clear out each new-activity bucket when user visits the details page

Reviewed-on: #237

.cursor/rules/app/timesafari_development.mdc

@@ -11,7 +11,7 @@
 
 # Web (development)
 
-npm run build:web
+npm run dev
 
 # Mobile
 

.cursor/rules/app/timesafari_platforms.mdc

@@ -13,7 +13,7 @@
 
 - **File System**: Limited browser APIs
 
-- **Build**: `npm run build:web` (development build)
+- **Build**: `npm run dev` (development server), `npm run build:web` (production build into `dist/`)
 
 ### Mobile (Capacitor)
 
@@ -59,7 +59,7 @@
 
 # Web (development)
 
-npm run build:web
+npm run dev
 
 # Mobile
 

.cursor/rules/architecture/build_architecture_guard.mdc

@@ -63,7 +63,7 @@ follow proper review, testing, and documentation procedures.
 
 - **CI/CD Pipeline**: GitHub Actions, build validation scripts
 
-- **Service Worker Assembly**: `sw_scripts/`, `sw_combine.js`, WASM copy steps
+- **WASM Assembly**: WASM copy steps
 
 ## Change Authorization Requirements
 

.cursor/rules/architecture/build_testing.mdc

@@ -39,7 +39,7 @@
 
 ### Rollback Verification
 
-- **Web**: `npm run build:web:dev` and `npm run build:web:prod`
+- **Web**: `npm run dev` and `npm run build:web:prod`
 
 - **Mobile**: `npm run build:android:test` and `npm run build:ios:test`
 

.cursor/rules/architecture/build_validation.mdc

@@ -19,7 +19,7 @@
 
 ### After Build System Change
 
-- [ ] **Web Platform**: Does `npm run build:web:dev` work?
+- [ ] **Web Platform**: Does `npm run dev` work?
 
 - [ ] **Mobile Platforms**: Do iOS/Android builds succeed?
 
@@ -33,9 +33,9 @@
 
 ### Web Platform
 
-- **Development**: `npm run build:web:dev` - serve and load app
+- **Development**: `npm run dev` - serve and load app
 
-- **Production**: `npm run build:web:prod` - verify SW and WASM present
+- **Production**: `npm run build:web:prod` - verify WASM present
 
 ### Mobile Platforms
 
@@ -98,13 +98,11 @@
   verify single-instance,
   icons, signing
 
-### Service Worker / WASM
+### WASM
 
-- **Trigger**: `sw_combine.js`, WASM copy path
+- **Trigger**: WASM copy path
 
-- **Validation**: Verify combined SW exists and is injected; page loads offline;
-
-  WASM present
+- **Validation**: WASM present
 
 ### Docker
 

.env.test

@@ -5,7 +5,7 @@ VITE_LOG_LEVEL=info
 
 # iOS doesn't like spaces in the app title.
 TIME_SAFARI_APP_TITLE="TimeSafari_Test"
-VITE_APP_SERVER=https://test.timesafari.app
+VITE_APP_SERVER=https://test.`
 # This is the claim ID for actions in the BVC project, with the JWT ID on this environment (not
 # This is the claim ID for actions in the BVC project, with the JWT ID on this environment (not production).
 

.gitignore

@@ -5,8 +5,6 @@ dist-electon-build
 node_modules
 dist
 signature.bin
-# generated during `npm run build`
-sw_scripts-combined.js
 *.pem
 verified.txt
 myenv

AGENTS.md

@@ -2,16 +2,18 @@
 
 ## Android Build — Google Play Services / FOSS Compatibility
 
-**Firebase is opt-in. Do NOT enable it accidentally.**
+**Firebase is on by default for Android and iOS builds.** Do not turn it off unless the build is an exceptional FOSS/F-Droid artifact.
 
-`android/google-services.json` is gitignored and may be present on disk for push notification development, but Firebase is only activated when you explicitly pass `-PfirebaseEnabled` to Gradle:
+`android/app/google-services.json` is required when Firebase is enabled. It does not decide the switch: a missing file fails the build, and a file on disk is ignored when Firebase is explicitly disabled.
 
-- **FOSS / APK / Aurora / Zapstore / F-Droid builds**: just `./gradlew assembleRelease` — Firebase stays off even if `google-services.json` is on disk.
-- **Firebase / FCM / Play Store builds**: `./gradlew bundleRelease -PfirebaseEnabled` — explicitly opt in.
+- **Default (local, test, production, Play Store)**: `./gradlew assembleRelease` or `./gradlew bundleRelease` — do not pass `-PfirebaseEnabled`.
+- **Opt out (F-Droid / FOSS)**: `./gradlew assembleRelease -PfirebaseEnabled=false`, or an npm `:nostore` script such as `npm run build:android:test:nostore:run`. Those set `FIREBASE_ENABLED=false`, which forwards `-PfirebaseEnabled=false`. `:nostore` disables Firebase only; it does not remove every Play Services dependency.
 
-This guard is in `android/app/build.gradle`. Do NOT change this conditional to activate Firebase unconditionally based on file presence alone — that was the bug that broke FOSS distribution in June 2026.
+iOS builds bundle `ios/App/App/GoogleService-Info.plist` by default (`ios/App/scripts/bundle-firebase-config.sh`, run from `scripts/build-ios.sh` and as an Xcode build phase). Opt out with `FIREBASE_ENABLED=false` (the build script forwards that to both the build and archive `xcodebuild` invocations), `npm run build:ios:prod:nostore`, or the Xcode build setting `FIREBASE_ENABLED=NO`. A missing plist fails an enabled build; the file's presence does not enable Firebase on its own.
 
-`google-services.json` is intentionally excluded from git (`android/.gitignore`). Never commit it.
+The guard is in `android/app/build.gradle`. Do NOT activate Firebase from file presence alone — that was the bug that broke FOSS distribution in June 2026.
+
+Never commit `google-services.json`.
 
 Full details, incident history, and F-Droid notes: `doc/android-firebase-gms.md`
 

BUILDING.md

@@ -9,9 +9,9 @@ This guide explains how to build TimeSafari for different platforms using the co
 ```bash
 # 🖥️ Web Development
 npm install                          # setup -- and pkgx.dev `dev` command before this will set environment with npm, etc
-npm run build:web:serve -- --test    # Start with test endorser server
-npm run build:web:dev                # Start development server with hot reload with local endorser server
-npm run build:web:prod               # Production build
+npm run dev                          # Start development server with hot reload with local endorser server
+npm run build:web:serve:test         # Test build served from dist/ (test endorser server)
+npm run build:web                    # Production build into dist/
 
 # 📱 Mobile Development
 npm run build:ios              # iOS build (opens Xcode)
@@ -44,7 +44,7 @@ npm run test:web               # Run web tests to verify setup
 
 ```bash
 # Start web development server
-npm run build:web:dev          # Opens http://localhost:8080
+npm run dev                    # Opens http://localhost:8080
 
 # For mobile development
 npm run build:ios              # Opens Xcode with iOS project
@@ -219,36 +219,41 @@ Install dependencies:
 npm install
 ```
 
-## Web Development
+## Web Development & Deployment
 
 ### Web Development Commands
 
 ```bash
 # Local development
-npm run build:web:dev               # Start development server with hot reload
+npm run dev                         # Start development server with hot reload (writes nothing to dist/)
 
-# Web builds
-npm run build:web                   # Development build (starts dev server with hot reload)
+# Web builds (each one writes dist/)
+npm run build:web                   # Production build (same as build:web:prod)
 npm run build:web:test              # Test environment build (optimized for testing)
 npm run build:web:prod              # Production build (optimized for production)
-npm run build:web:serve             # Build and serve locally for production testing
+
+# Build, then serve dist/ locally
+npm run build:web:serve             # Production build, then serve
+npm run build:web:serve:test        # Test build, then serve
 
 # Docker builds
-npm run build:web:docker            # Development build with Docker containerization
+npm run build:web:docker            # Production build with Docker containerization
 npm run build:web:docker:test       # Test build with Docker containerization
 npm run build:web:docker:prod       # Production build with Docker containerization
 ```
 
 ### Local Development
 
-Start the development server using `npm run build:web:dev` or `npm run build:web` (both start the development server with hot reload).
+Start the development server with hot reload using `npm run dev`. Open it at `http://localhost:8080/`, not at a wildcard address such as `http://[::]:8080/` or `http://0.0.0.0:8080/`: browsers only allow the cryptography the app needs on HTTPS, `localhost`, `127.0.0.1`, or `[::1]`, so any other plain-HTTP address shows a "Cannot Start Here" page.
 
 ### Web Build for Server
 
-1. Run the production build using `npm run build:web:prod`
+1. Run the production build using `npm run build:web` (or `npm run build:web:test` for the test server)
 2. The built files will be in the `dist` directory
 3. To test the production build locally, use `npm run build:web:serve` (builds then serves)
 
+`dist/` is shared with the Android, iOS, Electron, and Capacitor builds, which overwrite it with non-web output. Run the web build immediately before deploying, and confirm that the browser console reports `Loading TimeSafari for platform: web`.
+
 **Why Use `serve`?**
 - **Production Testing**: Test your optimized production build locally before deployment
 - **SPA Routing Validation**: Verify deep linking and navigation work correctly (handles routes like `/discover`, `/account`)
@@ -1069,6 +1074,9 @@ npm run build:ios:prod              # Production build (builds for production en
 npm run build:ios:test:run          # Test build with auto-run (builds then runs on simulator)
 npm run build:ios:prod:run          # Production build with auto-run (builds then runs on simulator)
 
+# Firebase off (`:nostore` sets FIREBASE_ENABLED=false, forwarded to xcodebuild as FIREBASE_ENABLED=NO)
+npm run build:ios:prod:nostore      # Same as prod, without Firebase
+
 # Debug and release builds
 npm run build:ios:debug             # Debug build (builds debug app bundle)
 npm run build:ios:debug:run         # Debug build with auto-run (builds then runs on simulator)
@@ -1122,15 +1130,15 @@ The script handles all the necessary steps including:
 
 If you need to build manually or want to understand the individual steps:
 
-#### First-time iOS Configuration
+##### First-time iOS Configuration
 
 - Generate certificates inside XCode.
 - Right-click on App and under Signing & Capabilities set the Team.
 - In the App Developer setup (eg. https://developer.apple.com/account), under Identifiers and/or "Certificates, Identifiers & Profiles"
 
-#### Each Release
+##### Each Release
 
-##### 0. First time (or if dependencies change)
+###### 0. First time (or if dependencies change)
 
 - `pkgx +rubygems.org +pod /bin/zsh`
 
@@ -1143,15 +1151,15 @@ export GEM_HOME=$shortened_path
 export GEM_PATH=$shortened_path
 ```
 
-##### 1. Bump the version in package.json & CHANGELOG.md for `MARKETING_VERSION`, then `grep CURRENT_PROJECT_VERSION ios/App/App.xcodeproj/project.pbxproj` and add 1 for the numbered version here:
+###### 1. Bump the version in package.json & CHANGELOG.md for `MARKETING_VERSION`, then `grep CURRENT_PROJECT_VERSION ios/App/App.xcodeproj/project.pbxproj` and add 1 for the numbered version here:
 
 ```bash
-cd ios/App && xcrun agvtool new-version 72 && perl -p -i -e "s/MARKETING_VERSION = .*;/MARKETING_VERSION = 1.4.6;/g" App.xcodeproj/project.pbxproj && cd -
+cd ios/App && xcrun agvtool new-version 76 && perl -p -i -e "s/MARKETING_VERSION = .*;/MARKETING_VERSION = 1.4.10;/g" App.xcodeproj/project.pbxproj && cd -
 # Unfortunately this edits Info.plist directly.
 #xcrun agvtool new-marketing-version 0.4.5
 ```
 
-##### 2. Build
+###### 2. Build
 
 Here's prod. Also available: test, dev
 
@@ -1332,6 +1340,10 @@ npm run build:android:test:run       # Test build with auto-run (builds then run
 npm run build:android:prod:run       # Production build with auto-run (builds then runs on emulator)
 # Auto-run targets the one connected device; with none or several it prompts, or exits 9 without a terminal
 
+# Firebase off (`:nostore` sets FIREBASE_ENABLED=false, which passes -PfirebaseEnabled=false)
+npm run build:android:test:nostore:run  # Same as test:run, without Firebase
+npm run build:android:prod:nostore      # Same as prod, without Firebase
+
 # Debug and release builds
 npm run build:android:debug          # Debug build (builds debug APK)
 npm run build:android:debug:run      # Debug build with auto-run (builds then runs on emulator)
@@ -1434,8 +1446,8 @@ The recommended way to build for Android is using the automated build script:
 ##### 1. Bump the version in package.json, then update these versions & run:
 
 ```bash
-perl -p -i -e 's/versionCode .*/versionCode 72/g' android/app/build.gradle
-perl -p -i -e 's/versionName .*/versionName "1.4.6"/g' android/app/build.gradle
+perl -p -i -e 's/versionCode .*/versionCode 76/g' android/app/build.gradle
+perl -p -i -e 's/versionName .*/versionName "1.4.10"/g' android/app/build.gradle
 ```
 
 ##### 2. Build
@@ -1446,13 +1458,13 @@ perl -p -i -e 's/versionName .*/versionName "1.4.6"/g' android/app/build.gradle
 npm run build:android:prod
 ```
 
-##### 3. Open the project in Android Studio
+##### 2.1. (Optional) Open the project in Android Studio
 
 ```bash
 npx cap open android
 ```
 
-##### 4. Use Android Studio to build and run on emulator or device
+##### 3. Use Android Studio to build and run on emulator or device
 
 #### Android Build from the console
 
@@ -1460,13 +1472,7 @@ npx cap open android
 
 * Note that this currently fails: `./gradlew build`
 
-To create the `aab` file, `bundle` instead of `build` (but not signed and not usable in Play Store):
-
-```bash
-./gradlew bundleDebug -Dlint.baselines.continue=true
-```
-
-So, to create a signed `aab` release:
+To create a signed `aab` release:
 
 - Setup by adding the app/gradle.properties.secrets file (see properties at top
   of app/build.gradle) and the app/time-safari-upload-key-pkcs12.jks file
@@ -1474,11 +1480,19 @@ So, to create a signed `aab` release:
 
 ```bash
 # if you use pkgx: pkgx +openjdk.org /bin/zsh
-./gradlew bundleRelease -Dlint.baselines.continue=true -PfirebaseEnabled
+./gradlew bundleRelease -Dlint.baselines.continue=true
 ```
 
+Firebase is on by default (`firebaseEnabled=true` in `android/gradle.properties`). Do not pass `-PfirebaseEnabled` for a normal release. F-Droid and other builds that must omit Firebase use `-PfirebaseEnabled=false`, or an npm `:nostore` script (`FIREBASE_ENABLED=false`). `:nostore` only disables Firebase. It does not remove other store-linked dependencies, such as the ML Kit barcode scanner's Play Services library, and it does not by itself make the app run on every device outside the Play Store.
+
 ... and find your `aab` file at app/build/outputs/bundle/release
 
+To create an unsigned debugging bundle (not usable in Play Store):
+
+```bash
+./gradlew bundleDebug -Dlint.baselines.continue=true
+```
+
 * Gradle packages whatever web bundle was last synced into
   `android/app/src/main/assets/public`, even one from a `--test` build. Before
   uploading, confirm it has production server defaults:
@@ -1486,8 +1500,6 @@ So, to create a signed `aab` release:
 * `build-android.sh` runs `./gradlew clean`, which deletes any earlier `aab`, so
   run `bundleRelease` after the build script finishes.
 
-* Note that F-Droid builds should omit `-PfirebaseEnabled`.
-
 At play.google.com/console:
 
 - Go to Production or the Closed Testing and either Create Track or Manage Track.
@@ -1603,8 +1615,7 @@ Use the commands above to check and fix code quality issues.
 
 1. **Environment Setup**: Load platform-specific environment variables
 2. **Asset Building**: Vite builds optimized web assets
-3. **PWA Generation**: Service worker and manifest creation
-4. **Output**: Production-ready files in `dist/` directory
+3. **Output**: Production-ready files in `dist/` directory
 
 ### Electron Build Process
 
@@ -1856,38 +1867,21 @@ npm run build:android:assets
 
 ### Build Process Overview
 
-TimeSafari's build system follows a multi-stage process that prepares assets,
-combines scripts, and generates platform-specific outputs.
+TimeSafari's build system follows a multi-stage process that prepares assets
+and generates platform-specific outputs.
 
-#### Pre-Build Preparation
-
-##### 1. Service Worker Script Preparation
-
-```bash
-# Optional: Format third-party service worker scripts
-npx prettier --write ./sw_scripts/
-```
-
-**What this does:**
-
-- Formats cryptographic libraries (`nacl.js`, `noble-curves.js`,
- `noble-hashes.js`, etc.)
-- These scripts are automatically combined during the build process
-- Improves readability and makes version control diffs cleaner
-- **Note**: This is optional and only needed when updating third-party scripts
-
-**2. Automatic Pre-Build Steps**
-The `prebuild` script automatically runs before any build:
+#### Pre-Build Script
 
 ```json
-"prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node sw_combine.js && node scripts/copy-wasm.js"
+"prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node scripts/copy-wasm.js"
 ```
 
-**What happens automatically:**
+npm runs `prebuild` only before a script named `build`. This project defines
+no `build` script, so none of the `build:*` commands trigger it.
 
-- **ESLint**: Checks and fixes code formatting in `src/`
-- **Script Combination**: `sw_combine.js` combines all `sw_scripts/*.js` files
-  into `sw_scripts-combined.js`
+**What it does when run:**
+
+- **ESLint**: Checks code formatting in `src/`
 - **WASM Copy**: `copy-wasm.js` copies SQLite WASM files to `public/wasm/`
 
 #### Build Process Architecture
@@ -1895,11 +1889,10 @@ The `prebuild` script automatically runs before any build:
 **Web Build Process:**
 
 ```text
-1. Pre-Build: ESLint + Script Combination + WASM Copy
-2. Environment Setup: Load .env files, set NODE_ENV
-3. Vite Build: Bundle web assets with PWA support
-4. Service Worker: Inject combined scripts into PWA
-5. Output: Production-ready files in dist/
+1. Environment Setup: Load .env files, set NODE_ENV
+2. Type Check: tsc --noEmit (test and production modes)
+3. Vite Build: Bundle web assets
+4. Output: Production-ready files in dist/
 ```
 
 **Electron Build Process:**
@@ -1922,34 +1915,6 @@ The `prebuild` script automatically runs before any build:
 5. Package Creation: APK/IPA generation
 ```
 
-#### Service Worker Architecture
-
-**Script Organization:**
-
-- `sw_scripts/` - Individual third-party scripts
-- `sw_combine.js` - Combines scripts into single file
-- `sw_scripts-combined.js` - Combined service worker (317KB, 10K+ lines)
-- `vite.config.utils.mts` - PWA configuration using combined script
-
-**PWA Integration:**
-
-```typescript
-// vite.config.utils.mts
-pwaConfig: {
-  strategies: "injectManifest",
-  filename: "sw_scripts-combined.js",  // Uses our combined script
-  // ... manifest configuration
-}
-```
-
-**What Gets Combined:**
-
-- `nacl.js` - NaCl cryptographic library
-- `noble-curves.js` - Elliptic curve cryptography (177KB)
-- `noble-hashes.js` - Cryptographic hash functions (91KB)
-- `safari-notifications.js` - Safari-specific notifications
-- `additional-scripts.js` - Additional service worker functionality
-
 #### Process Environment Configuration
 
 **Environment Files:**
@@ -2002,10 +1967,13 @@ device)
 ```folders
 dist/
 ├── index.html              # Main HTML file
-├── assets/                 # Bundled JavaScript/CSS
-├── sw.js                   # Service worker (injected)
-├── manifest.webmanifest    # PWA manifest
-└── wasm/                   # SQLite WASM files
+├── assets/                 # Bundled JavaScript, CSS, and SQLite WASM
+├── img/                    # Static images (copied from public/)
+├── models/                 # Static model files (copied from public/)
+├── favicon.ico
+├── manifest.webmanifest    # Web app manifest, incl. share_target (copied from public/)
+├── robots.txt
+└── sw.js                   # Service worker for the Web Share Target (copied from public/)
 ```
 
 **Electron Build:**
@@ -2027,17 +1995,14 @@ electron/
 **Manual Steps (Developer Responsibility):**
 
 - Database migration testing
-- Service worker script formatting (optional)
 - Version updates and changelog
 - Environment-specific builds
 
 **Automatic Steps (Build System):**
 
-- Code linting and formatting
-- Script combination
+- Type checking (test and production builds)
 - Asset optimization
 - Package creation
-- Service worker injection
 
 This architecture ensures consistent builds across all platforms while providing
 flexibility for platform-specific optimizations and manual quality assurance steps.
@@ -2062,31 +2027,34 @@ environment setup, Vite build, and optional Docker containerization.
 
 ```bash
 # Direct script usage
-./scripts/build-web.sh                    # Development build
-./scripts/build-web.sh --dev              # Development build (explicit)
+./scripts/build-web.sh                    # Production build into dist/
+./scripts/build-web.sh --prod             # Production build (explicit)
 ./scripts/build-web.sh --test             # Test environment build
-./scripts/build-web.sh --prod             # Production environment build
-./scripts/build-web.sh --docker           # Build with Docker containerization
+./scripts/build-web.sh --dev              # Start Vite dev server (no dist/)
+./scripts/build-web.sh --docker           # Production build + Docker image
 ./scripts/build-web.sh --docker:test      # Test environment + Docker
 ./scripts/build-web.sh --docker:prod      # Production environment + Docker
-./scripts/build-web.sh --serve            # Build and serve locally
+./scripts/build-web.sh --serve            # Production build, then serve dist/
 ./scripts/build-web.sh --help             # Show help
 ./scripts/build-web.sh --verbose          # Enable verbose logging
 
 # NPM Script Equivalents
-npm run build:web                         # Development build
+npm run dev                               # Vite dev server
+npm run build:web                         # Production build
 npm run build:web:test                    # Test environment build
 npm run build:web:prod                    # Production environment build
-npm run build:web:docker                  # Docker build
+npm run build:web:docker                  # Production Docker build
 npm run build:web:docker:test             # Test Docker build
 npm run build:web:docker:prod             # Production Docker build
+npm run build:web:serve                   # Production build, then serve
+npm run build:web:serve:test              # Test build, then serve
 ```
 
 **Build Modes**:
 
-- **Development**: Starts Vite dev server with hot reload (default)
+- **Production**: Optimized for production with full minification (default)
 - **Test**: Optimized for testing with minimal minification
-- **Production**: Optimized for production with full minification
+- **Development**: Starts Vite dev server with hot reload (`--dev` alone); with `--serve` or `--docker`, builds `dist/` in development mode
 
 **Script Features**:
 
@@ -2407,7 +2375,7 @@ npm run clean:electron         # Electron only
 # Clean and rebuild
 npm run clean:all
 npm install
-npm run build:web:dev
+npm run dev
 ```
 
 ## Appendix B: Vite Configuration Files Reference
@@ -2439,9 +2407,7 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
   const appConfig = await loadAppConfig();
   const isCapacitor = platform === "capacitor";
   const isElectron = platform === "electron";
-  const isNative = isCapacitor || isElectron;
 
-  // Set platform - PWA is always enabled for web platforms
   process.env.VITE_PLATFORM = platform;
 
   return {
@@ -2457,7 +2423,6 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
       assetsDir: 'assets',
       chunkSizeWarningLimit: 1000,
       rollupOptions: {
-        external: isNative ? ['@capacitor/app'] : [],
         output: {
           format: 'esm',
           generatedCode: { preset: 'es2015' },
@@ -2489,12 +2454,7 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
         '@jlongster/sql.js',
         'absurd-sql',
         // ... additional dependencies
-      ],
-      exclude: isNative ? [
-        'register-service-worker',
-        'workbox-window',
-        // ... native exclusions
-      ] : []
+      ]
     }
   };
 }
@@ -2517,98 +2477,23 @@ export async function createBuildConfig(platform: string): Promise<UserConfig> {
 
 **File**: `vite.config.web.mts`
 **Author**: Matthew Raymer
-**Description**: Vite configuration for web platform with PWA support
+**Description**: Vite configuration for the web platform
 
-**Purpose**: Configures Vite for web builds with environment-specific
-optimizations and PWA features.
+**Purpose**: Configures Vite for web builds by delegating to the common
+configuration with the `web` platform.
+
+**Configuration Structure**:
+
+```typescript
+export default defineConfig(async () => createBuildConfig('web'));
+```
 
 **Key Features**:
 
-- **Environment-Specific Configuration**: Different settings for dev/test/prod
-- **PWA Integration**: Progressive Web App support with service worker
-- **Build Optimization**: Manual chunk splitting for better caching
-- **Source Maps**: Environment-specific source map configuration
-- **Caching Strategies**: Production-specific API caching
-
-**Environment Configurations**:
-
-**Development Mode**:
-
-```typescript
-{
-  build: {
-    minify: false,
-    sourcemap: true,
-    rollupOptions: { output: { manualChunks: undefined } }
-  },
-  define: {
-    __DEV__: true,
-    __TEST__: false,
-    __PROD__: false
-  }
-}
-```
-
-**Test Mode**:
-
-```typescript
-{
-  build: {
-    minify: false,
-    sourcemap: true,
-    rollupOptions: { output: { manualChunks: undefined } }
-  },
-  define: {
-    __DEV__: false,
-    __TEST__: true,
-    __PROD__: false
-  }
-}
-```
-
-**Production Mode**:
-
-```typescript
-{
-  build: {
-    minify: 'terser',
-    sourcemap: false,
-    rollupOptions: {
-      output: {
-        manualChunks: {
-          vendor: ['vue', 'vue-router', 'pinia'],
-          utils: ['luxon', 'ramda', 'zod'],
-          crypto: ['@ethersproject/wallet', '@ethersproject/hdnode'],
-          sql: ['@jlongster/sql.js', 'absurd-sql']
-        }
-      }
-    }
-  },
-  define: {
-    __DEV__: false,
-    __TEST__: false,
-    __PROD__: true
-  }
-}
-```
-
-**PWA Configuration**:
-
-```typescript
-VitePWA({
-  registerType: 'autoUpdate',
-  manifest: appConfig.pwaConfig?.manifest,
-  devOptions: { enabled: true, type: 'classic' },
-  workbox: {
-    cleanupOutdatedCaches: true,
-    skipWaiting: true,
-    clientsClaim: true,
-    sourcemap: mode !== 'production',
-    maximumFileSizeToCacheInBytes: 10 * 1024 * 1024,
-    runtimeCaching: mode === 'production' ? [/* API caching */] : []
-  }
-})
-```
+- **Minimal Configuration**: Inherits all settings from `vite.config.common.mts`
+- **Mode Selection**: `--mode test` or `--mode production` (passed by
+  `scripts/build-web.sh`) selects the matching `.env.*` file
+- **Output**: Writes to `dist/`
 
 ### B.3 vite.config.electron.mts
 
@@ -2699,7 +2584,6 @@ export default defineConfig(async () => createBuildConfig('capacitor'));
 
 - **Minimal Configuration**: Inherits all settings from common config
 - **Mobile Platform**: Automatically configures for mobile-specific settings
-- **PWA Disabled**: Progressive Web App features disabled for native apps
 - **Native Dependencies**: Handles Capacitor-specific dependencies
 
 ### B.5 vite.config.utils.mts
@@ -2708,51 +2592,15 @@ export default defineConfig(async () => createBuildConfig('capacitor'));
 **Author**: Matthew Raymer
 **Description**: Utility functions for Vite configuration
 
-**Purpose**: Provides shared configuration loading and PWA manifest generation.
+**Purpose**: Provides the shared alias configuration and strict ESBuild settings.
 
 **Key Functions**:
 
-**loadPackageJson()**: Loads and parses package.json for app configuration
+**loadAppConfig()**: Returns the alias configuration used by the common and
+optimized configs
 
-**loadAppConfig()**: Loads complete application configuration including PWA settings
-
-**PWA Configuration**:
-
-```typescript
-interface PWAConfig {
-  registerType: string;
-  strategies: string;
-  srcDir: string;
-  filename: string;
-  manifest: {
-    name: string;
-    short_name: string;
-    theme_color: string;
-    background_color: string;
-    icons: ManifestIcon[];
-    share_target: ShareTarget;
-  };
-}
-```
-
-**Manifest Icons**:
-
-- Android Chrome 192x192 PNG
-- Android Chrome 512x512 PNG
-- Maskable icons for adaptive UI
-
-**Share Target Configuration**:
-
-```typescript
-share_target: {
-  action: "/share-target",
-  method: "POST",
-  enctype: "multipart/form-data",
-  params: {
-    files: [{ name: "photo", accept: ["image/*"] }]
-  }
-}
-```
+**getStrictESBuildConfig()**: Returns ESBuild settings that fail the build on
+syntax and duplicate-declaration errors
 
 **Alias Configuration**:
 
@@ -2820,8 +2668,7 @@ All scripts use consistent error handling:
 
 **Web Platform**:
 
-- PWA features enabled
-- Service worker injection
+- Requires a secure context (HTTPS, `localhost`, `127.0.0.1`, or `[::1]`)
 - Browser-specific optimizations
 
 **Electron Platform**:

CHANGELOG.md

@@ -6,6 +6,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [1.4.10] - 2026.10.17
+### Changed
+- New Activities were heavily refactored and enhanced to match alertSearch endpoints with more results, cursors, etc.
+- `npm run build:web` builds production into `dist/` instead of starting the dev server.
+- `npm run build:web:serve` builds production (instead of development) before serving.
+- `npm run build:web:docker` builds production (instead of development) before creating the image.
+- `npm run build:native` builds with the Capacitor Vite config instead of a bare `vite build`.
+- The claim and profile pages show "Who Can Introduce You" as a collapsed section, loading the next-closer people only when opened.
+- Messages about hidden people point to who can introduce you, instead of saying nobody can.
+- "Who Can Introduce You" labels a person whom Endorser hides in its results as outside your view.
+### Removed
+- `npm run build:web:dev` is removed; use `npm run dev` for the dev server.
+- Leftover service-worker build code (`sw_scripts/`, the unused PWA config, and the `register-service-worker` package) is removed.
+### Fixed
+- The daily starred-project check (Android and iOS) remembers the newest change it found, so it no longer reports the same changes again the next day.
+- Sharing a photo into the installed web app (Web Share Target) works again.
+- `npm run docker:up:test` and `npm run docker:up:prod` run, instead of failing on a missing `build:web:build` script.
+- Affirm Delivery on an offer to a project waits for the project to load, so a quick tap no longer makes the offerer both giver and recipient.
+- When the browser cannot run WebAssembly ("compiler"), the start-up error screen explains it and points to the settings that block it.
+- An unregistered user no longer sees every person on a claim described as unknown to this server.
+
+
+## [1.4.9] - 2026.10.11
+### Fixed
+- Startup DB error for new installations
+### Changed
+- Allow in-app notifications on production (as an advanced feature)
+- Allow modification of image server URL
+- Terms & conditions and privacy policy
+
+
 ## [1.4.6] - 2026.09.27
 ### Fixed
 - Incorrect 'test' server URLs on production.

Dockerfile

@@ -21,13 +21,13 @@
 #   Using npm scripts (recommended):
 #   Production: npm run build:web:docker:prod
 #   Test: npm run build:web:docker:test
-#   Development: npm run build:web:docker
+#   Development: ./scripts/build-web.sh --docker --dev
 #   
 #   Manual workflow:
-#   1. Build web assets: npm run build:web:build -- --mode production
+#   1. Build web assets: npm run build:web:prod
 #   2. Build Docker: docker build -t timesafari:latest .
 #   
-#   Note: For development, use npm run build:web directly (no Docker needed)
+#   Note: For development, use npm run dev directly (no Docker needed)
 #
 # Build Arguments:
 #   BUILD_MODE: development, test, or production (default: production)

README.md

@@ -20,7 +20,7 @@ npm install
 ### Web
 
 ```bash
-npm run build:web:dev
+npm run dev
 ```
 
 Then go to [the test page](http://localhost:8080/test) and click "Become User 0" to take action on the platform.
@@ -98,16 +98,16 @@ TimeSafari supports configurable logging levels via the `VITE_LOG_LEVEL` environ
 
 ```bash
 # Show only errors
-VITE_LOG_LEVEL=error npm run build:web:dev
+VITE_LOG_LEVEL=error npm run dev
 
 # Show warnings and errors
-VITE_LOG_LEVEL=warn npm run build:web:dev
+VITE_LOG_LEVEL=warn npm run dev
 
 # Show info, warnings, and errors (default)
-VITE_LOG_LEVEL=info npm run build:web:dev
+VITE_LOG_LEVEL=info npm run dev
 
 # Show all log levels including debug
-VITE_LOG_LEVEL=debug npm run build:web:dev
+VITE_LOG_LEVEL=debug npm run dev
 ```
 
 ### Available Levels
@@ -121,7 +121,7 @@ See [Logging Configuration Guide](doc/logging-configuration.md) for complete det
 
 ## Notification Debug Panel (dev builds)
 
-In non-production bundles (for example `vite dev` or a Vite build whose mode is not `production`), the **Notification Debug Panel** at `/dev/notifications` helps you test notification registration, backend refresh, WAKEUP_PING handling, and local schedule inspection on native builds.
+In non-production bundles (for example `vite dev` or a Vite build whose mode is not `production`), the **Notification Debug Panel** at `/dev/notifications` helps you test FCM token registration, AlertSearch authorization upload, FCM wakeup delivery (`/debug/send-wakeup`), and local schedule inspection on native builds. The app no longer consumes `WAKEUP_PING` to call `/notifications/refresh` or schedule `api_*` notifications.
 
 **Access:** **Account** → enable **Show All General Advanced Functions** → **Notification Debug Panel**.
 
@@ -147,7 +147,7 @@ Platform-specific end-to-end guides:
 
 # Then restart your development server
 npm run build:electron:dev  # For Electron
-npm run build:web:dev       # For Web
+npm run dev                 # For Web
 ```
 
 ### What It Does
@@ -339,7 +339,7 @@ The application uses a platform-agnostic database layer with Vue mixins for serv
 
 **Architecture Decision**: The project uses Vue mixins over Composition API composables for platform service access. See [Architecture Decisions](doc/architecture-decisions.md) for detailed rationale.
 
