		F1REBA5E000000000000A001 /* Bundle Firebase Config */ = {
+			isa = PBXShellScriptBuildPhase;
+			alwaysOutOfDate = 1;
+			buildActionMask = 2147483647;
+			enableUserScriptSandboxing = 0;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			name = "Bundle Firebase Config";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${PROJECT_DIR}/scripts/bundle-firebase-config.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
+		F1REBA5E000000000000A002 /* Bundle Firebase Config */ = {
+			isa = PBXShellScriptBuildPhase;
+			alwaysOutOfDate = 1;
+			buildActionMask = 2147483647;
+			enableUserScriptSandboxing = 0;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			name = "Bundle Firebase Config";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${PROJECT_DIR}/scripts/bundle-firebase-config.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
 		96A7EF592DF3366D00084D51 /* Fix Privacy Manifest */ = {
 			isa = PBXShellScriptBuildPhase;
 			alwaysOutOfDate = 1;
@@ -466,7 +506,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				MTL_ENABLE_DEBUG_INFO = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				SDKROOT = iphoneos;
@@ -523,7 +563,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;
@@ -541,10 +581,11 @@
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = App/AppDebug.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 75;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				INFOPLIST_FILE = App/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
@@ -552,7 +593,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.9;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -571,10 +612,11 @@
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 75;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				INFOPLIST_FILE = App/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
@@ -582,7 +624,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.9;
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";
@@ -600,21 +642,23 @@
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TimeSafariShareExtension/TimeSafariShareExtension.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 75;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
+				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = TimeSafariShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.9;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari.TimeSafariShareExtension;
@@ -638,21 +682,23 @@
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TimeSafariShareExtension/TimeSafariShareExtension.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 75;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
+				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = TimeSafariShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.9;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari.TimeSafariShareExtension;
 				PRODUCT_NAME = "$(TARGET_NAME)";

ios/App/App/TimeSafariNativeFetcher.swift

@@ -144,20 +144,16 @@ final class TimeSafariNativeFetcher: NativeNotificationContentFetcher {
         return (s?.isEmpty == false) ? s : nil
     }
 
+    /// Store the newest JWT ID in the response (the highest ULID), so the next fetch
+    /// asks only for later changes. The server lists them newest first, so the last
+    /// item is the oldest.
     private func updateLastAckedJwtIdFromResponse(responseBody: String) {
         guard let data = responseBody.data(using: .utf8),
               let root = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
               let dataArray = root["data"] as? [[String: Any]], !dataArray.isEmpty
         else { return }
 
-        let lastItem = dataArray[dataArray.count - 1]
-        var jwtId: String?
-        if let j = lastItem["jwtId"] as? String {
-            jwtId = j
-        } else if let plan = lastItem["plan"] as? [String: Any], let j = plan["jwtId"] as? String {
-            jwtId = j
-        }
-        if let jwtId = jwtId, !jwtId.isEmpty {
+        if let jwtId = dataArray.compactMap({ extractJwtIdFromItem($0) }).max() {
             UserDefaults.standard.set(jwtId, forKey: prefsLastAckedKey)
         }
     }

ios/App/Podfile

@@ -82,6 +82,10 @@ post_install do |installer|
   assertDeploymentTarget(installer)
   installer.pods_project.targets.each do |target|
     target.build_configurations.each do |config|
+      deployment_target = config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'].to_f
+      if deployment_target > 0.0 && deployment_target < 15.5
+        config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '15.5'
+      end
       config.build_settings['CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES'] = 'YES'
       merge_sqlite_omit_load_extension_definition(config)
       strip_system_sqlite_from_pod_config(config)

ios/App/Podfile.lock

@@ -177,6 +177,6 @@ SPEC CHECKSUMS:
   TimesafariDailyNotificationPlugin: 69277c884380a9a620f671b68e0327eaa4b3d27d
   ZIPFoundation: dfd3d681c4053ff7e2f7350bc4e53b5dba3f5351
 
-PODFILE CHECKSUM: abe640043e6b8adea745693d980ead03251912f9
+PODFILE CHECKSUM: 5736811d271d5309d3e2de8f3eefdbb6632086a3
 
 COCOAPODS: 1.16.2

ios/App/scripts/bundle-firebase-config.sh

@@ -0,0 +1,80 @@
+#!/bin/sh
+# Bundle GoogleService-Info.plist when Firebase is enabled (the default).
+# Opt out with FIREBASE_ENABLED=false, or the Xcode build setting
+# FIREBASE_ENABLED=NO. The plist does not decide the switch: a missing file
+# fails an enabled build, and an opt-out build does not bundle the plist
+# even when the file is on disk.
+#
+# Xcode run-script phases invoke this with no arguments. build-ios.sh may pass
+# --check to validate before a long build without copying into a product.
+set -eu
+
+check_only=0
+if [ "${1:-}" = "--check" ]; then
+  check_only=1
+fi
+
+if [ -z "${SRCROOT:-}" ]; then
+  script_dir=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+  SRCROOT=$(CDPATH= cd -- "$script_dir/.." && pwd)
+fi
+
+normalized=$(printf '%s' "${FIREBASE_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')
+plist="${SRCROOT}/App/GoogleService-Info.plist"
+
+firebase_off=0
+case "$normalized" in
+  false|0|no) firebase_off=1 ;;
+esac
+
+remove_bundled_plist() {
+  base="$1"
+  leaf="$2"
+  if [ -n "$base" ] && [ -n "$leaf" ]; then
+    rm -f "${base}/${leaf}/GoogleService-Info.plist"
+  fi
+}
+
+if [ "$firebase_off" -eq 1 ]; then
+  if [ "$check_only" -eq 0 ]; then
+    # Drop the plist from this product, including a copy left by an earlier
+    # Firebase-enabled build. The app and the share extension each run this phase.
+    remove_bundled_plist "${TARGET_BUILD_DIR:-}" "${UNLOCALIZED_RESOURCES_FOLDER_PATH:-}"
+    remove_bundled_plist "${TARGET_BUILD_DIR:-}" "${WRAPPER_NAME:-}"
+    remove_bundled_plist "${BUILT_PRODUCTS_DIR:-}" "${WRAPPER_NAME:-}"
+    # Embed does not delete files that disappeared from the appex, so a plist
+    # copied into PlugIns on an earlier Firebase-enabled build would otherwise stay.
+    if [ -n "${TARGET_BUILD_DIR:-}" ] && [ -n "${WRAPPER_NAME:-}" ]; then
+      for stale in "${TARGET_BUILD_DIR}/${WRAPPER_NAME}/PlugIns/"*.appex/GoogleService-Info.plist; do
+        if [ -f "$stale" ]; then
+          rm -f "$stale"
+        fi
+      done
+    fi
+  fi
+  echo "note: Firebase disabled (FIREBASE_ENABLED=${FIREBASE_ENABLED}); GoogleService-Info.plist will not be bundled."
+  exit 0
+fi
+
+if [ ! -s "$plist" ] || ! grep -q "GOOGLE_APP_ID" "$plist"; then
+  echo "error: Firebase is enabled, but ios/App/App/GoogleService-Info.plist is missing, empty, or has no GOOGLE_APP_ID." >&2
+  echo "error: Download it from the Firebase console (Project settings → Your apps → Apple apps)" >&2
+  echo "error: and place it at ios/App/App/GoogleService-Info.plist." >&2
+  echo "error: To build without Firebase, set FIREBASE_ENABLED=false or pass the Xcode build setting FIREBASE_ENABLED=NO." >&2
+  exit 1
+fi
+
+if [ "$check_only" -eq 1 ]; then
+  echo "note: Firebase enabled; ios/App/App/GoogleService-Info.plist is present."
+  exit 0
+fi
+
+if [ -z "${TARGET_BUILD_DIR:-}" ] || [ -z "${UNLOCALIZED_RESOURCES_FOLDER_PATH:-}" ]; then
+  echo "error: Bundle Firebase Config must run as an Xcode build phase (TARGET_BUILD_DIR is unset)." >&2
+  exit 1
+fi
+
+dest_dir="${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
+mkdir -p "$dest_dir"
+cp "$plist" "${dest_dir}/GoogleService-Info.plist"
+echo "note: Firebase enabled; bundled GoogleService-Info.plist."

package.json

@@ -1,6 +1,6 @@
 {
   "name": "giftopia",
-  "version": "1.4.6",
+  "version": "1.4.9",
   "description": "Giftopia App",
   "author": {
     "name": "Gift Economies Team"
@@ -26,8 +26,11 @@
     "build:android:deploy": "./scripts/build-android.sh --deploy",
     "build:android:dev": "./scripts/build-android.sh --dev",
     "build:android:dev:custom": "./scripts/build-android.sh --dev --api-ip",
+    "build:android:dev:nostore": "FIREBASE_ENABLED=false npm run build:android:dev",
     "build:android:dev:run:custom": "./scripts/build-android.sh --dev --api-ip --auto-run",
     "build:android:prod": "./scripts/build-android.sh --prod",
+    "build:android:prod:nostore": "FIREBASE_ENABLED=false npm run build:android:prod",
+    "build:android:prod:nostore:run": "FIREBASE_ENABLED=false npm run build:android:prod:run",
     "build:android:prod:run": "./scripts/build-android.sh --prod --auto-run",
     "build:android:release": "./scripts/build-android.sh --release",
     "build:android:release:run": "./scripts/build-android.sh --release --auto-run",
@@ -35,6 +38,8 @@
     "build:android:sync": "./scripts/build-android.sh --sync",
     "build:android:test": "./scripts/build-android.sh --test",
     "build:android:test:custom": "./scripts/build-android.sh --test --api-ip",
+    "build:android:test:nostore": "FIREBASE_ENABLED=false npm run build:android:test",
+    "build:android:test:nostore:run": "FIREBASE_ENABLED=false npm run build:android:test:run",
     "build:android:test:run": "./scripts/build-android.sh --test --auto-run",
     "build:android:test:run:custom": "./scripts/build-android.sh --test --api-ip --auto-run",
     "build:capacitor": "VITE_GIT_HASH=`git log -1 --pretty=format:%h` vite build --mode capacitor --config vite.config.capacitor.mts",
@@ -78,9 +83,12 @@
     "build:ios:deploy": "./scripts/build-ios.sh --deploy",
     "build:ios:dev": "./scripts/build-ios.sh --dev",
     "build:ios:dev:custom": "./scripts/build-ios.sh --dev --api-ip",
+    "build:ios:dev:nostore": "FIREBASE_ENABLED=false npm run build:ios:dev",
     "build:ios:dev:run:custom": "./scripts/build-ios.sh --dev --api-ip --auto-run",
     "build:ios:ipa": "./scripts/build-ios.sh --ipa",
     "build:ios:prod": "./scripts/build-ios.sh --prod",
+    "build:ios:prod:nostore": "FIREBASE_ENABLED=false npm run build:ios:prod",
+    "build:ios:prod:nostore:run": "FIREBASE_ENABLED=false npm run build:ios:prod:run",
     "build:ios:prod:run": "./scripts/build-ios.sh --prod --auto-run",
     "build:ios:release": "./scripts/build-ios.sh --release",
     "build:ios:release:run": "./scripts/build-ios.sh --release --auto-run",
@@ -88,11 +96,12 @@
     "build:ios:sync": "./scripts/build-ios.sh --sync",
     "build:ios:test": "./scripts/build-ios.sh --test",
     "build:ios:test:custom": "./scripts/build-ios.sh --test --api-ip",
+    "build:ios:test:nostore": "FIREBASE_ENABLED=false npm run build:ios:test",
+    "build:ios:test:nostore:run": "FIREBASE_ENABLED=false npm run build:ios:test:run",
     "build:ios:test:run": "./scripts/build-ios.sh --test --auto-run",
     "build:ios:test:run:custom": "./scripts/build-ios.sh --test --api-ip --auto-run",
-    "build:native": "vite build && npx cap sync && node scripts/restore-local-plugins.js && bash -c 'source scripts/common.sh && ensure_ios_capacitor_asset_directories' && npx capacitor-assets generate --assetPath resources",
+    "build:native": "npm run build:capacitor:sync && bash -c 'source scripts/common.sh && ensure_ios_capacitor_asset_directories' && npx capacitor-assets generate --ios --android --assetPath resources",
     "build:web": "./scripts/build-web.sh",
-    "build:web:dev": "./scripts/build-web.sh --dev",
     "build:web:docker": "./scripts/build-web.sh --docker",
     "build:web:docker:prod": "./scripts/build-web.sh --docker:prod",
     "build:web:docker:test": "./scripts/build-web.sh --docker:test",
@@ -110,11 +119,12 @@
     "clean:electron": "./scripts/build-electron.sh --clean",
     "clean:ios": "rm -rf ios/App/build ios/App/Pods ios/App/output ios/App/App/public ios/DerivedData ios/capacitor-cordova-ios-plugins ios/App/App/capacitor.config.json ios/App/App/config.xml || true",
     "deps:update-daily-notification-plugin": "npm install @timesafari/daily-notification-plugin@git+https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin.git#master",
+    "dev": "./scripts/build-web.sh --dev",
     "docker:down": "docker-compose down",
     "docker:logs": "docker-compose logs -f",
     "docker:up": "docker-compose up",
-    "docker:up:prod": "npm run build:web:build -- --mode production && docker-compose up production",
-    "docker:up:test": "npm run build:web:build -- --mode test && docker-compose up test",
+    "docker:up:prod": "npm run build:web:prod && docker-compose up production",
+    "docker:up:test": "npm run build:web:test && docker-compose up test",
     "guard": "bash ./scripts/build-arch-guard.sh",
     "guard:setup": "npm run prepare && echo 'Build Architecture Guard is now active!'",
     "guard:test": "bash ./scripts/build-arch-guard.sh --staged",
@@ -123,7 +133,7 @@
     "markdown:check": "markdownlint-cli2",
     "markdown:fix": "markdownlint-cli2 --fix",
     "markdown:setup": "./scripts/setup-markdown-hooks.sh",
-    "prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node sw_combine.js && node scripts/copy-wasm.js",
+    "prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node scripts/copy-wasm.js",
     "prepare": "husky",
     "test:all": "npm run lint && npm run type-check && npm run type-check:vue && npm run test:unit && npm run test:web && npm run test:mobile && echo '\n\n\nGotta add the performance tests'",
     "test:android": "node scripts/test-android.js",
@@ -219,7 +229,6 @@
     "ramda": "^0.29.1",
     "readable-stream": "^4.5.2",
     "reflect-metadata": "^0.1.14",
-    "register-service-worker": "^1.7.2",
     "simple-vue-camera": "^1.1.3",
     "sqlite3": "^5.1.7",
     "stream-browserify": "^3.0.0",

playwright.config-local.ts

@@ -106,7 +106,7 @@ export default defineConfig({
    */
   webServer: {
     command:
-      "VITE_APP_SERVER=http://localhost:8080 VITE_DEFAULT_ENDORSER_API_SERVER=http://localhost:3000 VITE_DEFAULT_PARTNER_API_SERVER=http://localhost:3000 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app VITE_PASSKEYS_ENABLED=true npm run build:web -- --port=8080",
+      "VITE_APP_SERVER=http://localhost:8080 VITE_DEFAULT_ENDORSER_API_SERVER=http://localhost:3000 VITE_DEFAULT_PARTNER_API_SERVER=http://localhost:3000 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app VITE_PASSKEYS_ENABLED=true npm run dev",
     url: "http://localhost:8080",
     reuseExistingServer: !process.env.CI,
   },