-## 📁 Project Structure
+### 📁 Project Structure
 
 ```text
 timesafari/
@@ -354,6 +354,45 @@ timesafari/
 └── 📄 doc/README-BUILD-GUARD.md # Guard system documentation
 ```
 
+### Building an APK for Android 6 (API 23)
+
+App versions up to 1.4.6 support Android 6.0 (API 23); later versions require Android 7.0 (API 24) or newer. To run the app on an Android 6 device, build your own APK from the 1.4.6 release commit (`6183afc2`, "bump version to 1.4.6").
+
+Prerequisites: git, Node.js 20 (see `.nvmrc`), Java 21, and the Android SDK with `ANDROID_HOME` set (see [Android Emulator Without Android Studio](BUILDING.md#android-emulator-without-android-studio-command-line-only) for an SDK setup that skips Android Studio). With [pkgx](https://pkgx.dev), prefix the commands with `pkgx`, e.g. `pkgx npm ci`.
+
+1. Get the 1.4.6 source:
+
+   ```bash
+   git clone https://gitea.anomalistdesign.com/trent_larson/crowd-funder-for-time-pwa.git
+   cd crowd-funder-for-time-pwa
+   git checkout 6183afc2
+   ```
+
+2. Confirm the minimum SDK is 23:
+
+   ```bash
+   grep minSdkVersion android/variables.gradle   # expect: minSdkVersion = 23
+   ```
+
+3. Install dependencies and build a production APK:
+
+   ```bash
+   npm ci
+   npm run build:android:prod -- --apk
+   ```
+
+   `npm ci` installs the exact dependency versions locked for 1.4.6. `build:android:prod -- --apk` builds the web app with production server settings, syncs it into the Android project, and runs `./gradlew assembleDebug`. The result is signed with your local Android debug key, so it installs on any device without a release keystore.
+
+4. Find the APK at `android/app/build/outputs/apk/debug/app-debug.apk` and install it, either with `adb install android/app/build/outputs/apk/debug/app-debug.apk` (USB debugging enabled on the phone) or by copying the file to the phone and opening it (allow "Install unknown apps" for the file manager).
+
+Notes:
+
+* **Back up your identity first.** A self-built APK has a different signature from the Play Store app, so Android refuses to install it over the store version. Uninstalling the store version deletes the app's local data, including your identifier keys. Back up your seed phrase (Profile page → "Backup Identifier Seed") before uninstalling, then import it into the self-built app.
+* This build has Firebase disabled, so push notifications through Google's FCM service are off.
+* The daily notification plugin calls `java.time`, which Android provides only from 8.0 (API 26). On Android 6, scheduling a daily reminder can crash the app; leave daily reminders off. See [doc/plugin-feedback-android-6-api23-zoneid-fix.md](doc/plugin-feedback-android-6-api23-zoneid-fix.md).
+* Barcode scanning uses Google Play Services; on devices without them, scanning fails while the rest of the app works.
+* A self-built APK does not auto-update.
+
 ## 🤝 Contributing
 
 1. **Follow the Build Architecture Guard** - Update BUILDING.md when modifying build files

android/app/build.gradle

@@ -29,6 +29,8 @@ android {
     compileSdk rootProject.ext.compileSdkVersion
 
     compileOptions {
+        // Backports java.time (API 26+) to older Android; the daily notification plugin uses it.
+        coreLibraryDesugaringEnabled true
         sourceCompatibility JavaVersion.VERSION_21
         targetCompatibility JavaVersion.VERSION_21
     }
@@ -37,8 +39,8 @@ android {
         applicationId "app.timesafari.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 72
-        versionName "1.4.6"
+        versionCode 76
+        versionName "1.4.10"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
@@ -101,6 +103,7 @@ repositories {
 }
 
 dependencies {
+    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:2.1.5"
     implementation fileTree(include: ['*.jar'], dir: 'libs')
     implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
     implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
@@ -130,20 +133,32 @@ dependencies {
 
 apply from: 'capacitor.build.gradle'
 
-// Firebase / Google Play Services are opt-in. Pass -PfirebaseEnabled to any Gradle command
-// to activate Firebase (FCM push notifications). Without this flag the build works on
-// F-Droid, Aurora, Zapstore, and plain APK sideloading even when google-services.json
-// is present on disk (it is gitignored; see AGENTS.md for the full story).
-try {
-    def servicesJSON = file('google-services.json')
-    if (servicesJSON.exists() && servicesJSON.text && project.hasProperty('firebaseEnabled')) {
-        apply plugin: 'com.google.gms.google-services'
-        logger.info("Firebase enabled: google-services plugin applied")
-    } else if (servicesJSON.exists() && !project.hasProperty('firebaseEnabled')) {
-        logger.info("google-services.json present but firebaseEnabled not set — skipping Firebase plugin (pass -PfirebaseEnabled to enable)")
-    } else {
-        logger.info("google-services.json not found — Firebase plugin not applied")
+// Firebase is on for every build. Opt out only with -PfirebaseEnabled=false
+// (F-Droid / other builds that must not apply the google-services plugin).
+// The config file does not decide the switch: when Firebase is on, a missing
+// file fails the build; when it is off, a file on disk is ignored.
+def firebaseEnabledRaw = project.findProperty('firebaseEnabled')
+def firebaseEnabled = true
+if (firebaseEnabledRaw != null) {
+    def normalized = firebaseEnabledRaw.toString().trim().toLowerCase()
+    if (normalized == 'false' || normalized == '0' || normalized == 'no') {
+        firebaseEnabled = false
     }
-} catch(Exception e) {
-    logger.info("google-services plugin not applied: ${e.message}")
+}
+
+if (!firebaseEnabled) {
+    logger.lifecycle('Firebase disabled (-PfirebaseEnabled=false): google-services plugin not applied')
+} else {
+    def servicesJSON = file('google-services.json')
+    def servicesBody = servicesJSON.isFile() ? servicesJSON.getText('UTF-8') : ''
+    if (!servicesBody.trim() || !servicesBody.contains('mobilesdk_app_id')) {
+        throw new GradleException(
+            'Firebase is enabled, but android/app/google-services.json is missing, empty, or has no mobilesdk_app_id.\n' +
+            'Download it from the Firebase console (Project settings → Your apps → Android app)\n' +
+            'and place it at android/app/google-services.json.\n' +
+            'To build without Firebase (F-Droid / FOSS), pass -PfirebaseEnabled=false.'
+        )
+    }
+    apply plugin: 'com.google.gms.google-services'
+    logger.lifecycle('Firebase enabled: google-services plugin applied')
 }

android/app/src/main/AndroidManifest.xml

@@ -3,6 +3,8 @@
     <application
         android:name=".TimeSafariApplication"
         android:allowBackup="true"
+        android:fullBackupContent="@xml/backup_rules"
+        android:dataExtractionRules="@xml/data_extraction_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

android/app/src/main/assets/capacitor.config.json

@@ -36,8 +36,8 @@
 			"splashFullScreen": true,
 			"splashImmersive": true
 		},
-		"CapSQLite": {
-			"iosDatabaseLocation": "Library/CapacitorDatabase",
+		"CapacitorSQLite": {
+			"iosDatabaseLocation": "Documents",
 			"iosIsEncryption": false,
 			"iosBiometric": {
 				"biometricAuth": false,

android/app/src/main/java/app/timesafari/TimeSafariNativeFetcher.java

@@ -311,23 +311,25 @@ public class TimeSafariNativeFetcher implements NativeNotificationContentFetcher
         return prefs.getString(KEY_LAST_ACKED_JWT_ID, null);
     }
 
+    /**
+     * Store the newest JWT ID in the response (the highest ULID), so the next fetch
+     * asks only for later changes. The server lists them newest first, so the last
+     * item is the oldest.
+     */
     private void updateLastAckedJwtIdFromResponse(String responseBody) {
         try {
             JsonObject root = JsonParser.parseString(responseBody).getAsJsonObject();
             if (!root.has("data")) return;
             JsonArray dataArray = root.getAsJsonArray("data");
             if (dataArray == null || dataArray.size() == 0) return;
-            JsonObject lastItem = dataArray.get(dataArray.size() - 1).getAsJsonObject();
             String jwtId = null;
-            if (lastItem.has("jwtId")) {
-                jwtId = lastItem.get("jwtId").getAsString();
-            } else if (lastItem.has("plan")) {
-                JsonObject plan = lastItem.getAsJsonObject("plan");
-                if (plan.has("jwtId")) {
-                    jwtId = plan.get("jwtId").getAsString();
+            for (int i = 0; i < dataArray.size(); i++) {
+                String itemJwtId = extractJwtIdFromItem(dataArray.get(i).getAsJsonObject());
+                if (itemJwtId != null && !itemJwtId.isEmpty() && (jwtId == null || itemJwtId.compareTo(jwtId) > 0)) {
+                    jwtId = itemJwtId;
                 }
             }
-            if (jwtId != null && !jwtId.isEmpty()) {
+            if (jwtId != null) {
                 prefs.edit().putString(KEY_LAST_ACKED_JWT_ID, jwtId).apply();
             }
         } catch (Exception e) {

android/app/src/main/java/app/timesafari/notifications/NotificationInspectorPlugin.java

@@ -15,8 +15,8 @@ public class NotificationInspectorPlugin extends Plugin {
   }
 
   /**
-   * Whether this build carries a Firebase config, i.e. was built with
-   * -PfirebaseEnabled. Without it, PushNotifications.register() throws on the
+   * Whether this build carries a Firebase config. Normal builds do.
+   * -PfirebaseEnabled=false omits it. Without it, PushNotifications.register() throws on the
    * Capacitor plugin thread and kills the app, so JS must check this first.
    * The google-services Gradle plugin generates the google_app_id resource,
    * which is what Firebase's own auto-initialization looks for.

android/app/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Backup rules for Android 11 and lower; data_extraction_rules.xml has the same
+  exclusions for Android 12 and higher. Everything not excluded is backed up.
+
+  The SQLite plugin's encrypted preferences are tied to an Android Keystore key,
+  and Keystore keys are never backed up. Restoring the preferences without the
+  key makes the plugin fail to load on every launch.
+-->
+<full-backup-content>
+    <exclude domain="sharedpref" path="sqlite_encrypted_shared_prefs.xml" />
+    <exclude domain="sharedpref" path="__androidx_security_crypto_encrypted_prefs_key_keyset__.xml" />
+</full-backup-content>

android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Backup and device-transfer rules for Android 12 and higher; backup_rules.xml
+  has the same exclusions for Android 11 and lower. Everything not excluded is
+  backed up and transferred, including the database (which holds the user's keys).
+
+  The SQLite plugin's encrypted preferences are tied to an Android Keystore key,
+  and Keystore keys never leave the device. Restoring the preferences without
+  the key makes the plugin fail to load on every launch.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="sharedpref" path="sqlite_encrypted_shared_prefs.xml" />
+        <exclude domain="sharedpref" path="__androidx_security_crypto_encrypted_prefs_key_keyset__.xml" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="sharedpref" path="sqlite_encrypted_shared_prefs.xml" />
+        <exclude domain="sharedpref" path="__androidx_security_crypto_encrypted_prefs_key_keyset__.xml" />
+    </device-transfer>
+</data-extraction-rules>

android/gradle.properties

@@ -22,3 +22,8 @@ org.gradle.jvmargs=-Xmx1536m --add-opens=jdk.compiler/com.sun.tools.javac.api=AL
 # https://developer.android.com/topic/libraries/support-library/androidx-rn
 android.useAndroidX=true
 android.suppressUnsupportedCompileSdk=36
+
+# Firebase/FCM is on for every Gradle build (Android Studio, ./gradlew, npm scripts).
+# Opt out with -PfirebaseEnabled=false. android/app/google-services.json does not
+# toggle this; a missing file fails the build while Firebase is enabled.
+firebaseEnabled=true

android/variables.gradle

@@ -1,5 +1,5 @@
 ext {
-    minSdkVersion = 23
+    minSdkVersion = 24
     compileSdkVersion = 36
     targetSdkVersion = 36
     androidxActivityVersion = '1.8.0'

capacitor.config.json

@@ -30,7 +30,7 @@
 			"splashImmersive": true
 		},
 		"CapacitorSQLite": {
-			"iosDatabaseLocation": "Library/CapacitorDatabase",
+			"iosDatabaseLocation": "Documents",
 			"iosIsEncryption": false,
 			"iosBiometric": {
 				"biometricAuth": false,

capacitor.config.ts

@@ -34,8 +34,10 @@ const config: CapacitorConfig = {
       splashFullScreen: true,
       splashImmersive: true
     },
-    CapSQLite: {
-      iosDatabaseLocation: 'Library/CapacitorDatabase',
+    // The key must match the plugin's registered name or every setting here is ignored.
+    CapacitorSQLite: {
+      // Installed iOS apps keep their database in Documents; changing this strands existing data.
+      iosDatabaseLocation: 'Documents',
       iosIsEncryption: false,
       iosBiometric: {
         biometricAuth: false,

doc/CHANGES/PLAN-contacts-without-did.md

@@ -0,0 +1,409 @@
+# Plan: Contacts Without a DID ("Placeholder Contacts")
+
+## Goal
+
+Let a user record a gift (or offer) given by or to a person who has not
+installed the app, under that person's name, and later swap that person's real
+DID into those claims once they join.
+
+Requirements:
+
+1. A locally saved name for a person with no DID, plus everything a real
+   contact can hold locally: phone numbers and other contact methods, notes,
+   and labels, edited through the same screens.
+2. That person can be picked as the giver or recipient in the gift dialogs,
+   the same way a real contact is.
+3. The app keeps a local list of every claim that names the person, so the
+   claims can be found again without a server search.
+4. When the person joins, the user links the placeholder to the person's real
+   contact, and the app edits each linked claim so the real DID appears
+   where the placeholder was.
+5. Nothing that identifies a placeholder — its name or its local key — is
+   sent to the endorser server or shared with other users.
+6. When the app links contacts to the device's address book, a placeholder
+   links the same way a real contact does, and the link survives the
+   placeholder becoming a real contact.
+
+## Relevant constraints in the current schema
+
+These come from `src/db-sql/migration.ts` and
+`src/utils/PlatformServiceMixin.ts`.
+
+| Constraint | Where | Effect on this feature |
+|---|---|---|
+| `contacts.did TEXT NOT NULL` | migration 008 | A contact row must have some DID value. |
+| `UNIQUE INDEX idx_contacts_did ON contacts(did)` | migration 008 | Every contact's DID must be distinct. (SQLite allows multiple NULLs in a unique index, so the index alone would not block NULL DIDs; `NOT NULL` does.) |
+| `contact_labels.did ... REFERENCES contacts(did) ON DELETE CASCADE` | migration 008 | Labels are keyed by DID. There is no `ON UPDATE` action, so `UPDATE contacts SET did = ...` fails with `FOREIGN KEY constraint failed` while the contact has labels (verified with the `sqlite3` CLI), when foreign keys are enforced on the connection. |
+| `$insertContact` uses `INSERT OR REPLACE` | `PlatformServiceMixin.ts` | REPLACE deletes the conflicting row before inserting. With foreign keys enforced, that delete cascades and wipes the contact's labels. The new row also gets a new `id`, because `id` is not in the insert's column list (both verified with the `sqlite3` CLI). Any table that references `contacts(did)` with `ON DELETE CASCADE` inherits the first hazard, and anything that references `contacts.id` inherits the second. Callers: `ContactsView`, `InviteOneView`, `MeetingMembersList`, `BulkMembersDialog`. |
+| `Contact.did: string` (required) | `src/db/tables/contacts.ts` | Every view, lookup (`contactForDid`, `didInfo`), and mixin method (`$getContact`, `$updateContact`, `$deleteContact`, label methods) is keyed by DID string. |
+| `isDid(s)` is `s.startsWith("did:")` | `src/libs/endorserServer.ts` | Any string starting with `did:` is treated as a real DID by import validation, display logic, and server calls. |
+
+Whether foreign keys are enforced at runtime depends on whether a
+`PRAGMA foreign_keys = ON` took effect on the current connection; nothing
+outside the migrations sets it. The plan below assumes they may be enforced
+and must work either way.
+
+## Recommended: local placeholder key in `contacts`, no DID in the claim
+
+### Summary
+
+- A placeholder is an ordinary row in `contacts` whose `did` column holds a
+  local-only key: `local:` followed by a random UUID, e.g.
+  `local:3f0c9a8e-5d2b-4c1e-9b7a-2e6f1d0c4a11`.
+- The key deliberately does **not** start with `did:`, so `isDid()` is false
+  for it and every existing DID-only code path rejects it instead of treating
+  it as real.
+- Claims naming a placeholder carry **no** agent/recipient DID in that slot —
+  the same shape the gift dialog already sends for "Unnamed".
+- A new table records which claims involve which placeholder, so they can be
+  edited when the real DID is known.
+
+The only schema change is one additive `CREATE TABLE`. The `contacts` and
+`contact_labels` tables are untouched, so no table rebuild is needed (a
+rebuild is the risky part of migration 008).
+
+### Schema change (migration 012)
+
+```sql
+-- Claims that name a placeholder contact (contacts.did LIKE 'local:%') in place of a DID,
+-- kept so they can be edited to carry the real DID once that person joins.
+CREATE TABLE placeholder_claims (
+  contactKey TEXT NOT NULL,      -- contacts.did: the placeholder key, or the real DID after linking
+  claimHandleId TEXT NOT NULL,   -- handleId from the server; stays the same across edits
+  role TEXT NOT NULL CHECK (role IN ('agent', 'recipient')),
+  claimType TEXT NOT NULL,       -- eg. 'GiveAction', 'Offer'
+  issuerDid TEXT NOT NULL,       -- only this identity can edit the claim
+  apiServer TEXT NOT NULL,       -- the server the claim was sent to
+  dateCreated TEXT NOT NULL,
+  dateAssigned TEXT,             -- set when the claim has been edited to carry the real DID
+  PRIMARY KEY (contactKey, claimHandleId, role)
+);
+CREATE INDEX idx_placeholder_claims_key ON placeholder_claims(contactKey);
+```
+
+The column is named for the contact rather than the placeholder because
+linking rekeys it to the real DID along with every other contact-keyed column (see
+*Linking when the person joins*). A row with a real DID and
+`dateAssigned IS NULL` is a claim still waiting to be edited.
+
+No foreign key to `contacts`: a cascade would let any `INSERT OR REPLACE` of
+the placeholder contact silently delete its claim links (see the
+`$insertContact` row above), and those links are the only record of which
+claims to fix. Orphan cleanup happens in code when a placeholder is deleted
+on purpose.
+
+The `role` column is part of the key because one claim can name the same
+placeholder as both giver and recipient.
+
+### Code changes
+
+**Prerequisite: make `$insertContact` an upsert that keeps the row**
+
+Change `INSERT OR REPLACE` to an `UPDATE ... WHERE did = ?`, followed by an
+`INSERT` only when no row was updated. That keeps the row's `id` and leaves
+its labels and other contact-keyed rows alone. An `INSERT ... ON CONFLICT(did)
+DO UPDATE` does the same in one statement, but needs SQLite 3.24+ on every
+platform's driver, and that hasn't been checked. This fixes an existing
+label-loss hazard and is worth shipping first, on its own.
+
+**Identity helpers** (`src/libs/endorserServer.ts`)
+
+- `PLACEHOLDER_KEY_PREFIX = "local:"`, `isPlaceholderKey(s)`, and
+  `newPlaceholderKey()` (uses `crypto.randomUUID()`).
+- `didInfoForContact`: a placeholder contact displays its name, with a marker
+  such as "(not on Time Safari yet)", and `known: true`.
+
+**Creating a placeholder**
+
+- Contacts view: an "Add someone without the app" action that asks only for
+  a name (notes and contact methods optional) and saves a contact with a new
+  placeholder key.
+- Gift dialog entity picker: the same action inline, so a user can create a
+  placeholder while recording a gift.
+- Device address book (once that integration exists): pick a person from the
+  phone's contacts. The placeholder is created with that name and phone
+  number filled in and already linked to the device contact.
+
+**Phone numbers, notes, and labels**
+
+These need no new storage. `ContactEditView` (`/contact-edit/:did`) edits
+`contactMethods` (the JSON column holding phone numbers, emails, and so
+on), `notes`, and labels through `contact_labels`, all keyed by the
+`contacts.did` value and with no server calls. A placeholder key in that
+route parameter works as-is. Changes needed:
+
+- Hide the server-backed parts of contact pages (visibility, registration,
+  the DID/key display) for placeholders. The edit form itself stays as it
+  is.
+- Store phone numbers in a normalized form (E.164, e.g. `+18015550100`)
+  alongside what the user typed, so they can be compared for matching when
+  the person joins (see *Linking*). Normalizing on save is cheaper than
+  normalizing on every comparison.
+
+**Device address-book links**
+
+Whatever table holds the link between an app contact and a device contact
+(Android lookup key / iOS `CNContact` identifier) is keyed by the
+`contacts.did` value, the same as `contact_labels`. That gives real contacts
+and placeholders one shared mechanism, and linking rekeys the link along
+with everything else. Two rules for that table:
+
+- No `ON DELETE CASCADE` foreign key to `contacts`, for the same reason as
+  `placeholder_claims`. Code cleans up these rows when a contact is
+  deleted on purpose.
+- Device identifiers mean nothing on another device, so a backup restored
+  elsewhere either leaves these rows out or re-checks them against that
+  device's address book.
+
+**One contact-keyed registry**
+
+Every table with a column holding a `contacts.did` value is listed in one
+constant, e.g. `CONTACT_KEYED_COLUMNS = [["contact_labels", "did"],
+["placeholder_claims", "contactKey"], ...]`, which `rekeyContact` and
+`deleteContact` iterate over. A test compares that list with the live
+schema: every foreign key to `contacts(did)` (from `PRAGMA
+foreign_key_list`), plus any column named `contactKey`. A table added later
+and left out of the list fails the test, so it can't be orphaned by a
+rekey.
+
+**Recording a claim** (`GiftedDialog`, offer dialog, `hydrateGive`, `hydrateOffer` callers)
+
+- When the chosen giver or recipient is a placeholder, pass `undefined` for
+  that DID to `createAndSubmitGive` / `createAndSubmitOffer`.
+- On success, insert a `placeholder_claims` row with the returned `handleId`,
+  the role, the active DID as issuer, and the API server.
+- If the submission succeeds but the local insert fails, show an error that
+  names the claim, because the link would otherwise be lost silently.
+- A placeholder on both sides is allowed: the server accepts a give with no
+  agent, no recipient, and no project.
+
+**Choosing a giver or recipient** (`EntityGrid`, `EntitySelectionStep`, `PersonCard`)
+
+Placeholders appear in the picker in alphabetical order, searchable by name,
+mixed in with real contacts. Because a placeholder is a row in `contacts`,
+this needs almost no list-merging work:
+
+- `GiftedDialog` passes `$contactsByDateAdded()` to `EntityGrid`, which
+  already builds both sections from that one array: "Recently Added" (the
+  first rows, newest by `id`) and "Everyone" (sorted by
+  `(name || did).toLowerCase()` with `localeCompare`). Placeholders land in
+  both sections with no extra query and no merge step.
+- `performContactSearch` filters the same array by name and DID substring
+  and sorts it the same way, so placeholders are searchable automatically.
+
+What does need care:
+
+- **Require a name.** Both sorts fall back to the DID when the name is blank,
+  which would put a nameless placeholder under "L" for `local:`. Saving a
+  placeholder requires a non-blank, trimmed name.
+- **Don't match on the key.** Searching "local" or a UUID fragment would
+  match every placeholder. In `performContactSearch`, compare against the
+  DID only when `!isPlaceholderKey(contact.did)`.
+- **One comparator.** The sort is written out twice (`alphabeticalContacts`
+  and `performContactSearch`). Pull it into one exported function, e.g.
+  `compareContactsByName`, so a placeholder tiebreak only has to be added
+  once. For a tie, put real contacts before placeholders and then compare
+  keys, so a real "Bob" and a placeholder "Bob" always come out in the same
+  order.
+- **Mark placeholders on the card.** `PersonCard` shows a small badge or
+  subtitle ("not on Time Safari yet"), and `EntityIcon` shows a fixed
+  "person without the app" icon rather than an identicon built from the
+  key. This matters most when two people share a name.
+- **Create from search.** When a contact search finds nothing (the
+  `filteredEntities.length === 0` message), offer "Add “<term>” as someone
+  without the app". The new placeholder is selected immediately and the
+  dialog moves to the next step. Next to the "Unnamed" `SpecialEntityCard`,
+  an "Add someone without the app" card covers the case where nothing has
+  been typed yet.
+- **Keep the selection key-based.** `handlePersonSelected` and
+  `isPersonConflicted` compare `did` strings, and the placeholder key works
+  there unchanged. Convert key → `undefined` only at submission time (see
+  *Recording a claim*), never in the picker, or two placeholders would
+  look identical to the conflict check.
+- **Filter where a real DID is required.** `ProjectRepresentativeDialog`
+  uses the same grid to pick someone who will act on the server, so it gets
+  `allContacts.filter(c => !isPlaceholderKey(c.did))`. The same goes for any
+  other picker whose choice is sent to the server as a DID.
+
+The `EntityGrid` doc comment says arrays must be sorted by date added
+(newest first). That holds for placeholders because they get ordinary
+autoincrement `id`s.
+
+**Guards: a placeholder key must never reach the server or another user**
+
+Every place that sends a contact's DID somewhere needs to skip or refuse
+placeholders. From the current code, that includes:
+
+- Visibility toggles and checks (`setVisibilityUtil`, "sees me" refresh)
+- Registration (`register`) and invite flows
+- Contact sharing: QR/JWT URL generation, CSV export (`CONTACT_CSV_HEADER`),
+  "copy selected contacts", `contactImportPayload`
+- Server-side give/offer totals per contact in `ContactsView` (`loadGives`)
+- The `/did/:did` route (`DIDView`), which queries the server: placeholders
+  open a local-only detail page instead
+- Meeting member flows (`MeetingMembersList`, `BulkMembersDialog`)
+
+As a backstop, `createAndSubmitClaim` throws if the serialized claim contains
+any `local:` key, so a missed guard fails loudly rather than publishing the
+key.
+
+**Backups**: the full data export (DataExportSection / backup) **includes**
+placeholders and the `placeholder_claims` table, since they exist only on
+this device. Contact sharing with other users **excludes** them.
+
+**Linking when the person joins**
+
+The placeholder's row **becomes** the real contact: its `did` value is
+rekeyed from the `local:` key to the real DID. Its `id`, phone numbers,
+notes, labels, device link, and claim rows all stay with it. Two contact
+rows are never kept for one person.
+
+1. The person's DID arrives the usual way (QR scan, contact link). Before
+   inserting it, the app checks for placeholders that match: the same
+   normalized phone number, the same device-contact link, or the same name.
+   It asks "Is this <name>, whom you recorded without the app?" The user can
+   also start from the placeholder's page ("This person joined") and pick a
+   contact that already exists.
+2. `rekeyContact(fromKey, toDid)`, in one transaction:
+   1. Read every contact-keyed row (from the registry) for both `fromKey`
+      and `toDid`.
+   2. If a contact row with `toDid` already exists, copy its server-derived
+      fields (`publicKeyBase64`, `nextPubKeyHashB64`, `seesMe`,
+      `registered`, `profileImageUrl`) onto the placeholder row, and fill
+      any other field the placeholder left empty. Then delete that row's
+      dependent rows and the row itself.
+   3. Delete the dependent rows for `fromKey`.
+   4. `UPDATE contacts SET did = toDid WHERE did = fromKey`.
+   5. Re-insert the union of both sets of dependent rows under `toDid`
+      (`INSERT OR IGNORE`, so a label both rows had is kept once).
+
+   Dependent rows are deleted before the update and re-inserted after it
+   because `UPDATE contacts SET did` fails while `contact_labels` rows
+   reference the old value and foreign keys are enforced. This order works
+   whether or not they are enforced, so it doesn't rely on
+   `PRAGMA defer_foreign_keys`. (That pragma also works, verified with the
+   `sqlite3` CLI, but only inside an explicit transaction.)
+3. Before any edits, warn about confirmations. Editing a claim does not
+   carry its confirmations over to the edited version, so the app lists the
+   linked claims that have confirmations (from the same data the claim
+   detail view shows) and says those confirmations will have to be given
+   again. The user can go ahead or cancel.
+4. For each `placeholder_claims` row for this contact with
+   `dateAssigned IS NULL`:
+   - skip it, with a message, if `issuerDid` is not the active identity
+     (the server accepts edits only from the claim's issuer; the message
+     names which of this device's accounts to switch to, if any), or if its
+     `apiServer` differs from the active one;
+   - fetch the current claim by handle ID, call `editAndSubmitGive` /
+     `editAndSubmitOffer` with the real DID in the row's role, keeping every
+     other field;
+   - set `dateAssigned` on success.
+5. When every row is assigned, its `placeholder_claims` rows can be
+   deleted; the contact itself stays, as an ordinary real contact. Any
+   unassigned rows stay listed on the contact's page with a retry button,
+   since some edits may need another account or a network connection.
+6. Prompt the user to tell the person. Once at least one claim is assigned,
+   offer to share a message (through the share sheet, or a contact method
+   saved on the placeholder) saying their earlier gifts are recorded under
+   their identity, with a link to their gifts.
+
+`hydrateGive` / `hydrateOffer` only set agent/recipient when a DID is passed
+and never clear them. That is correct for this flow (it only ever adds a
+DID), but a test should pin it so a later "clear when blank" change does not
+break assignment.
+
+### Tests
+
+- Migration test (`src/test/migrations.test.ts`): 012 applies on a database
+  that already has contacts and labels, and leaves them unchanged.
+- `createAndSubmitClaim` rejects a claim containing a `local:` key.
+- `$insertContact` on an existing DID keeps the row's `id` and its labels,
+  with foreign keys both on and off.
+- `rekeyContact`, with foreign keys both on and off: labels, claim rows,
+  and device links move to the real DID; the row's `id` is unchanged; when
+  a row for the real DID already existed, it is folded in and its labels
+  are kept.
+- Registry coverage: every foreign key to `contacts(did)` and every
+  `contactKey` column in the migrated schema appears in
+  `CONTACT_KEYED_COLUMNS`.
+- Each guard listed above returns early (or hides the control) for a
+  placeholder.
+
+## Rejected
+
+### Make `contacts.did` nullable and key contacts by `contacts.id`
+
+The relationally clean model: a contact without a DID is just a row with
+`did IS NULL`.
+
+- Requires rebuilding `contacts` (dropping `NOT NULL` is not possible with
+  `ALTER TABLE` in SQLite) and rebuilding `contact_labels` to reference
+  `contacts.id` — the same backup/drop/recreate pattern that made migration
+  008 fail on every startup for some users.
+- `Contact.did` becomes optional, which breaks type-checking at every lookup,
+  route, and mixin method keyed by DID across roughly 70 files, and every
+  `WHERE did = ?` method needs an `id` variant.
+- Gains nothing functional over the placeholder key: the key is a surrogate
+  ID that happens to live in the existing column.
+- Its one real advantage is that linking a DID never rekeys child rows. That
+  advantage depends on `id` being stable, and it isn't: `INSERT OR REPLACE`
+  gives the row a new `id`, and contact export/import doesn't keep `id`, so
+  ids don't match across devices. The `rekeyContact` registry gets the same
+  safety without a table rebuild.
+
+Worth revisiting only if contacts get rekeyed by `id` for some other reason.
+
+### A separate, permanent `contactKey` column on `contacts`
+
+Add `contacts.contactKey TEXT UNIQUE` that never changes (the `local:` key
+for placeholders, the DID for everyone else), and key every child table by
+it, so linking only sets `did`. It is additive for new tables, but
+`contact_labels` references `contacts(did)`, so moving it to the new key is
+a table rebuild. Every DID-keyed lookup would also need to decide which key
+it means. It costs more than the rekey function it replaces.
+
+### Separate `placeholder_people` table outside `contacts`
+
+No risk to existing tables, but every picker and list (gift dialog entity
+grid, contacts list, labels, search) must merge two sources of different
+types, and labels need a second mapping table. The recommended option gets
+those UIs for free because a placeholder is a contact.
+
+### Fake DID written into the published claim
+
+E.g. `did:none:<uuid>` or a random `did:ethr:` with no key behind it, sent
+to the server as the agent/recipient.
+
+- Publishes a dangling identifier that other users see as "Someone Visible
+  But Not In Your Contact List"; it never resolves.
+- `did:none:` is the server's hidden-DID namespace (`did:none:HIDDEN`);
+  reusing the prefix risks the server treating it as hidden or rejecting it.
+- The claim still has to be edited when the person joins, so it saves no
+  work; the only gain is finding claims by server search, which the local
+  table already provides.
+
+### Custodial key: generate a real identity for the person
+
+The app creates a real keypair for the placeholder and uses its DID in claims;
+when the person joins, they import that key, so no claims need editing.
+
+- The user's device holds another person's private key, and every claim
+  "about" them was made while someone else held their identity.
+- The person may already have an identity, or may install on a device
+  without a way to receive the key; then the claims need editing anyway.
+- Handing over a seed phrase is a security-sensitive step this app's
+  onboarding does not have.
+
+### Put the person's name in the claim (`agent: { name: "..." }`)
+
+- Publishes a name for someone who has not consented to being on the
+  platform; server visibility rules hide DIDs, not free-text names.
+- Still needs the local record to assign the DID later.
+- Server acceptance of an agent without `identifier` is unverified.
+
+### Store linked claim IDs as a JSON column on `contacts`
+
+An `ALTER TABLE contacts ADD COLUMN placeholderClaims TEXT` is also additive,
+but role, issuer, server, and assignment status per claim fit a table
+better, and any whole-row rewrite of the contact (such as `INSERT OR
+REPLACE` from a stale copy) could overwrite the list.

doc/CHANGES/PLAN-new-activity-alert-search.md

@@ -0,0 +1,353 @@
+# Plan: New Activity Screen on alertSearch
+
+## Goal
+
+The New Activity screen (`/new-activity`, `src/views/NewActivityView.vue`)
+shows the same total the daily push or text reported, broken down by kind of
+activity. Each kind opens a page with the exact list and count for that kind.
+When a page's count differs from the number the person was told, the page
+says why.
+
+## The two endpoints
+
+alertSearch has two halves. Each returns **lists**, not counts; a count is a
+list's length.
+
+| Bucket | Server | What it holds | Needs |
+|---|---|---|---|
+| `claims` | endorser `/api/v2/report/alertSearch` | Claims by others with you as `toEntity` or `fromEntity` (offers, gives, every other claim type) | — |
+| `personalPlanContributions` | endorser | Gives and offers to or from projects you issued or are agent of (your own claims included) | — |
+| `trackedPlanUpdates` | endorser | Edits to starred projects | `planHandleIds` |
+| `trackedPlanClaims` | endorser | Gives and offers to or from starred projects | `planHandleIds` |
+| `plansNearby` | endorser | Projects created or edited in the search area | `location` |
+| `profilesNearby` | partner `/api/partner/alertSearch` | Profiles created or edited in the search area | `location` |
+| `profilesSimilar` | partner | Profiles close in meaning to your profile, best first, at most 50, not paged | a profile with text |
+| `plansSimilar` | partner | Projects close in meaning to your profile, best first, at most 50, not paged | a profile with text |
+
+Paging facts (from the endorser-ch handlers):
+
+- Each server has one cursor covering all of its buckets. Endorser cursors
+  look like `1234567`; partner cursors look like `45678-1234567` (partner
+  position, then main position). Clients treat both as opaque text, compared
+  only for equality.
+- `afterCursor` returns changes after it, oldest first; `beforeCursor` returns
+  changes before it, newest first. Both together bound a window.
+- A page holds at most 50 rows per list, all cut at the same change point;
+  `hasMore` is one flag for the whole page.
+- A row's `changeSeq` is not a cursor, so no cursor points at a single item.
+
+## How the notification service counts
+
+`notification-wakeup-service` runs one daily alertSearch per channel and
+identity:
+
+- `src/alertSearch/retrieve.ts` calls both endpoints with the channel's stored
+  `afterCursor`, `planHandleIds` and `location`, pages forward while `hasMore`
+  (at most 20 pages), and merges the pages.
+- `src/alertSearch/digest.ts` totals all eight buckets.
+- Cursors are stored per channel (`fcm` and `sms` in separate tables) and
+  advance after every run in which both sources complete, sent or not. Each
+  daily count therefore covers only changes after the previous run, whether or
+  not the person opened the app in between, so no item is counted in two
+  notifications. Rejected: subtracting the previous day's count, which would
+  subtract it twice.
+- An upload carrying a cursor for a server replaces that server's stored
+  cursor, and the first run counts from it. An upload without one leaves the
+  stored cursor alone.
+- A run with no stored cursor for a server only stores that server's cursor
+  and counts nothing from it. The app avoids this by sending cursors with
+  every upload that turns a channel on (see "Starting from the latest
+  change").
+- The SMS body is `Gift Economies: you have N new updates.
+  https://giftopia.me/deep-link/new-activity?c=<start cursors> Reply STOP to
+  end.` The FCM payload carries title, body, `type: "alert_search"` and `c`.
+
+## Read state
+
+Stored as JSON in one settings column, `newActivityCursors`
+(`NewActivityCursorState` in `src/libs/newActivity.ts`):
+
+- **Visit window**, one cursor per server. The summary counts every bucket from
+  its start, the same window the notification service counts from once the
+  visit is uploaded to it, except a bucket whose list was opened after that
+  start was recorded: it counts from the end of that list (`summaryStart` in
+  `src/libs/newActivity.ts`, `countSummaryActivity` in
+  `src/services/newActivity.ts`).
+- **Bucket window**, one per bucket, on that bucket's server. A detail page
+  lists everything since the end of its last load, so opening it marks the
+  bucket read; reopening it shows nothing new until more arrives, and "Show
+  earlier" lists what it showed before. A bucket never opened starts where the
+  summary does, so its first detail count equals the summary's.
+- **Uploaded**, the cursors last sent to each notification channel.
+
+A window records where a load counted from (`from`) and when that cursor was
+recorded (`fromSeenAt`), where it ended (`to`) and when (`seenAt`), and when
+the visit began (`at`). A summary load less than 30 minutes after `at` is the
+same visit and counts from the same `from`, so reloading the summary keeps the
+counts of unopened lists; a later load starts a new visit from the last
+`to`. "Mark unread from this item" does not exist, since no cursor points at an
+item.
+
+The first load ever has no cursor. It only records where to start and shows
+nothing as new:
+
+1. The app sends each server a request with no cursor and no ID. The server
+   answers with its most recent rows and its latest cursors
+   (`nextAfterCursor`).
+2. The app ignores the rows: every count is 0 and every list is empty
+   (`countServer` and `loadBucket` in `src/services/newActivity.ts` count
+   nothing without a start).
+3. It stores a visit ending at those cursors (`seedIfNeeded`, `seededState`),
+   with a start time long past, so the next load counts from them.
+
+Home and the detail pages seed before counting; the summary's own first load
+does the same, since the end of a load with no start becomes the start of
+the next visit. Turning on notifications seeds too, with the cursors it
+uploads. Seeding needs both servers to answer; otherwise nothing is stored,
+nothing shows as new, and the next load tries again. A detail page's "Show
+earlier" still lists what came before the seed.
+
+Arriving through a notification link with no visit yet counts from the
+link's `c` instead.
+
+Rejected: starting endorser after the oldest `lastAcked*JwtId` (`afterId`) so
+items unread on the earlier screen stay unread; the app would then depend on
+the ID path that endorser-ch plans to retire.
+
+Opening a detail page also moves the `lastAcked*JwtId` read markers
+(`claims` → offers to you, `personalPlanContributions` → offers to your
+projects, `trackedPlanUpdates` → starred changes), which the Recent Offers
+pages use to mark the last-read offer.
+
+## Summary screen
+
+- One alertSearch call per server from the visit start, paging forward while
+  `hasMore` up to 4 pages; past that a count shows "+".
+- Same inputs as the notification service: `planHandleIds` from
+  `settings.starredPlanHandleIds`, `location` from the first
+  `settings.searchBoxes` entry converted from `BoundingBox` to
+  `minLocLat/maxLocLat/minLocLon/maxLocLon`.
+- The total at the top is the sum of all eight buckets, as the service totals
+  them, so with no activity since the run it equals the notified number.
+- With no search box, the location rows link to `/search-area`; with no
+  starred projects, the tracked rows show a hint.
+- A server that fails shows "?" on its buckets and the error; the other
+  server's counts appear, and the visit does not move.
+
+## Home screen
+
+The Home screen shows one tile per bucket with something unseen, in the
+summary's order, from the same eight alertSearch buckets
+(`countUnseenActivity` in `src/services/newActivity.ts`).
+
+- Each tile shows the count (with "+" past the page limit) and the bucket's
+  label, and opens that bucket's detail page with `?expected=` set to the
+  count. "View All New Activity For You" opens the summary.
+- A bucket counts from the end of whichever load the person saw last: the
+  summary's visit or that bucket's own list (`unseenStart` in
+  `src/libs/newActivity.ts`, ordered by each window's `seenAt`). It never
+  uses a visit's start, so a summary just loaded shows no tiles, even inside
+  the 30-minute visit in which the summary keeps showing its counts.
+- Buckets on one server with the same start share one request, so with no
+  list opened since the summary, Home makes one request per server.
+- Home writes the cursor state only to seed it on the first load ever; it
+  never starts a visit otherwise, and never uploads to the notification
+  service.
+- Tile test IDs are `newActivityNumber-<bucket>`.
+
+## Detail pages
+
+One view, `/new-activity/:bucket` (`NewActivityBucketView.vue`), calls the
+same endpoint from the bucket start and shows only that bucket, so its count
+is exact. A per-bucket legacy endpoint cannot match it: `/report/offers`
+holds only offers, while `claims` holds every claim type that names you.
+
+- The heading shows its own count. The summary and the Home tiles pass their
+  count as `?expected=`; when they differ, a note says how many came before
+  the tapped count started, or that the list has fewer than it showed.
+  Rejected: handing Home's rows to the detail page, which saves one request
+  while this query runs anyway after a deep link, a relaunch, a capped count
+  or a different bucket start.
+- "Show more" continues forward; "Show earlier" pages back with
+  `beforeCursor` from the bucket start, listing items already seen.
+- Rows (`NewActivityRow.vue`) link to `/claim/:id`, `/project/:handleId`,
+  `/user-profile/:rowId`; similarity matches show their match percentage.
+- `trackedPlanUpdates` keeps the before/after diff (`PlanChangeDiff.vue`),
+  fed by `plansLastUpdatedBetween` for the page's handle IDs with `afterId`
+  just before the oldest edit, because alertSearch plan rows carry no earlier
+  claim.
+- The `claims` and `personalPlanContributions` pages link to
+  `RecentOffersToUserView` and `RecentOffersToUserProjectsView`.
+- endorser-ch returns `claim` on `claims` rows, so the page can say what was
+  offered or given.
+
+## Re-registering notifications on visit
+
+When the summary (`/new-activity`) opens a new visit and the push or text
+channel is on, the app re-uploads that channel's alert authorization in the
+background, after the counts are on screen: a fresh
+JWT batch replacing the unused one, with the visit's end cursors, the starred
+handle IDs and the search area. The next daily count then starts from this
+visit and uses the person's current starred projects and area.
+
+- It reuses `mintAlertAuthorizationBatch` and the POST
+  `/notifications/alert-authorization` and POST
+  `/notify-sms/alert-authorization` routes
+  (`src/services/notifications/newActivityRefresh.ts`).
+- It is skipped inside the same visit, and when the channel already counts
+  from this visit's start and nothing is new.
+- Detail pages and the Home screen never upload. A detail page's window is
+  narrower than the service's single cursor per server, so uploading it would
+  drop the other buckets' unseen items from the next notification.
+- Changing the text time re-uploads without cursors, so nothing waiting for
+  the next text is dropped.
+
+Notification service changes this needs:
+
+1. `AlertAuthorizationRequestBody` accepts optional `endorserAfterCursor`,
+   `partnerAfterCursor`, `planHandleIds` and `location`; the routes write all
+   four into that channel's cursor table.
+2. The daily run sends the stored `planHandleIds` and `location` to
+   alertSearch.
+3. `replaceUnusedBatch` skips days that already hold a consumed JWT.
+   Without that, a re-upload after today's run installs an unused JWT for
+   today, and the scheduler runs and pushes a second time the same day (SMS
+   has a per-phone daily cap; FCM has none).
+4. `profilesSimilar` and `plansSimilar` join the total on both sides:
+   `mergePartner` keeps them (deduplicated by profile `rowId` and plan
+   `handleId`) and `ALERT_SEARCH_DIGEST_BUCKETS` lists them.
+5. Cursors advance only when both sources complete, so a half-failed run
+   repeats the whole window on its retry.
+6. A run with no stored cursor for a source seeds that cursor and counts
+   nothing from it.
+
+## Starting from the latest change
+
+Turning on push or text notifications (the toggles in `AccountViewView.vue`)
+sends the latest cursors with the first upload, so the first notification
+counts only what happens after the person turned it on. The app gets those
+cursors from one alertSearch call per server, made just before the upload,
+and stores them as its visit when it has none. Each server stands alone: one
+that does not answer gets the end of the last visit instead, and with neither
+its cursor is left out of the upload. Service change 6 covers only that last
+case.
+
+## Notification links carry the window
+
+Each run holds the cursors it counted from (`startCursors` on the daily
+result). The text and the push carry them, so the app can tell whether it is
+looking at the same window the person was told about.
+
+- SMS URL: one parameter joining both servers' start cursors with `.`:
+  `https://giftopia.me/deep-link/new-activity?c=1234567.45678-1234567`.
+  That adds about 25 characters; the body stays inside one 160-character
+  segment for counts under 10,000. A first run counts nothing and sends no
+  text.
+- FCM: the same `c` in the data payload, and a tap routes to
+  `/new-activity?c=…`.
+- App: `deepLinkQuerySchemas["new-activity"]` accepts optional `c`. When `c`
+  differs from the visit start, the summary also counts from `c` and compares
+  totals: fewer since the visit means "you may have already seen some of what
+  it counted"; more means "this includes N from before that notification".
+- Optional, for an exact replay: also send the run's end cursors and offer a
+  "Show what the notification counted" view using `afterCursor` = start and
+  `beforeCursor` = end. That doubles the URL addition and can push the text
+  past one segment.
+
+## Steps
+
+App (`crowd-funder-for-time-pwa`):
+
+- [x] HTTP client and paging in `src/libs/alertSearch.ts`.
+- [x] Bucket registry and cursor state in `src/libs/newActivity.ts`; loads in
+  `src/services/newActivity.ts`.
+- [x] Settings column `newActivityCursors`, migration
+  `012_add_newActivityCursors_to_settings`.
+- [x] `NewActivityView.vue` as the summary, with the `c` comparison.
+- [x] `NewActivityBucketView.vue`, `NewActivityRow.vue`, `PlanChangeDiff.vue`,
+  route `/new-activity/:bucket`.
+- [x] Re-upload on visit; latest cursors from the enable toggles.
+- [x] `c` in the deep-link query schema; FCM taps open New Activity with `c`.
+- [x] First load seeds cursors and shows nothing; no `afterId` sent.
+- [x] Home tiles for all eight buckets, each opening its detail page, counted
+  from `unseenStart`; the legacy `/report/offers`,
+  `offersToPlansOwnedByMe` and starred-changes counts removed from Home.
+- [x] Jest tests (`src/test/newActivity.test.ts`); Playwright specs 50 and 55
+  updated.
+- [x] Playwright specs 50 and 55 pass against local servers in Chromium and
+  Firefox.
+- [x] CHANGELOG entry (1.4.10).
+- [x] Test and start-up fixes found while running the specs (Home records
+  where New Activity starts in parallel with the feed, Affirm Delivery waits
+  for the offer's project, a WebAssembly explanation on the start-up error
+  screen, test warm-up, retry and reporter).
+- [ ] Release the app after endorser-ch is deployed, since detail rows read
+  `claim` from `alertSearch` — next: release (Trent)
+
+Notification service (`notification-wakeup-service`):
+
+- [x] Service changes 1–6, `c` in the SMS link and FCM data, tests, README,
+  CHANGELOG.
+- [ ] Deploy to test and production — next: deploy, or tick this if done
+  (Trent)
+
+endorser-ch:
+
+- [x] `claim` on `claims` rows of `/api/v2/report/alertSearch`, CHANGELOG.
+- [x] An Offer that names its plan in `itemOffered.isPartOf` (as the app
+  sends) gets `toEntity`, so it reaches the owner's
+  `personalPlanContributions` and `trackedPlanClaims`; migration V23 fills
+  existing offers without moving `changeSeq`; test, CHANGELOG.
+- [ ] Commit the `isPartOf` change: `CHANGELOG.md`, `sql/README.md`,
+  `sql/V23__offer_is_part_of_to_entity.sqlite3`, `claim.service.js`,
+  `endorser.db.service.js`, `test/controller-endorser-6-plans-totals.js` —
+  next: commit (Trent)
+- [ ] Deploy to test, then production, running Flyway on the main DB so V23
+  applies — next: deploy (Trent)
+- [ ] Leave a person's own gives and offers out of their
+  `personalPlanContributions` (the query includes them when a person
+  contributes to their own project) — next: implement after the deploys above (agent)
+  - endorser-ch: add `AND j.issuer != ?`, bound to the requesting DID, to
+    both halves of the `UNION` in `jwtsForUserPlanContributions`
+    (`endorser.db.service.js`), as `jwtsWithDidAfterId` does.
+  - endorser-ch test in `controller-endorser-6-plans-totals.js`: user 1's own
+    offer to user 1's plan is absent from user 1's
+    `personalPlanContributions`, and user 2's offer is present.
+  - App spec 50 "Record an offer": record the offer as User 1
+    (`importUserFromAccount(page, "01")`) on a project User 0 owns, then
+    switch to User 0 to check the `personalPlanContributions` tile and list.
+    "Affirm delivery" then gets User 1 as giver and the project as recipient.
+  - endorser-ch CHANGELOG entry; the notification service needs no change,
+    since its counts come from the same query.
+
+## Out of scope
+
+- The native background fetcher (`TimeSafariNativeFetcher`) keeps its own
+  read state.
+
+## History
+
+Closed findings from reading the notification service before these changes
+(2026-10-15):
+
+- The schedulers called `runDailyAlertSearch(userId, now, {})`, and the upload
+  body had no field for `location` or `planHandleIds`, so `trackedPlanUpdates`,
+  `trackedPlanClaims`, `plansNearby` and `profilesNearby` were always empty: the
+  reported total was `claims` + `personalPlanContributions`.
+- `profilesSimilar` and `plansSimilar` were dropped when partner pages merged.
+- Each source's cursor advanced on its own, so when one source completed and
+  the other failed, the retry started past the completed source's rows and
+  never counted them.
+- A first run counted the server's newest page, up to 50 rows per bucket of old
+  activity.
+
+Closed decisions:
+
+- 2026-10-16: the first load seeds cursors and shows nothing, replacing the
+  `afterId` handoff from the oldest `lastAcked*JwtId`, so the app sends
+  `alertSearch` only cursors and endorser-ch can retire the ID path. A person
+  upgrading with unread offers sees them under "Show earlier" and on the
+  Recent Offers pages, not as new.
+- 2026-10-16: detail pages query `alertSearch` themselves and do not reuse
+  Home's rows; an in-memory hand-off would be a second path that every
+  entry other than a fresh, uncapped Home tile skips.

doc/CHANGES/PLAN-restore-web-push.md

@@ -0,0 +1,167 @@
+# Plan: Web Push on the Web Build
+
+## Goal
+
+A user of the web build (browser tab or installed web app) can turn on the
+Daily Reminder and New Activity notifications and receive them, matching what
+native builds deliver.
+
+Requirements:
+
+1. A `DIRECT_NOTIFICATION` push shows its message as sent.
+2. A `DAILY_CHECK` push shows the count of new activity for the active
+   identity, using the same Endorser query the native fetcher uses.
+3. The service worker never holds a long-lived credential: it holds only
+   day-scoped JWTs, the same pool native builds hand to their background
+   fetcher.
+4. The Notifications section of the Account view works on the web build.
+
+## Can FCM replace Web Push?
+
+No. Firebase Cloud Messaging on the web (the `firebase/messaging` SDK) is a
+layer over the browser Push API: `getToken()` requires a registered service
+worker (`firebase-messaging-sw.js` by default), and that worker must display the
+notification, the same as a plain Web Push worker. FCM changes only the
+sending side — the push server would call the FCM HTTP v1 API instead of
+sending VAPID-signed Web Push requests — and it adds a Google dependency and
+Firebase config to the web build. It removes none of the work below.
+
+## Current state
+
+- `public/sw.js` is registered by `src/main.web.ts` on the web platform. It
+  handles only the Web Share Target POST; it has no `push` or
+  `notificationclick` handler.
+- The Notifications section of the Account view renders only on native
+  (`v-if="isNativePlatform"`, `src/views/AccountViewView.vue:81`), and the
+  "Notification Push Server" setting is hidden with `v-if="false"`
+  (`src/views/AccountViewView.vue:719`). Web users cannot subscribe.
+- `src/components/PushNotificationPermission.vue` contains the web
+  subscription flow:
+  - GET `{pushUrl}/web-push/vapid` for the VAPID key (`:242`);
+  - `pushManager.subscribe({ userVisibleOnly: true, ... })` (`:538`);
+  - POST of the subscription to the relative URL `/web-push/subscribe`
+    (`:583`), so the web host must proxy that path to the push server;
+  - `askPermission()` sends the worker the placeholder secret
+    `"temporary-secret"` via `SEND_LOCAL_DATA`, which nothing reads.
+- The push server sends a JSON payload whose `title` is `DAILY_CHECK` (run the
+  new-activity check) or `DIRECT_NOTIFICATION` (show `message` as-is).
+- Account data lives in SQLite through absurd-sql, which a service worker
+  cannot open. The worker therefore cannot decrypt the identity and sign its
+  own JWTs.
+- Native builds solve the same problem with `mintBackgroundJwtTokenPool()`
+  (`src/libs/crypto/backgroundJwtPool.ts`): 100 JWTs, each valid for one UTC
+  day, stored at index `epochDay % 100`, handed to the background fetcher by
+  `configureNativeFetcherIfReady()`
+  (`src/services/notifications/nativeFetcherConfig.ts`). Passkey (`did:peer`)
+  identities cannot mint the pool and raise
+  `BackgroundJwtUnsupportedIdentityError`.
+
+## Work
+
+### 1. Service worker push handling (`public/sw.js`)
+
+- `push`: parse the JSON payload.
+  - `DIRECT_NOTIFICATION`: `showNotification("Direct Message", { body: message })`.
+  - `DAILY_CHECK` (and any other title): take the token for today's slot from the
+    pool, GET `{apiServer}/api/v2/report/claims` with it, count claims newer
+    than the stored `lastNotifiedClaimId`, store the newest ID, and show "There
+    is 1 new activity" / "There are N new activities".
+- `notificationclick`: close the notification, focus an open app window or open
+  `/`.
+- Worker state (token pool, `apiServer`, `activeDid`, `lastNotifiedClaimId`)
+  lives in the worker's own IndexedDB database, never in the app's SQLite
+  database.
+
+### 2. Hand the token pool to the worker
+
+- On app start, identity change, and pool expiry, mint the pool with
+  `mintBackgroundJwtTokenPool()` and `postMessage` it to the worker together
+  with `apiServer` and `activeDid`. Reuse the trigger points in
+  `src/services/notifications/notificationAuthLifecycle.ts`
+  (`onNotificationAuthMayBeReady`).
+- Delete the `SEND_LOCAL_DATA` / placeholder-secret path in
+  `PushNotificationPermission.vue`.
+- Passkey identities: do not offer New Activity notifications (the Daily
+  Reminder needs no token).
+
+### 3. Empty daily checks
+
+Chrome requires every push received with `userVisibleOnly: true` to show a
+notification. A `DAILY_CHECK` that finds nothing new must show one anyway, or
+Chrome eventually shows its own "This site has been updated in the background"
+notice. Choose one (see Open questions):
+
+- show a quiet "No new activity" notification and close it after a short delay;
+- have the push server skip pushes when there is nothing new, which requires
+  the server to query Endorser on the user's behalf.
+
+### 4. Re-enable the UI on the web build
+
+- Render the Notifications section on web when `"PushManager" in window` and a
+  service worker is registered, instead of only on native.
+- Restore the "Notification Push Server" setting for web.
+- iOS Safari delivers Web Push only to web apps added to the Home Screen
+  (iOS 16.4+). `public/manifest.webmanifest` is linked from `index.html` and
+  makes the app installable; the UI must explain the Home Screen requirement on
+  iOS.
+
+### 5. Hosting
+
+- Confirm each web host (test, production, Docker `docker/*.conf`) proxies
+  `/web-push/subscribe` to the push server, or change the client to POST to
+  `{pushUrl}/web-push/subscribe`.
+- Serve `sw.js` with `Cache-Control: no-cache` so worker updates reach users
+  promptly.
+
+### 6. Tests
+
+- Playwright: register the worker, then deliver pushes with the Chrome DevTools
+  Protocol `ServiceWorker.deliverPushMessage` and assert on the shown
+  notification (`registration.getNotifications()`), for both payload types.
+- Unit-test the claim-counting function, extracted so it runs outside the
+  worker.
+
+## Estimate
+
+Two to four days of work, plus push-server and nginx checks (low confidence:
+the push server's current behavior and routing are not visible from this
+repository).
+
+## Open questions
+
+- Empty daily checks: silent-notification workaround, or server-side filtering?
+- Does the push server serve `/web-push/vapid` and accept
+  `/web-push/subscribe`, and does it send `DAILY_CHECK` daily?
+- Should New Activity on web use the same Endorser query as the native fetcher
+  (starred-plan changes) rather than `/api/v2/report/claims`, so both platforms
+  report the same thing?
+
+## Rejected
+
+- **FCM for web:** still needs a service worker; adds a Google dependency to the
+  web build and a server-side switch to the FCM API. See "Can FCM replace Web
+  Push?".
+- **Reviving the old worker scripts (`sw_scripts/safari-notifications.js`):**
+  they read the Dexie `TimeSafari` IndexedDB database, which no longer holds
+  accounts, and decrypted the identity inside the worker using a secret passed
+  from the page, shipping NaCl and noble crypto libraries into the worker. The
+  day-scoped token pool needs neither.
+
+## History
+
+- 2025-02-18 (`2746b8fe`): the Vite config reorganization switched the web build
+  to a Workbox-generated worker, so the custom push, notification-click, and
+  share-target handlers stopped shipping.
+- 2025-07-18 (`8bc1c521`): VitePWA and the generated worker were removed; the
+  web manifest stopped being generated and linked.
+- The leftover `sw_scripts/` files and PWA config were deleted, and
+  `public/sw.js` was added for the Web Share Target only.
+
+## Checklist
+
+- [ ] Decide the empty-daily-check behavior
+- [ ] Confirm push-server endpoints and routing per environment
+- [ ] `push` and `notificationclick` handlers in `public/sw.js`
+- [ ] Token-pool handoff to the worker; remove the placeholder secret
+- [ ] Re-enable the web Notifications UI, with the iOS Home Screen note
+- [ ] Playwright push-delivery tests

doc/CHANGES/PLAN-startup-db-failure-recovery.md

@@ -0,0 +1,129 @@
+# Plan: Startup Database Failure — Diagnostics and Degraded Mode
+
+## Goal
+
+When the local database cannot be opened, a user should (1) get a useful
+report to the developers with one tap, and (2) keep using whatever
+parts of the app do not need local storage, with a clear path to recovery.
+
+Requirements:
+
+1. A failure report reaches the developers without the user composing an email,
+   and it carries enough to identify the cause on the first report.
+2. The report is sent only with the user's consent and holds no keys, seed
+   phrases, or contact data.
+3. A user whose database is down can browse public content (feed, projects,
+   claims) instead of being held on the recovery screen.
+4. Every action that needs the database or an identity is visibly disabled with
+   the real reason, and points to the recovery screen.
+5. Recovery steps never delete the database without keeping a copy.
+
+## Startup failure behavior
+
+- `CapacitorPlatformService._initialize()`
+  (`src/services/platforms/CapacitorPlatformService.ts`) opens the database in
+  three steps: "create connection", "open database", "run migrations". A
+  failure throws `Failed to initialize database (step: <step>): <cause>`.
+- `src/utils/startupError.ts` recognizes that error by its message and hands it
+  to `StartView` through `sessionStorage`.
+- Three places catch it and redirect to `/start`: the router `errorHandler`
+  and `beforeEach` guard (`src/router/index.ts:344`, `:363-454`), and the Vue
+  global error handler (`src/main.common.ts`).
+- The guard calls `retrieveAccountDids()` for every route except the
+  identity-setup routes, so with the database down every route except
+  `/account`, `/test` and `/logs` lands on `/start`.
+- `StartView` shows the recovery screen: Try Again, Email/Copy Details,
+  "Save a Copy of My Data" (`shareDatabaseFile()`), and "Start Over"
+  (`resetDatabase()`, which copies the file aside before deleting it).
+- API reads work without an identity: `getHeaders()`
+  (`src/libs/endorserServer.ts:430`) omits the Authorization header when there
+  is no DID.
+- Every path that creates, saves, or signs with an identity reads the `secret`
+  and `accounts` tables (`src/libs/util.ts`: `saveNewIdentity`,
+  `retrieveFullyDecryptedAccount`), so no action that needs a DID can work while
+  the database is down.
+
+## Part A: One-tap diagnostics report
+
+Contents of the report:
+
+- the startup error message (step and cause) and stack
+- app version, platform, OS version, device model
+- Android: WebView version and installer package (`getInstallerPackageName`)
+- whether a database file existed before the first connection attempt of this
+  process, which shows whether Android restored a backup at install time
+- whether the SQLite plugin loaded (a plugin load failure surfaces as a
+  `CapacitorSQLitePlugin:` prefix on the cause)
+- the `migrations` table contents, when the database opens far enough to read it
+
+Delivery: a POST to an endpoint on a server the project runs. The recovery
+screen shows the exact payload and a Send button; the email option stays for
+users who decline.
+
+The database-existed flag needs a native-side or `Filesystem.stat` check before
+`createConnection`; `databaseDirectoryUri()` already resolves the directory on
+Android and iOS.
+
+## Part B: Degraded mode
+
+- Change the router guard so that a database startup error records the error
+  and lets read-only routes through: home feed, projects, project and claim
+  views, and discovery. Identity-setup routes and anything that writes stay
+  redirected to `/start`.
+- Show a persistent banner on every page while in degraded mode: "Your
+  device's storage isn't working. You can look around, but you can't act yet.
+  Fix it →", linking to the recovery screen.
+- Disable buttons that need a DID or the database (give, offer, create project,
+  confirm, invite, contacts) with that same reason, instead of the
+  "someone must register you" text an unregistered user sees.
+- Default `apiServer` in every settings fallback. `$accountSettings()`
+  (`src/utils/PlatformServiceMixin.ts:1071-1136`) returns `defaultSettings` or
+  the caller's `defaults` (often `{}`) on its early-return and error paths, so
+  `apiServer` can be undefined; `HomeView` works around this on its own.
+- Order the recovery screen as a ladder: Try Again → Send Diagnostics → Save a
+  Copy → Start Over.
+
+## Part C (optional): An identity that does not need SQLite
+
+Key generation is pure (`generateSeed` → `deriveAddress` → `newIdentifier`).
+In degraded mode the app could generate an identity, require the user to write
+down the seed phrase, and keep the mnemonic in `@capacitor/preferences`
+(installed, and independent of SQLite). The user would then have a DID someone
+can register. When the database opens again, the app imports the identity from
+Preferences and deletes the Preferences copy.
+
+Trade-off: the mnemonic sits unencrypted in Preferences, about the same
+protection as the database's secret stored next to the data it encrypts.
+Worth building only if startup failures keep being reported with the plugin's
+encryption setting (`androidIsEncryption: false`) in effect.
+
+## Open questions
+
+- Which server and endpoint receive diagnostics, and how long reports are kept.
+- Whether to quarantine a corrupt database automatically ("file is not a
+  database", "malformed") and start fresh. Automatic quarantine trades a
+  visible failure for a silent switch to a new identity, and some "malformed"
+  databases are recoverable with `REINDEX` or `.recover`; the manual Start Over
+  button covers this case.
+- Whether Android backup should include `databases/`. Including it restores a
+  user's identity on a new phone; it also gives the Google backup a copy of the
+  keys together with the secret that decrypts them. The backup rules
+  (`android/app/src/main/res/xml/backup_rules.xml`,
+  `data_extraction_rules.xml`) include it.
+
+## Rejected
+
+- An IndexedDB (absurd-sql) database as a fallback inside the Capacitor
+  WebView: untested there, and two stores that both hold keys risk losing an
+  identity when they disagree.
+
+## Checklist
+
+- [ ] A1. Decide the diagnostics endpoint and payload retention.
+- [ ] A2. Capture "database file existed before first connection" during startup.
+- [ ] A3. Build the report payload and the Send Diagnostics button with preview.
+- [ ] B1. Let read-only routes through the router guard on a database startup error.
+- [ ] B2. Degraded-mode banner and disabled-action reasons.
+- [ ] B3. Default `apiServer` in all `$accountSettings()` fallbacks.
+- [ ] B4. Reorder the recovery screen.
+- [ ] C1. (Optional) Preferences-backed identity with import on recovery.

doc/CHANGES/history/fix-startup-db-crash.md

@@ -0,0 +1,124 @@
+# Fix: Startup Database Error on Android
+
+## Symptom
+
+On some Android installs from the Play Store, the app showed a "Startup
+Error" on every launch:
+
+```
+[CapacitorPlatformService] Failed to initialize database
+```
+
+Reinstalling did not help. The failure never appeared on developer devices
+installed through adb or Android Studio. Full symptom report:
+`startup-db-error-symptoms.md`.
+
+## Causes
+
+### 1. The SQLite plugin ignored its configuration (main cause)
+
+`capacitor.config.ts` listed the SQLite settings under the key `CapSQLite`.
+The plugin registers as `CapacitorSQLite` and reads only that key, so every
+setting under `CapSQLite` was ignored and the plugin defaults applied:
+
+- **Android:** `isEncryption` defaults to true, so on every launch the plugin
+  created an Android Keystore master key and opened an
+  `EncryptedSharedPreferences` file (`sqlite_encrypted_shared_prefs`) to hold a
+  database passphrase. If that step throws, the plugin fails to load and every
+  `createConnection` call is rejected.
+- **iOS:** the database location defaults to `Documents`, not the configured
+  `Library/CapacitorDatabase`.
+- **Electron:** the plugin reads `plugins.CapacitorSQLite` directly, so a
+  bundled config with the wrong key would throw at plugin startup.
+
+The Keystore step fails on Android in two ways:
+
+- **Restore without the key.** Android Auto Backup and device-to-device
+  transfer restore the encrypted preferences file, but Keystore keys never
+  leave the device. The restored file can't be decrypted, so the plugin fails on
+  every launch, and a reinstall from Play restores the same file again.
+- **Device Keystore bugs.** Some manufacturers' Keystore implementations fail
+  without any restore.
+
+The app never used plugin encryption: it opens the database with
+`encrypted = false` and mode `"no-encryption"`, and never stores a passphrase.
+The Keystore setup protected nothing.
+
+### 2. A migration could be applied but not recorded
+
+The migration runner ran each migration's SQL in one transaction and recorded
+its name in the `migrations` table in a second one. If the app died between the
+two, the migration ran again on the next launch. Migration 001's
+`INSERT INTO secret (id, ...) VALUES (1, ...)` then failed with
+`UNIQUE constraint failed: secret.id` on every launch. The window is
+milliseconds, but once hit the failure is permanent, and Auto Backup carries it
+to a reinstall.
+
+## Changes
+
+| Area | Change |
+|---|---|
+| `capacitor.config.ts`, `electron/capacitor.config.ts`, `android/app/src/main/assets/capacitor.config.json` | Key renamed to `CapacitorSQLite`, so `androidIsEncryption: false` takes effect and the Keystore step never runs. `iosDatabaseLocation` set to `Documents`, the location every iOS install uses. |
+| `capacitor.config.json`, `electron/capacitor.config.json` | `iosDatabaseLocation` set to `Documents` to match. These files already used the correct key. |
+| `src/services/platforms/CapacitorPlatformService.ts` | `databaseDirectoryUri()` points at `Documents` on iOS, so "Save a Copy of My Data" and "Start Over" find the real database file. |
+| `src/services/migrationService.ts` | Each migration's `INSERT INTO migrations` is appended to its own statement batch, which the native plugin runs as one transaction. |
+| `src/db-sql/migration.ts` | Migration 001 uses `INSERT OR IGNORE` for the `secret` and `settings` rows, so a re-run never replaces the existing secret. |
+| `android/app/src/main/AndroidManifest.xml`, `res/xml/backup_rules.xml`, `res/xml/data_extraction_rules.xml` | Cloud backup and device transfer exclude the plugin's encrypted preference files. Everything else is backed up, including the database. |
+| `src/test/migrations.test.ts` | Tests for a crash right after a migration commits, and for a re-run of 001 keeping the secret. |
+| `src/test/capacitorConfig.test.ts` | Fails if the plugin config key or the iOS location is wrong. |
+
+## Security
+
+Encryption of user keys is unchanged. The identity and seed phrase are encrypted
+by the app (`simpleEncrypt` with the random secret from migration 001) and stored
+in `accounts`. The plugin's encryption flag only controlled whole-database
+SQLCipher encryption, which the app never used; the database file was plain
+SQLite before and after this change. App sandboxing keeps the file private to
+the app on both platforms.
+
+## Compatibility with existing installs
+
+- **Android:** the database has no password whether plugin encryption is on or
+  off, so it opens the same way. The leftover encrypted preferences file is
+  never read again.
+- **iOS:** the database stays in `Documents`. Setting the location back to
+  `Library/CapacitorDatabase` would not be safe: the plugin moves databases into
+  a custom location only when that folder does not exist yet, and installs from
+  between May and August 2025 have that folder with an outdated database in it.
+- **Migrations:** existing installs already have 001 recorded, so its edit
+  never runs for them. The recording change affects only migrations that have
+  not run.
+
+## Verification
+
+- **Reproduced before the fix** on an Android emulator: run the app once, copy
+  `shared_prefs` out with `run-as app.timesafari.app`, uninstall (which deletes
+  the Keystore key), reinstall, put the copied `shared_prefs` back, and launch.
+  The startup error appeared.
+- **Unit tests:** `pkgx npm run test:unit -- src/test/migrations.test.ts
+  src/test/capacitorConfig.test.ts`. The two migration tests fail on the
+  earlier code and pass on the fixed code.
+- **Android resources:** `./gradlew :app:processDebugResources` builds, and
+  the merged manifest carries both backup-rule attributes.
+- **After the fix:** run the same emulator steps on a fixed build, and also
+  restore `shared_prefs` captured from a pre-fix build. The app should start
+  normally either way.
+
+## Follow-up
+
+The one-tap diagnostics report and a degraded mode for users without a working
+database are planned in `doc/CHANGES/PLAN-startup-db-failure-recovery.md`.
+
+## History
+
+- 2025-05-27: `capacitor.config.json` set `iosDatabaseLocation` to
+  `Library/CapacitorDatabase` under the correct `CapacitorSQLite` key
+  (commit 7b4f9d65).
+- 2025-08-14: the config moved to `capacitor.config.ts` under the key
+  `CapSQLite`, which the plugin does not read (commit a2840675). Plugin
+  encryption setup ran on Android from then on, and iOS databases moved to the
+  default `Documents` location.
+- 2026-10-10: commit d6ccf0e4 added the failed step and underlying cause to the
+  startup error, made migration 008 tolerate duplicate contact DIDs and labels
+  pointing at deleted contacts, and added the recovery screen.
+- 2026-10-10: this fix (config key, atomic migration records, backup rules).

doc/DEEP_LINKS.md

@@ -198,9 +198,7 @@ These take no parameters.
 