public/manifest.webmanifest

@@ -1,46 +1,46 @@
 {
+  "name": "Giftopia",
+  "short_name": "Giftopia",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "theme_color": "#4a90e2",
+  "background_color": "#ffffff",
   "icons": [
     {
-      "src": "../icons/icon-48.webp",
-      "type": "image/png",
-      "sizes": "48x48",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-72.webp",
-      "type": "image/png",
-      "sizes": "72x72",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-96.webp",
-      "type": "image/png",
-      "sizes": "96x96",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-128.webp",
-      "type": "image/png",
-      "sizes": "128x128",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-192.webp",
-      "type": "image/png",
+      "src": "/img/icons/android-chrome-192x192.png",
       "sizes": "192x192",
-      "purpose": "any maskable"
+      "type": "image/png"
     },
     {
-      "src": "../icons/icon-256.webp",
-      "type": "image/png",
-      "sizes": "256x256",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-512.webp",
-      "type": "image/png",
+      "src": "/img/icons/android-chrome-512x512.png",
       "sizes": "512x512",
-      "purpose": "any maskable"
+      "type": "image/png"
+    },
+    {
+      "src": "/img/icons/android-chrome-maskable-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/img/icons/android-chrome-maskable-512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
     }
-  ]
+  ],
+  "share_target": {
+    "action": "/share-target",
+    "method": "POST",
+    "enctype": "multipart/form-data",
+    "params": {
+      "files": [
+        {
+          "name": "photo",
+          "accept": ["image/*"]
+        }
+      ]
+    }
+  }
 }

public/sw.js

@@ -0,0 +1,68 @@
+/* eslint-env serviceworker */
+/**
+ * Service worker for the web build.
+ *
+ * Its only job is the Web Share Target: the manifest's share_target POSTs a
+ * photo to /share-target, which no static server can accept. This worker
+ * stashes the photo in Cache Storage and redirects to /shared-photo, where
+ * src/libs/webShareTarget.ts picks it up. Every other request goes straight to
+ * the network (no fetch handler response, no precaching).
+ *
+ * It also replaces the Workbox worker that older builds registered at this
+ * same URL, and deletes that worker's precaches, which otherwise keep serving
+ * a stale index.html that points at JavaScript files no longer deployed.
+ */
+
+const SHARE_TARGET_CACHE = "share-target";
+// Keep in sync with src/libs/webShareTarget.ts
+const SHARED_PHOTO_KEY = "/share-target/photo";
+const FILE_NAME_HEADER = "X-File-Name";
+
+self.addEventListener("install", () => {
+  self.skipWaiting();
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    (async () => {
+      const names = await caches.keys();
+      await Promise.all(
+        names
+          .filter((name) => name !== SHARE_TARGET_CACHE)
+          .map((name) => caches.delete(name)),
+      );
+      await self.clients.claim();
+    })(),
+  );
+});
+
+self.addEventListener("fetch", (event) => {
+  const url = new URL(event.request.url);
+  if (
+    event.request.method !== "POST" ||
+    url.origin !== self.location.origin ||
+    url.pathname !== "/share-target"
+  ) {
+    return;
+  }
+
+  event.respondWith(
+    (async () => {
+      const formData = await event.request.formData();
+      const photo = formData.get("photo");
+      if (photo instanceof File) {
+        const cache = await caches.open(SHARE_TARGET_CACHE);
+        await cache.put(
+          SHARED_PHOTO_KEY,
+          new Response(photo, {
+            headers: {
+              "Content-Type": photo.type || "application/octet-stream",
+              [FILE_NAME_HEADER]: encodeURIComponent(photo.name || ""),
+            },
+          }),
+        );
+      }
+      return Response.redirect("/shared-photo?source=share-target", 303);
+    })(),
+  );
+});

pull_request_template.md

@@ -15,7 +15,7 @@
 
 ## Commands Run (paste exact logs/snips)
 
-- [ ] Web: `npm run build:web` / `:prod`
+- [ ] Web: `npm run dev` / `npm run build:web`
 - [ ] Electron: `npm run build:electron:dev` / package step
 - [ ] Mobile: `npm run build:android:test` / iOS equivalent
 - [ ] Clean/auto-run impacted scripts

scripts/README.md

@@ -23,10 +23,10 @@ All scripts automatically handle environment variables for different build types
 
 #### Build Types and Environment Variables
 
-| Platform | Mode | PWA Enabled | Native Features | Build Script |
-|----------|------|-------------|-----------------|--------------|
-| `web` | web | true | false | `build-web.sh` |
-| `capacitor` | capacitor | false | true | `build-capacitor.sh` |
+| Platform | Mode | Native Features | Build Script |
+|----------|------|-----------------|--------------|
+| `web` | web | false | `build-web.sh` |
+| `capacitor` | capacitor | true | `build-capacitor.sh` |
 
 #### Automatic Environment Setup
 
@@ -183,8 +183,6 @@ All scripts automatically configure the correct environment variables for their
 ```bash
 # Capacitor builds automatically get:
 export VITE_PLATFORM=capacitor
-export VITE_PWA_ENABLED=false
-export VITE_DISABLE_PWA=true
 export DEBUG_MIGRATIONS=0
 export VITE_GIT_HASH=<git-hash>
 

scripts/build-android.sh

@@ -23,6 +23,7 @@
 #   --assets                Generate assets only
 #   --deploy                Deploy APK to connected device
 #   --uninstall             Uninstall app from connected device
+#   FIREBASE_ENABLED=false  Opt out of Firebase (-PfirebaseEnabled=false)
 #   -h, --help             Show this help message
 #   -v, --verbose          Enable verbose logging
 #
@@ -439,6 +440,9 @@ print_android_usage() {
     echo "  --uninstall             Uninstall app from connected device"
     echo "  --api-ip <ip>          Custom IP address for claim API (defaults to 10.0.2.2)"
     echo ""
+    echo "Firebase is on by default. Opt out with FIREBASE_ENABLED=false"
+    echo "(passes -PfirebaseEnabled=false to Gradle)."
+    echo ""
     echo "Common Options:"
     echo "  -h, --help             Show this help message"
     echo "  -v, --verbose          Enable verbose logging"
@@ -460,6 +464,17 @@ print_android_usage() {
 # Parse command line arguments
 parse_android_args "$@"
 
+# Firebase is on unless FIREBASE_ENABLED is false, 0, or no. Gradle also
+# defaults firebaseEnabled=true; this only forwards an explicit opt-out.
+gradle_firebase_arg=""
+firebase_enabled_normalized=$(printf '%s' "${FIREBASE_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')
+case "$firebase_enabled_normalized" in
+    false|0|no)
+        gradle_firebase_arg="-PfirebaseEnabled=false"
+        log_info "Firebase disabled for this Android build (FIREBASE_ENABLED=${FIREBASE_ENABLED})"
+        ;;
+esac
+
 # Print build header
 print_header "TimeSafari Android Build Process"
 
@@ -528,7 +543,7 @@ if [ "$CLEAN_ONLY" = true ]; then
     log_info "Clean-only mode: cleaning build artifacts"
     safe_execute "Cleaning Android app" "npm run clean:android" || exit 1
     safe_execute "Cleaning dist directory" "clean_build_artifacts dist" || exit 1
-    safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean && cd .." || exit 4
+    safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean ${gradle_firebase_arg} && cd .." || exit 4
     log_success "Clean completed successfully!"
     exit 0
 fi
@@ -561,7 +576,7 @@ if [ "$DEPLOY_APP" = true ]; then
     fi
     
     # Build APK
-    safe_execute "Building APK" "cd android && ./gradlew assembleDebug && cd .." || exit 5
+    safe_execute "Building APK" "cd android && ./gradlew assembleDebug ${gradle_firebase_arg} && cd .." || exit 5
     
     # Install APK on device
     safe_execute "Installing APK on device" "adb install -r android/app/build/outputs/apk/debug/app-debug.apk" || exit 6
@@ -628,26 +643,26 @@ fi
 safe_execute "Generating assets" "npx capacitor-assets generate --android --assetPath resources" || exit 7
 
 # Step 8: Clean Gradle build
-safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean && cd .." || exit 4
+safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean ${gradle_firebase_arg} && cd .." || exit 4
 
 # Step 9: Build based on type
 if [ "$BUILD_TYPE" = "debug" ]; then
-    safe_execute "Assembling debug build" "cd android && ./gradlew assembleDebug && cd .." || exit 5
+    safe_execute "Assembling debug build" "cd android && ./gradlew assembleDebug ${gradle_firebase_arg} && cd .." || exit 5
 elif [ "$BUILD_TYPE" = "release" ]; then
-    safe_execute "Assembling release build" "cd android && ./gradlew assembleRelease && cd .." || exit 5
+    safe_execute "Assembling release build" "cd android && ./gradlew assembleRelease ${gradle_firebase_arg} && cd .." || exit 5
 fi
 
 # Step 10: Build APK/AAB if requested
 if [ "$BUILD_APK" = true ]; then
     if [ "$BUILD_TYPE" = "debug" ]; then
-        safe_execute "Building debug APK" "cd android && ./gradlew assembleDebug && cd .." || exit 5
+        safe_execute "Building debug APK" "cd android && ./gradlew assembleDebug ${gradle_firebase_arg} && cd .." || exit 5
     else
-        safe_execute "Building release APK" "cd android && ./gradlew assembleRelease && cd .." || exit 5
+        safe_execute "Building release APK" "cd android && ./gradlew assembleRelease ${gradle_firebase_arg} && cd .." || exit 5
     fi
 fi
 
 if [ "$BUILD_AAB" = true ]; then
-    safe_execute "Building AAB" "cd android && ./gradlew bundleRelease && cd .." || exit 5
+    safe_execute "Building AAB" "cd android && ./gradlew bundleRelease ${gradle_firebase_arg} && cd .." || exit 5
     if [ "$BUILD_MODE" = "production" ]; then
         safe_execute "Checking production AAB" "./scripts/check-prod-bundle.sh android/app/build/outputs/bundle/release/app-release.aab" || exit 10
     fi

scripts/build-arch-guard.sh

@@ -23,8 +23,6 @@ SENSITIVE=(
   "electron/**" 
   "android/**" 
   "ios/**"
-  "sw_scripts/**" 
-  "sw_combine.js" 
   "Dockerfile" 
   "docker/**"
   "capacitor.config.ts"

scripts/build-ios.sh

@@ -44,6 +44,9 @@ print_ios_usage() {
     echo "  --auto-run              Auto-run app after build"
     echo "  --api-ip <ip>          Custom IP address for claim API (uses Capacitor default)"
     echo ""
+    echo "Firebase is on by default. Opt out with FIREBASE_ENABLED=false"
+    echo "(forwarded to xcodebuild as FIREBASE_ENABLED=NO)."
+    echo ""
     echo "Common Options:"
     echo "  -h, --help             Show this help message"
     echo "  -v, --verbose          Enable verbose logging"
@@ -321,6 +324,17 @@ clean_ios_build() {
     log_success "iOS build cleaned"
 }
 
+# Map FIREBASE_ENABLED onto the Xcode build setting the run-script phases read.
+# Unset stays YES. false, 0, and no (any case) become NO.
+ios_firebase_build_setting() {
+    local normalized
+    normalized=$(printf '%s' "${FIREBASE_ENABLED:-YES}" | tr '[:upper:]' '[:lower:]')
+    case "$normalized" in
+        false|0|no) printf 'NO' ;;
+        *) printf 'YES' ;;
+    esac
+}
+
 # Function to build iOS app
 build_ios_app() {
     local build_config=""
@@ -358,6 +372,7 @@ build_ios_app() {
                -configuration "$build_config" \
                -destination "$destination" \
                build \
+               "FIREBASE_ENABLED=$(ios_firebase_build_setting)" \
                CODE_SIGN_IDENTITY="" \
                CODE_SIGNING_REQUIRED=NO \
                CODE_SIGNING_ALLOWED=NO \
@@ -537,6 +552,13 @@ if [ "$ASSETS_ONLY" = true ]; then
     exit 0
 fi
 
+# Firebase is on unless FIREBASE_ENABLED=false. Fail before the web build and
+# xcodebuild when the plist is missing. Xcode runs the same script as a build
+# phase so GUI builds get the same check and bundle the plist.
+if ! ios/App/scripts/bundle-firebase-config.sh --check; then
+    exit 1
+fi
+
 # Handle deploy-app mode
 if [ "$DEPLOY_APP" = true ]; then
     deploy_ios_app
@@ -701,6 +723,7 @@ if [ "$BUILD_IPA" = true ]; then
                -configuration Release \
                -archivePath build/App.xcarchive \
                archive \
+               "FIREBASE_ENABLED=$(ios_firebase_build_setting)" \
                CODE_SIGN_IDENTITY="" \
                CODE_SIGNING_REQUIRED=NO \
                CODE_SIGNING_ALLOWED=NO \

scripts/build-web.sh

@@ -5,25 +5,31 @@
 # This script handles the complete web build process including cleanup,
 # environment setup, Vite build, and optional Docker containerization.
 #
+# Every invocation except --dev writes dist/. --dev alone starts the Vite dev
+# server and writes nothing.
+#
 # Usage:
-#   ./scripts/build-web.sh                    # Development build
-#   ./scripts/build-web.sh --dev              # Development build (explicit)
+#   ./scripts/build-web.sh                    # Production build into dist/
+#   ./scripts/build-web.sh --prod             # Production build (explicit)
 #   ./scripts/build-web.sh --test             # Test environment build
-#   ./scripts/build-web.sh --prod             # Production environment build
-#   ./scripts/build-web.sh --docker           # Build with Docker containerization
+#   ./scripts/build-web.sh --dev              # Start Vite dev server (no dist/)
+#   ./scripts/build-web.sh --docker           # Production build + Docker image
 #   ./scripts/build-web.sh --docker:test      # Test environment + Docker
 #   ./scripts/build-web.sh --docker:prod      # Production environment + Docker
-#   ./scripts/build-web.sh --serve            # Build and serve locally
+#   ./scripts/build-web.sh --serve            # Production build, then serve dist/
 #   ./scripts/build-web.sh --help             # Show help
 #   ./scripts/build-web.sh --verbose          # Enable verbose logging
 #
 # NPM Script Equivalents:
-#   npm run build:web                         # Development build
+#   npm run dev                               # Vite dev server
+#   npm run build:web                         # Production build
 #   npm run build:web:test                    # Test environment build
 #   npm run build:web:prod                    # Production environment build
-#   npm run build:web:docker                  # Docker build
+#   npm run build:web:docker                  # Production Docker build
 #   npm run build:web:docker:test             # Test Docker build
 #   npm run build:web:docker:prod             # Production Docker build
+#   npm run build:web:serve                   # Production build, then serve
+#   npm run build:web:serve:test              # Test build, then serve
 #
 # Exit Codes:
 # 1 - Web cleanup failed
@@ -40,7 +46,7 @@ set -e
 source "$(dirname "$0")/common.sh"
 
 # Default values
-BUILD_MODE="development"
+BUILD_MODE="production"
 BUILD_ACTION="build"
 DOCKER_BUILD=false
 SERVE_BUILD=false
@@ -51,9 +57,10 @@ show_usage() {
 Usage: $0 [OPTIONS]
 
 OPTIONS:
-    --dev, --development    Build for development environment (default)
+    --prod, --production    Build for production environment (default)
     --test                  Build for test environment
-    --prod, --production    Build for production environment
+    --dev, --development    Start the Vite dev server (with --serve or
+                            --docker: build for development instead)
     --docker                Build and create Docker container
     --docker:test           Build for test environment and create Docker container
     --docker:prod           Build for production environment and create Docker container
@@ -63,18 +70,18 @@ OPTIONS:
     --env                   Show environment variables
 
 EXAMPLES:
-    $0                                   # Development build
+    $0                                   # Production build
     $0 --test                            # Test environment build
-    $0 --prod                            # Production environment build
-    $0 --docker                          # Development + Docker
+    $0 --dev                             # Development server
+    $0 --docker                          # Production + Docker
     $0 --docker:test                     # Test + Docker
     $0 --docker:prod                     # Production + Docker
-    $0 --serve                           # Build and serve
+    $0 --serve                           # Production build, then serve
 
 BUILD MODES:
-    development: Starts Vite development server with hot reload (default)
+    production: Optimized for production with full minification and optimization (default)
     test: Optimized for testing with minimal minification
-    production: Optimized for production with full minification and optimization
+    development: Starts Vite development server with hot reload
 
 EOF
 }

scripts/clear-database.sh

@@ -161,4 +161,4 @@ echo "✅ Database clearing instructions completed!"
 echo ""
 echo "💡 Tip: After clearing the database, restart your development server:"
 echo "   npm run build:electron:dev    # For Electron"
-echo "   npm run build:web:dev         # For Web" 
+echo "   npm run dev                   # For Web" 

scripts/test-android.js

@@ -283,7 +283,6 @@ const runDeeplinkTests = async (log) => {
 const buildWebAssets = async (log) => {
     log('🌐 Building web assets...');
     execSync('rm -rf dist', { stdio: 'inherit' });
-    execSync('npm run build:web', { stdio: 'inherit' });
     execSync('npm run build:capacitor', { stdio: 'inherit' });
     log('✅ Web assets built successfully');
 };

scripts/test-ios.js

@@ -147,7 +147,6 @@ export default config;
     log('🔄 Building web assets before adding iOS platform...');
     try {
         execSync('rm -rf dist', { stdio: 'inherit' });
-        execSync('npm run build:web', { stdio: 'inherit' });
         execSync('npm run build:capacitor', { stdio: 'inherit' });
         log('✅ Web assets built successfully');
     } catch (error) {
@@ -416,7 +415,6 @@ const generateTestData = async (log) => {
 const buildWebAssets = async (log) => {
     log('🌐 Building web assets...');
     execSync('rm -rf dist', { stdio: 'inherit' });
-    execSync('npm run build:web', { stdio: 'inherit' });
     execSync('npm run build:capacitor', { stdio: 'inherit' });
     log('✅ Web assets built successfully');
 };

src/App.vue

@@ -386,19 +386,28 @@ export default class App extends Vue {
     // On native (iOS/Android) we don't use web push; the callback handles cancel + state in the view.
     // The callback is the one passed for this specific modal (New Activity or Daily Reminder), so we only turn off that one.
     if (Capacitor.isNativePlatform()) {
+      // A false callback means the view refused the off (AlertSearch revoke
+      // failed). Leave the existing "Notifications are off." toast for every
+      // other callback, which returns void.
+      let turnedOff = true;
       if (notification.callback) {
-        await notification.callback(true);
+        const callbackResult = await notification.callback(true);
+        if (callbackResult === false) {
+          turnedOff = false;
+        }
       }
-      this.$notify(
-        {
-          group: "alert",
-          type: "info",
-          title: "Finished",
-          text: "Notifications are off.",
-        },
-        5000,
-      );
-      return true;
+      if (turnedOff) {
+        this.$notify(
+          {
+            group: "alert",
+            type: "info",
+            title: "Finished",
+            text: "Notifications are off.",
+          },
+          5000,
+        );
+      }
+      return turnedOff;
     }
 
     let subscription: PushSubscriptionJSON | null = null;
@@ -483,7 +492,17 @@ export default class App extends Vue {
           return false;
         });
 
-      const message = pushServerSuccess
+      // Ask the view before announcing success. A callback that returns false
+      // (failed AlertSearch revoke) keeps the existing failure sentence.
+      // Callbacks that return void, including Daily Reminder, keep today's copy.
+      let callbackRefused = false;
+      if (notification.callback) {
+        const callbackResult = await notification.callback(pushServerSuccess);
+        callbackRefused = callbackResult === false;
+      }
+
+      const turnedOff = pushServerSuccess && !callbackRefused;
+      const message = turnedOff
         ? "Notification is off."
         : "Notification is still on. Try to turn it off again.";
 
@@ -497,11 +516,7 @@ export default class App extends Vue {
         5000,
       );
 
-      if (notification.callback) {
-        notification.callback(pushServerSuccess);
-      }
-
-      return pushServerSuccess;
+      return turnedOff;
     } catch (error) {
       this.$logAndConsole(
         "Error turning off notifications: " + JSON.stringify(error),

src/components/ImageMethodDialog.vue

@@ -854,19 +854,19 @@ export default class ImageMethodDialog extends Vue {
     formData.append("image", this.blob, this.fileName || "photo.jpg");
     formData.append("claimType", this.claimType);
     try {
+      const imageServer =
+        (await this.$accountSettings()).imageServer || DEFAULT_IMAGE_API_SERVER;
       if (
         window.location.hostname === "localhost" &&
-        !DEFAULT_IMAGE_API_SERVER.includes("localhost")
+        !imageServer.includes("localhost")
       ) {
         logger.log(
           "Using shared image API server, so only users on that server can play with images.",
         );
       }
-      const response = await axios.post(
-        DEFAULT_IMAGE_API_SERVER + "/image",
-        formData,
-        { headers },
-      );
+      const response = await axios.post(imageServer + "/image", formData, {
+        headers,
+      });
       this.uploading = false;
 
       this.close();

src/components/PhotoDialog.vue

@@ -556,19 +556,19 @@ export default class PhotoDialog extends Vue {
     formData.append("image", this.blob, this.fileName || "photo.jpg");
     formData.append("claimType", this.claimType);
     try {
+      const imageServer =
+        (await this.$accountSettings()).imageServer || DEFAULT_IMAGE_API_SERVER;
       if (
         window.location.hostname === "localhost" &&
-        !DEFAULT_IMAGE_API_SERVER.includes("localhost")
+        !imageServer.includes("localhost")
       ) {
         logger.log(
           "Using shared image API server, so only users on that server can play with images.",
         );
       }
-      const response = await axios.post(
-        DEFAULT_IMAGE_API_SERVER + "/image",
-        formData,
-        { headers },
-      );