 ### Gift Routes
 
-- `timesafari://confirm-gift/:id`
-  - Query params:
-    - `action`: "confirm" | "details"
+- `timesafari://confirm-gift/:id` opens the claim page, the same as `timesafari://claim/:id`
 
 ### Offer Routes
 

doc/README-BUILD-GUARD.md

@@ -104,9 +104,7 @@ Build Scripts:
 ├── scripts/**             # All build and automation scripts
 ├── electron/**            # Electron build files
 ├── android/**             # Android build configuration
-├── ios/**                 # iOS build configuration
-├── sw_scripts/**          # Service worker scripts
-└── sw_combine.js          # Service worker combination
+└── ios/**                 # iOS build configuration
 
 Deployment:
 ├── Dockerfile             # Docker configuration

doc/android-firebase-gms.md

@@ -2,49 +2,47 @@
 
 ## Overview
 
-The app is designed to work on Android devices with and without Google Play Services (GMS). Firebase/FCM push notifications are an opt-in feature at build time; all other functionality works on GMS-less devices (F-Droid, LineageOS without OpenGApps, etc.).
+The app is designed to work on Android devices with and without Google Play Services (GMS). Firebase/FCM is **on by default** for local, test, and production builds. GMS-less devices still run the app; FCM degrades when Play Services is absent. F-Droid and other builds that must omit Firebase opt out explicitly.
 
-## How the opt-in guard works
+## How the switch works
 
-`android/app/build.gradle` applies the `com.google.gms.google-services` Gradle plugin only when **both** conditions are true:
+`android/app/build.gradle` applies `com.google.gms.google-services` unless `firebaseEnabled` is `false`. `android/gradle.properties` sets `firebaseEnabled=true`, so Android Studio, `./gradlew`, and `scripts/build-android.sh` all pick it up. `-PfirebaseEnabled` and `-PfirebaseEnabled=true` stay on. The config file does not decide the switch.
 
-1. `android/google-services.json` is present on disk
-2. The Gradle property `firebaseEnabled` is explicitly passed
+When Firebase is on, `android/app/google-services.json` must exist, be non-empty, and contain `mobilesdk_app_id`. Otherwise configuration fails with an error that names that path. When Firebase is off, the file is ignored even if it is on disk.
 
-```groovy
-if (servicesJSON.exists() && servicesJSON.text && project.hasProperty('firebaseEnabled')) {
-    apply plugin: 'com.google.gms.google-services'
-}
-```
+`scripts/build-android.sh` forwards an opt-out: `FIREBASE_ENABLED=false` adds `-PfirebaseEnabled=false` to its Gradle commands. Default npm scripts leave Firebase on. A `:nostore` script sets `FIREBASE_ENABLED=false` and reuses that script (`npm run build:android:test:nostore:run`).
 
-This means the file can live on disk for development purposes without accidentally activating Firebase.
+iOS uses the same default. `ios/App/scripts/bundle-firebase-config.sh` copies `ios/App/App/GoogleService-Info.plist` into the app and the share extension. `scripts/build-ios.sh` runs it with `--check` before a device build, and both Xcode targets run it as a build phase. The build and archive `xcodebuild` commands both receive `FIREBASE_ENABLED`. `FIREBASE_ENABLED=false` becomes `FIREBASE_ENABLED=NO` and skips the plist. A `:nostore` script sets that variable (`npm run build:ios:prod:nostore`). A missing or empty plist fails the build when Firebase is on.
+
+`:nostore` disables Firebase only. It does not strip other store-linked dependencies (the ML Kit barcode scanner still pulls in Play Services) and does not guarantee the build will run on every device outside the Play Store.
 
 ## Build commands
 
 | Target | Command | Firebase |
 |---|---|---|
-| APK / sideload / Zapstore | `./gradlew assembleRelease` | off |
-| Aurora / Play Store without FCM | `./gradlew bundleRelease` | off |
-| Play Store with FCM push notifications | `./gradlew bundleRelease -PfirebaseEnabled` | on |
-| F-Droid | `./gradlew assembleRelease` | off (required) |
+| Local / test / production APK or AAB | `./gradlew assembleRelease` or `bundleRelease` | on |
+| Play Store with FCM | `./gradlew bundleRelease` | on |
+| iOS (Xcode or `scripts/build-ios.sh`) | default | on |
+| F-Droid / FOSS Android | `./gradlew assembleRelease -PfirebaseEnabled=false` or `npm run build:android:test:nostore` | off |
+| iOS without Firebase | `FIREBASE_ENABLED=false` or `npm run build:ios:prod:nostore` | off |
 
 ## Behavior on non-GMS devices
 
-When built with `-PfirebaseEnabled`, Firebase SDKs check for GMS availability at startup and degrade gracefully if it is absent:
+When Firebase is enabled (the default), Firebase SDKs check for GMS availability at startup and degrade gracefully if it is absent:
 
 - Firebase initializes but detects no GMS
 - FCM skips token registration silently (no token, no notifications)
 - The app continues to work normally
 
-This means a single Play Store AAB (`bundleRelease -PfirebaseEnabled`) covers both GMS and non-GMS users. GMS users get push notifications; non-GMS users get a fully functional app without them.
+This means a single Play Store AAB (`bundleRelease`, Firebase on by default) covers both GMS and non-GMS users. GMS users get push notifications; non-GMS users get a fully functional app without them.
 
-**Aurora Store** pulls the exact APK from Play Store servers, so Aurora users get whichever variant was uploaded. The Play Store AAB built with `-PfirebaseEnabled` is correct for Aurora.
+**Aurora Store** pulls the exact APK from Play Store servers, so Aurora users get whichever variant was uploaded. The default Play Store AAB (Firebase on) is the one to upload.
 
-**F-Droid** is stricter: their build policy rejects any APK with GMS dependencies at the binary level, even with graceful degradation. F-Droid submission would require a separate `assembleRelease` build (no flag) and a dedicated F-Droid listing.
+**F-Droid** is stricter: their build policy rejects any APK with GMS dependencies at the binary level, even with graceful degradation. F-Droid submission would require a separate `assembleRelease -PfirebaseEnabled=false` build and a dedicated F-Droid listing.
 
 ## Push registration in builds without Firebase
 
-A build without `-PfirebaseEnabled` contains the `@capacitor/push-notifications` plugin, but no Firebase config. In that build, `PushNotifications.register()` throws `Default FirebaseApp is not initialized` on the Capacitor plugin thread, which kills the app; a JS `try/catch` cannot intercept it.
+A build with `-PfirebaseEnabled=false` contains the `@capacitor/push-notifications` plugin, but no Firebase config. In that build, `PushNotifications.register()` throws `Default FirebaseApp is not initialized` on the Capacitor plugin thread, which kills the app; a JS `try/catch` cannot intercept it.
 
 The JS therefore asks native code first. `NotificationInspector.isFirebaseConfigured()` (`android/app/src/main/java/app/timesafari/notifications/NotificationInspectorPlugin.java`) reports whether the `google_app_id` string resource exists; the google-services Gradle plugin generates that resource only when Firebase is enabled, and it is the same signal Firebase's auto-initialization uses. `firebaseMessagingClient.ts` skips `register()` on Android when it is absent (or when the check fails), logging `No Firebase config in this Android build; skipping push registration`. Listener setup and the notification permission request run either way, since local daily notifications need that permission.
 
@@ -56,7 +54,8 @@ Any code that calls `PushNotifications.register()` or other `FirebaseMessaging`
 
 - Gitignored (`android/.gitignore` line 80) — never commit it
 - Contains Firebase project credentials (project number, app ID, API key)
-- Safe to leave on disk; has no effect unless `-PfirebaseEnabled` is passed
+- Required for the default (Firebase on) build. Place it at `android/app/google-services.json`
+- Ignored when you pass `-PfirebaseEnabled=false`; leaving it on disk does not re-enable Firebase
 - Obtain from the Firebase console: Project Settings → Your apps → Android app → Download `google-services.json`
 
 ## Known GMS dependency: MLKit barcode scanner

doc/local-android-testing-analysis.md

@@ -2,9 +2,9 @@
 
 **Created:** 2026-06-02  
 **Source document:** [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md)  
-**Purpose:** Plan a future **Android** counterpart guide by mapping what can be reused from the iOS ngrok workflow and what must be written for Android-specific push, permissions, and OS behavior.
+**Status:** Planning snapshot from 2026-06-02. Several iOS-guide assumptions (app **Refresh Notifications**, Simulate WAKEUP, `applyNotificationRefreshPayload`, WAKEUP_PING → `/notifications/refresh` → `api_*`) are **retired**. For current Android procedure see [local-android-testing-ngrok.md](./local-android-testing-ngrok.md). Do not treat the reuse tables below as the live app path.
 
-**Status:** Planning only — does not replace or modify the iOS guide.
+**Purpose:** Plan a future **Android** counterpart guide by mapping what can be reused from the iOS ngrok workflow and what must be written for Android-specific push, permissions, and OS behavior.
 
 ---
 

doc/local-android-testing-ngrok.md

@@ -1,8 +1,10 @@
 # Local Android Testing with ngrok (notification-wakeup-service)
 
-**Last updated:** 2026-06-02 (verification checklist, end-to-end test)  
+**Last updated:** 2026-09-24 (retired WAKEUP_PING → refresh → `api_*` consumption)  
 **Audience:** Developers on **crowd-funder-for-time-pwa**, **daily-notification-plugin**, and **notification-wakeup-service**  
-**Goal:** Exercise FCM wakeup (`WAKEUP_PING`), FCM token registration, and notification refresh against a Mac-hosted backend reachable from a physical Android device.
+**Goal:** Exercise FCM token registration and FCM wakeup **delivery** (`WAKEUP_PING` via `/debug/send-wakeup`) against a Mac-hosted backend reachable from a physical Android device.
+
+> **Retired (do not expect this in the app):** `WAKEUP_PING` → `POST /notifications/refresh` → `applyNotificationRefreshPayload()` → `api_*` local schedules. The app logs ignored push types and does not refresh or schedule from wakeup. `/debug/send-wakeup` remains an FCM diagnostic. Mac `curl` of `/notifications/refresh` only tests the backend. Local schedules come from Static Daily Reminder, New Activity / dual, and the native fetcher.
 
 **See also:** [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md) for the iOS workflow (APNs, Xcode). [android-physical-device-guide.md](./android-physical-device-guide.md) for USB debugging and build/run commands.
 
@@ -10,7 +12,7 @@
 
 ## Architecture overview
 
-End-to-end flow when testing New Activity / silent wake on a physical Android phone:
+End-to-end flow when testing FCM registration and wakeup **delivery** on a physical Android phone:
 
 ```text
 ┌─────────────────────┐     HTTPS      ┌──────────────────────┐
@@ -19,7 +21,7 @@ End-to-end flow when testing New Activity / silent wake on a physical Android ph
 │  wakeup-service     │                └──────────┬───────────┘
 └──────────┬──────────┘                           │
            │                                      │ fetch
-           │ POST /notifications/refresh          │ POST /notifications/register
+           │                                      │ POST /notifications/register
            │                                      ▼
            │                             ┌──────────────────────┐
            │                             │  crowd-funder-for-   │
@@ -28,7 +30,7 @@ End-to-end flow when testing New Activity / silent wake on a physical Android ph
            │                             └──────────┬───────────┘
            │                                        │
            │  FCM data message (WAKEUP_PING)        │ daily-notification-plugin
-           ▼                                        ▼ (local schedule replace)
+           ▼                                        ▼ (Daily Reminder / dual / fetcher)
 ┌─────────────────────┐                ┌──────────────────────┐
 │  Firebase Cloud     │ ──FCM────────► │  Android device      │
 │  Messaging          │  direct        │  app.timesafari.app  │
@@ -41,18 +43,16 @@ Unlike iOS, Android does **not** use APNs. FCM delivers directly to the app via
 
 | Repo | Role |
 |------|------|
-| **notification-wakeup-service** | HTTP API: device registration, refresh payload (`nextNotifications`), health, debug wakeup send |
-| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register` & `/refresh`, handles `WAKEUP_PING` push |
-| **daily-notification-plugin** | Native Android: clear + reschedule local notifications from refresh timestamps |
+| **notification-wakeup-service** | HTTP API: device registration, health, debug wakeup send; may still expose `/notifications/refresh` for the backend |
+| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register`; logs `WAKEUP_PING` without refresh/`api_*` scheduling |
+| **daily-notification-plugin** | Native Android: Daily Reminder, New Activity / dual, native fetcher; Phase 4 `clearApiNotifications()` |
 
-### Android wakeup flow (production path)
+### Android wakeup flow (current)
 
-1. **notification-wakeup-service** (or `/debug/send-wakeup`) sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
+1. **notification-wakeup-service** `/debug/send-wakeup` sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
 2. FCM delivers to the device (best-effort; see [Android Platform Notes](#8-android-platform-notes) and [Battery Optimization Caveats](#9-battery-optimization-caveats)).
 3. Capacitor `pushNotificationReceived` fires → `handleCapacitorPushNotificationReceived()` in `NativeNotificationService.ts`.
-4. Handler calls `refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" })`, which `POST`s `{backend}/notifications/refresh` with `testMode` from the debug config.
-5. Backend returns `nextNotifications: [{ timestamp }, ...]`.
-6. App calls `applyNotificationRefreshPayload()` → **daily-notification-plugin** clears existing local alarms and schedules new ones.
+4. Handler logs `[Notifications] push handler ignored type=WAKEUP_PING`. It does **not** POST `/notifications/refresh` or schedule `api_*` notifications.
 
 Console and debug panel lines are prefixed with **`[Notifications]`** (see `NotificationDebugEvents.ts`).
 
@@ -240,7 +240,7 @@ Complete this section once before your first physical-device push test. If Fireb
 
 2. The repo gitignores this file — each developer keeps a local copy; never commit it.
 
-3. Rebuild so Gradle applies the Google Services plugin (`android/app/build.gradle` applies `com.google.gms.google-services` when the file exists). If the file is missing, the build logs: *google-services.json not found, google-services plugin not applied. Push Notifications won't work*.
+3. Rebuild. Firebase is on by default, so Gradle applies the Google Services plugin. If `android/app/google-services.json` is missing or empty, the build stops and names that path. Opt out only with `-PfirebaseEnabled=false` or `FIREBASE_ENABLED=false`.
 
 4. Sync Capacitor if you changed native config:
 
@@ -290,12 +290,11 @@ For a full panel reference (configuration, URL resolution order, authentication,
 | Control | Purpose |
 |---------|---------|
 | **Notification Backend URL** | Paste ngrok HTTPS URL → **Save Backend URL** (changes target server only) |
-| **Test Mode** | Sends `testMode: true/false` in register/refresh JSON bodies (default on when unset in storage) |
+| **Test Mode** | Sends `testMode: true/false` in register / send-wakeup JSON bodies (default on when unset in storage) |
 | **Skip JWT Authentication (Local Development Only)** | When on, omits `Authorization` headers for local servers that accept unauthenticated requests (default **off**) |
 | **Register Token Now** | `POST /notifications/register` with current FCM token and `platform: "android"` |
-| **Refresh Notifications** | `POST /notifications/refresh` (same as post-wakeup flow) |
-| **Simulate WAKEUP_PING (Local)** | Calls refresh API directly (no FCM) — quick backend + ngrok test |
-| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup` on the backend override URL; server sends a real FCM `WAKEUP_PING` to the panel’s current FCM token (see below) |
+| **Upload AlertSearch Authorization** | Uploads AlertSearch delegated JWTs (`/notifications/alert-authorization`) |
+| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; FCM delivery diagnostic only (no app-side refresh/`api_*` scheduling) |
 | **Event Log** | Shared `[Notifications]` panel log (100 entries) |
 
 Persistence: `localStorage` keys `notificationDebug.backendBaseUrl`, `notificationDebug.testMode`, and `notificationDebug.bypassAuth` (`NotificationDebugConfig.ts`).
@@ -314,19 +313,13 @@ For **local ngrok / localhost**: set the backend URL to your tunnel or `http://1
 
 ### testMode
 
-When **Test Mode** is on (default if never saved), register and refresh requests include `"testMode": true`. The backend can route dev traffic separately from production. Turn it off in the panel only if you intentionally want production-mode API behavior against your tunnel.
+When **Test Mode** is on (default if never saved), register and send-wakeup requests include `"testMode": true`. The backend can route dev traffic separately from production. Turn it off in the panel only if you intentionally want production-mode API behavior against your tunnel.
 
 ### WAKEUP_PING debug controls
 
-Three panel actions exercise different segments of the wakeup pipeline. Use them to bisect failures (see [Troubleshooting §14](#fcm-message-not-received)).
+**Send Real WAKEUP_PING** is the remaining panel control for wakeup. Mock refresh, Simulate WAKEUP_PING, Wakeup Ping Simulator, and Flood Test were removed with the retired refresh pipeline.
 
-| Button | Behavior |
-|--------|----------|
-| **Backend Testing → Simulate WAKEUP_PING (Local)** | Skips FCM; calls refresh API only (ngrok path test) |
-| **Backend Testing → Send Real WAKEUP_PING** | Full pipeline: backend `/debug/send-wakeup` → FCM → Capacitor listener → refresh (see below) |
-| **Wakeup Ping Simulator** (lower on panel) | Runs production handler with synthetic `WAKEUP_PING` payload (no FCM, no backend wakeup call) |
-
-Use **Simulate WAKEUP_PING (Local)** to verify ngrok + refresh; use **Wakeup Ping Simulator** to verify handler + refresh chaining without FCM; use **Send Real WAKEUP_PING** for end-to-end FCM delivery on device.
+Use **Send Real WAKEUP_PING** to confirm backend → FCM → Capacitor listener delivery. Do not expect `/notifications/refresh` or `api_*` rescheduling.
 
 ### Send Real WAKEUP_PING
 
@@ -337,9 +330,9 @@ Use **Simulate WAKEUP_PING (Local)** to verify ngrok + refresh; use **Wakeup Pin
 1. Reads the **Current FCM Token** shown in the panel (same token used by **Register Token Now**). If no token is available, the action fails with a panel status message.
 2. `POST`s to `{backend override}/debug/send-wakeup` with `deviceId`, `fcmToken`, `platform: "android"`, and `testMode` from the panel config (`NotificationDebugService.sendRealWakeupPing()`).
 3. On HTTP success, the **notification-wakeup-service** enqueues a real FCM **data** message with `data.type = "WAKEUP_PING"` to that device.
-4. When FCM delivers the message to the app, Capacitor fires `pushNotificationReceived` → `handleCapacitorPushNotificationReceived()` → `refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" })` → `POST /notifications/refresh` → `applyNotificationRefreshPayload()` (clear + reschedule via **daily-notification-plugin**).
+4. When FCM delivers the message to the app, Capacitor fires `pushNotificationReceived` → `handleCapacitorPushNotificationReceived()`, which logs `push handler ignored type=WAKEUP_PING`. There is no `refreshNotificationsWithDiagnostics` and no `applyNotificationRefreshPayload`.
 
-That exercises the full **backend → FCM → Capacitor push listener → refresh request → notification rescheduling** path on Android without manual `curl` on the Mac.
+That exercises **backend → FCM → Capacitor push listener** on Android without manual `curl` on the Mac. It does **not** reschedule local notifications.
 
 **Prerequisites:** ngrok backend override saved, **Test Mode** as needed, notification permission granted, **Register Token Now** succeeded, app **backgrounded** (Home — not force-stop) before expecting FCM delivery ([§8](#8-android-platform-notes)).
 
@@ -348,27 +341,24 @@ That exercises the full **backend → FCM → Capacitor push listener → refres
 Filter logcat (prefix is always `[Notifications]`):
 
 ```bash
-adb logcat | grep -E '\[Notifications\].*(Real WAKEUP_PING|pushNotificationReceived|WAKEUP_PING|Refresh started|Refresh completed)'
+adb logcat | grep -E '\[Notifications\].*(Real WAKEUP_PING|push handler ignored)'
 ```
 
-On a **successful end-to-end** run (HTTP success from the panel, then FCM delivery within ~30–120s), expect these key lines in order:
+On a **successful FCM delivery** run (HTTP success from the panel, then FCM delivery within ~30–120s), expect these key lines in order:
 
 ```
 [Notifications] Real WAKEUP_PING requested
 [Notifications] Real WAKEUP_PING success
-[Notifications] pushNotificationReceived type=WAKEUP_PING
-[Notifications] WAKEUP_PING handler — invoking refresh
-[Notifications] Refresh started (WAKEUP_PING)
-[Notifications] Refresh completed (WAKEUP_PING) in …ms (scheduled N)
+[Notifications] push handler ignored type=WAKEUP_PING
 ```
 
-Intermediate lines (e.g. `WAKEUP_PING received — will trigger refresh`, `Schedule replacement: …`, `Using authenticated notification request` or auth bypass messages when **Skip JWT Authentication** is on) are normal. ngrok should also show a new `POST /notifications/refresh` after the push is handled.
+Auth bypass messages when **Skip JWT Authentication** is on are normal. ngrok should **not** show a new `POST /notifications/refresh` from the app after the push.
 
-#### Send Real WAKEUP_PING vs end-to-end success
+#### Send Real WAKEUP_PING vs delivery success
 
-The panel status **“Real WAKEUP_PING sent via backend.”** and the Event Log line **`Real WAKEUP_PING success`** only confirm that the backend **accepted the request and attempted FCM delivery**. They do **not** prove the device received the push or ran refresh.
+The panel status **“Real WAKEUP_PING sent via backend.”** and the Event Log line **`Real WAKEUP_PING success`** only confirm that the backend **accepted the request and attempted FCM delivery**. They do **not** prove the device received the push.
 
-**Successful end-to-end delivery** is confirmed only when the subsequent **`pushNotificationReceived`**, **`WAKEUP_PING handler`**, and **`Refresh started (WAKEUP_PING)`** / **`Refresh completed (WAKEUP_PING)`** lines appear in logcat (or Event Log) within the delivery window. If you see `Real WAKEUP_PING success` but not those lines, treat it as an FCM delivery problem ([FCM message not received](#fcm-message-not-received)), not a backend enqueue failure.
+**Successful delivery** is confirmed when **`push handler ignored type=WAKEUP_PING`** appears in logcat (or Event Log) within the delivery window. If you see `Real WAKEUP_PING success` but not that line, treat it as an FCM delivery problem ([FCM message not received](#fcm-message-not-received)), not a backend enqueue failure.
 
 ### Programmatic override (optional)
 
@@ -455,15 +445,11 @@ On **API 33+**, `POST_NOTIFICATIONS` is a runtime permission ([section 7](#7-and
 
 ### Network connectivity
 
-FCM and your ngrok-backed refresh both need network:
-
-- Device must reach **Google’s FCM endpoints** (mobile data or Wi‑Fi).
-- After wake, the app must reach the **ngrok HTTPS URL** for `POST /notifications/refresh`.
-- Airplane mode, captive portals, VPNs, or flaky Wi‑Fi cause “server sent wakeup but app never refreshed” symptoms even when FCM eventually arrives.
+FCM needs network to Google’s endpoints. Registration needs the ngrok HTTPS URL for `POST /notifications/register`. Airplane mode, captive portals, VPNs, or flaky Wi‑Fi cause “server sent wakeup but app never logged ignored type” symptoms even when FCM eventually arrives.
 
 ### Physical device vs emulator
 
-Doze, App Standby, and OEM battery menus are weak or absent on many emulators. Use a **physical device** for wakeup SLA testing; emulators are fine for panel-only register/refresh smoke tests.
+Doze, App Standby, and OEM battery menus are weak or absent on many emulators. Use a **physical device** for wakeup SLA testing; emulators are fine for panel-only register smoke tests.
 
 ### Logcat
 
@@ -471,7 +457,7 @@ Doze, App Standby, and OEM battery menus are weak or absent on many emulators. U
 adb logcat | grep -E '\[Notifications\]|\[FirebaseMessaging\]|\[NativeNotificationService\]'
 ```
 
-Expect `pushNotificationReceived type=WAKEUP_PING` and `WAKEUP_PING handler — invoking refresh` after a successful wake. For a panel-driven test, use **Send Real WAKEUP_PING** ([§6](#send-real-wakeup_ping)) instead of manual `curl`.
+Expect `push handler ignored type=WAKEUP_PING` after a successful wake. For a panel-driven test, use **Send Real WAKEUP_PING** ([§6](#send-real-wakeup_ping)) instead of manual `curl`.
 
 ---
 
@@ -499,7 +485,7 @@ Apps used infrequently move to **standby** buckets with reduced background netwo
 
 ### Manufacturer-specific restrictions
 
-OEMs add layers on top of AOSP. Aggressive battery management can delay **WAKEUP_PING** delivery or prevent the refresh `fetch` from running promptly.
+OEMs add layers on top of AOSP. Aggressive battery management can delay **WAKEUP_PING** delivery.
 
 | Vendor | Where to look (names vary by OS version) |
 |--------|------------------------------------------|
@@ -515,8 +501,8 @@ If wakeup works on a **Pixel** but fails on an OEM phone, assume battery policy
 
 1. Server accepts `/debug/send-wakeup` → FCM enqueue succeeds.
 2. Device may **hold** the message until Doze maintenance or OEM policy allows delivery.
-3. `pushNotificationReceived` runs → `refreshNotificationsWithDiagnostics()` → ngrok `POST /notifications/refresh`.
-4. Any step can lag under battery savers; use **Simulate WAKEUP_PING (Local)** in the debug panel to separate FCM delay from refresh/API issues; use **Send Real WAKEUP_PING** for the full FCM path ([§6](#send-real-wakeup_ping)).
+3. `pushNotificationReceived` runs → `push handler ignored type=WAKEUP_PING`.
+4. Any step can lag under battery savers; use **Send Real WAKEUP_PING** for the FCM path ([§6](#send-real-wakeup_ping)).
 
 ---
 
@@ -528,12 +514,10 @@ If wakeup works on a **Pixel** but fails on an OEM phone, assume battery policy
 4. Grant notification permission when prompted (or enable in Settings).
 5. Open **Notification Debug Panel** → paste ngrok URL → **Save Backend URL**; confirm **Test Mode** is on; enable **Skip JWT Authentication** only if your local backend accepts unauthenticated requests.
 6. Tap **Register Token Now** → confirm ngrok `POST /notifications/register` and `[Notifications] Token registration success` in Event Log / logcat.
-7. Tap **Refresh Notifications** → confirm `POST /notifications/refresh` and `Refresh completed in Nms (scheduled X)` in Event Log.
-8. Optional: tap **Simulate WAKEUP_PING (Local)** to verify ngrok + refresh without FCM.
-9. Background the app (Home), then tap **Send Real WAKEUP_PING** (or from the Mac, call **`/debug/send-wakeup`** — see [curl examples](#13-sample-curl-commands)) with the registered `deviceId` / token as required by **notification-wakeup-service**.
-10. Watch logcat for `WAKEUP_PING` and `Refresh completed (WAKEUP_PING)` lines ([expected output](#expected-logcat-output)).
-11. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate HTTP traffic.
-12. Use **Pending Notification Inspector** on the panel to confirm locally scheduled fires after refresh.
+7. Background the app (Home), then tap **Send Real WAKEUP_PING** (or from the Mac, call **`/debug/send-wakeup`** — see [curl examples](#13-sample-curl-commands)) with the registered `deviceId` / token as required by **notification-wakeup-service**.
+8. Watch logcat for `push handler ignored type=WAKEUP_PING` ([expected output](#expected-logcat-output)).
+9. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate HTTP traffic (register and send-wakeup; not app-initiated refresh).
+10. Use **Pending Notification Inspector** for Daily Reminder / New Activity / dual schedules — not for retired `api_*` refresh.
 
 For a formal pass/fail sequence, use the [Verification Checklist](#11-verification-checklist) below.
 
@@ -549,12 +533,12 @@ Use this checklist during development or QA sign-off. Each step lists **actions*
 | 2 | Device → backend override | §2 |
 | 3 | FCM token registered | §3 |
 | 4 | Device record in wakeup service | §4 |
-| 5 | Refresh returns schedule data | §5 |
-| 6 | Locals scheduled | §6 |
+| 5 | Optional backend `/notifications/refresh` curl | §5 (backend only; app does not call this) |
+| 6 | Locals scheduled | §6 (Daily Reminder / dual / fetcher — not refresh) |
 | 7 | Manual wakeup sends FCM | §7 |
-| 8 | WAKEUP_PING → refresh | §8 |
-| 9 | Replace after refresh | §9 |
-| 10 | Test mode frequent refreshes | §10 |
+| 8 | WAKEUP_PING delivered | §8 |
+| 9 | _(retired)_ Replace after refresh | skipped |
+| 10 | _(retired)_ Test mode frequent refreshes | skipped |
 
 ### 1. Backend reachable through ngrok
 
@@ -578,7 +562,7 @@ curl -sS -w "\nHTTP %{http_code}\n" "$BASE/health"
 3. Confirm **Backend Status → URL** matches the saved ngrok host.
 4. Enable **Test Mode** if using dev backend behavior.
 
-**Expected outcome:** **Active** URL in the panel equals your ngrok `https://…` host. Subsequent app requests use that base (not the default `DEFAULT_NOTIFY_API_SERVER`) for `/notifications/register` and `/notifications/refresh`.
+**Expected outcome:** **Active** URL in the panel equals your ngrok `https://…` host. Subsequent app requests use that base (not the default `DEFAULT_NOTIFY_API_SERVER`) for `/notifications/register` and `/debug/send-wakeup`.
 
 ---
 
@@ -611,12 +595,11 @@ curl -sS -w "\nHTTP %{http_code}\n" "$BASE/health"
 
 ---
 
-### 5. Refresh endpoint returns schedule data
+### 5. Refresh endpoint (backend only; app does not call this)
 
 **Actions:**
 
-1. Tap **Refresh Notifications** in the panel (or curl below).
-2. Inspect ngrok response body.
+Mac-side curl against **notification-wakeup-service** if you need to confirm the backend still answers. The app has no **Refresh Notifications** button and does not schedule from this payload.
 
 ```bash
 curl -sS -X POST "$BASE/notifications/refresh" \
@@ -624,18 +607,18 @@ curl -sS -X POST "$BASE/notifications/refresh" \
   -d '{"platform":"android","testMode":true}'
 ```
 
-**Expected outcome:** HTTP **200**; JSON includes `nextNotifications` array with at least one `{ "timestamp": <number> }` in the **future** (epoch ms). Event Log: `Refresh completed in …ms (scheduled N)` with **N ≥ 1**. If `scheduled 0` or empty array, fix backend auth, DID/native fetcher, or `testMode` handling before scheduling tests.
+**Expected outcome:** HTTP **200** from the **service** if that route is still deployed. Do **not** expect Event Log `Refresh completed` or `api_*` schedules in the app.
 
 ---
 
-### 6. Local notifications are scheduled
+### 6. Local notifications are scheduled (not from refresh)
 
 **Actions:**
 
-1. After a successful refresh (step 5), open **Pending Notification Inspector** → **Refresh** (list button).
-2. Optionally cross-check logcat for `Schedule replacement applied (N timestamp(s))`.
+1. Configure Static Daily Reminder and/or New Activity (dual) in the app, or rely on the native fetcher.
+2. Open **Pending Notification Inspector** → **Refresh** (list button).
 
-**Expected outcome:** Inspector lists **N** pending item(s) matching refresh count; each row has a **future** `nextTriggerDate` / wall-clock time. No `Schedule replacement aborted` or `skipped (no valid timestamps)` in Event Log.
+**Expected outcome:** Inspector lists pending Daily Reminder / dual / fetcher items. Do not expect `api_*` identifiers after Phase 4 startup cleanup. There is no `Schedule replacement applied` from WAKEUP_PING.
 
 ---
 
@@ -656,11 +639,11 @@ curl -sS -X POST "$BASE/debug/send-wakeup" \
 
 3. Check **notification-wakeup-service** logs for FCM send success (no Admin SDK / token errors).
 
-**Expected outcome:** HTTP **200** (or documented success code) from `/debug/send-wakeup`; Event Log / logcat: `Real WAKEUP_PING success` when using the panel button; server logs indicate FCM message enqueued/sent with `data.type = "WAKEUP_PING"`. This step alone does not prove device delivery (see step 8 and [Send Real WAKEUP_PING vs end-to-end success](#send-real-wakeup_ping-vs-end-to-end-success)).
+**Expected outcome:** HTTP **200** (or documented success code) from `/debug/send-wakeup`; Event Log / logcat: `Real WAKEUP_PING success` when using the panel button; server logs indicate FCM message enqueued/sent with `data.type = "WAKEUP_PING"`. This step alone does not prove device delivery (see step 8 and [Send Real WAKEUP_PING vs delivery success](#send-real-wakeup_ping-vs-delivery-success)).
 
 ---
 
-### 8. WAKEUP_PING triggers refreshNotifications()
+### 8. WAKEUP_PING is delivered (no refresh)
 
 **Actions:**
 
@@ -669,42 +652,28 @@ curl -sS -X POST "$BASE/debug/send-wakeup" \
 3. Filter logcat:
 
 ```bash
-adb logcat | grep -E 'WAKEUP_PING|pushNotificationReceived|Refresh completed'
+adb logcat | grep -E 'WAKEUP_PING|push handler ignored'
 ```
 
 **Expected outcome (within ~30–120s, longer under Doze/OEM):**
 
-1. `pushNotificationReceived type=WAKEUP_PING` / `WAKEUP_PING received`
-2. `WAKEUP_PING handler — invoking refresh`
-3. `Refresh started (WAKEUP_PING)`
-4. ngrok: new `POST /notifications/refresh`
-5. `Refresh completed (WAKEUP_PING) in …ms (scheduled N)`
+1. `Real WAKEUP_PING success` (panel path)
+2. `push handler ignored type=WAKEUP_PING`
+3. ngrok: **no** app-initiated `POST /notifications/refresh`
 
-**Isolation:** **Wakeup Ping Simulator** on the panel should produce lines 2–5 without FCM. **Simulate WAKEUP_PING (Local)** proves refresh only (no handler, source `WAKEUP_PING simulation`). Full expected logcat for **Send Real WAKEUP_PING**: [§6](#expected-logcat-output).
+Full expected logcat for **Send Real WAKEUP_PING**: [§6](#expected-logcat-output).
 
 ---
 
 ### 9. Existing notifications are replaced after refresh
 
-**Actions:**
-
-1. Note pending count and identifiers in **Pending Notification Inspector**.
-2. Tap **Refresh Notifications** again (or trigger step 8).
-3. Refresh inspector; compare IDs/times to step 1.
-
-**Expected outcome:** Event Log shows `clearAllNotifications` or `cancelAllNotifications` then `Schedule replacement applied`; pending list reflects **new** timestamps (old alarms not accumulated). Total pending count should match latest refresh `N`, not double from duplicate refreshes unless backend returned more slots.
+**Retired.** The app no longer replaces local schedules from `/notifications/refresh`. Pending list changes come from Daily Reminder / dual / native fetcher, or from Phase 4 `clearApiNotifications()`.
 
 ---
 
 ### 10. Test mode produces frequent notification refreshes
 
-**Actions:**
-
-1. Confirm **Test Mode** checked; **Backend Status → testMode: true**.
-2. Call refresh twice (panel or curl) with `testMode: true`.
-3. Compare `nextNotifications` timestamps in ngrok responses.
-
-**Expected outcome:** With **testMode: true**, **notification-wakeup-service** returns **dev-friendly** schedule data—typically **sooner** fire times than production mode (shorter horizons). Pending Inspector updates to nearer triggers after each refresh. With Test Mode **off**, timestamps should be farther out (production-like); use that contrast to confirm the flag is wired end-to-end.
+**Retired.** `testMode` still goes on register and send-wakeup bodies. It does not drive app-side `api_*` refresh cadences.
 
 ---
 
@@ -739,31 +708,23 @@ npm run dev
 
 8. Paste `BASE` → **Save Backend URL**; enable **Test Mode**.
 
-### Phase C — Register and schedule
+### Phase C — Register
 
 9. **Register Token Now** → Event Log success; ngrok `POST /notifications/register` **200**; copy `deviceId` from ngrok request body.
 
 10. Confirm device in **notification-wakeup-service** (logs/DB per that repo).
 
-11. **Refresh Notifications** → Event Log `scheduled N`, N ≥ 1; ngrok refresh **200** with `nextNotifications`.
+### Phase D — FCM wakeup delivery
 
-12. **Pending Notification Inspector** → **Refresh** → future alarm(s) listed.
+11. Background app (Home).
 
-### Phase D — FCM wakeup path
+12. Tap **Send Real WAKEUP_PING** in the panel (or Mac: `curl -X POST "$BASE/debug/send-wakeup" -H "Content-Type: application/json" -d '{"deviceId":"…","testMode":true}'`) → panel `Real WAKEUP_PING success` and server FCM enqueue success.
 
-13. Background app (Home).
+13. Within 30–120s (longer if unplugged/Doze): logcat shows `push handler ignored type=WAKEUP_PING`; ngrok does **not** show an app `POST /notifications/refresh`.
 
-14. Tap **Send Real WAKEUP_PING** in the panel (or Mac: `curl -X POST "$BASE/debug/send-wakeup" -H "Content-Type: application/json" -d '{"deviceId":"…","testMode":true}'`) → panel `Real WAKEUP_PING success` and server FCM enqueue success.
+### Phase E — Optional local notification proof
 
-15. Within 30–120s (longer if unplugged/Doze): logcat shows `pushNotificationReceived` → `Refresh completed (WAKEUP_PING)`; ngrok shows second `POST /notifications/refresh`.
-
-16. Pending Inspector **Refresh** → timestamps updated (replacement, not duplicate stack).
-
-### Phase E — Optional delivery proof
-
-17. If `testMode` returned a trigger within a few minutes, wait for wall-clock fire with app backgrounded; confirm notification appears (permission + channel + exact alarm rules).
-
-18. If FCM step 15 failed but step 11 passed: run **Simulate WAKEUP_PING (Local)** then **Wakeup Ping Simulator** to bisect FCM vs handler; see [Troubleshooting](#14-troubleshooting) and [Send Real WAKEUP_PING vs end-to-end success](#send-real-wakeup_ping-vs-end-to-end-success).
+14. Enable Daily Reminder or New Activity; wait for wall-clock fire with app backgrounded; confirm the OS notification is **not** the retired generic `api_*` “Reminder” copy.
 
 ### End-to-end pass criteria
 
@@ -771,9 +732,9 @@ npm run dev
 |-------|------|
 | A | Health OK local + ngrok |
 | B | Override URL + testMode active |
-| C | Register + refresh + pending list populated |
-| D | Wakeup curl OK → logcat refresh chain → pending updated |
-| E | Optional visible notification at scheduled time |
+| C | Register succeeded |
+| D | Wakeup curl/panel OK → logcat ignored-type line |
+| E | Optional visible Daily Reminder / New Activity notification |
 
 ---
 
@@ -804,7 +765,7 @@ curl -sS -X POST "$BASE/notifications/register" \
   }'
 ```
 
-### Refresh (mirror app payload)
+### Refresh (backend only; app does not consume)
 
 ```bash
 curl -sS -X POST "$BASE/notifications/refresh" \
@@ -815,19 +776,7 @@ curl -sS -X POST "$BASE/notifications/refresh" \
   }'
 ```
 
-Example success body shape (actual fields may vary by service version):
-
-```json
-{
-  "shouldNotify": true,
-  "nextNotifications": [
-    { "timestamp": 1710000000000 },
-    { "timestamp": 1710003600000 }
-  ]
-}
-```
-
-The app schedules those timestamps via **daily-notification-plugin** (`applyNotificationRefreshPayload` in `NativeNotificationService.ts`).
+This exercises **notification-wakeup-service** only. The app does **not** call `applyNotificationRefreshPayload` or schedule `api_*` from the response.
 
 ### Send wakeup push (debug)
 
@@ -842,7 +791,7 @@ curl -sS -X POST "$BASE/debug/send-wakeup" \
   }'
 ```
 
-Confirm parameters (token vs `deviceId`, auth headers) in that repo’s README or OpenAPI spec. The server must send FCM data including `type: "WAKEUP_PING"` to match `handleCapacitorPushNotificationReceived`.
+Confirm parameters (token vs `deviceId`, auth headers) in that repo’s README or OpenAPI spec. The server may still send FCM data including `type: "WAKEUP_PING"`; the app logs it as ignored and does not refresh.
 
 ---
 
@@ -899,35 +848,28 @@ Compare with panel **Backend Status** and Event Log error text.
 
 ### Refresh endpoint failures
 
-**Symptoms:** **Refresh Notifications** fails; Event Log HTTP error; no `scheduled X` line; ngrok missing `POST /notifications/refresh`.
+**Symptoms:** Mac `curl` of `/notifications/refresh` fails; ngrok missing that path. This is a **backend** issue. The app does not POST refresh.
 
-**Likely causes:** Stale ngrok URL; backend down; 404/wrong path; JWT/native fetcher not configured; refresh auth failure.
+**Verification:** `curl` health and refresh from the Mac; confirm the service still ships that route.
 
-**Verification:**
-
-1. **Simulate WAKEUP_PING (Local)** — if this fails, problem is ngrok/refresh API, not FCM.
-2. ngrok inspect for refresh status code and response body.
-3. Logcat: `refreshNotifications failed` or JWT errors from `configureNativeFetcherIfReady()`.
-
-**Fixes:** Fix backend URL and health; ensure active DID and endorser settings ([notification-from-api-call.md](./notification-from-api-call.md)); confirm `testMode` if backend requires it.
+**Fixes:** Fix backend URL and health. App scheduling uses Daily Reminder / dual / native fetcher, not this payload.
 
 ---
 
 ### FCM message not received
 
-**Symptoms:** `/debug/send-wakeup` or panel **Send Real WAKEUP_PING** shows success (`Real WAKEUP_PING success` in Event Log); no `pushNotificationReceived` / `WAKEUP_PING` in logcat within 2 minutes; refresh never triggered.
+**Symptoms:** `/debug/send-wakeup` or panel **Send Real WAKEUP_PING** shows success (`Real WAKEUP_PING success` in Event Log); no `push handler ignored type=WAKEUP_PING` in logcat within 2 minutes.
 
 **Likely causes:** Force-stopped app; wrong FCM token on server; Doze/OEM delay; no Google Play services; payload missing `data.type = "WAKEUP_PING"`; device offline.
 
-**Note:** `Real WAKEUP_PING success` only means the backend accepted and sent the FCM request. Missing downstream refresh logs indicates a **delivery** failure, not a failed wakeup API call ([§6](#send-real-wakeup_ping-vs-end-to-end-success)).
+**Note:** `Real WAKEUP_PING success` only means the backend accepted and sent the FCM request. Missing the ignored-type log indicates a **delivery** failure, not a failed wakeup API call ([§6](#send-real-wakeup_ping-vs-delivery-success)).
 
 **Verification:**
 
 1. App **backgrounded** (Home), not force-stopped.
 2. Panel FCM token matches token used by server/register.
-3. **Simulate WAKEUP_PING (Local)** works → isolates FCM path from refresh/API.
-4. Wait 30–120s (longer on Doze/OEM).
-5. Battery **Unrestricted** and OEM autostart enabled for test device.
+3. Wait 30–120s (longer on Doze/OEM).
+4. Battery **Unrestricted** and OEM autostart enabled for test device.
 
 **Fixes:** Re-register token; relaunch app; relax battery settings ([section 9](#9-battery-optimization-caveats)); confirm **notification-wakeup-service** message format; test on Pixel vs suspect OEM policy.
 
@@ -947,30 +889,28 @@ Compare with panel **Backend Status** and Event Log error text.
 
 ### Notifications not appearing
 
-**Symptoms:** Refresh succeeds (`scheduled X` in log) but no visible notification at fire time; Pending Inspector empty or stale.
+**Symptoms:** Daily Reminder or New Activity configured but no visible notification at fire time; Pending Inspector empty or stale.
 
 **Likely causes:** Permission denied (display blocked); exact alarm permission on Android 12+; timestamps in past; plugin schedule error; DND/channel settings.
 
 **Verification:**
 
 1. Permission granted ([section 7](#7-android-notification-permissions)).
-2. Pending Notification Inspector after refresh.
-3. Logcat: `Schedule replacement applied` vs aborted messages.
-4. Confirm `nextNotifications` timestamps are in the future (curl refresh response).
+2. Pending Notification Inspector for Daily Reminder / dual identifiers (not `api_*` after Phase 4 cleanup).
 
-**Fixes:** Grant `POST_NOTIFICATIONS`; check `SCHEDULE_EXACT_ALARM` / alarm permission per plugin docs; fix refresh payload; test with nearer timestamps via backend `testMode`.
+**Fixes:** Grant `POST_NOTIFICATIONS`; check `SCHEDULE_EXACT_ALARM` / alarm permission per plugin docs. Do not expect wakeup refresh payloads to populate the inspector.
 
 ---
 
 ### Duplicate notifications
 
-**Symptoms:** Multiple identical local notifications; Event Log shows repeated refresh lines.
+**Symptoms:** Multiple identical local notifications.
 
-**Likely causes:** Multiple `WAKEUP_PING` deliveries; repeated manual **Refresh**; flood test; separate Daily Reminder vs New Activity schedules.
+**Likely causes:** Separate Daily Reminder vs New Activity schedules; duplicate dual config; leftover `api_*` before Phase 4 cleanup.
 
-**Verification:** Event Log count of refresh completions; ngrok inspect for duplicate `POST /notifications/refresh`.
+**Verification:** Pending Inspector identifiers; see [notification-new-activity-lay-of-the-land.md](./notification-new-activity-lay-of-the-land.md) for product-level double-schedule issues.
 
-**Fixes:** Each refresh should **replace** schedule (clear + schedule)—if duplicates persist, check plugin logs; see [notification-new-activity-lay-of-the-land.md](./notification-new-activity-lay-of-the-land.md) for product-level double-schedule issues.
+**Fixes:** Confirm Daily Reminder vs dual settings. WAKEUP_PING no longer stacks `api_*` refreshes.
 
 ---
 
@@ -988,11 +928,11 @@ Compare with panel **Backend Status** and Event Log error text.
 
 ### Gradle: Push Notifications won't work
 
-**Symptoms:** Build log: `google-services.json not found, google-services plugin not applied`.
+**Symptoms:** Build fails: `android/app/google-services.json is missing, empty, or has no mobilesdk_app_id`.
 
 **Likely causes:** Missing `android/app/google-services.json`.
 
-**Verification:** File exists on disk; rebuild shows Google Services plugin applied.
+**Verification:** File exists on disk and the build log says `Firebase enabled: google-services plugin applied`.
 
 **Fixes:** Download from Firebase Console (package `app.timesafari.app`); place in `android/app/`; `npx cap sync android` and rebuild.
 
@@ -1006,7 +946,7 @@ Compare with panel **Backend Status** and Event Log error text.
 | `src/services/notifications/NotificationDebugEvents.ts` | Panel event log + `logNotification()` |
 | `src/services/notifications/notificationLog.ts` | Structured log helpers |
 | `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
-| `src/services/notifications/NativeNotificationService.ts` | `refreshNotifications`, `WAKEUP_PING`, `applyNotificationRefreshPayload` |
+| `src/services/notifications/NativeNotificationService.ts` | Push delivery hook (logs ignored types; no refresh) |
 | `src/services/notifications/firebaseMessagingClient.ts` | Capacitor push listeners, permission, token registration |
 | `src/components/dev/NotificationDebugPanel.vue` | Dev UI |
 | `src/main.capacitor.ts` | Native push init at startup |

doc/local-ios-testing-ngrok.md

@@ -1,14 +1,16 @@
 # Local iOS Testing with ngrok (notification-wakeup-service)
 
-**Last updated:** 2026-05-18  
+**Last updated:** 2026-09-24 (retired WAKEUP_PING → refresh → `api_*` consumption)  
 **Audience:** Developers on **crowd-funder-for-time-pwa**, **daily-notification-plugin**, and **notification-wakeup-service**  
-**Goal:** Exercise silent push wake (`WAKEUP_PING`), FCM token registration, and notification refresh against a Mac-hosted backend reachable from a physical iPhone.
+**Goal:** Exercise FCM token registration and silent-push **delivery** (`WAKEUP_PING` via `/debug/send-wakeup`) against a Mac-hosted backend reachable from a physical iPhone.
+
+> **Retired (do not expect this in the app):** `WAKEUP_PING` → `POST /notifications/refresh` → `applyNotificationRefreshPayload()` → `api_*` local schedules. The app logs ignored push types and does not refresh or schedule from wakeup. `/debug/send-wakeup` remains an FCM/APNs diagnostic. Mac `curl` of `/notifications/refresh` only tests the backend.
 
 ---
 
 ## Architecture overview
 
-End-to-end flow when testing New Activity / silent wake on a physical iPhone:
+End-to-end flow when testing FCM registration and wakeup **delivery** on a physical iPhone:
 
 ```text
 ┌─────────────────────┐     HTTPS      ┌──────────────────────┐
@@ -17,7 +19,7 @@ End-to-end flow when testing New Activity / silent wake on a physical iPhone:
 │  wakeup-service     │                └──────────┬───────────┘
 └──────────┬──────────┘                           │
            │                                        │ fetch
-           │ POST /notifications/refresh            │ POST /notifications/register
+           │                                        │ POST /notifications/register
            │                                        ▼
            │                             ┌──────────────────────┐
            │                             │  crowd-funder-for-     │
@@ -26,7 +28,7 @@ End-to-end flow when testing New Activity / silent wake on a physical iPhone:
            │                             └──────────┬───────────┘
            │                                        │
            │  FCM data message (WAKEUP_PING)        │ daily-notification-plugin
-           ▼                                        ▼ (local schedule replace)
+           ▼                                        ▼ (Daily Reminder / dual / fetcher)
 ┌─────────────────────┐                ┌──────────────────────┐
 │  Firebase Cloud      │ ──APNs──────► │  iPhone (physical)   │
 │  Messaging           │  silent push  │  app.timesafari      │
@@ -37,18 +39,16 @@ End-to-end flow when testing New Activity / silent wake on a physical iPhone:
 
 | Repo | Role |
 |------|------|
-| **notification-wakeup-service** | HTTP API: device registration, refresh payload (`nextNotifications`), health, debug wakeup send |
-| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register` & `/refresh`, handles `WAKEUP_PING` push |
-| **daily-notification-plugin** | Native iOS/Android: clear + reschedule local notifications from refresh timestamps |
+| **notification-wakeup-service** | HTTP API: device registration, health, debug wakeup send; may still expose `/notifications/refresh` |
+| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register`; logs `WAKEUP_PING` without refresh/`api_*` scheduling |
+| **daily-notification-plugin** | Native iOS/Android: Daily Reminder, New Activity / dual, native fetcher; Phase 4 `clearApiNotifications()` |
 
-### Silent wake sequence (production path)
+### Silent wake sequence (current)
 
-1. Backend (or `/debug/send-wakeup`) sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
+1. Backend `/debug/send-wakeup` sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
 2. APNs delivers to the device (best-effort; see iOS caveats below).
 3. Capacitor `pushNotificationReceived` fires → `handleCapacitorPushNotificationReceived()`.
-4. App calls `POST {backend}/notifications/refresh` with `testMode` (from debug config).
-5. Backend returns `nextNotifications: [{ timestamp }, ...]`.
-6. App calls `applyNotificationRefreshPayload()` → plugin clears and schedules new local alarms.
+4. Handler logs `[Notifications] push handler ignored type=WAKEUP_PING`. It does **not** POST `/notifications/refresh` or schedule `api_*` notifications.
 
 Console and debug panel lines are prefixed with **`[Notifications]`** (see `NotificationDebugEvents.ts`).
 
@@ -297,12 +297,11 @@ For a full panel reference (configuration, URL resolution order, authentication,
 | Control | Purpose |
 |---------|---------|
 | **Notification Backend URL** | Paste ngrok HTTPS URL → **Save Backend URL** (changes target server only) |
-| **Test Mode** | Sends `testMode: true/false` in register/refresh JSON bodies (default on when unset in storage) |
+| **Test Mode** | Sends `testMode: true/false` in register / send-wakeup JSON bodies (default on when unset in storage) |
 | **Skip JWT Authentication (Local Development Only)** | When on, omits `Authorization` headers for local servers that accept unauthenticated requests (default **off**) |
 | **Register Token Now** | `POST /notifications/register` with current FCM token |
-| **Refresh Notifications** | `POST /notifications/refresh` (same as post-wakeup flow) |
-| **Simulate WAKEUP_PING (Local)** | Calls refresh API directly (no FCM) — quick backend test |
-| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; server sends real FCM `WAKEUP_PING` (Android doc has full flow) |
+| **Upload AlertSearch Authorization** | Uploads AlertSearch delegated JWTs |
+| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; FCM/APNs delivery diagnostic only |
 | **Event Log** | Shared `[Notifications]` panel log (100 entries) |
 
 Persistence: `localStorage` keys `notificationDebug.backendBaseUrl`, `notificationDebug.testMode`, and `notificationDebug.bypassAuth` (`NotificationDebugConfig.ts`).
@@ -352,7 +351,7 @@ This section is a quick verification checklist for the detailed Firebase/APNs se
 | **GoogleService-Info.plist** | Present in the iOS target if using Firebase iOS SDK paths in your build |
 | **FCM token** | Confirm **Register Token Now** succeeds in the debug panel and ngrok shows `POST /notifications/register` |
 
-Silent/data pushes used for wake typically use a **content-available** style payload; confirm **notification-wakeup-service** and Firebase message format match what `handleCapacitorPushNotificationReceived` expects (`data.type === "WAKEUP_PING"`).
+Silent/data pushes used for wake typically use a **content-available** style payload; confirm **notification-wakeup-service** and Firebase message format. The app logs `WAKEUP_PING` as ignored and does not refresh.
 
 ---
 
@@ -378,14 +377,9 @@ Silent/data pushes used for wake typically use a **content-available** style pay
 - **Low Power Mode** can reduce background execution.
 - **Focus / Do Not Disturb** may affect notification presentation (separate from silent data wake, but confusing during tests).
 
-### Two “Simulate WAKEUP_PING” buttons
+### Send Real WAKEUP_PING (FCM/APNs diagnostic)
 
-| Button | Behavior |
-|--------|----------|
-| **Backend Testing → Simulate WAKEUP_PING** | Skips FCM; calls refresh API only (ngrok path test) |
-| **Wakeup Ping Simulator** (lower on panel) | Runs production handler with synthetic `WAKEUP_PING` payload |
-
-Use the backend button to verify ngrok + refresh; use the simulator to verify handler + refresh chaining.
+**Send Real WAKEUP_PING** posts `/debug/send-wakeup`. Delivery is confirmed by `push handler ignored type=WAKEUP_PING`. Mock refresh, Simulate WAKEUP_PING, and Wakeup Ping Simulator were removed.
 
 ---
 
@@ -395,11 +389,10 @@ Use the backend button to verify ngrok + refresh; use the simulator to verify ha
 2. Start **ngrok** and copy the HTTPS URL.
 3. Set URL + **Test Mode** in the Notification Debug Panel; confirm **Backend Status**.
 4. Tap **Register Token Now** → confirm ngrok request and `[Notifications] Token registration success`.
-5. Tap **Refresh Notifications** → confirm `Refresh completed in Nms (scheduled X)` in Event Log and ngrok `POST /notifications/refresh`.
-6. From the backend, call **`/debug/send-wakeup`** (see curl below) with the registered `deviceId` / FCM token as required by that service.
-7. Watch **Xcode console** for `[Notifications] pushNotificationReceived type=WAKEUP_PING` and refresh timing lines.
-8. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate requests.
-9. Use **Pending Notification Inspector** on the panel to see locally scheduled fires after refresh.
+5. From the backend, call **`/debug/send-wakeup`** (see curl below) with the registered `deviceId` / FCM token as required by that service, or tap **Send Real WAKEUP_PING**.
+6. Watch **Xcode console** for `[Notifications] push handler ignored type=WAKEUP_PING`.
+7. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate requests (register and send-wakeup; not app-initiated refresh).
+8. Use **Pending Notification Inspector** for Daily Reminder / dual / fetcher schedules.
 
 ---
 
@@ -430,7 +423,7 @@ curl -sS -X POST "$BASE/notifications/register" \
   }'
 ```
 
-### Refresh (mirror app payload)
+### Refresh (backend only; app does not consume)
 
 ```bash
 curl -sS -X POST "$BASE/notifications/refresh" \
@@ -441,19 +434,7 @@ curl -sS -X POST "$BASE/notifications/refresh" \
   }'
 ```
 
-Example success body shape (actual fields may vary by service version):
-
-```json
-{
-  "shouldNotify": true,
-  "nextNotifications": [
-    { "timestamp": 1710000000000 },
-    { "timestamp": 1710003600000 }
-  ]
-}
-```
-
-The app schedules those timestamps via **daily-notification-plugin** (`applyNotificationRefreshPayload` in `NativeNotificationService.ts`).
+This exercises **notification-wakeup-service** only. The app does **not** call `applyNotificationRefreshPayload` or schedule `api_*` from the response.
 
 ### Send wakeup push (debug)
 
@@ -478,8 +459,8 @@ Confirm parameters (token vs deviceId, auth headers) in that repo’s README or
 
 | Symptom | Checks |
 |---------|--------|
-| Network error in Event Log | ngrok running? URL saved without typo/trailing slash? |
-| HTTP 404 | Tunnel port matches backend `PORT`; path is `/notifications/refresh` |
+| Mac `curl` of `/notifications/refresh` fails | ngrok running? URL saved without typo/trailing slash? |
+| HTTP 404 | Tunnel port matches backend `PORT`; path is `/notifications/refresh` (backend route; the app does not call it) |
 | CORS (web only) | Native Capacitor fetch usually avoids browser CORS; if testing in Safari PWA, configure CORS on the service |
 | ngrok browser warning | Free tier may show an interstitial for browser clients; native `fetch` from the app is usually unaffected |
 
@@ -495,15 +476,15 @@ Confirm parameters (token vs deviceId, auth headers) in that repo’s README or
 - App **backgrounded**, not force-quit
 - Physical device, correct provisioning profile
 - APNs key uploaded to Firebase; bundle ID matches
-- FCM message includes `data.type = "WAKEUP_PING"` (see `NativeNotificationService.ts`)
+- FCM message includes `data.type = "WAKEUP_PING"` (logged as ignored in `NativeNotificationService.ts`)
 - Server actually sent to the **same** FCM token shown in the debug panel
 - Wait 30–120s — delivery is not instant
-- Try **Simulate WAKEUP_PING** (refresh API) to isolate app/plugin from FCM/APNs
+- Confirm Xcode shows `push handler ignored type=WAKEUP_PING` (there is no Simulate WAKEUP_PING / refresh API in the app)
 
 ### Notifications duplicating
 
-- Multiple refresh calls (flood test, repeated wakeups) each **replace** schedule via clear + schedule — check Event Log for repeated refreshes
-- Separate issue: Daily Reminder vs New Activity both scheduling — see `doc/notification-new-activity-lay-of-the-land.md`
+- Daily Reminder vs New Activity both scheduling — see `doc/notification-new-activity-lay-of-the-land.md`
+- Leftover `api_*` before Phase 4 cleanup (startup `clearApiNotifications()`)
 
 ### Stale ngrok URL
 
@@ -525,7 +506,7 @@ Confirm parameters (token vs deviceId, auth headers) in that repo’s README or
 | `src/services/notifications/NotificationDebugEvents.ts` | Panel event log + `logNotification()` |
 | `src/services/notifications/notificationLog.ts` | Structured log helpers |
 | `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
-| `src/services/notifications/NativeNotificationService.ts` | Refresh, `WAKEUP_PING`, schedule replace |
+| `src/services/notifications/NativeNotificationService.ts` | Push delivery hook (logs ignored types; no refresh) |
 | `src/services/notifications/firebaseMessagingClient.ts` | Capacitor push listeners |
 | `src/components/dev/NotificationDebugPanel.vue` | Dev UI |
 | `src/main.capacitor.ts` | Native push init at startup |

doc/migration-progress-tracker.md

@@ -212,7 +212,6 @@ export default class ComponentName extends Vue {
 - [ ] ContactGiftingView.vue
 - [x] DiscoverView.vue ✅ **MIGRATED & HUMAN TESTED**
 - [ ] ImportAccountView.vue
-- [ ] ConfirmGiftView.vue
 - [ ] SeedBackupView.vue
 - [ ] ContactAmountsView.vue
 - [x] ContactQRScanFullView.vue ✅ **MIGRATED & HUMAN TESTED**

doc/notification-debug-panel.md

@@ -1,16 +1,16 @@
 # Notification Debug Panel
 
 **Created:** 2026-07-07  
-**Updated:** 2026-07-22  
-**Audience:** Developers testing notification registration, refresh, and WAKEUP_PING flows on native (iOS/Android) dev builds.
+**Updated:** 2026-09-24  
+**Audience:** Developers testing notification registration, AlertSearch authorization upload, and FCM delivery diagnostics on native (iOS/Android) dev builds.
 
-The **Notification Debug Panel** is a dev-only UI for exercising the same notification orchestration paths the production app uses: FCM token registration, backend refresh, wakeup handling, and local schedule inspection. It does not duplicate scheduling logic.
+The **Notification Debug Panel** is a dev-only UI for FCM token registration, AlertSearch authorization upload, FCM wakeup delivery diagnostics (`/debug/send-wakeup`), and local schedule inspection. It does not schedule notifications from `WAKEUP_PING`. The production `WAKEUP_PING` → `/notifications/refresh` → `api_*` path was retired; leftover `api_*` schedules are cleared once at startup (Phase 4).
 
 ---
 
 ## Notification API base URL
 
-Notification HTTP calls (`/notifications/register`, `/notifications/refresh`, `/debug/send-wakeup`, etc.) do **not** use `APP_SERVER`. They use a dedicated Notification API host, resolved at runtime by `getNotificationApiBaseUrl()` in `NotificationDebugConfig.ts`.
+Notification HTTP calls (`/notifications/register`, `/notifications/alert-authorization`, `/debug/send-wakeup`, etc.) do **not** use `APP_SERVER`. They use a dedicated Notification API host, resolved at runtime by `getNotificationApiBaseUrl()` in `NotificationDebugConfig.ts`. The app does not call `/notifications/refresh`.
 
 ### Configuration constants
 
@@ -65,7 +65,7 @@ Settings persist in `localStorage` via `NotificationDebugConfig.ts`:
 | `notificationDebug.testMode` | `true` | Sent in JSON request bodies (`testMode: true/false`) |
 | `notificationDebug.bypassAuth` | `false` | When `true`, omit JWT `Authorization` headers on notification API calls |
 
-All notification API requests (`/notifications/register`, `/notifications/refresh`, `/debug/send-wakeup`, etc.) obtain headers through `getNotificationApiHeaders()` in `notificationApiAuth.ts`.
+All notification API requests (`/notifications/register`, `/notifications/alert-authorization`, `/debug/send-wakeup`, etc.) obtain headers through `getNotificationApiHeaders()` in `notificationApiAuth.ts`.
 
 ### Notification Backend URL
 
@@ -75,7 +75,7 @@ Leave empty to use the configured build default (`DEFAULT_NOTIFY_API_SERVER`, fr
 
 ### Test Mode
 
-When enabled (default if never saved), register and refresh requests include `"testMode": true` in the JSON body. The backend can use this to return dev-friendly schedules or route test traffic separately from production.
+When enabled (default if never saved), register and send-wakeup requests include `"testMode": true` in the JSON body. The backend can use this to route test traffic separately from production.
 
 Test Mode is **independent of authentication**. It does not control whether `Authorization` headers are sent.
 
@@ -124,9 +124,8 @@ Example: `https://abc123.ngrok-free.app` or `http://127.0.0.1:3000`
 | Action | What it does |
 |--------|----------------|
 | **Register Token Now** | `POST {backend}/notifications/register` with current FCM token, `deviceId`, `platform`, and `testMode`. Forces re-registration (bypasses duplicate-token skip). |
-| **Refresh Notifications** | `POST {backend}/notifications/refresh` — same path used after a real WAKEUP_PING. Applies returned schedule to the native plugin. |
-| **Simulate WAKEUP_PING (Local)** | Calls the refresh API directly (no FCM). Quick test of backend URL + auth + refresh parsing without push delivery. |
-| **Send Real WAKEUP_PING** | `POST {backend}/debug/send-wakeup`; server sends a real FCM data message with `data.type = "WAKEUP_PING"`. Exercises backend → FCM → Capacitor listener → refresh → reschedule. Background the app before expecting delivery. |
+| **Upload AlertSearch Authorization** | Mints and uploads delegated AlertSearch JWTs (`POST /notifications/alert-authorization`). Requires an active `did:ethr` identity; Test Mode is not used. |
+| **Send Real WAKEUP_PING** | `POST {backend}/debug/send-wakeup`; server sends a real FCM data message with `data.type = "WAKEUP_PING"`. FCM delivery diagnostic only — the app logs `push handler ignored type=…` and does **not** call `/notifications/refresh` or schedule `api_*` notifications. Background the app before expecting delivery. |
 
 **Current FCM Token** displays the last token from Capacitor/Firebase registration. **Event Log** shows the last 100 `[Notifications]` messages (also visible in logcat / Xcode console on native).
 
@@ -136,12 +135,8 @@ Example: `https://abc123.ngrok-free.app` or `http://127.0.0.1:3000`
 
 | Section | Purpose |
 |---------|---------|
-| **Mock Timing Presets** | Interval for mock refresh timestamps (30 sec – 10 min). |
-| **Trigger Mock Refresh** | Applies synthetic future timestamps locally — no backend call. |
-| **Wakeup Ping Simulator** | Runs the production push handler with a synthetic `WAKEUP_PING` payload (no FCM, no backend). |
-| **Flood Test** | Runs 20 sequential mock refreshes (stress test). |
-| **Pending Notification Inspector** | Lists locally scheduled notifications (iOS; Android may show unavailable). |
-| **Clear Notifications** | Clears/cancels all plugin-scheduled notifications on native. |
+| **Pending Notification Inspector** | Lists locally scheduled notifications (Daily Reminder, New Activity / dual, and any leftover `api_*` until Phase 4 cleanup). |
+| **Clear Notifications** | Clears/cancels plugin-scheduled notifications on native. Does not replace the one-time `api_*` startup cleanup. |
 
 ---
 
@@ -198,11 +193,11 @@ The app deferred registration because JWT could not be built (no active DID or e
 
 Same as above. Confirm the **Active** URL in the panel matches your running tunnel or local server port.
 
-### Register succeeds but Send Real WAKEUP_PING does not trigger refresh
+### Register succeeds but Send Real WAKEUP_PING does not show delivery
 
-**Real WAKEUP_PING success** only means the backend accepted the wakeup request and attempted FCM delivery. Missing `pushNotificationReceived` / `Refresh completed (WAKEUP_PING)` indicates an FCM delivery or background execution issue — not necessarily a bad wakeup API call.
+**Real WAKEUP_PING success** only means the backend accepted the wakeup request and attempted FCM delivery. It does **not** schedule local `api_*` notifications. Delivery is confirmed when logcat / Event Log shows `push handler ignored type=WAKEUP_PING` (the retired refresh chain is gone).
 
-**Checks:** App backgrounded (not force-stopped); FCM token matches registration; **Simulate WAKEUP_PING (Local)** works (isolates FCM from refresh API).
+**Checks:** App backgrounded (not force-stopped); FCM token matches registration; Firebase / Play services available.
 