+      const response = await axios.post(imageServer + "/image", formData, {
+        headers,
+      });
       this.uploading = false;
 
       this.close();

src/components/dev/NotificationDebugPanel.vue

@@ -88,25 +88,6 @@
           Manually mints and uploads 100 delegated day JWTs. Requires an active
           did:ethr identity and JWT authentication; Test Mode is not used.
         </p>
-        <button
-          class="w-full text-md bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-          :disabled="busy"
-          :class="{ 'opacity-50 cursor-not-allowed': busy }"
-          @click="onBackendRefresh"
-        >
-          Refresh Notifications
-        </button>
-        <button
-          class="w-full text-md bg-gradient-to-b from-violet-400 to-violet-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-          :disabled="busy"
-          :class="{ 'opacity-50 cursor-not-allowed': busy }"
-          @click="onSimulateWakeupRefresh"
-        >
-          Simulate WAKEUP_PING (Local)
-        </button>
-        <p class="text-xs text-slate-500">
-          Local simulation only — calls the refresh API directly (no FCM push).
-        </p>
         <button
           class="w-full text-md bg-gradient-to-b from-amber-400 to-amber-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
           :disabled="busy"
@@ -128,8 +109,8 @@
           {{ realWakeupStatus.message }}
         </p>
         <p v-else class="text-xs text-slate-500">
-          Full pipeline — backend `/debug/send-wakeup` → FCM → WAKEUP_PING
-          handler.
+          FCM delivery diagnostic only — backend `/debug/send-wakeup`. The app
+          no longer schedules api_* notifications from WAKEUP_PING.
         </p>
       </div>
 
@@ -177,70 +158,6 @@
       </div>
     </div>
 
-    <!-- SECTION F: Mock Timing Presets -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Mock Timing Presets</h2>
-      <div class="flex flex-wrap gap-2">
-        <button
-          v-for="preset in presets"
-          :key="preset.ms"
-          class="px-3 py-2 rounded border border-slate-300 bg-white text-sm"
-          :class="{
-            'border-blue-500 ring-1 ring-blue-300': intervalMs === preset.ms,
-          }"
-          @click="intervalMs = preset.ms"
-        >
-          {{ preset.label }}
-        </button>
-      </div>
-      <div class="text-xs text-slate-500 mt-2">
-        Selected interval: <b>{{ intervalLabel }}</b>
-      </div>
-    </div>
-
-    <!-- SECTION A: Mock Refresh Controls -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Mock Refresh Controls</h2>
-      <button
-        class="w-full text-md bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-        :disabled="busy"
-        :class="{ 'opacity-50 cursor-not-allowed': busy }"
-        @click="onMockRefresh"
-      >
-        Trigger Mock Refresh
-      </button>
-    </div>
-
-    <!-- SECTION B: Wakeup Ping Simulator -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Wakeup Ping Simulator</h2>
-      <p class="text-xs text-slate-500 mb-2">
-        Exercises the production push handler (not the refresh API shortcut
-        above).
-      </p>
-      <button
-        class="w-full text-md bg-gradient-to-b from-slate-400 to-slate-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-        :disabled="busy"
-        :class="{ 'opacity-50 cursor-not-allowed': busy }"
-        @click="onWakeupPing"
-      >
-        Simulate WAKEUP_PING
-      </button>
-    </div>
-
-    <!-- SECTION C: Flood Test -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Flood Test</h2>
-      <button
-        class="w-full text-md bg-gradient-to-b from-rose-400 to-rose-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-        :disabled="busy"
-        :class="{ 'opacity-50 cursor-not-allowed': busy }"
-        @click="onFloodTest"
-      >
-        Run 20 Refreshes
-      </button>
-    </div>
-
     <!-- SECTION D: Pending Notification Inspector -->
     <div class="mb-6">
       <div class="flex items-center gap-3 mb-2">
@@ -358,14 +275,6 @@ type PendingInfo = {
   wallClockSource?: string | null;
 };
 
-const presets = [
-  { label: "30 sec", ms: 30_000 },
-  { label: "1 min", ms: 60_000 },
-  { label: "5 min", ms: 5 * 60_000 },
-  { label: "10 min", ms: 10 * 60_000 },
-];
-
-const intervalMs = ref<number>(60_000);
 const busy = ref(false);
 const pending = ref<PendingInfo[]>([]);
 const pendingInspectorMessage = ref<string | null>(null);
@@ -395,11 +304,6 @@ const truncatedFcmToken = computed(() => {
 const eventLog = ref<string[]>([]);
 let unsubscribeEventLog: (() => void) | undefined;
 
-const intervalLabel = computed(() => {
-  const preset = presets.find((p) => p.ms === intervalMs.value);
-  return preset?.label ?? `${intervalMs.value}ms`;
-});
-
 function formatIsoMs(ms: number | null | undefined): string {
   if (ms == null || !Number.isFinite(ms)) {
     return "";
@@ -423,27 +327,6 @@ async function refreshPending(): Promise<void> {
   pendingInspectorMessage.value = result.inspectorUnavailableMessage ?? null;
 }
 
-async function onMockRefresh(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.triggerMockRefresh(intervalMs.value);
-    await refreshPending();
-  });
-}
-
-async function onWakeupPing(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.simulateWakeupPing();
-    await refreshPending();
-  });
-}
-
-async function onFloodTest(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.runFloodTest(intervalMs.value);
-    await refreshPending();
-  });
-}
-
 async function onClearNotifications(): Promise<void> {
   await withBusy(async () => {
     await NotificationDebugService.clearNotifications();
@@ -514,20 +397,6 @@ async function onUploadAlertAuthorization(): Promise<void> {
   });
 }
 
-async function onBackendRefresh(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.triggerBackendRefresh();
-    await refreshPending();
-  });
-}
-
-async function onSimulateWakeupRefresh(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.simulateWakeupViaRefresh();
-    await refreshPending();
-  });
-}
-
 function formatRealWakeupStatusMessage(
   result: Awaited<
     ReturnType<typeof NotificationDebugService.sendRealWakeupPing>

src/composables/useNotifications.ts

@@ -1,134 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unused-vars */
-import { inject, onBeforeUnmount, onMounted } from "vue";
-import { NotificationIface } from "../constants/app";
-import { registerToken } from "@/services/notifications/NotificationService";
-import { refreshNotifications } from "@/services/notifications/NativeNotificationService";
-
-/**
- * Vue 3 composable for notifications
- * Provides a concise API for common notification patterns
- */
-
-export const NOTIFICATION_TIMEOUTS = {
-  BRIEF: 1000, // Very brief toasts ("Sent..." messages)
-  SHORT: 2000, // Short notifications (clipboard copies, quick confirmations)
-  STANDARD: 3000, // Standard notifications (success messages, general info)
-  LONG: 5000, // Longer notifications (errors, warnings, important info)
-  VERY_LONG: 7000, // Very long notifications (complex operations)
-  MODAL: -1, // Modal confirmations (no auto-dismiss)
-} as const;
-
-export function useNotifications() {
-  // Inject the notify function from the app
-  const notify =
-    inject<(notification: NotificationIface, timeout?: number) => void>(
-      "notify",
-    );
-
-  if (!notify) {
-    throw new Error(
-      "useNotifications must be used within a component that has $notify available",
-    );
-  }
-
-  let refreshTimer: number | undefined = undefined;
-  let refreshInFlight: Promise<void> | null = null;
-
-  async function refreshNotificationsDebounced(): Promise<void> {
-    if (refreshTimer != null) {
-      window.clearTimeout(refreshTimer);
-    }
-    refreshTimer = window.setTimeout(() => {
-      if (!refreshInFlight) {
-        refreshInFlight = refreshNotifications().finally(() => {
-          refreshInFlight = null;
-        });
-      }
-    }, 300);
-  }
-
-  const onResume = () => {
-    void refreshNotificationsDebounced();
-  };
-
-  onMounted(() => {
-    void refreshNotificationsDebounced();
-    document.addEventListener("resume", onResume);
-  });
-
-  onBeforeUnmount(() => {
-    document.removeEventListener("resume", onResume);
-    if (refreshTimer != null) {
-      window.clearTimeout(refreshTimer);
-    }
-  });
-
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function success(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function error(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function warning(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function info(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function toast(_title: string, _text?: string, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function copied(_item: string, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function sent(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function confirm(
-    _text: string,
-    _onYes: () => Promise<void>,
-    _timeout?: number,
-  ) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function confirmationSubmitted(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function genericError(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function genericSuccess(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function alreadyConfirmed(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function cannotConfirmIssuer(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function cannotConfirmHidden(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function notRegistered(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function notAGive(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function notificationOff(
-    _title: string,
-    _callback: (success: boolean) => Promise<void>,
-    _timeout?: number,
-  ) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function downloadStarted(_format: string = "Dexie", _timeout?: number) {}
-
-  return {
-    success,
-    error,
-    warning,
-    info,
-    toast,
-    copied,
-    sent,
-    confirm,
-    confirmationSubmitted,
-    genericError,
-    genericSuccess,
-    alreadyConfirmed,
-    cannotConfirmIssuer,
-    cannotConfirmHidden,
-    notRegistered,
-    notAGive,
-    notificationOff,
-    downloadStarted,
-    /** POST FCM token to `/notifications/register` (same as startup native hook). */
-    registerFcmToken: registerToken,
-    refreshNotifications: refreshNotificationsDebounced,
-  };
-}

src/constants/app.ts

@@ -34,7 +34,10 @@ export enum AppString {
 }
 
 export const APP_SERVER =
-  import.meta.env.VITE_APP_SERVER || "https://timesafari.app";
+  import.meta.env.VITE_APP_SERVER || "https://giftopia.me";
+
+export const ORG_SERVER =
+  import.meta.env.VITE_ORG_SERVER || "GiftEconomies.org";
 
 export const DEFAULT_ENDORSER_API_SERVER =
   import.meta.env.VITE_DEFAULT_ENDORSER_API_SERVER ||
@@ -65,7 +68,7 @@ export const IMAGE_TYPE_PROFILE = "profile";
 export function isNotProdServer(apiServer: string): boolean {
   return apiServer !== AppString.PROD_ENDORSER_API_SERVER;
 }
-export const SUPPORT_EMAIL = "info@TimeSafari.app";
+export const SUPPORT_EMAIL = "info@giftopia.me";
 
 export const PASSKEYS_ENABLED =
   !!import.meta.env.VITE_PASSKEYS_ENABLED || false;
@@ -79,7 +82,7 @@ export interface NotificationIface {
   type: string; // "toast" | "info" | "success" | "warning" | "danger"
   title?: string;
   text?: string;
-  callback?: (success: boolean) => Promise<void>; // if this triggered an action
+  callback?: (success: boolean) => Promise<void | boolean>; // if this triggered an action
   noText?: string;
   onCancel?: (stopAsking?: boolean) => Promise<void>;
   onNo?: (stopAsking?: boolean) => Promise<void>;

src/constants/notifications.ts

@@ -1401,6 +1401,22 @@ export const NOTIFY_PROJECT_DELETE_IMAGE_GENERAL_ERROR = {
   message: "There was an error deleting the image.",
 };
 
+// Used in: AccountViewView.vue, GiftedDetailsView.vue, NewEditProjectView.vue
+// (deleteImage - the image server returned 404). The server looks an image up
+// by URL and uploader, so this also happens when the image was uploaded to a
+// different image server than the one in settings.
+export const NOTIFY_IMAGE_DELETE_NOT_FOUND = {
+  title: "Image Not Deleted",
+  message:
+    "The image server in your settings has no record of that image, so it was not removed from storage. It may already be gone, or it may have been uploaded through a different image server.",
+};
+
+// Used in: GiftedDetailsView.vue (deleteImage method - image deletion error)
+export const NOTIFY_IMAGE_DELETE_ERROR = {
+  title: "Image Deletion Error",
+  message: "There was an error deleting the image from the image server.",
+};
+
 // Used in: NewEditProjectView.vue (validateLocation method - invalid location error)
 export const NOTIFY_PROJECT_INVALID_LOCATION = {
   title: "Invalid Location",

src/db-sql/migration.ts

@@ -108,7 +108,7 @@ const MIGRATIONS = [
         secretBase64 TEXT NOT NULL
       );
 
-      INSERT INTO secret (id, secretBase64) VALUES (1, '${secretBase64}');
+      INSERT OR IGNORE INTO secret (id, secretBase64) VALUES (1, '${secretBase64}');
 
       CREATE TABLE IF NOT EXISTS settings (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -144,7 +144,7 @@ const MIGRATIONS = [
 
       CREATE INDEX IF NOT EXISTS idx_settings_accountDid ON settings(accountDid);
 
-      INSERT INTO settings (id, apiServer) VALUES (1, '${DEFAULT_ENDORSER_API_SERVER}');
+      INSERT OR IGNORE INTO settings (id, apiServer) VALUES (1, '${DEFAULT_ENDORSER_API_SERVER}');
 
       CREATE TABLE IF NOT EXISTS contacts (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -245,8 +245,11 @@ const MIGRATIONS = [
         registered BOOLEAN,
         hideTheirContent BOOLEAN DEFAULT 0
       );
+      -- Older versions could save the same DID more than once (nothing was unique on contacts.did),
+      -- which made the unique index below fail on every startup. Keep only the newest row per DID.
       INSERT INTO _contacts_backup_008 (id, did, name, contactMethods, nextPubKeyHashB64, notes, profileImageUrl, publicKeyBase64, seesMe, registered, hideTheirContent)
-      SELECT id, did, name, contactMethods, nextPubKeyHashB64, notes, profileImageUrl, publicKeyBase64, seesMe, registered, COALESCE(hideTheirContent, 0) FROM contacts;
+      SELECT id, did, name, contactMethods, nextPubKeyHashB64, notes, profileImageUrl, publicKeyBase64, seesMe, registered, COALESCE(hideTheirContent, 0) FROM contacts
+      WHERE id IN (SELECT MAX(id) FROM contacts GROUP BY did);
 
       DROP TABLE contacts;
       ALTER TABLE _contacts_backup_008 RENAME TO contacts;
@@ -263,7 +266,9 @@ const MIGRATIONS = [
       );
       CREATE INDEX idx_contact_labels_label ON contact_labels(label);
       CREATE INDEX idx_contact_labels_did ON contact_labels(did);
-      INSERT INTO contact_labels SELECT * FROM _contact_labels_backup_008;
+      -- The PRAGMA above is a no-op inside the migration's transaction, so foreign keys are enforced here:
+      -- skip any label whose contact no longer exists.
+      INSERT INTO contact_labels SELECT * FROM _contact_labels_backup_008 WHERE did IN (SELECT did FROM contacts);
       DROP TABLE _contact_labels_backup_008;
 
       PRAGMA foreign_keys = ON;
@@ -287,6 +292,13 @@ const MIGRATIONS = [
       ALTER TABLE settings ADD COLUMN smsNotificationsEnabled BOOLEAN DEFAULT FALSE;
     `,
   },
+  {
+    name: "011_add_imageServer_to_settings",
+    sql: `
+      -- Image API server URL; blank means DEFAULT_IMAGE_API_SERVER
+      ALTER TABLE settings ADD COLUMN imageServer TEXT;
+    `,
+  },
 ];
 
 /**
@@ -313,6 +325,8 @@ function extractSingleValue<T>(result: T): string | number | null {
   return null;
 }
 
+let migrationsRegistered = false;
+
 /**
  * @param sqlExec - A function that executes a SQL statement and returns the result
  * @param extractMigrationNames - A function that extracts the names (string array) from "select name from migrations"
@@ -324,9 +338,14 @@ export async function runMigrations<T>(
 ): Promise<void> {
   logger.debug("[Migration] Starting database migrations");
 
-  for (const migration of MIGRATIONS) {
-    logger.debug("[Migration] Registering migration:", migration.name);
-    registerMigration(migration);
+  // Register once: a retry after a failed initialization calls this again,
+  // and the registry rejects duplicate names.
+  if (!migrationsRegistered) {
+    for (const migration of MIGRATIONS) {
+      logger.debug("[Migration] Registering migration:", migration.name);
+      registerMigration(migration);
+    }
+    migrationsRegistered = true;
   }
 
   logger.debug("[Migration] Running migration service");

src/db/databaseUtil.ts

@@ -298,7 +298,6 @@ export async function logToDb(
   }
 }
 
-// similar method is in the sw_scripts/additional-scripts.js file
 export async function logConsoleAndDb(
   message: string,
   isError = false,

src/db/index.ts

@@ -302,7 +302,6 @@ export async function logToDb(message: string): Promise<void> {
   await db.logs.update(todayKey, { message: fullMessage });
 }
 
-// similar method is in the sw_scripts/additional-scripts.js file
 export async function logConsoleAndDb(
   message: string,
   isError = false,

src/db/tables/settings.ts

@@ -38,7 +38,7 @@ export type Settings = {
   hasBackedUpSeed?: boolean; // tracks whether the user has backed up their seed phrase
   hideRegisterPromptOnNewContact?: boolean;
   isRegistered?: boolean;