 See platform-specific guides for extended ngrok and FCM workflows:
 
@@ -222,7 +217,7 @@ See platform-specific guides for extended ngrok and FCM workflows:
 | `src/services/notifications/notificationApiDebugMode.ts` | Auth bypass gate |
 | `src/services/notifications/NotificationDebugService.ts` | Panel action handlers |
 | `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
-| `src/services/notifications/NativeNotificationService.ts` | `POST /notifications/refresh`, WAKEUP_PING handler |
+| `src/services/notifications/NativeNotificationService.ts` | Push delivery hook (logs ignored types; no refresh) |
 
 ---
 

doc/platformservicemixin-completion-plan.md

@@ -289,7 +289,6 @@ const { sql, params } = this.$generateInsertStatement(contact, 'contacts');
 - [ ] ContactGiftingView.vue
 - [ ] DiscoverView.vue
 - [ ] ImportAccountView.vue
-- [ ] ConfirmGiftView.vue
 - [ ] SeedBackupView.vue
 - [ ] [5 more view files]
 

doc/qr-code-implementation-guide.md

@@ -175,7 +175,6 @@ export async function createBuildConfig(mode: string) {
   return defineConfig({
     define: {
       'process.env.VITE_PLATFORM': JSON.stringify(mode),
-      // PWA is automatically enabled for web platforms via build configuration
       __IS_MOBILE__: JSON.stringify(isCapacitor),
       __USE_QR_READER__: JSON.stringify(!isCapacitor)
     },

docker-compose.yml

@@ -5,10 +5,9 @@
 # IMPORTANT: Build web assets first using npm scripts before running docker-compose
 #
 # Usage:
-#   Development: npm run build:web:build -- --mode development && docker-compose up dev
-#   Test: npm run build:web:build -- --mode test && docker-compose up test
-#   Production: npm run build:web:build -- --mode production && docker-compose up production
-#   Custom: BUILD_MODE=test npm run build:web:build -- --mode test && docker-compose up custom
+#   Test: npm run docker:up:test (runs npm run build:web:test && docker-compose up test)
+#   Production: npm run docker:up:prod (runs npm run build:web:prod && docker-compose up production)
+#   Custom: npm run build:web:test && BUILD_MODE=test docker-compose up custom
 #
 # Environment Variables:
 #   BUILD_MODE: development, test, or production (default: production)
@@ -16,7 +15,7 @@
 #   PORT: port to expose (default: 80 for production, 8080 for test)
 #   ENV_FILE: environment file to use (default: .env.production)
 #
-# Note: For development, use npm run build:web directly (no Docker needed)
+# Note: For development, use npm run dev directly (no Docker needed)
 
 version: '3.8'
 

docker/README.md

@@ -103,7 +103,6 @@ The Dockerfile supports these build arguments:
 | `BUILD_MODE` | `production` | Build mode: development, staging, or production |
 | `NODE_ENV` | `production` | Node.js environment |
 | `VITE_PLATFORM` | `web` | Vite platform type |
-| PWA | `enabled` | Automatically enabled for web platforms |
 
 ### Environment Variables
 
@@ -114,7 +113,6 @@ Docker Compose supports these environment variables:
 | `BUILD_MODE` | `production` | Build mode |
 | `NODE_ENV` | `production` | Node environment |
 | `VITE_PLATFORM` | `web` | Vite platform |
-| PWA | `enabled` | Automatically enabled for web platforms |
 | `DEV_PORT` | `5173` | Development port |
 | `STAGING_PORT` | `8080` | Staging port |
 | `PROD_PORT` | `80` | Production port |
@@ -219,13 +217,12 @@ BUILD_MODE=staging NODE_ENV=staging ./docker/run.sh custom
 docker build \
   --build-arg BUILD_MODE=staging \
   --build-arg NODE_ENV=staging \
-  
-  -t timesafari:staging-no-pwa .
+  -t timesafari:staging .
 
 # Run with custom configuration
 docker run -d -p 9000:80 \
   -e VITE_APP_SERVER=https://test.example.com \
-  timesafari:staging-no-pwa
+  timesafari:staging
 ```
 
 ### Docker Compose with Custom Variables

docker/run.sh

@@ -13,7 +13,6 @@
 #   BUILD_MODE: development, staging, or production
 #   NODE_ENV: node environment
 #   VITE_PLATFORM: vite platform
-#   PWA: automatically enabled for web platforms
 #   PORT: port to expose
 #   ENV_FILE: environment file to use
 
@@ -71,7 +70,6 @@ show_usage() {
     echo "  BUILD_MODE: development, staging, or production"
     echo "  NODE_ENV: node environment"
     echo "  VITE_PLATFORM: vite platform"
-    echo "  PWA: automatically enabled for web platforms"
     echo "  PORT: port to expose"
     echo "  ENV_FILE: environment file to use"
 }
@@ -86,7 +84,6 @@ show_build_args() {
             echo "  BUILD_MODE: development"
             echo "  NODE_ENV: development"
             echo "  VITE_PLATFORM: web"
-            echo "  PWA: enabled (web platform)"
             echo "  Target: development"
             echo "  Port: 5173"
             ;;
@@ -94,7 +91,6 @@ show_build_args() {
             echo "  BUILD_MODE: staging"
             echo "  NODE_ENV: staging"
             echo "  VITE_PLATFORM: web"
-            echo "  PWA: enabled (web platform)"
             echo "  Target: staging"
             echo "  Port: 80 (mapped to 8080)"
             ;;
@@ -102,7 +98,6 @@ show_build_args() {
             echo "  BUILD_MODE: production"
             echo "  NODE_ENV: production"
             echo "  VITE_PLATFORM: web"
-            echo "  PWA: enabled (web platform)"
             echo "  Target: production"
             echo "  Port: 80"
             ;;
@@ -110,7 +105,6 @@ show_build_args() {
             echo "  BUILD_MODE: \${BUILD_MODE:-production}"
             echo "  NODE_ENV: \${NODE_ENV:-production}"
             echo "  VITE_PLATFORM: \${VITE_PLATFORM:-web}"
-            echo "  PWA: enabled for web platforms"
             echo "  Target: \${BUILD_TARGET:-production}"
             echo "  Port: \${CUSTOM_PORT:-8080}:\${CUSTOM_INTERNAL_PORT:-80}"
             ;;

electron/capacitor.config.json

@@ -30,7 +30,7 @@
 			"splashImmersive": true
 		},
 		"CapacitorSQLite": {
-			"iosDatabaseLocation": "Library/CapacitorDatabase",
+			"iosDatabaseLocation": "Documents",
 			"iosIsEncryption": false,
 			"iosBiometric": {
 				"biometricAuth": false,

electron/capacitor.config.ts

@@ -31,8 +31,9 @@ const config: CapacitorConfig = {
       splashFullScreen: true,
       splashImmersive: true
     },
-    CapSQLite: {
-      iosDatabaseLocation: 'Library/CapacitorDatabase',
+    // The key must match the plugin's registered name or every setting here is ignored.
+    CapacitorSQLite: {
+      iosDatabaseLocation: 'Documents',
       iosIsEncryption: false,
       iosBiometric: {
         biometricAuth: false,

index.html

@@ -3,6 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/favicon.ico" />
+    <link rel="manifest" href="/manifest.webmanifest" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover, user-scalable=no, interactive-widget=overlays-content" />
     
     <!-- CORS headers removed to allow images from any domain -->

ios/App/App.xcodeproj/project.pbxproj

@@ -19,8 +19,6 @@
 		C86585DF2ED456DE00824752 /* TimeSafariShareExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = C86585D52ED456DE00824752 /* TimeSafariShareExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		C8C56E142EE0474B00737D0E /* SharedImageUtility.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8C56E132EE0474B00737D0E /* SharedImageUtility.swift */; };
 		C8C56E162EE064CB00737D0E /* SharedImagePlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8C56E152EE064CA00737D0E /* SharedImagePlugin.swift */; };
-		C8E73DD12FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */; };
-		C8E73DD22FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */; };
 		E9F1A0022EE05A8B00737D01 /* NotificationInspectorPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = E9F1A0012EE05A8B00737D01 /* NotificationInspectorPlugin.swift */; };
 /* End PBXBuildFile section */
 
@@ -185,10 +183,11 @@
 				504EC3001FED79650016851F /* Sources */,
 				504EC3011FED79650016851F /* Frameworks */,
 				504EC3021FED79650016851F /* Resources */,
+				F1REBA5E000000000000A001 /* Bundle Firebase Config */,
 				012076E8FFE4BF260A79B034 /* Fix Privacy Manifest */,
 				96A7EF592DF3366D00084D51 /* Fix Privacy Manifest */,
 				C86585E02ED456DE00824752 /* Embed Foundation Extensions */,
-				04A558C9E2DEC92B5B2AFBE4 /* [CP] Embed Pods Frameworks */,
+				2B3F98670AF3508A35AC3248 /* [CP] Embed Pods Frameworks */,
 			);
 			buildRules = (
 			);
@@ -207,6 +206,7 @@
 				C86585D12ED456DE00824752 /* Sources */,
 				C86585D22ED456DE00824752 /* Frameworks */,
 				C86585D32ED456DE00824752 /* Resources */,
+				F1REBA5E000000000000A002 /* Bundle Firebase Config */,
 			);
 			buildRules = (
 			);
@@ -270,7 +270,6 @@
 				50379B232058CBB4000EE86E /* capacitor.config.json in Resources */,
 				504EC30D1FED79650016851F /* Main.storyboard in Resources */,
 				2FAD9763203C412B000D30F8 /* config.xml in Resources */,
-				C8E73DD12FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -278,7 +277,6 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				C8E73DD22FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -305,7 +303,7 @@
 			shellScript = "\"${PROJECT_DIR}/app_privacy_manifest_fixer/fixer.sh\" \n";
 			showEnvVarsInLog = 0;
 		};
-		04A558C9E2DEC92B5B2AFBE4 /* [CP] Embed Pods Frameworks */ = {
+		2B3F98670AF3508A35AC3248 /* [CP] Embed Pods Frameworks */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -342,6 +340,48 @@
 			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
 			showEnvVarsInLog = 0;
 		};
+		F1REBA5E000000000000A001 /* Bundle Firebase Config */ = {
+			isa = PBXShellScriptBuildPhase;
+			alwaysOutOfDate = 1;
+			buildActionMask = 2147483647;
+			enableUserScriptSandboxing = 0;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			name = "Bundle Firebase Config";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${PROJECT_DIR}/scripts/bundle-firebase-config.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
+		F1REBA5E000000000000A002 /* Bundle Firebase Config */ = {
+			isa = PBXShellScriptBuildPhase;
+			alwaysOutOfDate = 1;
+			buildActionMask = 2147483647;
+			enableUserScriptSandboxing = 0;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			name = "Bundle Firebase Config";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${PROJECT_DIR}/scripts/bundle-firebase-config.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
 		96A7EF592DF3366D00084D51 /* Fix Privacy Manifest */ = {
 			isa = PBXShellScriptBuildPhase;
 			alwaysOutOfDate = 1;
@@ -466,7 +506,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				MTL_ENABLE_DEBUG_INFO = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				SDKROOT = iphoneos;
@@ -523,7 +563,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				SDKROOT = iphoneos;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;
@@ -541,10 +581,11 @@
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = App/AppDebug.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 76;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				INFOPLIST_FILE = App/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
@@ -552,7 +593,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.10;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -571,10 +612,11 @@
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 76;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				INFOPLIST_FILE = App/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
@@ -582,7 +624,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.10;
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";
@@ -600,21 +642,23 @@
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TimeSafariShareExtension/TimeSafariShareExtension.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 76;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
+				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = TimeSafariShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.10;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari.TimeSafariShareExtension;
@@ -638,21 +682,23 @@
 				CLANG_ENABLE_OBJC_WEAK = YES;
 				CODE_SIGN_ENTITLEMENTS = TimeSafariShareExtension/TimeSafariShareExtension.entitlements;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 72;
+				CURRENT_PROJECT_VERSION = 76;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
+				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				FIREBASE_ENABLED = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = TimeSafariShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = Giftopia;
 				INFOPLIST_KEY_NSHumanReadableCopyright = "";
-				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.5;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MARKETING_VERSION = 1.4.6;
+				MARKETING_VERSION = 1.4.10;
 				MTL_FAST_MATH = YES;
 				PRODUCT_BUNDLE_IDENTIFIER = app.timesafari.TimeSafariShareExtension;
 				PRODUCT_NAME = "$(TARGET_NAME)";

ios/App/App/TimeSafariNativeFetcher.swift

@@ -144,20 +144,16 @@ final class TimeSafariNativeFetcher: NativeNotificationContentFetcher {
         return (s?.isEmpty == false) ? s : nil
     }
 
+    /// Store the newest JWT ID in the response (the highest ULID), so the next fetch
+    /// asks only for later changes. The server lists them newest first, so the last
+    /// item is the oldest.
     private func updateLastAckedJwtIdFromResponse(responseBody: String) {
         guard let data = responseBody.data(using: .utf8),
               let root = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
               let dataArray = root["data"] as? [[String: Any]], !dataArray.isEmpty
         else { return }
 
-        let lastItem = dataArray[dataArray.count - 1]
-        var jwtId: String?
-        if let j = lastItem["jwtId"] as? String {
-            jwtId = j
-        } else if let plan = lastItem["plan"] as? [String: Any], let j = plan["jwtId"] as? String {
-            jwtId = j
-        }
-        if let jwtId = jwtId, !jwtId.isEmpty {
+        if let jwtId = dataArray.compactMap({ extractJwtIdFromItem($0) }).max() {
             UserDefaults.standard.set(jwtId, forKey: prefsLastAckedKey)
         }
     }

ios/App/Podfile

@@ -82,6 +82,10 @@ post_install do |installer|
   assertDeploymentTarget(installer)
   installer.pods_project.targets.each do |target|
     target.build_configurations.each do |config|
+      deployment_target = config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'].to_f
+      if deployment_target > 0.0 && deployment_target < 15.5
+        config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '15.5'
+      end
       config.build_settings['CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES'] = 'YES'
       merge_sqlite_omit_load_extension_definition(config)
       strip_system_sqlite_from_pod_config(config)

ios/App/Podfile.lock

@@ -80,7 +80,7 @@ PODS:
   - SQLCipher/common (4.10.0)
   - SQLCipher/standard (4.10.0):
     - SQLCipher/common
-  - TimesafariDailyNotificationPlugin (4.0.1):
+  - TimesafariDailyNotificationPlugin (5.0.0):
     - Capacitor
   - ZIPFoundation (0.9.20)
 
@@ -174,9 +174,9 @@ SPEC CHECKSUMS:
   nanopb: fad817b59e0457d11a5dfbde799381cd727c1275
   PromisesObjC: f5707f49cb48b9636751c5b2e7d227e43fba9f47
   SQLCipher: eb79c64049cb002b4e9fcb30edb7979bf4706dfc
-  TimesafariDailyNotificationPlugin: 69277c884380a9a620f671b68e0327eaa4b3d27d
+  TimesafariDailyNotificationPlugin: b60e726f8776b5d22e026caef906f1c3b0e963dd
   ZIPFoundation: dfd3d681c4053ff7e2f7350bc4e53b5dba3f5351
 
-PODFILE CHECKSUM: abe640043e6b8adea745693d980ead03251912f9
+PODFILE CHECKSUM: 5736811d271d5309d3e2de8f3eefdbb6632086a3
 
 COCOAPODS: 1.16.2

ios/App/scripts/bundle-firebase-config.sh

@@ -0,0 +1,80 @@
+#!/bin/sh
+# Bundle GoogleService-Info.plist when Firebase is enabled (the default).
+# Opt out with FIREBASE_ENABLED=false, or the Xcode build setting
+# FIREBASE_ENABLED=NO. The plist does not decide the switch: a missing file
+# fails an enabled build, and an opt-out build does not bundle the plist
+# even when the file is on disk.
+#
+# Xcode run-script phases invoke this with no arguments. build-ios.sh may pass
+# --check to validate before a long build without copying into a product.
+set -eu
+
+check_only=0
+if [ "${1:-}" = "--check" ]; then
+  check_only=1
+fi
+
+if [ -z "${SRCROOT:-}" ]; then
+  script_dir=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+  SRCROOT=$(CDPATH= cd -- "$script_dir/.." && pwd)
+fi
+
+normalized=$(printf '%s' "${FIREBASE_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')
+plist="${SRCROOT}/App/GoogleService-Info.plist"
+
+firebase_off=0
+case "$normalized" in
+  false|0|no) firebase_off=1 ;;
+esac
+
+remove_bundled_plist() {
+  base="$1"
+  leaf="$2"
+  if [ -n "$base" ] && [ -n "$leaf" ]; then
+    rm -f "${base}/${leaf}/GoogleService-Info.plist"
+  fi
+}
+
+if [ "$firebase_off" -eq 1 ]; then
+  if [ "$check_only" -eq 0 ]; then
+    # Drop the plist from this product, including a copy left by an earlier
+    # Firebase-enabled build. The app and the share extension each run this phase.
+    remove_bundled_plist "${TARGET_BUILD_DIR:-}" "${UNLOCALIZED_RESOURCES_FOLDER_PATH:-}"
+    remove_bundled_plist "${TARGET_BUILD_DIR:-}" "${WRAPPER_NAME:-}"
+    remove_bundled_plist "${BUILT_PRODUCTS_DIR:-}" "${WRAPPER_NAME:-}"
+    # Embed does not delete files that disappeared from the appex, so a plist
+    # copied into PlugIns on an earlier Firebase-enabled build would otherwise stay.
+    if [ -n "${TARGET_BUILD_DIR:-}" ] && [ -n "${WRAPPER_NAME:-}" ]; then
+      for stale in "${TARGET_BUILD_DIR}/${WRAPPER_NAME}/PlugIns/"*.appex/GoogleService-Info.plist; do
+        if [ -f "$stale" ]; then
+          rm -f "$stale"
+        fi
+      done
+    fi
+  fi
+  echo "note: Firebase disabled (FIREBASE_ENABLED=${FIREBASE_ENABLED}); GoogleService-Info.plist will not be bundled."
+  exit 0
+fi
+
+if [ ! -s "$plist" ] || ! grep -q "GOOGLE_APP_ID" "$plist"; then
+  echo "error: Firebase is enabled, but ios/App/App/GoogleService-Info.plist is missing, empty, or has no GOOGLE_APP_ID." >&2
+  echo "error: Download it from the Firebase console (Project settings → Your apps → Apple apps)" >&2
+  echo "error: and place it at ios/App/App/GoogleService-Info.plist." >&2
+  echo "error: To build without Firebase, set FIREBASE_ENABLED=false or pass the Xcode build setting FIREBASE_ENABLED=NO." >&2
+  exit 1
+fi
+
+if [ "$check_only" -eq 1 ]; then
+  echo "note: Firebase enabled; ios/App/App/GoogleService-Info.plist is present."
+  exit 0
+fi
+
+if [ -z "${TARGET_BUILD_DIR:-}" ] || [ -z "${UNLOCALIZED_RESOURCES_FOLDER_PATH:-}" ]; then
+  echo "error: Bundle Firebase Config must run as an Xcode build phase (TARGET_BUILD_DIR is unset)." >&2
+  exit 1
+fi
+
+dest_dir="${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
+mkdir -p "$dest_dir"
+cp "$plist" "${dest_dir}/GoogleService-Info.plist"
+echo "note: Firebase enabled; bundled GoogleService-Info.plist."

package.json

@@ -1,6 +1,6 @@
 {
   "name": "giftopia",
-  "version": "1.4.6",
+  "version": "1.4.11-beta",
   "description": "Giftopia App",
   "author": {
     "name": "Gift Economies Team"
@@ -26,8 +26,11 @@
     "build:android:deploy": "./scripts/build-android.sh --deploy",
     "build:android:dev": "./scripts/build-android.sh --dev",
     "build:android:dev:custom": "./scripts/build-android.sh --dev --api-ip",
+    "build:android:dev:nostore": "FIREBASE_ENABLED=false npm run build:android:dev",
     "build:android:dev:run:custom": "./scripts/build-android.sh --dev --api-ip --auto-run",
     "build:android:prod": "./scripts/build-android.sh --prod",
+    "build:android:prod:nostore": "FIREBASE_ENABLED=false npm run build:android:prod",
+    "build:android:prod:nostore:run": "FIREBASE_ENABLED=false npm run build:android:prod:run",
     "build:android:prod:run": "./scripts/build-android.sh --prod --auto-run",
     "build:android:release": "./scripts/build-android.sh --release",
     "build:android:release:run": "./scripts/build-android.sh --release --auto-run",
@@ -35,6 +38,8 @@
     "build:android:sync": "./scripts/build-android.sh --sync",
     "build:android:test": "./scripts/build-android.sh --test",
     "build:android:test:custom": "./scripts/build-android.sh --test --api-ip",
+    "build:android:test:nostore": "FIREBASE_ENABLED=false npm run build:android:test",
+    "build:android:test:nostore:run": "FIREBASE_ENABLED=false npm run build:android:test:run",
     "build:android:test:run": "./scripts/build-android.sh --test --auto-run",
     "build:android:test:run:custom": "./scripts/build-android.sh --test --api-ip --auto-run",
     "build:capacitor": "VITE_GIT_HASH=`git log -1 --pretty=format:%h` vite build --mode capacitor --config vite.config.capacitor.mts",
@@ -78,9 +83,12 @@
     "build:ios:deploy": "./scripts/build-ios.sh --deploy",
     "build:ios:dev": "./scripts/build-ios.sh --dev",
     "build:ios:dev:custom": "./scripts/build-ios.sh --dev --api-ip",
+    "build:ios:dev:nostore": "FIREBASE_ENABLED=false npm run build:ios:dev",
     "build:ios:dev:run:custom": "./scripts/build-ios.sh --dev --api-ip --auto-run",
     "build:ios:ipa": "./scripts/build-ios.sh --ipa",
     "build:ios:prod": "./scripts/build-ios.sh --prod",
+    "build:ios:prod:nostore": "FIREBASE_ENABLED=false npm run build:ios:prod",
+    "build:ios:prod:nostore:run": "FIREBASE_ENABLED=false npm run build:ios:prod:run",
     "build:ios:prod:run": "./scripts/build-ios.sh --prod --auto-run",
     "build:ios:release": "./scripts/build-ios.sh --release",
     "build:ios:release:run": "./scripts/build-ios.sh --release --auto-run",
@@ -88,11 +96,12 @@
     "build:ios:sync": "./scripts/build-ios.sh --sync",
     "build:ios:test": "./scripts/build-ios.sh --test",
     "build:ios:test:custom": "./scripts/build-ios.sh --test --api-ip",
+    "build:ios:test:nostore": "FIREBASE_ENABLED=false npm run build:ios:test",
+    "build:ios:test:nostore:run": "FIREBASE_ENABLED=false npm run build:ios:test:run",
     "build:ios:test:run": "./scripts/build-ios.sh --test --auto-run",
     "build:ios:test:run:custom": "./scripts/build-ios.sh --test --api-ip --auto-run",
-    "build:native": "vite build && npx cap sync && node scripts/restore-local-plugins.js && bash -c 'source scripts/common.sh && ensure_ios_capacitor_asset_directories' && npx capacitor-assets generate --assetPath resources",
+    "build:native": "npm run build:capacitor:sync && bash -c 'source scripts/common.sh && ensure_ios_capacitor_asset_directories' && npx capacitor-assets generate --ios --android --assetPath resources",
     "build:web": "./scripts/build-web.sh",
-    "build:web:dev": "./scripts/build-web.sh --dev",
     "build:web:docker": "./scripts/build-web.sh --docker",
     "build:web:docker:prod": "./scripts/build-web.sh --docker:prod",
     "build:web:docker:test": "./scripts/build-web.sh --docker:test",
@@ -110,11 +119,12 @@
     "clean:electron": "./scripts/build-electron.sh --clean",
     "clean:ios": "rm -rf ios/App/build ios/App/Pods ios/App/output ios/App/App/public ios/DerivedData ios/capacitor-cordova-ios-plugins ios/App/App/capacitor.config.json ios/App/App/config.xml || true",
     "deps:update-daily-notification-plugin": "npm install @timesafari/daily-notification-plugin@git+https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin.git#master",
+    "dev": "./scripts/build-web.sh --dev",
     "docker:down": "docker-compose down",
     "docker:logs": "docker-compose logs -f",
     "docker:up": "docker-compose up",
-    "docker:up:prod": "npm run build:web:build -- --mode production && docker-compose up production",
-    "docker:up:test": "npm run build:web:build -- --mode test && docker-compose up test",
+    "docker:up:prod": "npm run build:web:prod && docker-compose up production",
+    "docker:up:test": "npm run build:web:test && docker-compose up test",
     "guard": "bash ./scripts/build-arch-guard.sh",
     "guard:setup": "npm run prepare && echo 'Build Architecture Guard is now active!'",
     "guard:test": "bash ./scripts/build-arch-guard.sh --staged",
@@ -123,7 +133,7 @@
     "markdown:check": "markdownlint-cli2",
     "markdown:fix": "markdownlint-cli2 --fix",
     "markdown:setup": "./scripts/setup-markdown-hooks.sh",
-    "prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node sw_combine.js && node scripts/copy-wasm.js",
+    "prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node scripts/copy-wasm.js",
     "prepare": "husky",
     "test:all": "npm run lint && npm run type-check && npm run type-check:vue && npm run test:unit && npm run test:web && npm run test:mobile && echo '\n\n\nGotta add the performance tests'",
     "test:android": "node scripts/test-android.js",
@@ -219,7 +229,6 @@
     "ramda": "^0.29.1",
     "readable-stream": "^4.5.2",
     "reflect-metadata": "^0.1.14",
-    "register-service-worker": "^1.7.2",
     "simple-vue-camera": "^1.1.3",
     "sqlite3": "^5.1.7",
     "stream-browserify": "^3.0.0",

playwright.config-local.ts

@@ -18,13 +18,20 @@ export default defineConfig({
   fullyParallel: true,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: !!process.env.CI,
-  /* Retry on CI only */
-  retries: process.env.CI ? 2 : 0,
+  /* Load the app once before the tests so the dev server is warm; see that file
+   * for the Firefox WebAssembly failure it reduces. */
+  globalSetup: "./test-playwright/warmUpDevServer.ts",
+  /* Retry once locally: with several instances in parallel, Firefox can fail to
+   * start its WebAssembly compiler (so the app cannot open its database), at
+   * any point in a run. A retried pass is reported as "flaky", not hidden. */
+  retries: process.env.CI ? 2 : 1,
   /* Opt out of parallel tests on CI. */
   workers: 3,
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: [
     ['list'],
+    // explains failures caused by the Firefox WebAssembly start-up error
+    ['./test-playwright/webAssemblyHintReporter.ts'],
     ['html'],
     // ['html', { open: 'never' }], // don't automatically open report page after tests complete even with failures
     ['json', { outputFile: 'test-playwright-results/test-results.json' }]
@@ -106,7 +113,7 @@ export default defineConfig({
    */
   webServer: {
     command:
-      "VITE_APP_SERVER=http://localhost:8080 VITE_DEFAULT_ENDORSER_API_SERVER=http://localhost:3000 VITE_DEFAULT_PARTNER_API_SERVER=http://localhost:3000 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app VITE_PASSKEYS_ENABLED=true npm run build:web -- --port=8080",
+      "VITE_APP_SERVER=http://localhost:8080 VITE_DEFAULT_ENDORSER_API_SERVER=http://localhost:3000 VITE_DEFAULT_PARTNER_API_SERVER=http://localhost:3000 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app VITE_PASSKEYS_ENABLED=true npm run dev",
     url: "http://localhost:8080",
     reuseExistingServer: !process.env.CI,
   },

public/manifest.webmanifest

@@ -1,46 +1,46 @@
 {
+  "name": "Giftopia",
+  "short_name": "Giftopia",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "theme_color": "#4a90e2",
+  "background_color": "#ffffff",
   "icons": [
     {
-      "src": "../icons/icon-48.webp",
-      "type": "image/png",
-      "sizes": "48x48",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-72.webp",
-      "type": "image/png",
-      "sizes": "72x72",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-96.webp",
-      "type": "image/png",
-      "sizes": "96x96",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-128.webp",
-      "type": "image/png",
-      "sizes": "128x128",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-192.webp",
-      "type": "image/png",
+      "src": "/img/icons/android-chrome-192x192.png",
       "sizes": "192x192",
-      "purpose": "any maskable"
+      "type": "image/png"
     },
     {
-      "src": "../icons/icon-256.webp",
-      "type": "image/png",
-      "sizes": "256x256",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "../icons/icon-512.webp",
-      "type": "image/png",
+      "src": "/img/icons/android-chrome-512x512.png",
       "sizes": "512x512",
-      "purpose": "any maskable"
+      "type": "image/png"
+    },
+    {
+      "src": "/img/icons/android-chrome-maskable-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/img/icons/android-chrome-maskable-512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
     }
-  ]
+  ],
+  "share_target": {
+    "action": "/share-target",
+    "method": "POST",
+    "enctype": "multipart/form-data",
+    "params": {
+      "files": [
+        {
+          "name": "photo",
+          "accept": ["image/*"]
+        }
+      ]
+    }
+  }
 }

public/sw.js

@@ -0,0 +1,68 @@
+/* eslint-env serviceworker */
+/**
+ * Service worker for the web build.
+ *
+ * Its only job is the Web Share Target: the manifest's share_target POSTs a
+ * photo to /share-target, which no static server can accept. This worker
+ * stashes the photo in Cache Storage and redirects to /shared-photo, where
+ * src/libs/webShareTarget.ts picks it up. Every other request goes straight to
+ * the network (no fetch handler response, no precaching).
+ *
+ * It also replaces the Workbox worker that older builds registered at this
+ * same URL, and deletes that worker's precaches, which otherwise keep serving
+ * a stale index.html that points at JavaScript files no longer deployed.
+ */
+
+const SHARE_TARGET_CACHE = "share-target";
+// Keep in sync with src/libs/webShareTarget.ts
+const SHARED_PHOTO_KEY = "/share-target/photo";
+const FILE_NAME_HEADER = "X-File-Name";
+
+self.addEventListener("install", () => {
+  self.skipWaiting();
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    (async () => {
+      const names = await caches.keys();
+      await Promise.all(
+        names
+          .filter((name) => name !== SHARE_TARGET_CACHE)
+          .map((name) => caches.delete(name)),
+      );
+      await self.clients.claim();
+    })(),
+  );
+});
+
+self.addEventListener("fetch", (event) => {
+  const url = new URL(event.request.url);
+  if (
+    event.request.method !== "POST" ||
+    url.origin !== self.location.origin ||
+    url.pathname !== "/share-target"
+  ) {
+    return;
+  }
+
+  event.respondWith(
+    (async () => {
+      const formData = await event.request.formData();
+      const photo = formData.get("photo");
+      if (photo instanceof File) {
+        const cache = await caches.open(SHARE_TARGET_CACHE);
+        await cache.put(
+          SHARED_PHOTO_KEY,
+          new Response(photo, {
+            headers: {
+              "Content-Type": photo.type || "application/octet-stream",
+              [FILE_NAME_HEADER]: encodeURIComponent(photo.name || ""),
+            },
+          }),
+        );
+      }
+      return Response.redirect("/shared-photo?source=share-target", 303);
+    })(),
+  );
+});

pull_request_template.md

@@ -15,7 +15,7 @@
 
 ## Commands Run (paste exact logs/snips)
 
-- [ ] Web: `npm run build:web` / `:prod`
+- [ ] Web: `npm run dev` / `npm run build:web`
 - [ ] Electron: `npm run build:electron:dev` / package step
 - [ ] Mobile: `npm run build:android:test` / iOS equivalent
 - [ ] Clean/auto-run impacted scripts

scripts/README.md

@@ -23,10 +23,10 @@ All scripts automatically handle environment variables for different build types
 
 #### Build Types and Environment Variables
 
-| Platform | Mode | PWA Enabled | Native Features | Build Script |
-|----------|------|-------------|-----------------|--------------|
-| `web` | web | true | false | `build-web.sh` |
-| `capacitor` | capacitor | false | true | `build-capacitor.sh` |
+| Platform | Mode | Native Features | Build Script |
+|----------|------|-----------------|--------------|
+| `web` | web | false | `build-web.sh` |
+| `capacitor` | capacitor | true | `build-capacitor.sh` |
 
 #### Automatic Environment Setup
 
@@ -183,8 +183,6 @@ All scripts automatically configure the correct environment variables for their
 ```bash
 # Capacitor builds automatically get:
 export VITE_PLATFORM=capacitor
-export VITE_PWA_ENABLED=false
-export VITE_DISABLE_PWA=true
 export DEBUG_MIGRATIONS=0
 export VITE_GIT_HASH=<git-hash>
 

scripts/build-android.sh

@@ -23,6 +23,7 @@
 #   --assets                Generate assets only
 #   --deploy                Deploy APK to connected device
 #   --uninstall             Uninstall app from connected device
+#   FIREBASE_ENABLED=false  Opt out of Firebase (-PfirebaseEnabled=false)
 #   -h, --help             Show this help message
 #   -v, --verbose          Enable verbose logging
 #
@@ -439,6 +440,9 @@ print_android_usage() {
     echo "  --uninstall             Uninstall app from connected device"
     echo "  --api-ip <ip>          Custom IP address for claim API (defaults to 10.0.2.2)"
     echo ""
+    echo "Firebase is on by default. Opt out with FIREBASE_ENABLED=false"
+    echo "(passes -PfirebaseEnabled=false to Gradle)."
+    echo ""
     echo "Common Options:"
     echo "  -h, --help             Show this help message"
     echo "  -v, --verbose          Enable verbose logging"
@@ -460,6 +464,17 @@ print_android_usage() {
 # Parse command line arguments
 parse_android_args "$@"
 
+# Firebase is on unless FIREBASE_ENABLED is false, 0, or no. Gradle also
+# defaults firebaseEnabled=true; this only forwards an explicit opt-out.
+gradle_firebase_arg=""
+firebase_enabled_normalized=$(printf '%s' "${FIREBASE_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')
+case "$firebase_enabled_normalized" in
+    false|0|no)
+        gradle_firebase_arg="-PfirebaseEnabled=false"
+        log_info "Firebase disabled for this Android build (FIREBASE_ENABLED=${FIREBASE_ENABLED})"
+        ;;
+esac
+
 # Print build header
 print_header "TimeSafari Android Build Process"
 
@@ -528,7 +543,7 @@ if [ "$CLEAN_ONLY" = true ]; then
     log_info "Clean-only mode: cleaning build artifacts"
     safe_execute "Cleaning Android app" "npm run clean:android" || exit 1
     safe_execute "Cleaning dist directory" "clean_build_artifacts dist" || exit 1
-    safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean && cd .." || exit 4
+    safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean ${gradle_firebase_arg} && cd .." || exit 4
     log_success "Clean completed successfully!"
     exit 0
 fi
@@ -561,7 +576,7 @@ if [ "$DEPLOY_APP" = true ]; then
     fi
     
     # Build APK
-    safe_execute "Building APK" "cd android && ./gradlew assembleDebug && cd .." || exit 5
+    safe_execute "Building APK" "cd android && ./gradlew assembleDebug ${gradle_firebase_arg} && cd .." || exit 5
     
     # Install APK on device
     safe_execute "Installing APK on device" "adb install -r android/app/build/outputs/apk/debug/app-debug.apk" || exit 6
@@ -628,26 +643,26 @@ fi
 safe_execute "Generating assets" "npx capacitor-assets generate --android --assetPath resources" || exit 7
 
 # Step 8: Clean Gradle build
-safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean && cd .." || exit 4
+safe_execute "Cleaning Gradle build" "cd android && ./gradlew clean ${gradle_firebase_arg} && cd .." || exit 4
 
 # Step 9: Build based on type
 if [ "$BUILD_TYPE" = "debug" ]; then
-    safe_execute "Assembling debug build" "cd android && ./gradlew assembleDebug && cd .." || exit 5
+    safe_execute "Assembling debug build" "cd android && ./gradlew assembleDebug ${gradle_firebase_arg} && cd .." || exit 5
 elif [ "$BUILD_TYPE" = "release" ]; then
-    safe_execute "Assembling release build" "cd android && ./gradlew assembleRelease && cd .." || exit 5
+    safe_execute "Assembling release build" "cd android && ./gradlew assembleRelease ${gradle_firebase_arg} && cd .." || exit 5
 fi
 