-  // imageServer?: string; // if we want to allow modification then we should make image functionality optional -- or at least customizable
+  imageServer?: string; // image API server URL
   lastName?: string; // deprecated - put all names in firstName
 
   lastAckedOfferToUserJwtId?: string; // the last JWT ID for offer-to-user that they've acknowledged seeing

src/interfaces/accountView.ts

@@ -37,6 +37,7 @@ export interface AccountSettings {
   notifyingReminderMessage?: string;
   notifyingReminderTime?: string;
   starredPlanHandleIds?: string[];
+  imageServer?: string;
   reminderFastRolloverForTesting?: boolean;
   partnerApiServer?: string;
   profileImageUrl?: string;
@@ -102,6 +103,8 @@ export interface SettingsState {
   activeDid: string;
   apiServer: string;
   apiServerInput: string;
+  imageServer: string;
+  imageServerInput: string;
   partnerApiServer: string;
   partnerApiServerInput: string;
   webPushServer: string;

src/interfaces/alertSearch.ts

@@ -19,15 +19,28 @@
 /**
  * Server-issued ULID on a stored JWT/plan record, used as alertSearch afterId /
  * beforeId. Not an authentication JWT and not a delegated notification JWT.
+ * Superseded by AlertSearchCursor for "what changed since" queries.
  */
 export type AlertSearchCursorUlid = string;
 
+/**
+ * Opaque cursor: a position between changes on one server. Responses return
+ * `nextAfterCursor` and `nextBeforeCursor`; requests send them back as
+ * `afterCursor` (changes after it, oldest first) or `beforeCursor` (changes
+ * before it, newest first). Store it as text and never parse or compare it;
+ * its format belongs to the server (see endorser-ch
+ * CHANGE/PLAN-accurate-cursors.md).
+ */
+export type AlertSearchCursor = string;
+
 /**
  * JWT row from endorser `jwtsWithDidAfterId` (no claim body).
  * Cursor field: `id`.
  */
 export interface AlertSearchClaimRecord {
   id: AlertSearchCursorUlid;
+  /** Server change sequence of this row; ascending within a cursor-path list. */
+  changeSeq?: number;
   issuedAt: string;
   issuer: string;
   subject?: string;
@@ -54,6 +67,8 @@ export interface AlertSearchJwtWithClaimRecord extends AlertSearchClaimRecord {
 export interface AlertSearchPlanRecord {
   handleId: string;
   jwtId: AlertSearchCursorUlid;
+  /** Server change sequence of this row; ascending within a cursor-path list. */
+  changeSeq?: number;
   issuerDid?: string;
   agentDid?: string;
   fulfillsLinkConfirmed?: boolean | number;
@@ -77,6 +92,8 @@ export interface AlertSearchPlanRecord {
  */
 export interface AlertSearchProfileRecord {
   rowId?: number;
+  /** Server change sequence of this row; ascending within a cursor-path list. */
+  changeSeq?: number;
   issuerDid: string;
   updatedAt?: string;
   description: string;
@@ -94,18 +111,43 @@ export interface EndorserAlertSearchData {
   plansNearby: AlertSearchPlanRecord[];
 }
 
+/**
+ * A profile or plan close in meaning to the requester's profile, from partner
+ * `profilesSimilar` / `plansSimilar` (best first; not paged).
+ */
+export interface AlertSearchSimilarProfile {
+  similarity: number;
+  profile: AlertSearchProfileRecord;
+}
+
+export interface AlertSearchSimilarPlan {
+  similarity: number;
+  plan: AlertSearchPlanRecord;
+}
+
 export interface PartnerAlertSearchData {
   profilesNearby: AlertSearchProfileRecord[];
+  profilesSimilar?: AlertSearchSimilarProfile[];
+  plansSimilar?: AlertSearchSimilarPlan[];
 }
 
 /**
  * Endorser GET/POST /api/v2/report/alertSearch body.
- * Per-bucket SQL hitLimit is not currently copied onto this envelope.
- * Timeouts may set `userMessage` instead.
+ * The cursors and `hasMore` are absent from servers that predate cursors.
+ * Timeouts may set `userMessage`; the cursor then does not move.
  */
 export interface EndorserAlertSearchResponse {
   data: EndorserAlertSearchData;
   userMessage?: string;
+  /** Send as `afterCursor` to get what changed after this response. */
+  nextAfterCursor?: AlertSearchCursor;
+  /** Send as `beforeCursor` to scroll back past this response. */
+  nextBeforeCursor?: AlertSearchCursor;
+  /**
+   * A list was cut at its limit: call again in the same direction, with
+   * `afterCursor = nextAfterCursor` or `beforeCursor = nextBeforeCursor`.
+   */
+  hasMore?: boolean;
 }
 
 /**
@@ -114,6 +156,15 @@ export interface EndorserAlertSearchResponse {
 export interface PartnerAlertSearchResponse {
   data: PartnerAlertSearchData;
   userMessage?: string;
+  /** Send as `afterCursor` to get what changed after this response. */
+  nextAfterCursor?: AlertSearchCursor;
+  /** Send as `beforeCursor` to scroll back past this response. */
+  nextBeforeCursor?: AlertSearchCursor;
+  /**
+   * A list was cut at its limit: call again in the same direction, with
+   * `afterCursor = nextAfterCursor` or `beforeCursor = nextBeforeCursor`.
+   */
+  hasMore?: boolean;
 }
 
 /**

src/interfaces/notifyApi.ts

@@ -78,7 +78,10 @@ export interface NotificationRegisterRequest extends NotifyApiTestModeFlag {
 }
 
 /**
- * Body of `POST /notifications/refresh`. The service finds the caller's device
+ * Body of `POST /notifications/refresh`. The Capacitor app no longer calls this
+ * route (WAKEUP_PING → refresh → `api_*` scheduling was retired). These types
+ * remain because notification-wakeup-service still exposes the endpoint.
+ * The service finds the caller's device
  * by `deviceId`, or by `fcmToken` when no `deviceId` is sent, and answers 400
  * when neither is present and non-empty. When both are sent they must name the
  * same device, or the answer is 404.
@@ -170,7 +173,7 @@ export interface DelegatedAlertJwt {
 }
 
 /**
- * Body of `PUT /notifications/alert-authorization` (push) and
+ * Body of `POST /notifications/alert-authorization` (push) and
  * `POST /notify-sms/alert-authorization` (SMS), which validate it with one
  * rule. A stored batch replaces the unused inventory the DID holds in that
  * channel; JWTs already spent stay behind.
@@ -229,7 +232,7 @@ export interface AlertAuthorizationBatchFailure {
   details: string[];
 }
 
-/** Refusal from `PUT` or `DELETE /notifications/alert-authorization`. */
+/** Refusal from `POST` or `DELETE /notifications/alert-authorization`. */
 export type AlertAuthorizationFailure =
   | AlertAuthorizationBatchFailure
   | NotifyApiUncodedFailure;

src/libs/alertSearch.ts

@@ -14,18 +14,21 @@
  *   notify-api's push or SMS `alert-authorization` route.
  * - Native background pool: `mintBackgroundJwtTokenPool` for daily-notification
  *   plugin prefetch. Unrelated to alertSearch and to the delegated batch.
- * - alertSearch cursor ULID: server-issued record/JWT primary id (26-char
- *   ULID). `afterId` means ids strictly greater than that ULID; `beforeId`
- *   means strictly less. First daily run omits afterId. `beforeId` is for
- *   pagination within a run. These are not auth JWTs and not signed tokens.
+ * - alertSearch cursors: opaque server strings, positions between changes.
+ *   To get what changed: send the stored value as `afterCursor`, store each
+ *   response's `nextAfterCursor`, and while `hasMore` call again with
+ *   `afterCursor = nextAfterCursor`. Every page is complete up to it.
+ *   To scroll back, newest first: send `beforeCursor` (any cursor, eg. a
+ *   `nextAfterCursor`), then `beforeCursor = nextBeforeCursor` while `hasMore`.
+ *   A first run sends neither.
+ * - alertSearch ULIDs (`afterId` / `beforeId`): the older bounds, ignored when
+ *   a cursor is sent. Not auth JWTs and not signed tokens.
  *
- * Truncation: each endorser bucket query uses a server hit-limit (typically
- * 50). That flag is not currently returned on the alertSearch JSON envelope.
- * Timeouts may add `userMessage`. A later caller must still paginate with
- * beforeId when a bucket may be incomplete.
+ * See endorser-ch CHANGE/PLAN-accurate-cursors.md.
  */
 
 import type {
+  AlertSearchCursor,
   AlertSearchCursorUlid,
   CombinedAlertSearchData,
   EndorserAlertSearchResponse,
@@ -47,6 +50,10 @@ export interface AlertSearchLocationBBox {
  * GET is the planned daily method; the server also accepts POST.
  */
 export interface AlertSearchRequestParams {
+  /** Changes after this cursor, oldest first; the ID and date bounds are then ignored. */
+  afterCursor?: AlertSearchCursor;
+  /** Changes before this cursor (and after `afterCursor`, if given), newest first. */
+  beforeCursor?: AlertSearchCursor;
   afterId?: AlertSearchCursorUlid;
   beforeId?: AlertSearchCursorUlid;
   afterDate?: string;
@@ -59,9 +66,12 @@ export interface AlertSearchRequestParams {
   planHandleIds?: string[];
   planIds?: string[];
   handleIds?: string[];
+  /** Partner only: bounding box for profilesSimilar / plansSimilar (everywhere without it). */
+  similarLocation?: AlertSearchLocationBBox;
 }
 
 export type {
+  AlertSearchCursor,
   AlertSearchCursorUlid,
   CombinedAlertSearchData,
   EndorserAlertSearchResponse,

src/libs/endorserServer.ts

@@ -23,7 +23,7 @@ import { LRUCache } from "lru-cache";
 import * as R from "ramda";
 
 import { DEFAULT_IMAGE_API_SERVER, NotificationIface } from "../constants/app";
-import { NOTIFICATION_TIMEOUTS } from "../composables/useNotifications";
+import { NOTIFICATION_TIMEOUTS } from "../utils/notificationUtils";
 import { createNotifyHelpers } from "../utils/notify";
 import { NOTIFY_PERSONAL_DATA_ERROR } from "../constants/notifications";
 import { Contact } from "../db/tables/contacts";

src/libs/webShareTarget.ts

@@ -0,0 +1,52 @@
+/**
+ * Web Share Target handoff (web build only).
+ *
+ * public/sw.js receives the POST from the manifest's share_target, stores the
+ * photo in Cache Storage under these keys, and redirects to /shared-photo.
+ * Keep the constants in sync with public/sw.js.
+ */
+
+import { logger } from "../utils/logger";
+
+const SHARE_TARGET_CACHE = "share-target";
+const SHARED_PHOTO_KEY = "/share-target/photo";
+const FILE_NAME_HEADER = "X-File-Name";
+
+export interface WebSharedPhoto {
+  blob: Blob;
+  fileName: string;
+}
+
+/**
+ * Registers public/sw.js, which handles the share target POST.
+ */
+export function registerWebShareTargetWorker(): void {
+  if (!("serviceWorker" in navigator)) {
+    return;
+  }
+  navigator.serviceWorker.register("/sw.js").catch((error) => {
+    // Not fatal: only sharing into the app depends on the worker.
+    logger.warn("[WebShareTarget] Service worker registration failed", error);
+  });
+}
+
+/**
+ * Returns the photo stashed by the service worker and removes it, or null
+ * when there is none (or Cache Storage is unavailable).
+ */
+export async function takeWebSharedPhoto(): Promise<WebSharedPhoto | null> {
+  if (typeof caches === "undefined") {
+    return null;
+  }
+  const cache = await caches.open(SHARE_TARGET_CACHE);
+  const response = await cache.match(SHARED_PHOTO_KEY);
+  if (!response) {
+    return null;
+  }
+  const blob = await response.blob();
+  const fileName = decodeURIComponent(
+    response.headers.get(FILE_NAME_HEADER) || "",
+  );
+  await cache.delete(SHARED_PHOTO_KEY);
+  return { blob, fileName };
+}

src/main.capacitor.ts

@@ -48,6 +48,7 @@ import {
   configureNativeFetcherIfReady,
   initializeNativePushAndFirebaseMessaging,
   onNotificationAuthMayBeReady,
+  runLegacyApiNotificationsCleanupOnce,
 } from "@/services/notifications";
 
 logger.log("[Capacitor] 🚀 Starting initialization");
@@ -361,6 +362,8 @@ setTimeout(async () => {
     );
     await registerDeepLinkListener();
     logger.info(`[Main] 🎉 Deep link system fully initialized!`);
+    // One-time: remove persisted legacy api_* schedules from pre-retirement installs
+    await runLegacyApiNotificationsCleanupOnce();
     // Firebase Messaging (JS) + Capacitor PushNotifications (FCM/APNs token, delivery listeners)
     await initializeNativePushAndFirebaseMessaging();
     // Configure native fetcher for API-driven daily notifications (activeDid + JWT)

src/main.common.ts

@@ -9,6 +9,10 @@ import "./assets/styles/tailwind.css";
 import { FontAwesomeIcon } from "./libs/fontawesome";
 import Camera from "simple-vue-camera";
 import { logger } from "./utils/logger";
+import {
+  isDatabaseStartupError,
+  recordStartupError,
+} from "./utils/startupError";
 
 // Global Error Handler
 function setupGlobalErrorHandler(app: VueApp) {
@@ -22,6 +26,12 @@ function setupGlobalErrorHandler(app: VueApp) {
       info,
       component: instance?.$options.name || "unknown",
     });
+    if (isDatabaseStartupError(err)) {
+      // Nothing works without the database: show the recovery options instead.
+      recordStartupError(err);
+      router.replace("/start");
+      return;
+    }
     alert(
       (err instanceof Error ? err.message : "Something bad happened") +
         " - Try reloading or restarting the app.",

src/main.web.ts

@@ -1,20 +1,57 @@
-import { initializeApp } from "./main.common";
 import { logger } from "./utils/logger";
+import { registerWebShareTargetWorker } from "./libs/webShareTarget";
 
 const platform = process.env.VITE_PLATFORM;
 
-// PWA service worker is automatically registered by VitePWA plugin
-
-const app = initializeApp();
-
-// Note: Worker initialization is now handled by WebPlatformService
-// This ensures single-point database access and prevents double migrations
-if (platform === "web" || platform === "development") {
-  logger.debug(
-    "[Web] Database initialization will be handled by WebPlatformService",
-  );
-} else {
-  logger.debug("[Web] SQL not initialized for platform", { platform });
+/**
+ * Browsers withhold crypto.subtle outside secure contexts (HTTPS, localhost,
+ * 127.0.0.1, [::1]), and identity creation cannot run without it. Addresses
+ * like http://[::]:8000 or http://192.168.x.x would otherwise fail later with
+ * a misleading "could not open its data" startup error. main.common is loaded
+ * only after this check because importing the router starts navigation.
+ */
+function showInsecureContextError(): void {
+  const container = document.getElementById("app");
+  if (!container) {
+    return;
+  }
+  container.innerHTML = `
+    <section style="max-width: 40rem; margin: 3rem auto; padding: 0 1rem; font-family: sans-serif; line-height: 1.5;">
+      <h1 style="font-size: 1.25rem; font-weight: 600;">Time Safari Cannot Start Here</h1>
+      <p>This page must be opened over HTTPS or from <code>localhost</code>.</p>
+      <p>The browser does not treat <code></code> as secure, so it disables the cryptography the app uses for identities.</p>
+      <p>On a local server, use <code>http://localhost:PORT/</code> instead of <code>http://[::]:PORT/</code> or <code>http://0.0.0.0:PORT/</code>.</p>
+    </section>`;
+  const originCode = container.querySelectorAll("code")[1];
+  if (originCode) {
+    originCode.textContent = window.location.origin;
+  }
 }
 
-app.mount("#app");
+if (!window.isSecureContext) {
+  logger.error("[Web] Not a secure context; app will not start", {
+    origin: window.location.origin,
+  });
+  showInsecureContextError();
+} else {
+  import("./main.common").then(({ initializeApp }) => {
+    const app = initializeApp();
+
+    // Note: Worker initialization is now handled by WebPlatformService
+    // This ensures single-point database access and prevents double migrations
+    if (platform === "web" || platform === "development") {
+      logger.debug(
+        "[Web] Database initialization will be handled by WebPlatformService",
+      );
+    } else {
+      logger.debug("[Web] SQL not initialized for platform", { platform });
+    }
+
+    app.mount("#app");
+
+    // Handles the manifest's share_target POST (see public/sw.js)
+    if (platform === "web") {
+      registerWebShareTargetWorker();
+    }
+  });
+}

src/plugins/NotificationInspectorPlugin.ts

@@ -11,7 +11,7 @@ export type PendingNotificationInfo = {
 
 export interface NotificationInspectorPlugin {
   getPendingNotifications(): Promise<{ pending: PendingNotificationInfo[] }>;
-  /** Android only: whether the build has a Firebase config (-PfirebaseEnabled). */
+  /** Android only: whether this build included Firebase (off only with -PfirebaseEnabled=false). */
   isFirebaseConfigured(): Promise<{ configured: boolean }>;
 }
 

src/router/index.ts

@@ -6,11 +6,14 @@ import {
   RouteRecordRaw,
 } from "vue-router";
 import { logger } from "../utils/logger";
+import {
+  isDatabaseStartupError,
+  recordStartupError,
+} from "../utils/startupError";
 import {
   retrieveAccountDids,
   generateSaveAndActivateIdentity,
 } from "../libs/util";
-import { includeDevToolkitRoutes } from "../utils/includeDevToolkitRoutes";
 
 const routes: Array<RouteRecordRaw> = [
   {
@@ -92,6 +95,15 @@ const routes: Array<RouteRecordRaw> = [
       requiresAuth: false,
     },
   },
+  {
+    path: "/dev/notifications",
+    name: "dev-notifications",
+    component: () => import("../views/dev/NotificationDebugView.vue"),
+    meta: {
+      title: "Notification Debug",
+      requiresAuth: false,
+    },
+  },
   {
     path: "/did/:did?",
     name: "did",
@@ -269,8 +281,6 @@ const routes: Array<RouteRecordRaw> = [
     component: () => import("../views/SharedPhotoView.vue"),
   },
 
-  // /share-target is also an endpoint in the service worker
-
   {
     path: "/start",
     name: "start",
@@ -291,19 +301,6 @@ const routes: Array<RouteRecordRaw> = [
     name: "user-profile",
     component: () => import("../views/UserProfileView.vue"),
   },
-  ...(includeDevToolkitRoutes
-    ? ([
-        {
-          path: "/dev/notifications",