 # Step 10: Build APK/AAB if requested
 if [ "$BUILD_APK" = true ]; then
     if [ "$BUILD_TYPE" = "debug" ]; then
-        safe_execute "Building debug APK" "cd android && ./gradlew assembleDebug && cd .." || exit 5
+        safe_execute "Building debug APK" "cd android && ./gradlew assembleDebug ${gradle_firebase_arg} && cd .." || exit 5
     else
-        safe_execute "Building release APK" "cd android && ./gradlew assembleRelease && cd .." || exit 5
+        safe_execute "Building release APK" "cd android && ./gradlew assembleRelease ${gradle_firebase_arg} && cd .." || exit 5
     fi
 fi
 
 if [ "$BUILD_AAB" = true ]; then
-    safe_execute "Building AAB" "cd android && ./gradlew bundleRelease && cd .." || exit 5
+    safe_execute "Building AAB" "cd android && ./gradlew bundleRelease ${gradle_firebase_arg} && cd .." || exit 5
     if [ "$BUILD_MODE" = "production" ]; then
         safe_execute "Checking production AAB" "./scripts/check-prod-bundle.sh android/app/build/outputs/bundle/release/app-release.aab" || exit 10
     fi

scripts/build-arch-guard.sh

@@ -23,8 +23,6 @@ SENSITIVE=(
   "electron/**" 
   "android/**" 
   "ios/**"
-  "sw_scripts/**" 
-  "sw_combine.js" 
   "Dockerfile" 
   "docker/**"
   "capacitor.config.ts"

scripts/build-ios.sh

@@ -44,6 +44,9 @@ print_ios_usage() {
     echo "  --auto-run              Auto-run app after build"
     echo "  --api-ip <ip>          Custom IP address for claim API (uses Capacitor default)"
     echo ""
+    echo "Firebase is on by default. Opt out with FIREBASE_ENABLED=false"
+    echo "(forwarded to xcodebuild as FIREBASE_ENABLED=NO)."
+    echo ""
     echo "Common Options:"
     echo "  -h, --help             Show this help message"
     echo "  -v, --verbose          Enable verbose logging"
@@ -321,6 +324,17 @@ clean_ios_build() {
     log_success "iOS build cleaned"
 }
 
+# Map FIREBASE_ENABLED onto the Xcode build setting the run-script phases read.
+# Unset stays YES. false, 0, and no (any case) become NO.
+ios_firebase_build_setting() {
+    local normalized
+    normalized=$(printf '%s' "${FIREBASE_ENABLED:-YES}" | tr '[:upper:]' '[:lower:]')
+    case "$normalized" in
+        false|0|no) printf 'NO' ;;
+        *) printf 'YES' ;;
+    esac
+}
+
 # Function to build iOS app
 build_ios_app() {
     local build_config=""
@@ -358,6 +372,7 @@ build_ios_app() {
                -configuration "$build_config" \
                -destination "$destination" \
                build \
+               "FIREBASE_ENABLED=$(ios_firebase_build_setting)" \
                CODE_SIGN_IDENTITY="" \
                CODE_SIGNING_REQUIRED=NO \
                CODE_SIGNING_ALLOWED=NO \
@@ -537,6 +552,13 @@ if [ "$ASSETS_ONLY" = true ]; then
     exit 0
 fi
 
+# Firebase is on unless FIREBASE_ENABLED=false. Fail before the web build and
+# xcodebuild when the plist is missing. Xcode runs the same script as a build
+# phase so GUI builds get the same check and bundle the plist.
+if ! ios/App/scripts/bundle-firebase-config.sh --check; then
+    exit 1
+fi
+
 # Handle deploy-app mode
 if [ "$DEPLOY_APP" = true ]; then
     deploy_ios_app
@@ -701,6 +723,7 @@ if [ "$BUILD_IPA" = true ]; then
                -configuration Release \
                -archivePath build/App.xcarchive \
                archive \
+               "FIREBASE_ENABLED=$(ios_firebase_build_setting)" \
                CODE_SIGN_IDENTITY="" \
                CODE_SIGNING_REQUIRED=NO \
                CODE_SIGNING_ALLOWED=NO \

scripts/build-web.sh

@@ -5,25 +5,31 @@
 # This script handles the complete web build process including cleanup,
 # environment setup, Vite build, and optional Docker containerization.
 #
+# Every invocation except --dev writes dist/. --dev alone starts the Vite dev
+# server and writes nothing.
+#
 # Usage:
-#   ./scripts/build-web.sh                    # Development build
-#   ./scripts/build-web.sh --dev              # Development build (explicit)
+#   ./scripts/build-web.sh                    # Production build into dist/
+#   ./scripts/build-web.sh --prod             # Production build (explicit)
 #   ./scripts/build-web.sh --test             # Test environment build
-#   ./scripts/build-web.sh --prod             # Production environment build
-#   ./scripts/build-web.sh --docker           # Build with Docker containerization
+#   ./scripts/build-web.sh --dev              # Start Vite dev server (no dist/)
+#   ./scripts/build-web.sh --docker           # Production build + Docker image
 #   ./scripts/build-web.sh --docker:test      # Test environment + Docker
 #   ./scripts/build-web.sh --docker:prod      # Production environment + Docker
-#   ./scripts/build-web.sh --serve            # Build and serve locally
+#   ./scripts/build-web.sh --serve            # Production build, then serve dist/
 #   ./scripts/build-web.sh --help             # Show help
 #   ./scripts/build-web.sh --verbose          # Enable verbose logging
 #
 # NPM Script Equivalents:
-#   npm run build:web                         # Development build
+#   npm run dev                               # Vite dev server
+#   npm run build:web                         # Production build
 #   npm run build:web:test                    # Test environment build
 #   npm run build:web:prod                    # Production environment build
-#   npm run build:web:docker                  # Docker build
+#   npm run build:web:docker                  # Production Docker build
 #   npm run build:web:docker:test             # Test Docker build
 #   npm run build:web:docker:prod             # Production Docker build
+#   npm run build:web:serve                   # Production build, then serve
+#   npm run build:web:serve:test              # Test build, then serve
 #
 # Exit Codes:
 # 1 - Web cleanup failed
@@ -40,7 +46,7 @@ set -e
 source "$(dirname "$0")/common.sh"
 
 # Default values
-BUILD_MODE="development"
+BUILD_MODE="production"
 BUILD_ACTION="build"
 DOCKER_BUILD=false
 SERVE_BUILD=false
@@ -51,9 +57,10 @@ show_usage() {
 Usage: $0 [OPTIONS]
 
 OPTIONS:
-    --dev, --development    Build for development environment (default)
+    --prod, --production    Build for production environment (default)
     --test                  Build for test environment
-    --prod, --production    Build for production environment
+    --dev, --development    Start the Vite dev server (with --serve or
+                            --docker: build for development instead)
     --docker                Build and create Docker container
     --docker:test           Build for test environment and create Docker container
     --docker:prod           Build for production environment and create Docker container
@@ -63,18 +70,18 @@ OPTIONS:
     --env                   Show environment variables
 
 EXAMPLES:
-    $0                                   # Development build
+    $0                                   # Production build
     $0 --test                            # Test environment build
-    $0 --prod                            # Production environment build
-    $0 --docker                          # Development + Docker
+    $0 --dev                             # Development server
+    $0 --docker                          # Production + Docker
     $0 --docker:test                     # Test + Docker
     $0 --docker:prod                     # Production + Docker
-    $0 --serve                           # Build and serve
+    $0 --serve                           # Production build, then serve
 
 BUILD MODES:
-    development: Starts Vite development server with hot reload (default)
+    production: Optimized for production with full minification and optimization (default)
     test: Optimized for testing with minimal minification
-    production: Optimized for production with full minification and optimization
+    development: Starts Vite development server with hot reload
 
 EOF
 }

scripts/clear-database.sh

@@ -161,4 +161,4 @@ echo "✅ Database clearing instructions completed!"
 echo ""
 echo "💡 Tip: After clearing the database, restart your development server:"
 echo "   npm run build:electron:dev    # For Electron"
-echo "   npm run build:web:dev         # For Web" 
+echo "   npm run dev                   # For Web" 

scripts/test-android.js

@@ -283,7 +283,6 @@ const runDeeplinkTests = async (log) => {
 const buildWebAssets = async (log) => {
     log('🌐 Building web assets...');
     execSync('rm -rf dist', { stdio: 'inherit' });
-    execSync('npm run build:web', { stdio: 'inherit' });
     execSync('npm run build:capacitor', { stdio: 'inherit' });
     log('✅ Web assets built successfully');
 };

scripts/test-ios.js

@@ -147,7 +147,6 @@ export default config;
     log('🔄 Building web assets before adding iOS platform...');
     try {
         execSync('rm -rf dist', { stdio: 'inherit' });
-        execSync('npm run build:web', { stdio: 'inherit' });
         execSync('npm run build:capacitor', { stdio: 'inherit' });
         log('✅ Web assets built successfully');
     } catch (error) {
@@ -416,7 +415,6 @@ const generateTestData = async (log) => {
 const buildWebAssets = async (log) => {
     log('🌐 Building web assets...');
     execSync('rm -rf dist', { stdio: 'inherit' });
-    execSync('npm run build:web', { stdio: 'inherit' });
     execSync('npm run build:capacitor', { stdio: 'inherit' });
     log('✅ Web assets built successfully');
 };

src/App.vue

@@ -386,19 +386,28 @@ export default class App extends Vue {
     // On native (iOS/Android) we don't use web push; the callback handles cancel + state in the view.
     // The callback is the one passed for this specific modal (New Activity or Daily Reminder), so we only turn off that one.
     if (Capacitor.isNativePlatform()) {
+      // A false callback means the view refused the off (AlertSearch revoke
+      // failed). Leave the existing "Notifications are off." toast for every
+      // other callback, which returns void.
+      let turnedOff = true;
       if (notification.callback) {
-        await notification.callback(true);
+        const callbackResult = await notification.callback(true);
+        if (callbackResult === false) {
+          turnedOff = false;
+        }
       }
-      this.$notify(
-        {
-          group: "alert",
-          type: "info",
-          title: "Finished",
-          text: "Notifications are off.",
-        },
-        5000,
-      );
-      return true;
+      if (turnedOff) {
+        this.$notify(
+          {
+            group: "alert",
+            type: "info",
+            title: "Finished",
+            text: "Notifications are off.",
+          },
+          5000,
+        );
+      }
+      return turnedOff;
     }
 
     let subscription: PushSubscriptionJSON | null = null;
@@ -483,7 +492,17 @@ export default class App extends Vue {
           return false;
         });
 
-      const message = pushServerSuccess
+      // Ask the view before announcing success. A callback that returns false
+      // (failed AlertSearch revoke) keeps the existing failure sentence.
+      // Callbacks that return void, including Daily Reminder, keep today's copy.
+      let callbackRefused = false;
+      if (notification.callback) {
+        const callbackResult = await notification.callback(pushServerSuccess);
+        callbackRefused = callbackResult === false;
+      }
+
+      const turnedOff = pushServerSuccess && !callbackRefused;
+      const message = turnedOff
         ? "Notification is off."
         : "Notification is still on. Try to turn it off again.";
 
@@ -497,11 +516,7 @@ export default class App extends Vue {
         5000,
       );
 
-      if (notification.callback) {
-        notification.callback(pushServerSuccess);
-      }
-
-      return pushServerSuccess;
+      return turnedOff;
     } catch (error) {
       this.$logAndConsole(
         "Error turning off notifications: " + JSON.stringify(error),

src/components/HiddenDidDialog.vue

@@ -10,7 +10,7 @@
       </div>
 
       <!-- Content -->
-      <!-- This is somewhat similar to ClaimView.vue and ConfirmGiftView.vue -->
+      <!-- This is somewhat similar to ClaimView.vue -->
       <div class="mb-4">
         <p class="mb-4">
           <span v-if="R.isEmpty(visibleToDids)">
@@ -21,10 +21,17 @@
 
         <div v-if="R.isEmpty(visibleToDids)">
           <p class="mt-2">
-            You can ask one of your contacts to take a look and see if their
-            contacts can see more details. Someone is connected to people closer
-            to them; if you don't know who to ask, try the person who registered
-            you.
+            Someone is still closer to them than you are.
+            <router-link
+              v-if="claimJwtId"
+              :to="{ path: '/claim/' + encodeURIComponent(claimJwtId) }"
+              class="text-blue-500"
+              @click="close"
+              >Open the record to see who can introduce you.</router-link
+            >
+            <span v-else>
+              If you don't know who to ask, try the person who registered you.
+            </span>
           </p>
         </div>
 
@@ -119,8 +126,9 @@ import { createNotifyHelpers } from "@/utils/notify";
 import { TIMEOUTS } from "@/utils/notify";
 import { NOTIFY_COPIED_TO_CLIPBOARD } from "@/constants/notifications";
 import { APP_SERVER } from "@/constants/app";
+import { PlatformServiceMixin } from "@/utils/PlatformServiceMixin";
 
-@Component({ name: "HiddenDidDialog" })
+@Component({ name: "HiddenDidDialog", mixins: [PlatformServiceMixin] })
 export default class HiddenDidDialog extends Vue {
   $notify!: (notification: NotificationIface, timeout?: number) => void;
   notify!: ReturnType<typeof createNotifyHelpers>;
@@ -132,6 +140,7 @@ export default class HiddenDidDialog extends Vue {
   activeDid = "";
   allMyDids: Array<string> = [];
   canShare = false;
+  claimJwtId = "";
   deepLinkPathSuffix = "";
   deepLinkUrl = window.location.href; // this is changed to a deep link in the setup
 
@@ -171,7 +180,9 @@ export default class HiddenDidDialog extends Vue {
     allContacts: Array<Contact>,
     activeDid: string,
     allMyDids: Array<string>,
+    claimJwtId = "",
   ) {
+    this.claimJwtId = claimJwtId;
     this.deepLinkPathSuffix = deepLinkPathSuffix;
     this.roleName = roleName;
     this.visibleToDids = visibleToDids;

src/components/ImageMethodDialog.vue

@@ -854,19 +854,19 @@ export default class ImageMethodDialog extends Vue {
     formData.append("image", this.blob, this.fileName || "photo.jpg");
     formData.append("claimType", this.claimType);
     try {
+      const imageServer =
+        (await this.$accountSettings()).imageServer || DEFAULT_IMAGE_API_SERVER;
       if (
         window.location.hostname === "localhost" &&
-        !DEFAULT_IMAGE_API_SERVER.includes("localhost")
+        !imageServer.includes("localhost")
       ) {
         logger.log(
           "Using shared image API server, so only users on that server can play with images.",
         );
       }
-      const response = await axios.post(
-        DEFAULT_IMAGE_API_SERVER + "/image",
-        formData,
-        { headers },
-      );
+      const response = await axios.post(imageServer + "/image", formData, {
+        headers,
+      });
       this.uploading = false;
 
       this.close();

src/components/NetworkConnections.vue

@@ -0,0 +1,350 @@
+<template>
+  <!--
+    Nearest neighbors in the registration graph between the user and the people
+    in a claim or profile. Everyone registered is connected through the
+    registration tree, so there is always someone one step closer; nothing is
+    fetched until the user expands this section.
+  -->
+  <div ref="section" data-testId="networkConnections">
+    <h2
+      class="text-lg font-semibold text-blue-500 cursor-pointer"
+      data-testId="networkConnectionsToggle"
+      @click="toggle()"
+    >
+      Who Can Introduce You
+      <font-awesome :icon="isExpanded ? 'chevron-down' : 'chevron-right'" />
+    </h2>
+
+    <div v-if="isExpanded" class="mt-2">
+      <p class="text-sm text-slate-700 mb-3">
+        Everyone on this server is connected to you through the people who
+        registered each other, so someone is always one step closer to
+        {{ subjectDescription }}. Ask that person for an introduction.
+      </p>
+
+      <p v-if="!isRegistered" class="text-sm text-slate-700">
+        You are not registered yet, so you are not connected to anyone. The
+        person who registers you will be your first connection to everyone else;
+        find someone on the Help page.
+      </p>
+      <div v-else-if="isLoading" class="flex justify-center items-center py-8">
+        <font-awesome
+          icon="spinner"
+          class="fa-spin-pulse text-2xl text-slate-400"
+        />
+      </div>
+      <div
+        v-else-if="errorMessage"
+        class="bg-red-50 border border-red-300 rounded-md p-4"
+      >
+        <div class="flex items-start gap-2">
+          <font-awesome
+            icon="exclamation-triangle"
+            class="text-red-500 mt-0.5"
+          />
+          <p class="text-red-700">{{ errorMessage }}</p>
+        </div>
+      </div>
+      <p
+        v-else-if="Object.keys(neighborsByDid).length === 0"
+        class="text-sm text-slate-500 italic"
+      >
+        Nobody else is involved here.
+      </p>
+      <div v-else>
+        <div v-for="(neighbors, did) in neighborsByDid" :key="did" class="mb-4">
+          <h3
+            v-if="Object.keys(neighborsByDid).length > 1"
+            class="text-sm font-medium text-slate-600 mb-1"
+          >
+            Near {{ displayName(did as string) }}:
+          </h3>
+          <!-- the server only returns no neighbors for an unregistered DID -->
+          <p
+            v-if="neighbors.length === 0"
+            class="text-sm text-slate-500 italic"
+          >
+            {{ capitalize(displayName(did as string)) }} is not registered on
+            this server, so nobody here is connected to them. The data may be a
+            mistake, or a test, or a reference to someone on a different system.
+          </p>
+          <p
+            v-else-if="neighbors[0].did === did"
+            class="text-sm text-slate-700"
+          >
+            You are directly connected:
+            {{
+              neighbors[0].relation === "REGISTERED_BY_YOU"
+                ? "you registered them."
+                : "they registered you."
+            }}
+          </p>
+          <div v-else class="space-y-2">
+            <div
+              v-for="neighbor in neighbors"
+              :key="neighbor.did"
+              class="bg-slate-50 border border-slate-300 rounded-md"
+            >
+              <div class="flex items-center justify-between gap-3 p-3">
+                <div class="flex items-center gap-2 flex-1 min-w-0">
+                  <button
+                    :title="`Copy ${linkName.toLowerCase()} and expand`"
+                    class="text-blue-600 flex-shrink-0"
+                    @click="onNeighborExpandClick(neighbor.did)"
+                  >
+                    <font-awesome
+                      :icon="
+                        expandedNeighborDid === neighbor.did
+                          ? 'chevron-down'
+                          : 'chevron-right'
+                      "
+                      class="text-sm"
+                    />
+                    {{ displayName(neighbor.did) }}
+                  </button>
+                  <span :class="relationBadgeClass(neighbor.relation)">
+                    {{ relationLabel(neighbor.relation) }}
+                  </span>
+                </div>
+              </div>
+              <div
+                v-if="expandedNeighborDid === neighbor.did"
+                class="border-t border-slate-300 p-3 bg-white"
+              >
+                <router-link
+                  :to="{ path: '/did/' + encodeURIComponent(neighbor.did) }"
+                  class="text-blue-600 hover:text-blue-800 font-medium underline"
+                >
+                  Go to contact info
+                </router-link>
+                and send them the {{ linkName.toLowerCase() }} from your
+                clipboard. Ask them for an introduction.
+                <div
+                  v-if="isNotInContacts(neighbor.did)"
+                  class="flex flex-col gap-1 mt-2"
+                >
+                  <p class="text-xs text-slate-600">
+                    This person is connected to you, but they are not in this
+                    device's contacts. Copy this DID link and check on another
+                    device or check with different people.
+                  </p>
+                  <span class="flex items-center gap-1 min-w-0">
+                    <span class="text-xs truncate text-slate-600 min-w-0">
+                      {{ neighbor.did }}
+                    </span>
+                    <button
+                      title="Copy DID Link"
+                      class="text-blue-600 hover:text-blue-800 underline cursor-pointer flex-shrink-0"
+                      @click.prevent="onCopyDidClick(neighbor.did)"
+                    >
+                      <font-awesome icon="copy" class="text-sm" />
+                    </button>
+                  </span>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script lang="ts">
+import { Component, Prop, Vue } from "vue-facing-decorator";
+
+import { APP_SERVER, NotificationIface } from "../constants/app";
+import { Contact } from "../db/tables/contacts";
+import * as serverUtil from "../libs/endorserServer";
+import { copyToClipboard } from "../services/ClipboardService";
+import { createNotifyHelpers, TIMEOUTS } from "@/utils/notify";
+import { PlatformServiceMixin } from "@/utils/PlatformServiceMixin";
+
+interface Neighbor {
+  did: string;
+  relation: string;
+}
+
+/**
+ * Expandable list of the people one step closer, in the registration tree,
+ * to each person in a claim or profile.
+ *
+ * Exactly one of claimId or profileId is expected. The claim endpoint returns
+ * neighbors keyed by each DID in the claim; the profile endpoint returns one
+ * list for the profile owner (keyed here by profileDid).
+ */
+@Component({ name: "NetworkConnections", mixins: [PlatformServiceMixin] })
+export default class NetworkConnections extends Vue {
+  $notify!: (notification: NotificationIface, timeout?: number) => void;
+
+  @Prop({ required: true }) activeDid!: string;
+  @Prop({ default: () => [] }) allContacts!: Array<Contact>;
+  @Prop({ default: () => [] }) allMyDids!: Array<string>;
+  /** endorser server for claims, partner server for profiles */
+  @Prop({ required: true }) apiServer!: string;
+  @Prop() claimId?: string;
+  @Prop({ required: true }) isRegistered!: boolean;
+  /** deep link copied for the user to send to a neighbor */
+  @Prop({ required: true }) link!: string;
+  /** eg. "Claim link" */
+  @Prop({ required: true }) linkName!: string;
+  @Prop() profileDid?: string;
+  @Prop() profileId?: string;
+  /** eg. "this person" */
+  @Prop({ required: true }) subjectDescription!: string;
+
+  notify!: ReturnType<typeof createNotifyHelpers>;
+
+  errorMessage = "";
+  expandedNeighborDid: string | null = null;
+  isExpanded = false;
+  isLoaded = false;
+  isLoading = false;
+  neighborsByDid: Record<string, Array<Neighbor>> = {};
+
+  created() {
+    this.notify = createNotifyHelpers(this.$notify);
+  }
+
+  async toggle() {
+    if (this.isExpanded) {
+      this.isExpanded = false;
+    } else {
+      await this.expand();
+    }
+  }
+
+  /**
+   * Opens the section and loads the neighbors the first time.
+   * @param scroll whether to bring the section into view, for links elsewhere on the page
+   */
+  async expand(scroll = false) {
+    this.isExpanded = true;
+    if (scroll) {
+      (this.$refs.section as HTMLElement | undefined)?.scrollIntoView({
+        behavior: "smooth",
+      });
+    }
+    if (!this.isLoaded && !this.isLoading && this.isRegistered) {
+      await this.loadNeighbors();
+    }
+  }
+
+  async loadNeighbors() {
+    this.isLoading = true;
+    this.errorMessage = "";
+    try {
+      const url = this.claimId
+        ? this.apiServer +
+          "/api/claim/claimNearestNeighbors/" +
+          encodeURIComponent(this.claimId)
+        : this.apiServer +
+          "/api/partner/userProfileNearestNeighbors/" +
+          encodeURIComponent(this.profileId || "");
+      const headers = await serverUtil.getHeaders(this.activeDid);
+      const response = await fetch(url, { headers });
+      if (response.status !== 200) {
+        throw new Error(`Status ${response.status} from ${url}`);
+      }
+      const data = (await response.json()).data;
+      const raw: Record<string, unknown> = this.claimId
+        ? data || {}
+        : { [this.profileDid || ""]: data };
+      const result: Record<string, Array<Neighbor>> = {};
+      for (const [did, neighbors] of Object.entries(raw)) {
+        // the user's own entry adds nothing since "You" is already known
+        if (did === this.activeDid) continue;
+        // the server sends an {error} object instead of a list when one lookup fails
+        if (!Array.isArray(neighbors)) {
+          throw new Error(`Error for ${did}: ${JSON.stringify(neighbors)}`);
+        }
+        result[did] = neighbors.filter((neighbor: Neighbor) => neighbor.did);
+      }
+      this.neighborsByDid = result;
+      this.isLoaded = true;
+    } catch (error) {
+      this.$logAndConsole(`Error loading network connections: ${error}`, true);
+      this.errorMessage =
+        "An error occurred while loading network connections.";
+    } finally {
+      this.isLoading = false;
+    }
+  }
+
+  displayName(did: string): string {
+    // the server keys a DID hidden from this user as HIDDEN_DID + "_" + index
+    const isHiddenKey = did.startsWith(serverUtil.HIDDEN_DID + "_");
+    return serverUtil.didInfo(
+      isHiddenKey ? serverUtil.HIDDEN_DID : did,
+      this.activeDid,
+      this.allMyDids,
+      this.allContacts,
+    );
+  }
+
+  capitalize(text: string): string {
+    return text.charAt(0).toUpperCase() + text.slice(1);
+  }
+
+  isNotInContacts(did: string): boolean {
+    return !this.allContacts.some((contact) => contact.did === did);
+  }
+
+  relationLabel(relation: string): string {
+    switch (relation) {
+      case "REGISTERED_BY_YOU":
+        return "Registered by You";
+      case "REGISTERED_YOU":
+        return "Registered You";
+      case "TARGET":
+        return "Yourself";
+      default:
+        return relation;
+    }
+  }
+
+  relationBadgeClass(relation: string): string {
+    const baseClasses =
+      "text-xs font-semibold px-2 py-1 rounded whitespace-nowrap";
+    switch (relation) {
+      case "REGISTERED_BY_YOU":
+        return `${baseClasses} bg-blue-100 text-blue-700`;
+      case "REGISTERED_YOU":
+        return `${baseClasses} bg-green-100 text-green-700`;
+      case "TARGET":
+        return `${baseClasses} bg-purple-100 text-purple-700`;
+      default:
+        return `${baseClasses} bg-slate-100 text-slate-700`;
+    }
+  }
+
+  /**
+   * Copies the link for the neighbor and toggles their instructions
+   */
+  async onNeighborExpandClick(did: string) {
+    if (this.expandedNeighborDid === did) {
+      this.expandedNeighborDid = null;
+      return;
+    }
+    try {
+      await copyToClipboard(this.link);
+      this.notify.copied(this.linkName, TIMEOUTS.STANDARD);
+    } catch (error) {
+      this.$logAndConsole(`Error copying ${this.linkName}: ${error}`, true);
+      this.notify.error(`Failed to copy ${this.linkName.toLowerCase()}.`);
+    }
+    this.expandedNeighborDid = did;
+  }
+
+  async onCopyDidClick(did: string) {
+    const deepLink = `${APP_SERVER}/deep-link/did/${encodeURIComponent(did)}`;
+    try {
+      await copyToClipboard(deepLink);
+      this.notify.copied("DID link", TIMEOUTS.STANDARD);
+    } catch (error) {
+      this.$logAndConsole(`Error copying DID link: ${error}`, true);
+      this.notify.error("Failed to copy DID link.");
+    }
+  }
+}
+</script>

src/components/NewActivityRow.vue

@@ -0,0 +1,191 @@
+<template>
+  <div>
+    <!-- claims, and gifts & offers -->
+    <div v-if="kind === 'claim'" class="flex items-start gap-2">
+      <div class="grow min-w-0">
+        <span class="font-medium">{{ claimTypeText }}</span>
+        <span v-if="claimDescription" class="block truncate">{{
+          claimDescription
+        }}</span>
+        <span class="block text-sm text-slate-500">
+          from {{ personName(claimRow.issuer) }}
+          <template v-if="claimRow.issuedAt">
+            · {{ formatDate(claimRow.issuedAt) }}
+          </template>
+        </span>
+      </div>
+      <router-link
+        :to="{ path: '/claim/' + encodeURIComponent(claimRow.id) }"
+        class="text-blue-500 flex-shrink-0"
+      >
+        <font-awesome icon="file-lines" />
+      </router-link>
+    </div>
+
+    <!-- projects -->
+    <div v-else-if="kind === 'plan'">
+      <div class="flex items-start gap-2">
+        <div class="grow min-w-0">
+          <span class="font-medium">{{
+            planRow.name || "Unnamed Project"
+          }}</span>
+          <span
+            v-if="similarity !== undefined"
+            class="text-sm text-slate-500 ml-2"
+            >{{ similarity }}% match</span
+          >
+          <span v-if="planRow.description" class="block truncate">{{
+            planRow.description
+          }}</span>
+        </div>
+        <router-link
+          :to="{ path: '/project/' + encodeURIComponent(planRow.handleId) }"
+          class="text-blue-500 flex-shrink-0"
+        >
+          <font-awesome icon="file-lines" />
+        </router-link>
+      </div>
+      <PlanChangeDiff
+        v-if="planChange"
+        :plan-change="planChange"
+        :active-did="activeDid"
+        :all-my-dids="allMyDids"
+        :all-contacts="allContacts"
+      />
+    </div>
+
+    <!-- profiles -->
+    <div v-else-if="kind === 'profile'" class="flex items-start gap-2">
+      <div class="grow min-w-0">
+        <span class="font-medium">{{ personName(profileRow.issuerDid) }}</span>
+        <span
+          v-if="similarity !== undefined"
+          class="text-sm text-slate-500 ml-2"
+          >{{ similarity }}% match</span
+        >
+        <span class="block truncate">{{ profileRow.description }}</span>
+      </div>
+      <router-link
+        v-if="profileRow.rowId !== undefined"
+        :to="{
+          path: '/user-profile/' + encodeURIComponent(String(profileRow.rowId)),
+        }"
+        class="text-blue-500 flex-shrink-0"
+      >
+        <font-awesome icon="file-lines" />
+      </router-link>
+    </div>
+  </div>
+</template>
+
+<script lang="ts">
+import { Component, Prop, Vue } from "vue-facing-decorator";
+
+import PlanChangeDiff from "./PlanChangeDiff.vue";
+import { Contact } from "../db/tables/contacts";
+import type {
+  AlertSearchJwtWithClaimRecord,
+  AlertSearchPlanRecord,
+  AlertSearchProfileRecord,
+} from "../interfaces/alertSearch";
+import { PlanSummaryAndPreviousClaim } from "../interfaces/records";
+import { didInfo } from "../libs/endorserServer";
+import type { NewActivityBucket } from "../libs/newActivity";
+
+type RowKind = "claim" | "plan" | "profile";
+
+const BUCKET_KINDS: Record<NewActivityBucket, RowKind> = {
+  claims: "claim",
+  personalPlanContributions: "claim",
+  trackedPlanClaims: "claim",
+  trackedPlanUpdates: "plan",
+  plansNearby: "plan",
+  plansSimilar: "plan",
+  profilesNearby: "profile",
+  profilesSimilar: "profile",
+};
+
+/** Readable names for the claim types alertSearch returns most. */
+const CLAIM_TYPE_TEXT: Record<string, string> = {
+  AgreeAction: "Agreement",
+  GiveAction: "Gift",
+  JoinAction: "Join",
+  Offer: "Offer",
+  PlanAction: "Project",
+  RegisterAction: "Registration",
+};
+
+/** One row of a New Activity bucket, shaped by the kind of record it is. */
+@Component({ components: { PlanChangeDiff } })
+export default class NewActivityRow extends Vue {
+  @Prop({ required: true }) bucket!: NewActivityBucket;
+  @Prop({ required: true }) row!: unknown;
+  @Prop({ required: true }) activeDid!: string;
+  @Prop({ default: () => [] }) allMyDids!: string[];
+  @Prop({ default: () => [] }) allContacts!: Contact[];
+  @Prop() planChange?: PlanSummaryAndPreviousClaim;
+
+  get kind(): RowKind {
+    return BUCKET_KINDS[this.bucket];
+  }
+
+  /** Similar matches wrap the record with its similarity, 0 to 1. */
+  get record(): Record<string, unknown> {
+    const row = this.row as Record<string, unknown>;
+    return ((row.profile ?? row.plan ?? row) as Record<string, unknown>) || {};
+  }
+
+  get similarity(): number | undefined {
+    const value = (this.row as { similarity?: unknown }).similarity;
+    return typeof value === "number" ? Math.round(value * 100) : undefined;
+  }
+
+  get claimRow(): AlertSearchJwtWithClaimRecord {
+    return this.record as unknown as AlertSearchJwtWithClaimRecord;
+  }
+
+  get planRow(): AlertSearchPlanRecord {
+    return this.record as unknown as AlertSearchPlanRecord;
+  }
+
+  get profileRow(): AlertSearchProfileRecord {
+    return this.record as unknown as AlertSearchProfileRecord;
+  }
+
+  get claimTypeText(): string {
+    const type = this.claimRow.claimType || "";
+    return CLAIM_TYPE_TEXT[type] || type || "Claim";
+  }
+
+  /** The description inside the claim text, when the row carries it. */
+  get claimDescription(): string {
+    const text = this.claimRow.claim;
+    if (!text) return "";
+    try {
+      const claim = JSON.parse(text) as Record<string, unknown>;
+      const subject = (claim.credentialSubject ?? claim) as Record<
+        string,
+        unknown
+      >;
+      const object = subject.object as Record<string, unknown> | undefined;
+      const offered = subject.itemOffered as
+        | Record<string, unknown>
+        | undefined;
+      const description =
+        subject.description ?? object?.description ?? offered?.description;
+      return typeof description === "string" ? description : "";
+    } catch {
+      return "";
+    }
+  }
+
+  personName(did: string | undefined): string {
+    return didInfo(did, this.activeDid, this.allMyDids, this.allContacts);
+  }
+
+  formatDate(value: string): string {
+    const date = new Date(value);
+    return isNaN(date.getTime()) ? value : date.toLocaleDateString();
+  }
+}
+</script>

src/components/PhotoDialog.vue

@@ -556,19 +556,19 @@ export default class PhotoDialog extends Vue {
     formData.append("image", this.blob, this.fileName || "photo.jpg");
     formData.append("claimType", this.claimType);
     try {
+      const imageServer =
+        (await this.$accountSettings()).imageServer || DEFAULT_IMAGE_API_SERVER;
       if (
         window.location.hostname === "localhost" &&
-        !DEFAULT_IMAGE_API_SERVER.includes("localhost")
+        !imageServer.includes("localhost")
       ) {
         logger.log(
           "Using shared image API server, so only users on that server can play with images.",
         );
       }
-      const response = await axios.post(
-        DEFAULT_IMAGE_API_SERVER + "/image",
-        formData,
-        { headers },
-      );
+      const response = await axios.post(imageServer + "/image", formData, {
+        headers,
+      });
       this.uploading = false;
 
       this.close();