-          name: "dev-notifications",
-          component: () => import("../views/dev/NotificationDebugView.vue"),
-          meta: {
-            title: "Notification Debug",
-            requiresAuth: false,
-          },
-        },
-      ] satisfies Array<RouteRecordRaw>)
-    : []),
   // Catch-all route for 404 errors - must be last
   {
     path: "/:pathMatch(.*)*",
@@ -342,6 +339,12 @@ const errorHandler = (
 ) => {
   // Handle the error here
   logger.error("Caught in top level error handler:", error, to, from);
+  if (isDatabaseStartupError(error)) {
+    // Nothing works without the database: show the recovery options instead.
+    recordStartupError(error);
+    router.replace("/start");
+    return;
+  }
   alert("Something is very wrong. Try reloading or restarting the app.");
 
   // You can also perform additional actions, such as displaying an error message or redirecting the user to a specific page
@@ -426,17 +429,8 @@ router.beforeEach(async (to, _from, next) => {
       timestamp: new Date().toISOString(),
     });
 
-    // Store error details so StartView can display them
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    const errorStack = error instanceof Error ? error.stack || "" : "";
-    try {
-      sessionStorage.setItem(
-        "startupError",
-        JSON.stringify({ message: errorMessage, stack: errorStack }),
-      );
-    } catch {
-      // sessionStorage may be unavailable
-    }
+    // Store error details so StartView can display them with recovery options
+    recordStartupError(error);
 
     // Keep diagnostic pages reachable when identity creation fails (e.g. a
     // failed migration leaves every DB call throwing), so the user can open

src/services/PlatformService.ts

@@ -209,13 +209,20 @@ export interface PlatformService {
    */
   retrieveSettingsForActiveAccount(): Promise<Record<string, unknown> | null>;
 
-  // --- PWA/Web-only methods (optional, only implemented on web) ---
+  // --- Startup-failure recovery (optional, only implemented on native mobile) ---
   /**
-   * Registers the service worker for PWA support (web only)
+   * Opens the share sheet with a copy of the raw database file, so a user
+   * whose database cannot be opened can still save it or send it to support.
+   * It contains their keys, so the UI must say so.
    */
-  registerServiceWorker?(): void;
+  shareDatabaseFile?(): Promise<void>;
 
   /**
-   * Returns true if PWA is enabled (web only)
+   * Copies the database file aside (into the app's files directory) and then
+   * deletes it, so the next start builds a fresh database. The caller is
+   * expected to reload the app afterward.
+   * @returns the backup file's URI, or undefined when there was no file to back up
+   * @throws if the backup copy fails (the original is never deleted without one)
    */
+  resetDatabase?(): Promise<string | undefined>;
 }

src/services/migrationService.ts

@@ -153,6 +153,17 @@ class MigrationRegistry {
 // Create a singleton instance of the migration registry
 const migrationRegistry = new MigrationRegistry();
 
+/** The migration's SQL followed by the statement that records it as applied. */
+function withMigrationRecord(migration: Migration): string {
+  // A trailing "--" comment ends at its newline, so check what's left without comments.
+  const terminated = migration.sql
+    .replace(/--[^\n]*/g, "")
+    .trim()
+    .endsWith(";");
+  const name = migration.name.replace(/'/g, "''");
+  return `${migration.sql}\n${terminated ? "" : ";\n"}INSERT INTO migrations (name) VALUES ('${name}');\n`;
+}
+
 /**
  * Register a migration with the migration service
  *
@@ -282,19 +293,15 @@ export async function runMigrations<T>(
         logger.debug(`[Migration] Executing SQL for: ${migration.name}`);
         logger.debug(`[Migration] SQL content: ${migration.sql}`);
 
-        // Execute the migration SQL directly - it should be atomic
-        // The SQL itself should handle any necessary transactions
-        const execResult = await sqlExec(migration.sql);
+        // The record goes in the same batch as the migration, which the native
+        // plugin runs as one transaction: if the app dies between the two, a
+        // migration that can't run twice (like 001) would fail every launch.
+        const execResult = await sqlExec(withMigrationRecord(migration));
 
         logger.debug(
           `[Migration] SQL execution result: ${JSON.stringify(execResult)}`,
         );
 
-        // Record that the migration was applied
-        await sqlExec("INSERT INTO migrations (name) VALUES (?)", [
-          migration.name,
-        ]);
-
         logger.debug(`✅ [Migration] Successfully applied: ${migration.name}`);
         appliedCount++;
       } catch (error) {

src/services/notifications/NativeNotificationService.ts

@@ -13,30 +13,8 @@
 
 import { Capacitor } from "@capacitor/core";
 import type { PushNotificationSchema } from "@capacitor/push-notifications";
-import type {
-  NotificationRefreshRequest,
-  NotificationRefreshResponse,
-} from "@/interfaces/notifyApi";
 import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
-import { getOrCreateDeviceId } from "./deviceId";
 import { REMINDER_ID_DAILY_REMINDER } from "./reminderIds";
-import { configureNativeFetcherIfReady } from "./nativeFetcherConfig";
-import {
-  getNotificationApiBaseUrl,
-  getTestMode,
-} from "./NotificationDebugConfig";
-import {
-  logRefreshFailure,
-  logRefreshStarted,
-  logRefreshSuccess,
-  logScheduleReplacement,
-} from "./notificationLog";
-import {
-  getNotificationApiHeaders,
-  logSkippingRefreshDueToMissingAuth,
-  notificationApiFailureMessage,
-  readNotificationApiBody,
-} from "./notificationApiAuth";
 import { logNotification } from "./NotificationDebugEvents";
 
 /**
@@ -563,200 +541,14 @@ export class NativeNotificationService implements NotificationServiceInterface {
   }
 }
 
-export type RefreshNotificationsResult = {
-  ok: boolean;
-  scheduledCount: number;
-  status?: number;
-  errorMessage?: string;
-};
-
 /**
- * Re-applies native API fetcher credentials (JWT pool, active DID) so background
- * notification workers can run. No UI; safe from push handlers while backgrounded.
- */
-export async function refreshNotificationsWithDiagnostics(options?: {
-  source?: string;
-}): Promise<RefreshNotificationsResult> {
-  const startedAt = performance.now();
-  const source = options?.source;
-  logRefreshStarted(source);
-
-  if (!Capacitor.isNativePlatform()) {
-    const errorMessage = "not a native platform";
-    logRefreshFailure(startedAt, errorMessage, undefined, source);
-    return {
-      ok: false,
-      scheduledCount: 0,
-      errorMessage,
-    };
-  }
-
-  try {
-    const auth = await getNotificationApiHeaders("refresh");
-    if (!auth.ok) {
-      logSkippingRefreshDueToMissingAuth();
-      logRefreshFailure(startedAt, auth.message, undefined, source);
-      return {
-        ok: false,
-        scheduledCount: 0,
-        errorMessage: auth.message,
-      };
-    }
-
-    let deviceId: string | undefined;
-    try {
-      deviceId = await getOrCreateDeviceId();
-    } catch (err) {
-      logger.warn(
-        "[NativeNotificationService] Could not obtain deviceId; skipping refresh",
-        err,
-      );
-    }
-    if (!deviceId) {
-      // The service finds the device by deviceId or fcmToken and answers 400
-      // without either, so there is no request worth sending.
-      const errorMessage = "no deviceId (cannot identify this device)";
-      logRefreshFailure(startedAt, errorMessage, undefined, source);
-      return { ok: false, scheduledCount: 0, errorMessage };
-    }
-
-    const body: NotificationRefreshRequest = {
-      deviceId,
-      platform: Capacitor.getPlatform(),
-      testMode: getTestMode(),
-    };
-    const baseUrl = getNotificationApiBaseUrl();
-    const res = await fetch(`${baseUrl}/notifications/refresh`, {
-      method: "POST",
-      headers: auth.headers,
-      body: JSON.stringify(body),
-    });
-
-    if (!res.ok) {
-      const errorMessage = notificationApiFailureMessage(
-        res.status,
-        await readNotificationApiBody(res),
-      );
-      logger.warn("[NativeNotificationService] refreshNotifications failed", {
-        status: res.status,
-        statusText: res.statusText,
-        errorMessage,
-      });
-      logRefreshFailure(startedAt, errorMessage, res.status, source);
-      return {
-        ok: false,
-        scheduledCount: 0,
-        status: res.status,
-        errorMessage,
-      };
-    }
-
-    const payload = (await res.json()) as NotificationRefreshResponse;
-    const scheduledCount = Array.isArray(payload?.nextNotifications)
-      ? payload.nextNotifications.length
-      : 0;
-    await applyNotificationRefreshPayload(payload);
-    logRefreshSuccess(startedAt, scheduledCount, source);
-    return { ok: true, scheduledCount };
-  } catch (err) {
-    logger.error("[NativeNotificationService] Refresh failed", err);
-    const message = err instanceof Error ? err.message : String(err);
-    logRefreshFailure(startedAt, message, undefined, source);
-    return { ok: false, scheduledCount: 0, errorMessage: message };
-  }
-}
-
-export async function refreshNotifications(): Promise<void> {
-  await refreshNotificationsWithDiagnostics();
-}
-
-export type NotificationRefreshPayload = {
-  shouldNotify?: boolean;
-  nextNotifications?: Array<{ timestamp?: number }>;
-};
-
-// `handleCapacitorPushNotificationReceived` and `applyNotificationRefreshPayload` are used by
-// DEV notification simulation tooling; they must stay production-safe because that tooling
-// exercises real flows. (`applyNotificationRefreshPayload` is also used by production refresh.)
-
-/**
- * Apply a "refresh notifications" payload by clearing and scheduling timestamps via the native plugin.
- *
- * This is the shared implementation used by:
- * - production refresh flow (`refreshNotifications` fetching from backend)
- * - dev-only debug flows (mock refresh with local payloads)
- *
- * Important: This function intentionally mirrors production behavior and does not introduce
- * any scheduling logic in UI layers.
- */
-export async function applyNotificationRefreshPayload(
-  payload: unknown,
-): Promise<void> {
-  if (!Capacitor.isNativePlatform()) {
-    return;
-  }
-
-  const data = payload as NotificationRefreshPayload;
-  const nextNotifications = data?.nextNotifications;
-  if (!Array.isArray(nextNotifications)) {
-    return;
-  }
-
-  const timestamps = nextNotifications
-    .map((n) => (n as { timestamp?: unknown })?.timestamp)
-    .filter((t): t is number => typeof t === "number" && Number.isFinite(t));
-
-  if (timestamps.length === 0) {
-    logNotification("Schedule replacement skipped (no valid timestamps)");
-    return;
-  }
-
-  // Keep existing behavior: ensure background worker credentials are current.
-  await configureNativeFetcherIfReady();
-
-  logScheduleReplacement(timestamps.length);
-
-  if (typeof DailyNotification.clearApiNotifications !== "function") {
-    logger.warn(
-      "[NativeNotificationService] API notification clear unavailable (plugin clearApiNotifications missing); cannot replace schedule",
-    );
-    logNotification(
-      "Schedule replacement aborted (API notification clear unavailable on plugin)",
-    );
-    return;
-  }
-
-  logNotification("Clearing API notifications before refresh");
-  await DailyNotification.clearApiNotifications();
-  logNotification("Cleared API notifications");
-
-  if (typeof DailyNotification.scheduleApiNotifications !== "function") {
-    logger.warn(
-      "[NativeNotificationService] scheduleApiNotifications not available on plugin; cannot apply timestamps",
-    );
-    logNotification(
-      "Schedule replacement aborted (scheduleApiNotifications unavailable)",
-    );
-    return;
-  }
-
-  await DailyNotification.scheduleApiNotifications({ timestamps });
-  logNotification(
-    `Schedule replacement applied (${timestamps.length} timestamp(s))`,
-  );
-}
-
-/**
- * Silent FCM/APNs data push: refresh native notification pipeline when requested by backend.
+ * Capacitor push delivery hook. Legacy WAKEUP_PING → /notifications/refresh
+ * consumption was retired; AlertSearch uses visible FCM notifications and is
+ * not handled here. Keep logging for diagnostics without scheduling api_* work.
  */
 export async function handleCapacitorPushNotificationReceived(
   notification: PushNotificationSchema,
 ): Promise<void> {
-  if (notification.data?.type === "WAKEUP_PING") {
-    logNotification("WAKEUP_PING handler — invoking refresh");
-    await refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" });
-    return;
-  }
   const type =
     typeof notification.data?.type === "string"
       ? notification.data.type

src/services/notifications/NotificationDebugService.ts

@@ -1,14 +1,12 @@
 /**
  * DEV-only notification testing utilities.
  *
- * IMPORTANT:
- * This service intentionally routes through the same production notification
- * orchestration paths used by refresh flows, wakeup pushes, and replacement.
- * Avoid adding duplicate scheduling logic here.
+ * Legacy WAKEUP_PING → /notifications/refresh → api_* tooling was removed in
+ * the Phase 2 retirement. Remaining helpers cover FCM registration, AlertSearch
+ * authorization upload, backend URL overrides, and pending-notification inspection.
  */
 
 import { Capacitor } from "@capacitor/core";
-import type { PushNotificationSchema } from "@capacitor/push-notifications";
 import type {
   DebugSendWakeupRequest,
   DebugSendWakeupResponse,
@@ -38,12 +36,6 @@ import {
   notificationApiFailureMessage,
   readNotificationApiBody,
 } from "./notificationApiAuth";
-import {
-  applyNotificationRefreshPayload,
-  handleCapacitorPushNotificationReceived,
-  refreshNotificationsWithDiagnostics,
-  type NotificationRefreshPayload,
-} from "./NativeNotificationService";
 import { truncateFcmTokenForLog } from "./notificationLog";
 import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
 import { NotificationInspector } from "@/plugins/NotificationInspectorPlugin";
@@ -179,19 +171,10 @@ export const NotificationDebugService = {
     return result;
   },
 
-  async triggerBackendRefresh(): Promise<void> {
-    await refreshNotificationsWithDiagnostics({ source: "debug panel" });
-  },
-
-  /** Local simulation: same API call as a WAKEUP_PING handler (no push payload). */
-  async simulateWakeupViaRefresh(): Promise<void> {
-    logNotification("WAKEUP_PING simulation (local refresh API only)");
-    await refreshNotificationsWithDiagnostics({
-      source: "WAKEUP_PING simulation",
-    });
-  },
-
-  /** Full pipeline: backend `/debug/send-wakeup` → FCM → native WAKEUP_PING handler. */
+  /**
+   * Backend `/debug/send-wakeup` → FCM only. App no longer consumes WAKEUP_PING
+   * for api_* scheduling; kept for FCM delivery diagnostics until backend Phase 3.
+   */
   async sendRealWakeupPing(): Promise<SendRealWakeupPingResult> {
     logNotification("Real WAKEUP_PING requested");
 
@@ -264,62 +247,6 @@ export const NotificationDebugService = {
     }
   },
 
-  generateMockNotifications(
-    intervalMs: number = 60_000,
-  ): NotificationRefreshPayload {
-    const now = Date.now();
-    const future1 = now + intervalMs;
-    const future2 = now + intervalMs * 2;
-
-    return {
-      shouldNotify: true,
-      nextNotifications: [{ timestamp: future1 }, { timestamp: future2 }],
-    };
-  },
-
-  async triggerMockRefresh(intervalMs?: number): Promise<void> {
-    logNotification("Mock refresh requested");
-
-    const payload = this.generateMockNotifications(intervalMs);
-    const timestamps = payload.nextNotifications?.map((n) => n.timestamp) ?? [];
-    logNotification(`Mock payload generated (${timestamps.length} timestamps)`);
-
-    if (!Capacitor.isNativePlatform()) {
-      logNotification("Mock refresh skipped: not running on native platform");
-      return;
-    }
-
-    await applyNotificationRefreshPayload(payload);
-    logNotification("Mock refresh applied");
-  },
-
-  async simulateWakeupPing(): Promise<void> {
-    logNotification("Simulating WAKEUP_PING (production push handler)");
-
-    if (!Capacitor.isNativePlatform()) {
-      logNotification("WAKEUP_PING simulation skipped: not native platform");
-      return;
-    }
-
-    const notification = {
-      title: "WAKEUP_PING",
-      body: "",
-      id: "dev_wakeup_ping",
-      data: { type: "WAKEUP_PING" },
-    } as unknown as PushNotificationSchema;
-
-    await handleCapacitorPushNotificationReceived(notification);
-  },
-
-  async runFloodTest(intervalMs?: number): Promise<void> {
-    logNotification("Flood test started (20 sequential refreshes)");
-    for (let i = 0; i < 20; i++) {
-      logNotification(`Flood iteration ${i + 1}/20`);
-      await this.triggerMockRefresh(intervalMs);
-    }
-    logNotification("Flood test completed");
-  },
-
   async clearNotifications(): Promise<void> {
     logNotification("Clear notifications (debug panel)");
 

src/services/notifications/alertAuthorization.test.ts

@@ -1,9 +1,14 @@
 import type { AlertAuthorizationBatch } from "./alertAuthorizationBatch";
 import {
   type AlertAuthorizationDependencies,
+  revokeAlertSearchAuthorization,
   uploadAlertSearchAuthorization,
 } from "./alertAuthorization";
 import { alertSearchNotifyTimeUtcFromLocalNineAm } from "./alertSearchNotifyTime";
+import {
+  authorizeInAppNewActivity,
+  revokeInAppNewActivity,
+} from "./newActivityInAppSubscription";
 
 jest.mock("@/libs/crypto/vc", () => ({
   ETHR_DID_PREFIX: "did:ethr:",
@@ -100,7 +105,7 @@ function createDependencies(overrides?: {
 }
 
 describe("uploadAlertSearchAuthorization", () => {
-  it("uploads the minted batch with authenticated PUT semantics", async () => {
+  it("uploads the minted batch with authenticated POST semantics", async () => {
     const { dependencies, fetchMock, mintMock, authMock } =
       createDependencies();
     const minted = createMintedBatch();
@@ -124,7 +129,7 @@ describe("uploadAlertSearchAuthorization", () => {
     expect(url).toBe(
       "https://notification-backend.invalid/notifications/alert-authorization",
     );
-    expect(init.method).toBe("PUT");
+    expect(init.method).toBe("POST");
     expect(init.headers).toEqual({
       "Content-Type": "application/json",
       Authorization: "Bearer access-token-fixture",
@@ -238,3 +243,141 @@ describe("uploadAlertSearchAuthorization", () => {
     });
   });
 });
+
+function alertAuthorizationUrl(call: unknown[]): string {
+  return String(call[0]);
+}
+
+describe("revokeAlertSearchAuthorization", () => {
+  it("deletes alert authorization with the upload path's authenticated headers", async () => {
+    const { dependencies, fetchMock, mintMock, authMock } =
+      createDependencies();
+
+    const result = await revokeAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({ ok: true, status: 200 });
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(authMock).toHaveBeenCalledWith(undefined, ACTIVE_DID);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(init.method).toBe("DELETE");
+    expect(init.body).toBeUndefined();
+    expect(init.headers).toEqual({
+      "Content-Type": "application/json",
+      Authorization: "Bearer access-token-fixture",
+    });
+  });
+
+  it("does not unregister the FCM device registration", async () => {
+    const { dependencies, fetchMock } = createDependencies();
+
+    await revokeAlertSearchAuthorization(dependencies);
+
+    const urls = fetchMock.mock.calls.map(alertAuthorizationUrl);
+    expect(urls).toEqual([
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    ]);
+    expect(urls.some((url) => url.includes("/notifications/register"))).toBe(
+      false,
+    );
+    expect(fetchMock.mock.calls[0][1].method).not.toBe("POST");
+  });
+
+  it("rejects notification auth bypass before submission", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies({
+      bypassAuth: true,
+    });
+
+    const result = await revokeAlertSearchAuthorization(dependencies);
+
+    expect(result.ok).toBe(false);
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("surfaces a coded refusal without treating it as revoked", async () => {
+    const { dependencies, fetchMock } = createDependencies({
+      response: createResponse(500, {
+        success: false,
+        error: "ALERT_AUTHORIZATION_DELETE_FAILED",
+        message: "Could not delete AlertSearch authorization.",
+        jwt: "must-not-be-returned",
+      }),
+    });
+
+    const result = await revokeAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({
+      ok: false,
+      status: 500,
+      errorCode: "ALERT_AUTHORIZATION_DELETE_FAILED",
+      errorMessage: "Could not delete AlertSearch authorization.",
+    });
+    expect(JSON.stringify(result)).not.toContain("must-not-be-returned");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
+  });
+});
+
+describe("in-app New Activity AlertSearch subscription", () => {
+  it("uploads AlertSearch authorization when the setting is enabled", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies();
+    const reportError = jest.fn();
+
+    const result = await authorizeInAppNewActivity(reportError, dependencies);
+
+    expect(result.ok).toBe(true);
+    expect(mintMock).toHaveBeenCalledWith(ACTIVE_DID);
+    expect(reportError).not.toHaveBeenCalled();
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(init.method).toBe("POST");
+  });
+
+  it("deletes alert authorization when the setting is disabled", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies();
+    const reportError = jest.fn();
+
+    const revoked = await revokeInAppNewActivity(reportError, dependencies);
+
+    expect(revoked).toBe(true);
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(reportError).not.toHaveBeenCalled();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
+    expect(alertAuthorizationUrl(fetchMock.mock.calls[0])).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(
+      fetchMock.mock.calls.some((call) =>
+        alertAuthorizationUrl(call).includes("/notifications/register"),
+      ),
+    ).toBe(false);
+  });
+
+  it("reports a failed delete and does not treat it as revoked", async () => {
+    const { dependencies, fetchMock } = createDependencies({
+      response: createResponse(500, {
+        success: false,
+        message: "Could not delete AlertSearch authorization.",
+      }),
+    });
+    const reportError = jest.fn();
+
+    const revoked = await revokeInAppNewActivity(reportError, dependencies);
+
+    expect(revoked).toBe(false);
+    expect(reportError).toHaveBeenCalledTimes(1);
+    expect(reportError).toHaveBeenCalledWith(
+      "Could not delete AlertSearch authorization.",
+    );
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
+  });
+});

src/services/notifications/alertAuthorization.ts

@@ -1,8 +1,11 @@
 /**
- * Manual upload of a push-channel AlertSearch authorization, for the
- * notification debug panel: mint a delegated JWT batch for the active identity
- * and `PUT /notifications/alert-authorization`, with the send time fixed at
- * 09:00 in the device's zone.
+ * Push-channel AlertSearch authorization against notification-wakeup-service.
+ *
+ * Upload mints a delegated JWT batch for the active identity and
+ * `POST /notifications/alert-authorization`, with the send time fixed at
+ * 09:00 in the device's zone. Revoke sends `DELETE` on that same route and
+ * does not unregister the FCM device. The debug panel uploads manually; the
+ * in-app New Activity toggle uploads on enable and revokes on disable.
  *
  * The SMS channel uploads the same body through `authorizeSmsAlertSearch`, and
  * both mint with `mintAlertAuthorizationBatch`. The wire shapes are in
@@ -42,6 +45,19 @@ export type AlertAuthorizationUploadResult =
       errorCode?: string;
     };
 
+/** `DELETE /notifications/alert-authorization` does not carry a batch. */
+export type AlertAuthorizationRevokeResult =
+  | {
+      ok: true;
+      status: number;
+    }
+  | {
+      ok: false;
+      errorMessage: string;
+      status?: number;
+      errorCode?: string;
+    };
+
 type FetchNotificationApi = (
   input: RequestInfo | URL,
   init?: RequestInit,
@@ -89,6 +105,53 @@ function buildRequestBody(
   };
 }
 
+type DelegatedAlertAccess =
+  | { ok: true; did: string; headers: Record<string, string> }
+  | { ok: false; errorMessage: string };
+
+/**
+ * Same gate as upload: an active `did:ethr`, no auth bypass, and authenticated
+ * notification headers. `action` only changes the bypass sentence.
+ */
+async function requireDelegatedAlertAccess(
+  dependencies: AlertAuthorizationDependencies,
+  action: "uploaded" | "revoked",
+): Promise<DelegatedAlertAccess> {
+  const did = await dependencies.getActiveDid();
+  if (!did) {
+    return { ok: false, errorMessage: "No active identity is available." };
+  }
+  if (!did.startsWith(ETHR_DID_PREFIX)) {
+    return {
+      ok: false,
+      errorMessage:
+        "AlertSearch authorization requires an active did:ethr identity.",
+    };
+  }
+  if (dependencies.isAuthBypassEnabled()) {
+    return {
+      ok: false,
+      errorMessage: `AlertSearch authorization cannot be ${action} while JWT authentication is skipped.`,
+    };
+  }
+
+  const auth = await dependencies.getAuthHeaders(undefined, did);
+  if (!auth.ok) {
+    return {
+      ok: false,
+      errorMessage: `Authentication unavailable: ${auth.message}`,
+    };
+  }
+  if (!auth.authenticated) {
+    return {
+      ok: false,
+      errorMessage:
+        "AlertSearch authorization requires authenticated notification API headers.",
+    };
+  }
+  return { ok: true, did, headers: auth.headers };
+}
+
 /**
  * The code and message of a refusal, and nothing else from its body. The
  * service sends an `AlertAuthorizationFailure`: the code, when there is one,
@@ -118,73 +181,53 @@ async function readRefusal(
   };
 }
 
+async function authorizationHttpFailure(response: Response): Promise<{
+  ok: false;
+  status: number;
+  errorMessage: string;
+  errorCode?: string;
+}> {
+  const refusal = await readRefusal(response);
+  const fallback =
+    response.status === 401 || response.status === 403
+      ? httpAuthErrorMessage(response.status)
+      : `HTTP ${response.status}`;
+  return {
+    ok: false,
+    status: response.status,
+    errorMessage: refusal.message || fallback,
+    ...(refusal.errorCode ? { errorCode: refusal.errorCode } : {}),
+  };
+}
+
 /**
- * Mint and manually upload a delegated AlertSearch authorization batch.
+ * Mint and upload a delegated AlertSearch authorization batch.
  * This function never retries and refuses notification auth bypass mode.
  */
 export async function uploadAlertSearchAuthorization(
   dependencies: AlertAuthorizationDependencies = defaultDependencies,
 ): Promise<AlertAuthorizationUploadResult> {
   try {
-    const did = await dependencies.getActiveDid();
-    if (!did) {
-      return { ok: false, errorMessage: "No active identity is available." };
-    }
-    if (!did.startsWith(ETHR_DID_PREFIX)) {
-      return {
-        ok: false,
-        errorMessage:
-          "AlertSearch authorization requires an active did:ethr identity.",
-      };
-    }
-    if (dependencies.isAuthBypassEnabled()) {
-      return {
-        ok: false,
-        errorMessage:
-          "AlertSearch authorization cannot be uploaded while JWT authentication is skipped.",
-      };
+    const access = await requireDelegatedAlertAccess(dependencies, "uploaded");
+    if (!access.ok) {
+      return access;
     }
 
-    const batch = await dependencies.mintBatch(did);
+    const batch = await dependencies.mintBatch(access.did);
     const timeZone = dependencies.getTimeZone();
     const body = buildRequestBody(batch, timeZone);
 
-    const auth = await dependencies.getAuthHeaders(undefined, did);
-    if (!auth.ok) {
-      return {
-        ok: false,
-        errorMessage: `Authentication unavailable: ${auth.message}`,
-      };
-    }
-    if (!auth.authenticated) {
-      return {
-        ok: false,
-        errorMessage:
-          "AlertSearch authorization requires authenticated notification API headers.",
-      };
-    }
-
     const response = await dependencies.fetch(
       `${dependencies.getBaseUrl()}/notifications/alert-authorization`,
       {
-        method: "PUT",
-        headers: auth.headers,
+        method: "POST",
+        headers: access.headers,
         body: JSON.stringify(body),
       },
     );
 
     if (!response.ok) {
-      const refusal = await readRefusal(response);
-      const fallback =
-        response.status === 401 || response.status === 403
-          ? httpAuthErrorMessage(response.status)
-          : `HTTP ${response.status}`;
-      return {
-        ok: false,
-        status: response.status,
-        errorMessage: refusal.message || fallback,
-        ...(refusal.errorCode ? { errorCode: refusal.errorCode } : {}),
-      };
+      return authorizationHttpFailure(response);
     }
 
     return {
@@ -203,3 +246,38 @@ export async function uploadAlertSearchAuthorization(
     };
   }
 }
+
+/**
+ * Delete the active identity's push AlertSearch authorization batches.
+ * Uses the same URL, auth headers, and refusal handling as upload.
+ * Does not unregister the FCM device. Never retries.
+ */
+export async function revokeAlertSearchAuthorization(
+  dependencies: AlertAuthorizationDependencies = defaultDependencies,
+): Promise<AlertAuthorizationRevokeResult> {
+  try {
+    const access = await requireDelegatedAlertAccess(dependencies, "revoked");
+    if (!access.ok) {
+      return access;
+    }
+
+    const response = await dependencies.fetch(
+      `${dependencies.getBaseUrl()}/notifications/alert-authorization`,
+      {
+        method: "DELETE",
+        headers: access.headers,
+      },
+    );
+
+    if (!response.ok) {
+      return authorizationHttpFailure(response);
+    }
+
+    return { ok: true, status: response.status };
+  } catch (error: unknown) {
+    return {
+      ok: false,
+      errorMessage: error instanceof Error ? error.message : "Revoke failed.",
+    };
+  }
+}

src/services/notifications/alertAuthorizationBatch.ts

@@ -8,7 +8,7 @@
  * and stops when the inventory runs out.
  *
  * Both delivery channels take the same batch: push through
- * `PUT /notifications/alert-authorization` (see `alertAuthorization.ts`)
+ * `POST /notifications/alert-authorization` (see `alertAuthorization.ts`)
  * and SMS through `POST /notify-sms/alert-authorization` (see
  * `smsNotificationApi.ts`). The service validates both with one rule and keeps
  * a separate inventory per channel, so this module is the only minter for

src/services/notifications/firebaseMessagingClient.ts

@@ -69,9 +69,10 @@ async function registerRetrievedToken(
 }
 
 /**
- * Whether PushNotifications.register() is safe to call. Android builds without
- * -PfirebaseEnabled (FOSS/F-Droid/APK) have no Firebase config, and register()
- * there throws natively, crashing the app before any JS catch can run.
+ * Whether PushNotifications.register() is safe to call. Android builds with
+ * Firebase disabled (-PfirebaseEnabled=false, FOSS/F-Droid) have no Firebase
+ * config, and register() there throws natively, crashing the app before any
+ * JS catch can run.
  */
 async function canRegisterNativePush(): Promise<boolean> {
   if (Capacitor.getPlatform() !== "android") {
@@ -101,7 +102,7 @@ export async function reregisterFcmTokenNow(): Promise<string> {
 
   if (!(await canRegisterNativePush())) {
     throw new Error(
-      "Push is unavailable: this Android build has no Firebase config (built without -PfirebaseEnabled)",
+      "Push is unavailable: this Android build has no Firebase config (built with -PfirebaseEnabled=false)",
     );
   }
 

src/services/notifications/index.ts

@@ -38,10 +38,21 @@ export {
 export { NotificationService, registerToken } from "./NotificationService";
 export { NativeNotificationService } from "./NativeNotificationService";
 export { WebPushNotificationService } from "./WebPushNotificationService";
-export { uploadAlertSearchAuthorization } from "./alertAuthorization";
-export type { AlertAuthorizationUploadResult } from "./alertAuthorization";
+export {
+  revokeAlertSearchAuthorization,
+  uploadAlertSearchAuthorization,
+} from "./alertAuthorization";
+export type {
+  AlertAuthorizationRevokeResult,
+  AlertAuthorizationUploadResult,
+} from "./alertAuthorization";
+export {
+  authorizeInAppNewActivity,
+  revokeInAppNewActivity,
+} from "./newActivityInAppSubscription";
 
 export { configureNativeFetcherIfReady } from "./nativeFetcherConfig";
+export { runLegacyApiNotificationsCleanupOnce } from "./legacyApiNotificationsCleanup";
 export {
   deferFcmRegistration,
   flushDeferredFcmRegistration,

src/services/notifications/legacyApiNotificationsCleanup.test.ts

@@ -0,0 +1,101 @@
+import { Capacitor } from "@capacitor/core";
+import { Preferences } from "@capacitor/preferences";
+import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
+import {
+  LEGACY_API_NOTIFICATIONS_CLEANUP_KEY,
+  runLegacyApiNotificationsCleanupOnce,
+} from "./legacyApiNotificationsCleanup";
+
+jest.mock("@capacitor/core", () => ({
+  Capacitor: {
+    isNativePlatform: jest.fn(),
+  },
+}));
+
+jest.mock("@capacitor/preferences", () => ({
+  Preferences: {
+    get: jest.fn(),
+    set: jest.fn(),
+  },
+}));
+
+jest.mock("@/plugins/DailyNotificationPlugin", () => ({
+  DailyNotification: {
+    clearApiNotifications: jest.fn(),
+  },
+}));
+
+jest.mock("@/utils/logger", () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+    log: jest.fn(),
+  },
+}));
+
+const isNativePlatform = Capacitor.isNativePlatform as jest.Mock;
+const preferencesGet = Preferences.get as jest.Mock;
+const preferencesSet = Preferences.set as jest.Mock;
+const clearApiNotifications =
+  DailyNotification.clearApiNotifications as jest.Mock;
+
+describe("runLegacyApiNotificationsCleanupOnce", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    isNativePlatform.mockReturnValue(true);
+    preferencesGet.mockResolvedValue({ value: null });
+    preferencesSet.mockResolvedValue(undefined);
+    clearApiNotifications.mockResolvedValue(undefined);
+  });
+
+  it("no-ops on non-native platforms", async () => {
+    isNativePlatform.mockReturnValue(false);
+
+    await runLegacyApiNotificationsCleanupOnce();
+
+    expect(preferencesGet).not.toHaveBeenCalled();
+    expect(clearApiNotifications).not.toHaveBeenCalled();
+    expect(preferencesSet).not.toHaveBeenCalled();
+  });
+
+  it("skips cleanup when the migration marker is already set", async () => {
+    preferencesGet.mockResolvedValue({ value: "1" });
+
+    await runLegacyApiNotificationsCleanupOnce();
+
+    expect(clearApiNotifications).not.toHaveBeenCalled();
+    expect(preferencesSet).not.toHaveBeenCalled();
+  });
+
+  it("clears api_* state and writes the marker only after success", async () => {
+    await runLegacyApiNotificationsCleanupOnce();
+
+    expect(clearApiNotifications).toHaveBeenCalledTimes(1);
+    expect(preferencesSet).toHaveBeenCalledWith({
+      key: LEGACY_API_NOTIFICATIONS_CLEANUP_KEY,
+      value: "1",
+    });
+  });
+
+  it("does not write the marker when clearApiNotifications fails", async () => {
+    clearApiNotifications.mockRejectedValue(new Error("native failure"));
+
+    await runLegacyApiNotificationsCleanupOnce();
+
+    expect(clearApiNotifications).toHaveBeenCalledTimes(1);
+    expect(preferencesSet).not.toHaveBeenCalled();
+  });
+
+  it("does not write the marker when clearApiNotifications is missing", async () => {
+    const original = DailyNotification.clearApiNotifications;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    delete (DailyNotification as any).clearApiNotifications;
+
+    await runLegacyApiNotificationsCleanupOnce();
+
+    expect(preferencesSet).not.toHaveBeenCalled();
+    DailyNotification.clearApiNotifications = original;
+  });
+});

src/services/notifications/legacyApiNotificationsCleanup.ts

@@ -0,0 +1,85 @@
+/**
+ * One-time upgrade cleanup for legacy API-managed notification schedules
+ * (`api_*`) left behind by the retired WAKEUP_PING → /notifications/refresh path.
+ *
+ * Uses DailyNotification.clearApiNotifications(), which cancels only `api_*`
+ * pending/delivered state (and Android persisted api_* schedule rows). It does
+ * not touch daily reminders, dual/New Activity schedules, AlertSearch, or FCM.
+ */
+
+import { Capacitor } from "@capacitor/core";
+import { Preferences } from "@capacitor/preferences";
+import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
+import { logger } from "@/utils/logger";
+
+/** Preferences key; written only after a successful native cleanup. */
+export const LEGACY_API_NOTIFICATIONS_CLEANUP_KEY =
+  "legacy_api_notifications_cleanup_v1";
+
+const DONE_VALUE = "1";
+
+let inFlight: Promise<void> | null = null;
+
+/**
+ * Idempotent startup hook. Safe when zero `api_*` schedules exist.
+ * On failure, leaves the marker unset so a later launch can retry.
+ */
+export async function runLegacyApiNotificationsCleanupOnce(): Promise<void> {
+  if (inFlight) {
+    return inFlight;
+  }
+  inFlight = runCleanup().finally(() => {
+    inFlight = null;
+  });
+  return inFlight;
+}
+
+async function runCleanup(): Promise<void> {
+  if (!Capacitor.isNativePlatform()) {
+    return;
+  }
+
+  try {
+    const existing = await Preferences.get({
+      key: LEGACY_API_NOTIFICATIONS_CLEANUP_KEY,
+    });
+    if (existing.value === DONE_VALUE) {
+      return;
+    }
+  } catch (error) {
+    logger.warn(
+      "[legacyApiNotificationsCleanup] Could not read migration marker; skipping this launch",
+      error,
+    );
+    return;
+  }
+
+  const clearApiNotifications = (
+    DailyNotification as {
+      clearApiNotifications?: () => Promise<void>;
+    }
+  ).clearApiNotifications;
+
+  if (typeof clearApiNotifications !== "function") {
+    logger.warn(
+      "[legacyApiNotificationsCleanup] clearApiNotifications unavailable; will retry on a later launch",
+    );
+    return;
+  }
+
+  try {
+    await clearApiNotifications.call(DailyNotification);
+    await Preferences.set({
+      key: LEGACY_API_NOTIFICATIONS_CLEANUP_KEY,
+      value: DONE_VALUE,
+    });
+    logger.info(
+      "[legacyApiNotificationsCleanup] Cleared legacy api_* notification state",
+    );
+  } catch (error) {
+    logger.warn(
+      "[legacyApiNotificationsCleanup] Cleanup failed; will retry on next startup",
+      error,
+    );
+  }
+}

src/services/notifications/newActivityInAppSubscription.ts

@@ -0,0 +1,51 @@
+/**
+ * Server AlertSearch subscription for the in-app New Activity toggle.
+ *
+ * Enable uploads through `uploadAlertSearchAuthorization`. Disable revokes
+ * through `revokeAlertSearchAuthorization`. Neither call registers or deletes
+ * the FCM device. Local permission, settings, and the dual schedule stay in
+ * AccountViewView; a failed revoke returns false so that view can leave them
+ * unchanged instead of showing the subscription as off.
+ */
+
+import {
+  type AlertAuthorizationDependencies,
+  type AlertAuthorizationRevokeResult,
+  type AlertAuthorizationUploadResult,
+  revokeAlertSearchAuthorization,
+  uploadAlertSearchAuthorization,
+} from "./alertAuthorization";
+
+/**
+ * Upload the AlertSearch batch after the in-app setting has been enabled.
+ * A failure is reported and returned; it does not throw.
+ */
+export async function authorizeInAppNewActivity(
+  reportError: (message: string) => void,
+  dependencies?: AlertAuthorizationDependencies,
+): Promise<AlertAuthorizationUploadResult> {
+  const result = await uploadAlertSearchAuthorization(dependencies);
+  if (!result.ok) {
+    reportError(result.errorMessage);
+  }
+  return result;
+}
+
+/**
+ * Revoke the push AlertSearch authorization for the in-app toggle.
+ *
+ * @returns false when the delete did not succeed. Callers must not persist
+ *   the off setting or announce that notifications are off in that case.
+ */
+export async function revokeInAppNewActivity(
+  reportError: (message: string) => void,
+  dependencies?: AlertAuthorizationDependencies,
+): Promise<boolean> {
+  const result: AlertAuthorizationRevokeResult =
+    await revokeAlertSearchAuthorization(dependencies);
+  if (!result.ok) {
+    reportError(result.errorMessage);
+    return false;
+  }
+  return true;
+}

src/services/notifications/notificationApiAuth.ts

@@ -11,7 +11,7 @@ import { getNotificationDebugOverrideHeaders } from "./NotificationDebugConfig";
 import { shouldBypassNotificationAuth } from "./notificationApiDebugMode";
 import { logNotification } from "./NotificationDebugEvents";
 
-export type NotificationRequestKind = "register" | "refresh";
+export type NotificationRequestKind = "register";
 
 export type NotificationApiHeadersResult =
   | {
@@ -133,32 +133,17 @@ export async function getNotificationApiHeaders(
   };
 }
 
-export function logNotificationRequestAuthenticated(
-  kind: NotificationRequestKind,
-): void {
-  logNotification(
-    kind === "register"
-      ? "Register request authenticated"
-      : "Refresh request authenticated",
-  );
-}
-
 export function logNotificationAuthFailure(
-  kind: NotificationRequestKind,
+  _kind: NotificationRequestKind,
   message: string,
 ): void {
-  const verb = kind === "register" ? "Register" : "Refresh";
-  logNotification(`${verb} auth unavailable: ${message}`);
+  logNotification(`Register auth unavailable: ${message}`);
 }
 
 export function logWaitingForAuthBeforeRegistration(): void {
   logNotification("Waiting for auth before registration");
 }
 
-export function logSkippingRefreshDueToMissingAuth(): void {
-  logNotification("Skipping refresh due to missing auth");
-}
-
 export function httpAuthErrorMessage(status: number): string {
   if (status === 401) {
     return "unauthorized (expired or invalid auth)";

src/services/notifications/notificationAuthLifecycle.ts

@@ -1,5 +1,5 @@
 /**
- * Defers notification register/refresh until app auth (active DID + Bearer) is available.
+ * Defers FCM token registration until app auth (active DID + Bearer) is available.
  * Bounded retries avoid racing startup and prevent infinite loops.
  */
 

src/services/notifications/notificationLog.ts

@@ -24,9 +24,6 @@ export function logPushNotificationReceived(notification: {
     title: notification.title,
     dataType: type,
   });
-  if (type === "WAKEUP_PING") {
-    logNotification("WAKEUP_PING received — will trigger refresh");
-  }
 }
 
 export function logPushNotificationActionPerformed(action: {
@@ -74,44 +71,6 @@ export function logTokenRegistrationFailure(
   });
 }
 
-export function logRefreshStarted(source?: string): void {
-  logNotification(source ? `Refresh started (${source})` : "Refresh started");
-}
-
-function elapsedMsSince(startedAt: number): number {
-  return performance.now() - startedAt;
-}
-
-export function logRefreshSuccess(
-  startedAt: number,
-  scheduledCount: number,
-  source?: string,
-): void {
-  const elapsedMs = Math.round(elapsedMsSince(startedAt));
-  const message = source
-    ? `Refresh completed (${source}) in ${elapsedMs}ms (scheduled ${scheduledCount})`
-    : `Refresh completed in ${elapsedMs}ms (scheduled ${scheduledCount})`;
-  logNotification(message);
-}
-
-export function logRefreshFailure(
-  startedAt: number,
-  errorMessage: string,
-  status?: number,
-  source?: string,
-): void {
-  const statusPart = status != null ? ` HTTP ${status}` : "";
-  const elapsedMs = Math.round(elapsedMsSince(startedAt));
-  const message = source
-    ? `Refresh failed (${source}) in ${elapsedMs}ms: ${errorMessage}${statusPart}`
-    : `Refresh failed in ${elapsedMs}ms: ${errorMessage}${statusPart}`;
-  logNotification(message);
-}
-
 export function logNotificationClearing(method: string): void {
   logNotification(`Clearing notifications via ${method}`);
 }
-
-export function logScheduleReplacement(count: number): void {
-  logNotification(`Schedule replacement: ${count} notification(s)`);
-}

src/services/platforms/CapacitorPlatformService.ts

@@ -21,9 +21,17 @@ import {
   PlatformService,
   PlatformCapabilities,
 } from "../PlatformService";
-import { logger } from "../../utils/logger";
+import { logger, safeStringify } from "../../utils/logger";
 import { BaseDatabaseService } from "./BaseDatabaseService";
 
+/** Readable one-line description of anything thrown, including plugin rejections. */
+function describeError(error: unknown): string {
+  if (error instanceof Error) {
+    return String(error);
+  }
+  return typeof error === "string" ? error : safeStringify(error);
+}
+
 interface QueuedOperation {
   type: "run" | "query" | "rawQuery";
   sql: string;
@@ -54,6 +62,8 @@ export class CapacitorPlatformService
   private initializationPromise: Promise<void> | null = null;
   private operationQueue: Array<QueuedOperation> = [];
   private isProcessingQueue: boolean = false;
+  /** Set by resetDatabase so a stray query cannot recreate the file mid-reset. */
+  private resetInProgress = false;
 
   constructor() {
     super();
@@ -71,6 +81,12 @@ export class CapacitorPlatformService
       return this.initializationPromise;
     }
 
+    if (this.resetInProgress) {
+      throw new Error(
+        "[CapacitorPlatformService] The database is being reset; restart the app.",
+      );
+    }
+
     try {
       // Start initialization
       this.initializationPromise = this._initialize();
@@ -90,6 +106,8 @@ export class CapacitorPlatformService
       return;
     }
 
+    // Which step failed is the first thing support needs to know.
+    let step = "create connection";
     try {
       // Try to create/Open database connection
       try {
@@ -164,6 +182,7 @@ export class CapacitorPlatformService
       }
 
       // Open the connection if it's not already open
+      step = "open database";
       try {
         await this.db.open();
       } catch (openError: unknown) {
@@ -182,6 +201,7 @@ export class CapacitorPlatformService
       // await this.db.execute("PRAGMA journal_mode=WAL;");
 
       // Run migrations
+      step = "run migrations";
       await this.runCapacitorMigrations();
 
       this.initialized = true;
@@ -196,8 +216,9 @@ export class CapacitorPlatformService
         "[CapacitorPlatformService] Error initializing SQLite database:",
         error,
       );
+      // Keep the underlying cause in the message: it is all a user can send us.
       throw new Error(
-        "[CapacitorPlatformService] Failed to initialize database",
+        `[CapacitorPlatformService] Failed to initialize database (step: ${step}): ${describeError(error)}`,
       );
     }
   }
@@ -420,6 +441,119 @@ export class CapacitorPlatformService
     }
   }
 
+  /** File name the SQLite plugin stores this.dbName under (it appends "SQLite.db"). */
+  private get databaseFileName(): string {
+    return `${this.dbName}SQLite.db`;
+  }
+
+  /** URI of the directory where the SQLite plugin keeps its database files. */
+  private async databaseDirectoryUri(): Promise<string> {
+    const platform = Capacitor.getPlatform();
+    if (platform === "android") {
+      // The plugin uses Context.getDatabasePath(), the "databases" sibling of
+      // getFilesDir() (which is Directory.Data).
+      const { uri } = await Filesystem.getUri({
+        path: "",
+        directory: Directory.Data,
+      });
+      if (!/\/files\/?$/.test(uri)) {
+        throw new Error(`Unexpected app data directory: ${uri}`);
+      }
+      return uri.replace(/\/files\/?$/, "/databases");
+    }
+    if (platform === "ios") {
+      // Matches iosDatabaseLocation "Documents" in capacitor.config
+      const { uri } = await Filesystem.getUri({
+        path: "",
+        directory: Directory.Documents,
+      });
+      return uri.replace(/\/$/, "");
+    }
+    throw new Error(`Database file access is not supported on ${platform}.`);
+  }
+
+  private async databaseFileExists(fileUri: string): Promise<boolean> {
+    try {
+      await Filesystem.stat({ path: fileUri });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  async shareDatabaseFile(): Promise<void> {
+    const source = `${await this.databaseDirectoryUri()}/${this.databaseFileName}`;
+    if (!(await this.databaseFileExists(source))) {
+      throw new Error("There is no database file on this device.");
+    }
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const { uri } = await Filesystem.copy({
+      from: source,
+      to: `timesafari-database-${stamp}.sqlite`,
+      toDirectory: Directory.Cache,
+    });
+    await Share.share({
+      title: "Time Safari database",
+      url: uri,
+      dialogTitle: "Save or send your database file",
+    });
+  }
+
+  async resetDatabase(): Promise<string | undefined> {
+    this.resetInProgress = true;
+    try {
+      try {
+        await this.sqlite.closeConnection(this.dbName, false);
+      } catch (closeError) {
+        // Expected when the connection was never created
+        logger.debug(
+          "[CapacitorPlatformService] Close before reset failed (may be expected):",
+          closeError,
+        );
+      }
+      this.db = null;
+      this.initialized = false;
+      this.initializationPromise = null;
+
+      const source = `${await this.databaseDirectoryUri()}/${this.databaseFileName}`;
+      let backupUri: string | undefined;
+      if (await this.databaseFileExists(source)) {
+        // Never delete without a copy: this file may hold the only copy of the user's keys.
+        const backupDir = "database-backups";
+        try {
+          await Filesystem.mkdir({
+            path: backupDir,
+            directory: Directory.Data,
+            recursive: true,
+          });
+        } catch {
+          // Already exists
+        }
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        const { uri } = await Filesystem.copy({
+          from: source,
+          to: `${backupDir}/${this.databaseFileName}-${stamp}`,
+          toDirectory: Directory.Data,
+        });
+        backupUri = uri;
+        await Filesystem.deleteFile({ path: source });
+      }
+      for (const suffix of ["-journal", "-wal", "-shm"]) {
+        if (await this.databaseFileExists(source + suffix)) {
+          await Filesystem.deleteFile({ path: source + suffix });
+        }
+      }
+      logger.warn(
+        `[CapacitorPlatformService] Database reset; backup at ${backupUri ?? "(no file existed)"}`,
+      );
+      // resetInProgress stays set: the caller reloads the app.
+      return backupUri;
+    } catch (error) {
+      this.resetInProgress = false;
+      throw new Error(`Could not reset the database: ${describeError(error)}`);
+    }
+  }
+
   /**
    * Detect if an object is a Proxy object that cannot be serialized
    * Proxy objects cause "An object could not be cloned" errors in Capacitor
@@ -1412,9 +1546,6 @@ export class CapacitorPlatformService
     return false;
   }
 
-  // --- PWA/Web-only methods (no-op for Capacitor) ---
-  public registerServiceWorker(): void {}
-
   // Database utility methods - inherited from BaseDatabaseService
   // generateInsertStatement, updateDefaultSettings, updateActiveDid,
   // getActiveIdentity, insertNewDidIntoSettings, updateDidSpecificSettings,

src/services/platforms/ElectronPlatformService.ts

@@ -163,7 +163,4 @@ export class ElectronPlatformService extends CapacitorPlatformService {
   isWeb(): boolean {
     return false;
   }
-
-  // --- PWA/Web-only methods (no-op for Electron) ---
-  public registerServiceWorker(): void {}
 }

src/services/platforms/WebPlatformService.ts

@@ -3,7 +3,7 @@ import {
   PlatformService,
   PlatformCapabilities,
 } from "../PlatformService";
-import { logger } from "../../utils/logger";
+import { logger, safeStringify } from "../../utils/logger";
 import { QueryExecResult } from "@/interfaces/database";
 import { BaseDatabaseService } from "./BaseDatabaseService";
 // Dynamic import of initBackend to prevent worker context errors
@@ -123,7 +123,9 @@ export class WebPlatformService
       logger.error("[WebPlatformService] Failed to initialize worker:", error);
       this.workerReady = false;
       this.workerInitPromise = null;
-      throw new Error("Failed to initialize database worker");
+      throw new Error(
+        `Failed to initialize database worker: ${error instanceof Error ? String(error) : safeStringify(error)}`,
+      );
     }
   }