src/components/PlanChangeDiff.vue

@@ -0,0 +1,492 @@
+<template>
+  <div>
+    <div
+      v-if="getPlanDifferences(planChange.plan.handleId)"
+      class="text-sm mt-2"
+    >
+      <div class="font-medium mb-2">Changes</div>
+      <div class="overflow-x-auto">
+        <table
+          class="w-full text-xs border-collapse border border-gray-300 rounded-lg shadow-sm bg-white"
+        >
+          <thead>
+            <tr class="bg-gray-50">
+              <th
+                class="border border-gray-300 px-3 py-2 text-left font-semibold text-gray-700"
+              ></th>
+              <th
+                class="border border-gray-300 px-3 py-2 text-left font-semibold text-gray-700"
+              >
+                Previous
+              </th>
+              <th
+                class="border border-gray-300 px-3 py-2 text-left font-semibold text-gray-700"
+              >
+                Current
+              </th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr
+              v-for="(difference, field) in getPlanDifferences(
+                planChange.plan.handleId,
+              )"
+              :key="field"
+              class="hover:bg-gray-50"
+            >
+              <td
+                class="border border-gray-300 px-3 py-2 font-medium text-gray-800 break-words"
+              >
+                {{ getDisplayFieldName(field) }}
+              </td>
+              <template v-if="field === 'description'">
+                <td
+                  colspan="2"
+                  class="border border-gray-300 px-3 py-2 break-words align-top"
+                >
+                  <div class="w-3/5 mx-auto">
+                    <div
+                      v-for="(change, index) in getDescriptionDiff(
+                        difference.old,
+                        difference.new,
+                      )"
+                      :key="index"
+                    >
+                      <vue-markdown
+                        :source="change.value"
+                        :style="getDiffStyle(change)"
+                        class="markdown-content inline-block"
+                      />
+                    </div>
+                  </div>
+                </td>
+              </template>
+              <template v-else>
+                <td
+                  class="border border-gray-300 px-3 py-2 text-gray-600 break-words align-top"
+                >
+                  <span>{{ formatFieldValue(difference.old) }}</span>
+                </td>
+                <td
+                  class="border border-gray-300 px-3 py-2 text-green-700 font-medium break-words align-top"
+                >
+                  <span>{{ formatFieldValue(difference.new) }}</span>
+                </td>
+              </template>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+    <div v-else>
+      The changes are not important, like it was saved by accident or you've
+      seen it all before.
+    </div>
+  </div>
+</template>
+
+<script lang="ts">
+/**
+ * What changed in a starred project since the claim before the change: a
+ * table of previous and current values, with a line diff of the description.
+ */
+import { Component, Prop, Vue } from "vue-facing-decorator";
+import VueMarkdown from "vue-markdown-render";
+import { diffLines, Change } from "diff";
+import * as R from "ramda";
+
+import { Contact } from "../db/tables/contacts";
+import { GenericCredWrapper } from "@/interfaces";
+import { PlanActionClaim } from "../interfaces/claims";
+import {
+  PlanSummaryAndPreviousClaim,
+  PlanSummaryRecord,
+} from "../interfaces/records";
+import { didInfoOrNobody } from "../libs/endorserServer";
+import { logger } from "../utils/logger";
+
+@Component({ components: { VueMarkdown } })
+export default class PlanChangeDiff extends Vue {
+  @Prop({ required: true }) planChange!: PlanSummaryAndPreviousClaim;
+  @Prop({ required: true }) activeDid!: string;
+  @Prop({ default: () => [] }) allMyDids!: string[];
+  @Prop({ default: () => [] }) allContacts!: Contact[];
+
+  planDifferences: Record<
+    string,
+    Record<string, { old: unknown; new: unknown }>
+  > = {};
+
+  created() {
+    this.analyzePlanDifferences([this.planChange]);
+  }
+
+  /**
+   * Analyzes differences between current plans and their previous claims
+   *
+   * Walks through a list of PlanSummaryAndPreviousClaim items and stores the
+   * differences between the previous claim and the current plan. This method
+   * extracts the claim from the wrappedClaimBefore object and compares relevant
+   * fields with the current plan.
+   *
+   * @param planChanges Array of PlanSummaryAndPreviousClaim objects to analyze
+   */
+  analyzePlanDifferences(planChanges: Array<PlanSummaryAndPreviousClaim>) {
+    this.planDifferences = {};
+
+    for (const planChange of planChanges) {
+      const currentPlan: PlanSummaryRecord = planChange.plan;
+      const wrappedClaim: GenericCredWrapper<PlanActionClaim> | undefined =
+        planChange.wrappedClaimBefore;
+
+      // Extract the actual claim from the wrapped claim
+      let previousClaim: PlanActionClaim | undefined;
+
+      const embeddedClaim: PlanActionClaim | undefined = wrappedClaim?.claim;
+      if (
+        embeddedClaim &&
+        typeof embeddedClaim === "object" &&
+        "credentialSubject" in embeddedClaim
+      ) {
+        // It's a Verifiable Credential
+        previousClaim =
+          (embeddedClaim.credentialSubject as PlanActionClaim) || embeddedClaim;
+      } else {
+        // It's a direct claim
+        previousClaim = embeddedClaim;
+      }
+
+      if (!previousClaim) {
+        // Can happen when a project is starred after the stored last-seen-change-jwt ID
+        // so we'll just leave the message saying there are no important differences.
+        continue;
+      }
+
+      const differences: Record<string, { old: unknown; new: unknown }> = {};
+
+      // Compare name
+      const normalizedOldName = this.normalizeValueForComparison(
+        previousClaim.name,
+      );
+      const normalizedNewName = this.normalizeValueForComparison(
+        currentPlan.name,
+      );
+      if (!R.equals(normalizedOldName, normalizedNewName)) {
+        differences.name = {
+          old: previousClaim.name,
+          new: currentPlan.name,
+        };
+      }
+
+      // Compare description
+      const normalizedOldDescription = this.normalizeValueForComparison(
+        previousClaim.description,
+      );
+      const normalizedNewDescription = this.normalizeValueForComparison(
+        currentPlan.description,
+      );
+      if (!R.equals(normalizedOldDescription, normalizedNewDescription)) {
+        differences.description = {
+          old: previousClaim.description,
+          new: currentPlan.description,
+        };
+      }
+
+      // Compare location (combine latitude and longitude into one row)
+      const oldLat = this.normalizeValueForComparison(
+        previousClaim.location?.geo?.latitude,
+      );
+      const oldLon = this.normalizeValueForComparison(
+        previousClaim.location?.geo?.longitude,
+      );
+      const newLat = this.normalizeValueForComparison(currentPlan.locLat);
+      const newLon = this.normalizeValueForComparison(currentPlan.locLon);
+
+      if (!R.equals(oldLat, newLat) || !R.equals(oldLon, newLon)) {
+        differences.location = {
+          old: this.formatLocationValue(oldLat, oldLon, true),
+          new: this.formatLocationValue(newLat, newLon, false),
+        };
+      }
+
+      // Compare agent (issuer)
+      const oldAgent = didInfoOrNobody(
+        previousClaim.agent?.identifier,
+        this.activeDid,
+        this.allMyDids,
+        this.allContacts,
+      );
+      const newAgent = didInfoOrNobody(
+        currentPlan.agentDid,
+        this.activeDid,
+        this.allMyDids,
+        this.allContacts,
+      );
+      const normalizedOldAgent = this.normalizeValueForComparison(oldAgent);
+      const normalizedNewAgent = this.normalizeValueForComparison(newAgent);
+      if (!R.equals(normalizedOldAgent, normalizedNewAgent)) {
+        differences.agent = {
+          old: oldAgent,
+          new: newAgent,
+        };
+      }
+
+      // Compare start time
+      const oldStartTime = previousClaim.startTime;
+      const newStartTime = currentPlan.startTime;
+      const normalizedOldStartTime =
+        this.normalizeDateForComparison(oldStartTime);
+      const normalizedNewStartTime =
+        this.normalizeDateForComparison(newStartTime);
+      if (!R.equals(normalizedOldStartTime, normalizedNewStartTime)) {
+        differences.startTime = {
+          old: oldStartTime,
+          new: newStartTime,
+        };
+      }
+
+      // Compare end time
+      const oldEndTime = previousClaim.endTime;
+      const newEndTime = currentPlan.endTime;
+      const normalizedOldEndTime = this.normalizeDateForComparison(oldEndTime);
+      const normalizedNewEndTime = this.normalizeDateForComparison(newEndTime);
+      if (!R.equals(normalizedOldEndTime, normalizedNewEndTime)) {
+        differences.endTime = {
+          old: oldEndTime,
+          new: newEndTime,
+        };
+      }
+
+      // Compare image
+      const oldImage = previousClaim.image;
+      const newImage = currentPlan.image;
+      const normalizedOldImage = this.normalizeValueForComparison(oldImage);
+      const normalizedNewImage = this.normalizeValueForComparison(newImage);
+      if (!R.equals(normalizedOldImage, normalizedNewImage)) {
+        differences.image = {
+          old: oldImage,
+          new: newImage,
+        };
+      }
+
+      // Compare url
+      const oldUrl = previousClaim.url;
+      const newUrl = currentPlan.url;
+      const normalizedOldUrl = this.normalizeValueForComparison(oldUrl);
+      const normalizedNewUrl = this.normalizeValueForComparison(newUrl);
+      if (!R.equals(normalizedOldUrl, normalizedNewUrl)) {
+        differences.url = {
+          old: oldUrl,
+          new: newUrl,
+        };
+      }
+
+      // Store differences if any were found
+      if (!R.isEmpty(differences)) {
+        this.planDifferences[currentPlan.handleId] = differences;
+        logger.debug(
+          "[PlanChangeDiff] Plan differences found for",
+          currentPlan.handleId,
+          differences,
+        );
+      }
+    }
+
+    logger.debug(
+      "[PlanChangeDiff] Analyzed",
+      planChanges.length,
+      "plan changes, found differences in",
+      Object.keys(this.planDifferences).length,
+      "plans",
+    );
+  }
+
+  /**
+   * Normalizes values for comparison - treats null, undefined, and empty string as equivalent
+   *
+   * @param value The value to normalize
+   * @returns The normalized value (null for null/undefined/empty, otherwise the original value)
+   */
+  normalizeValueForComparison<T>(value: T | null | undefined): T | null {
+    if (value === null || value === undefined || value === "") {
+      return null;
+    }
+    return value;
+  }
+
+  /**
+   * Normalizes date values for comparison by converting strings to Date objects
+   * Returns null for null/undefined/empty values, Date objects for valid date strings
+   */
+  normalizeDateForComparison(value: unknown): Date | null {
+    if (value === null || value === undefined || value === "") {
+      return null;
+    }
+    if (typeof value === "string") {
+      const date = new Date(value);
+      // Check if the date is valid
+      return isNaN(date.getTime()) ? null : date;
+    }
+    if (value instanceof Date) {
+      return isNaN(value.getTime()) ? null : value;
+    }
+    return null;
+  }
+
+  /**
+   * Gets the differences for a specific plan by handle ID
+   *
+   * @param handleId The handle ID of the plan to get differences for
+   * @returns The differences object or null if no differences found
+   */
+  getPlanDifferences(
+    handleId: string,
+  ): Record<string, { old: unknown; new: unknown }> | null {
+    return this.planDifferences[handleId] || null;
+  }
+
+  /**
+   * Formats a field value for display in the UI
+   *
+   * @param value The value to format
+   * @returns A human-readable string representation
+   */
+  formatFieldValue(value: unknown): string {
+    if (value === null || value === undefined) {
+      return "Not set";
+    }
+    if (typeof value === "string") {
+      const stringValue = value || "Empty";
+
+      // Check if it's a date/time string
+      if (this.isDateTimeString(stringValue)) {
+        return this.formatDateTime(stringValue);
+      }
+
+      // Check if it's a URL
+      if (this.isUrl(stringValue)) {
+        return stringValue; // Keep URLs as-is for now
+      }
+
+      return stringValue;
+    }
+    if (typeof value === "number") {
+      return value.toString();
+    }
+    if (typeof value === "boolean") {
+      return value ? "Yes" : "No";
+    }
+    // For complex objects, stringify
+    const stringified = JSON.stringify(value);
+    return stringified;
+  }
+
+  /**
+   * Checks if a string appears to be a date/time string
+   */
+  isDateTimeString(value: string): boolean {
+    if (!value) return false;
+    // Check for ISO 8601 format or other common date formats
+    const dateRegex = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2})?(\.\d{3})?Z?$/;
+    return dateRegex.test(value) || !isNaN(Date.parse(value));
+  }
+
+  /**
+   * Checks if a string is a URL
+   */
+  isUrl(value: string): boolean {
+    if (!value) return false;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Formats a date/time string for display
+   */
+  formatDateTime(value: string): string {
+    try {
+      const date = new Date(value);
+      return date.toLocaleString();
+    } catch {
+      return value; // Return original if parsing fails
+    }
+  }
+
+  /**
+   * Gets a human-readable field name for display
+   *
+   * @param fieldName The internal field name
+   * @returns A formatted field name for display
+   */
+  getDisplayFieldName(fieldName: string): string {
+    const fieldNameMap: Record<string, string> = {
+      name: "Name",
+      description: "Description",
+      location: "Location",
+      agent: "Agent",
+      startTime: "Start Time",
+      endTime: "End Time",
+      image: "Image",
+      url: "URL",
+    };
+    return fieldNameMap[fieldName] || fieldName;
+  }
+
+  /**
+   * Formats location values for display
+   *
+   * @param latitude The latitude value
+   * @param longitude The longitude value
+   * @param isOldValue Whether this is the old value (true) or new value (false)
+   * @returns A formatted location string
+   */
+  formatLocationValue(
+    latitude: number | undefined | null,
+    longitude: number | undefined | null,
+    isOldValue: boolean = false,
+  ): string {
+    if (latitude == null && longitude == null) {
+      return "Not set";
+    }
+    // If there's any location data, show generic labels instead of coordinates
+    if (isOldValue) {
+      return "A Location";
+    } else {
+      return "New Location";
+    }
+  }
+
+  /**
+   * Computes the line-by-line diff between two description strings
+   *
+   * @param oldValue The old description value
+   * @param newValue The new description value
+   * @returns An array of Change objects from the diff library
+   */
+  getDescriptionDiff(oldValue: unknown, newValue: unknown): Change[] {
+    const oldStr = this.formatFieldValue(oldValue);
+    const newStr = this.formatFieldValue(newValue);
+    return diffLines(oldStr, newStr);
+  }
+
+  /**
+   * Gets the background color style for a diff change
+   *
+   * @param change A Change object from the diff library
+   * @returns A CSS style object with background color
+   */
+  getDiffStyle(change: Change): Record<string, string> {
+    if (change.added) {
+      return { backgroundColor: "#d4edda" }; // Light green
+    }
+    if (change.removed) {
+      return { backgroundColor: "#f8d7da" }; // Light red
+    }
+    return {};
+  }
+}
+</script>

src/components/dev/NotificationDebugPanel.vue

@@ -88,25 +88,6 @@
           Manually mints and uploads 100 delegated day JWTs. Requires an active
           did:ethr identity and JWT authentication; Test Mode is not used.
         </p>
-        <button
-          class="w-full text-md bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-          :disabled="busy"
-          :class="{ 'opacity-50 cursor-not-allowed': busy }"
-          @click="onBackendRefresh"
-        >
-          Refresh Notifications
-        </button>
-        <button
-          class="w-full text-md bg-gradient-to-b from-violet-400 to-violet-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-          :disabled="busy"
-          :class="{ 'opacity-50 cursor-not-allowed': busy }"
-          @click="onSimulateWakeupRefresh"
-        >
-          Simulate WAKEUP_PING (Local)
-        </button>
-        <p class="text-xs text-slate-500">
-          Local simulation only — calls the refresh API directly (no FCM push).
-        </p>
         <button
           class="w-full text-md bg-gradient-to-b from-amber-400 to-amber-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
           :disabled="busy"
@@ -128,8 +109,8 @@
           {{ realWakeupStatus.message }}
         </p>
         <p v-else class="text-xs text-slate-500">
-          Full pipeline — backend `/debug/send-wakeup` → FCM → WAKEUP_PING
-          handler.
+          FCM delivery diagnostic only — backend `/debug/send-wakeup`. The app
+          no longer schedules api_* notifications from WAKEUP_PING.
         </p>
       </div>
 
@@ -177,70 +158,6 @@
       </div>
     </div>
 
-    <!-- SECTION F: Mock Timing Presets -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Mock Timing Presets</h2>
-      <div class="flex flex-wrap gap-2">
-        <button
-          v-for="preset in presets"
-          :key="preset.ms"
-          class="px-3 py-2 rounded border border-slate-300 bg-white text-sm"
-          :class="{
-            'border-blue-500 ring-1 ring-blue-300': intervalMs === preset.ms,
-          }"
-          @click="intervalMs = preset.ms"
-        >
-          {{ preset.label }}
-        </button>
-      </div>
-      <div class="text-xs text-slate-500 mt-2">
-        Selected interval: <b>{{ intervalLabel }}</b>
-      </div>
-    </div>
-
-    <!-- SECTION A: Mock Refresh Controls -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Mock Refresh Controls</h2>
-      <button
-        class="w-full text-md bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-        :disabled="busy"
-        :class="{ 'opacity-50 cursor-not-allowed': busy }"
-        @click="onMockRefresh"
-      >
-        Trigger Mock Refresh
-      </button>
-    </div>
-
-    <!-- SECTION B: Wakeup Ping Simulator -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Wakeup Ping Simulator</h2>
-      <p class="text-xs text-slate-500 mb-2">
-        Exercises the production push handler (not the refresh API shortcut
-        above).
-      </p>
-      <button
-        class="w-full text-md bg-gradient-to-b from-slate-400 to-slate-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-        :disabled="busy"
-        :class="{ 'opacity-50 cursor-not-allowed': busy }"
-        @click="onWakeupPing"
-      >
-        Simulate WAKEUP_PING
-      </button>
-    </div>
-
-    <!-- SECTION C: Flood Test -->
-    <div class="mb-6">
-      <h2 class="mb-2 font-bold">Flood Test</h2>
-      <button
-        class="w-full text-md bg-gradient-to-b from-rose-400 to-rose-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
-        :disabled="busy"
-        :class="{ 'opacity-50 cursor-not-allowed': busy }"
-        @click="onFloodTest"
-      >
-        Run 20 Refreshes
-      </button>
-    </div>
-
     <!-- SECTION D: Pending Notification Inspector -->
     <div class="mb-6">
       <div class="flex items-center gap-3 mb-2">
@@ -358,14 +275,6 @@ type PendingInfo = {
   wallClockSource?: string | null;
 };
 
-const presets = [
-  { label: "30 sec", ms: 30_000 },
-  { label: "1 min", ms: 60_000 },
-  { label: "5 min", ms: 5 * 60_000 },
-  { label: "10 min", ms: 10 * 60_000 },
-];
-
-const intervalMs = ref<number>(60_000);
 const busy = ref(false);
 const pending = ref<PendingInfo[]>([]);
 const pendingInspectorMessage = ref<string | null>(null);
@@ -395,11 +304,6 @@ const truncatedFcmToken = computed(() => {
 const eventLog = ref<string[]>([]);
 let unsubscribeEventLog: (() => void) | undefined;
 
-const intervalLabel = computed(() => {
-  const preset = presets.find((p) => p.ms === intervalMs.value);
-  return preset?.label ?? `${intervalMs.value}ms`;
-});
-
 function formatIsoMs(ms: number | null | undefined): string {
   if (ms == null || !Number.isFinite(ms)) {
     return "";
@@ -423,27 +327,6 @@ async function refreshPending(): Promise<void> {
   pendingInspectorMessage.value = result.inspectorUnavailableMessage ?? null;
 }
 
-async function onMockRefresh(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.triggerMockRefresh(intervalMs.value);
-    await refreshPending();
-  });
-}
-
-async function onWakeupPing(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.simulateWakeupPing();
-    await refreshPending();
-  });
-}
-
-async function onFloodTest(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.runFloodTest(intervalMs.value);
-    await refreshPending();
-  });
-}
-
 async function onClearNotifications(): Promise<void> {
   await withBusy(async () => {
     await NotificationDebugService.clearNotifications();
@@ -514,20 +397,6 @@ async function onUploadAlertAuthorization(): Promise<void> {
   });
 }
 
-async function onBackendRefresh(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.triggerBackendRefresh();
-    await refreshPending();
-  });
-}
-
-async function onSimulateWakeupRefresh(): Promise<void> {
-  await withBusy(async () => {
-    await NotificationDebugService.simulateWakeupViaRefresh();
-    await refreshPending();
-  });
-}
-
 function formatRealWakeupStatusMessage(
   result: Awaited<
     ReturnType<typeof NotificationDebugService.sendRealWakeupPing>

src/composables/useNotifications.ts

@@ -1,134 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unused-vars */
-import { inject, onBeforeUnmount, onMounted } from "vue";
-import { NotificationIface } from "../constants/app";
-import { registerToken } from "@/services/notifications/NotificationService";
-import { refreshNotifications } from "@/services/notifications/NativeNotificationService";
-
-/**
- * Vue 3 composable for notifications
- * Provides a concise API for common notification patterns
- */
-
-export const NOTIFICATION_TIMEOUTS = {
-  BRIEF: 1000, // Very brief toasts ("Sent..." messages)
-  SHORT: 2000, // Short notifications (clipboard copies, quick confirmations)
-  STANDARD: 3000, // Standard notifications (success messages, general info)
-  LONG: 5000, // Longer notifications (errors, warnings, important info)
-  VERY_LONG: 7000, // Very long notifications (complex operations)
-  MODAL: -1, // Modal confirmations (no auto-dismiss)
-} as const;
-
-export function useNotifications() {
-  // Inject the notify function from the app
-  const notify =
-    inject<(notification: NotificationIface, timeout?: number) => void>(
-      "notify",
-    );
-
-  if (!notify) {
-    throw new Error(
-      "useNotifications must be used within a component that has $notify available",
-    );
-  }
-
-  let refreshTimer: number | undefined = undefined;
-  let refreshInFlight: Promise<void> | null = null;
-
-  async function refreshNotificationsDebounced(): Promise<void> {
-    if (refreshTimer != null) {
-      window.clearTimeout(refreshTimer);
-    }
-    refreshTimer = window.setTimeout(() => {
-      if (!refreshInFlight) {
-        refreshInFlight = refreshNotifications().finally(() => {
-          refreshInFlight = null;
-        });
-      }
-    }, 300);
-  }
-
-  const onResume = () => {
-    void refreshNotificationsDebounced();
-  };
-
-  onMounted(() => {
-    void refreshNotificationsDebounced();
-    document.addEventListener("resume", onResume);
-  });
-
-  onBeforeUnmount(() => {
-    document.removeEventListener("resume", onResume);
-    if (refreshTimer != null) {
-      window.clearTimeout(refreshTimer);
-    }
-  });
-
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function success(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function error(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function warning(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function info(_notification: NotificationIface, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function toast(_title: string, _text?: string, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function copied(_item: string, _timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function sent(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function confirm(
-    _text: string,
-    _onYes: () => Promise<void>,
-    _timeout?: number,
-  ) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function confirmationSubmitted(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function genericError(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function genericSuccess(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function alreadyConfirmed(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function cannotConfirmIssuer(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function cannotConfirmHidden(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function notRegistered(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function notAGive(_timeout?: number) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function notificationOff(
-    _title: string,
-    _callback: (success: boolean) => Promise<void>,
-    _timeout?: number,
-  ) {}
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  function downloadStarted(_format: string = "Dexie", _timeout?: number) {}
-
-  return {
-    success,
-    error,
-    warning,
-    info,
-    toast,
-    copied,
-    sent,
-    confirm,
-    confirmationSubmitted,
-    genericError,
-    genericSuccess,
-    alreadyConfirmed,
-    cannotConfirmIssuer,
-    cannotConfirmHidden,
-    notRegistered,
-    notAGive,
-    notificationOff,
-    downloadStarted,
-    /** POST FCM token to `/notifications/register` (same as startup native hook). */
-    registerFcmToken: registerToken,
-    refreshNotifications: refreshNotificationsDebounced,
-  };
-}

src/constants/app.ts

@@ -34,7 +34,10 @@ export enum AppString {
 }
 
 export const APP_SERVER =
-  import.meta.env.VITE_APP_SERVER || "https://timesafari.app";
+  import.meta.env.VITE_APP_SERVER || "https://giftopia.me";
+
+export const ORG_SERVER =
+  import.meta.env.VITE_ORG_SERVER || "GiftEconomies.org";
 
 export const DEFAULT_ENDORSER_API_SERVER =
   import.meta.env.VITE_DEFAULT_ENDORSER_API_SERVER ||
@@ -65,7 +68,7 @@ export const IMAGE_TYPE_PROFILE = "profile";
 export function isNotProdServer(apiServer: string): boolean {
   return apiServer !== AppString.PROD_ENDORSER_API_SERVER;
 }
-export const SUPPORT_EMAIL = "info@TimeSafari.app";
+export const SUPPORT_EMAIL = "info@giftopia.me";
 
 export const PASSKEYS_ENABLED =
   !!import.meta.env.VITE_PASSKEYS_ENABLED || false;
@@ -79,7 +82,7 @@ export interface NotificationIface {
   type: string; // "toast" | "info" | "success" | "warning" | "danger"
   title?: string;
   text?: string;
-  callback?: (success: boolean) => Promise<void>; // if this triggered an action
+  callback?: (success: boolean) => Promise<void | boolean>; // if this triggered an action
   noText?: string;
   onCancel?: (stopAsking?: boolean) => Promise<void>;
   onNo?: (stopAsking?: boolean) => Promise<void>;

src/constants/notifications.ts

@@ -13,10 +13,11 @@ import { THAT_UNNAMED_PERSON } from "./entities";
 // Constants marked with "[Component usage not yet documented]" need their
 // usage locations verified and documented.
 
-// Used in: [Component usage not yet documented]
+// Used in: ActivityListItem.vue (notifyHiddenPerson - hidden issuer, giver, or recipient)
 export const NOTIFY_PERSON_HIDDEN = {
   title: "Person Outside Your Network",
-  message: "This person is not visible to you.",
+  message:
+    "This person is not visible to you. Open the record to see who can introduce you.",
 };
 
 // Used in: [Component usage not yet documented]
@@ -357,55 +358,18 @@ export const NOTIFY_OFFER_PRIVACY_INFO = {
   message: "Your data is shared with the world when you sign and send.",
 };
 
-// ConfirmGiftView.vue specific constants
-// Used in: ConfirmGiftView.vue (mounted method - error loading gift details)
-export const NOTIFY_GIFT_ERROR_LOADING = {
-  title: "Error",
-  message: "There was an error loading the gift details.",
-};
-
-// Used in: ConfirmGiftView.vue (confirm method - no identifier error)
-export const NOTIFY_GIFT_ERROR_NO_IDENTIFIER = {
-  title: "Error",
-  message: "You must select an identifier before you can record a gift.",
-};
-
-// Used in: ConfirmGiftView.vue (confirm method - negative amount error)
+// Used in: GiftedDialog.vue, GiftedDetailsView.vue (negative amount error)
 export const NOTIFY_GIFT_ERROR_NEGATIVE_AMOUNT = {
   title: "",
   message: "You may not send a negative number.",
 };
 
-// Used in: ConfirmGiftView.vue (confirm method - no description error)
+// Used in: GiftedDialog.vue, GiftedDetailsView.vue (no description error)
 export const NOTIFY_GIFT_ERROR_NO_DESCRIPTION = {
   title: "Error",
   message: "You must enter a description or some number of {unit}.",
 };
 
-// Used in: ConfirmGiftView.vue (confirm method - processing status)
-export const NOTIFY_GIFT_PROCESSING = {
-  title: "",
-  message: "Recording the gift...",
-};
-
-// Used in: ConfirmGiftView.vue (recordGift method - creation error)
-export const NOTIFY_GIFT_ERROR_CREATION = {
-  title: "Error",
-  message: "There was an error creating the gift.",
-};
-
-// Used in: ConfirmGiftView.vue (recordGift method - success)
-export const NOTIFY_GIFT_SUCCESS_RECORDED = {
-  title: "Success",
-  message: "That gift was recorded.",
-};
-
-// Used in: ConfirmGiftView.vue (recordGift method - recordation error)
-export const NOTIFY_GIFT_ERROR_RECORDATION = {
-  title: "Error",
-  message: "There was an error recording the gift.",
-};
-
 // Used in: [Component usage not yet documented]
 export const NOTIFY_REGISTER_PROCESSING = {
   title: "Processing",
@@ -1098,26 +1062,7 @@ export function createCombinedSuccessMessage(
   }
 }
 
-// ConfirmGiftView.vue additional constants
-// Used in: ConfirmGiftView.vue (confirmClaim method - success)
-export const NOTIFY_GIFT_CONFIRMATION_SUCCESS = {
-  title: "Success",
-  message: "Confirmation submitted.",
-};
-
-// Used in: ConfirmGiftView.vue (confirmClaim method - error)
-export const NOTIFY_GIFT_CONFIRMATION_ERROR = {
-  title: "Error",
-  message: "There was a problem submitting the confirmation.",
-};
-
-// Used in: ConfirmGiftView.vue (confirmConfirmClaim method - confirm modal)
-export const NOTIFY_GIFT_CONFIRM_MODAL = {
-  title: "Confirm",
-  message: "Do you personally confirm that this is true?",
-};
-
-// Used in: ConfirmGiftView.vue (copyToClipboard method - copied toast)
+// Used in: HiddenDidDialog.vue, QuickActionBvcEndView.vue (copied toast)
 export const NOTIFY_COPIED_TO_CLIPBOARD = {
   title: "Copied",
   message: (description?: string) =>
@@ -1401,6 +1346,22 @@ export const NOTIFY_PROJECT_DELETE_IMAGE_GENERAL_ERROR = {
   message: "There was an error deleting the image.",
 };
 
+// Used in: AccountViewView.vue, GiftedDetailsView.vue, NewEditProjectView.vue
+// (deleteImage - the image server returned 404). The server looks an image up
+// by URL and uploader, so this also happens when the image was uploaded to a
+// different image server than the one in settings.
+export const NOTIFY_IMAGE_DELETE_NOT_FOUND = {
+  title: "Image Not Deleted",
+  message:
+    "The image server in your settings has no record of that image, so it was not removed from storage. It may already be gone, or it may have been uploaded through a different image server.",
+};
+
+// Used in: GiftedDetailsView.vue (deleteImage method - image deletion error)
+export const NOTIFY_IMAGE_DELETE_ERROR = {
+  title: "Image Deletion Error",
+  message: "There was an error deleting the image from the image server.",
+};
+
 // Used in: NewEditProjectView.vue (validateLocation method - invalid location error)
 export const NOTIFY_PROJECT_INVALID_LOCATION = {
   title: "Invalid Location",

src/db-sql/migration.ts

@@ -108,7 +108,7 @@ const MIGRATIONS = [
         secretBase64 TEXT NOT NULL
       );
 
-      INSERT INTO secret (id, secretBase64) VALUES (1, '${secretBase64}');
+      INSERT OR IGNORE INTO secret (id, secretBase64) VALUES (1, '${secretBase64}');
 
       CREATE TABLE IF NOT EXISTS settings (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -144,7 +144,7 @@ const MIGRATIONS = [
 
       CREATE INDEX IF NOT EXISTS idx_settings_accountDid ON settings(accountDid);
 
-      INSERT INTO settings (id, apiServer) VALUES (1, '${DEFAULT_ENDORSER_API_SERVER}');
+      INSERT OR IGNORE INTO settings (id, apiServer) VALUES (1, '${DEFAULT_ENDORSER_API_SERVER}');
 
       CREATE TABLE IF NOT EXISTS contacts (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -245,8 +245,11 @@ const MIGRATIONS = [
         registered BOOLEAN,
         hideTheirContent BOOLEAN DEFAULT 0
       );
+      -- Older versions could save the same DID more than once (nothing was unique on contacts.did),
+      -- which made the unique index below fail on every startup. Keep only the newest row per DID.
       INSERT INTO _contacts_backup_008 (id, did, name, contactMethods, nextPubKeyHashB64, notes, profileImageUrl, publicKeyBase64, seesMe, registered, hideTheirContent)
-      SELECT id, did, name, contactMethods, nextPubKeyHashB64, notes, profileImageUrl, publicKeyBase64, seesMe, registered, COALESCE(hideTheirContent, 0) FROM contacts;
+      SELECT id, did, name, contactMethods, nextPubKeyHashB64, notes, profileImageUrl, publicKeyBase64, seesMe, registered, COALESCE(hideTheirContent, 0) FROM contacts
+      WHERE id IN (SELECT MAX(id) FROM contacts GROUP BY did);
 
       DROP TABLE contacts;
       ALTER TABLE _contacts_backup_008 RENAME TO contacts;
@@ -263,7 +266,9 @@ const MIGRATIONS = [
       );
       CREATE INDEX idx_contact_labels_label ON contact_labels(label);
       CREATE INDEX idx_contact_labels_did ON contact_labels(did);
-      INSERT INTO contact_labels SELECT * FROM _contact_labels_backup_008;
+      -- The PRAGMA above is a no-op inside the migration's transaction, so foreign keys are enforced here:
+      -- skip any label whose contact no longer exists.
+      INSERT INTO contact_labels SELECT * FROM _contact_labels_backup_008 WHERE did IN (SELECT did FROM contacts);
       DROP TABLE _contact_labels_backup_008;
 
       PRAGMA foreign_keys = ON;
@@ -287,6 +292,20 @@ const MIGRATIONS = [
       ALTER TABLE settings ADD COLUMN smsNotificationsEnabled BOOLEAN DEFAULT FALSE;
     `,
   },
+  {
+    name: "011_add_imageServer_to_settings",
+    sql: `
+      -- Image API server URL; blank means DEFAULT_IMAGE_API_SERVER
+      ALTER TABLE settings ADD COLUMN imageServer TEXT;
+    `,
+  },
+  {
+    name: "012_add_newActivityCursors_to_settings",
+    sql: `
+      -- JSON of the alertSearch cursors the New Activity screen counts from
+      ALTER TABLE settings ADD COLUMN newActivityCursors TEXT;
+    `,
+  },
 ];
 
 /**
@@ -313,6 +332,8 @@ function extractSingleValue<T>(result: T): string | number | null {
   return null;
 }
 
+let migrationsRegistered = false;
+
 /**
  * @param sqlExec - A function that executes a SQL statement and returns the result
  * @param extractMigrationNames - A function that extracts the names (string array) from "select name from migrations"
@@ -324,9 +345,14 @@ export async function runMigrations<T>(
 ): Promise<void> {
   logger.debug("[Migration] Starting database migrations");
 
-  for (const migration of MIGRATIONS) {
-    logger.debug("[Migration] Registering migration:", migration.name);
-    registerMigration(migration);
+  // Register once: a retry after a failed initialization calls this again,
+  // and the registry rejects duplicate names.
+  if (!migrationsRegistered) {
+    for (const migration of MIGRATIONS) {
+      logger.debug("[Migration] Registering migration:", migration.name);
+      registerMigration(migration);
+    }
+    migrationsRegistered = true;
   }
 
   logger.debug("[Migration] Running migration service");

src/db/databaseUtil.ts

@@ -298,7 +298,6 @@ export async function logToDb(
   }
 }
 
-// similar method is in the sw_scripts/additional-scripts.js file
 export async function logConsoleAndDb(
   message: string,
   isError = false,

src/db/index.ts

@@ -302,7 +302,6 @@ export async function logToDb(message: string): Promise<void> {
   await db.logs.update(todayKey, { message: fullMessage });
 }
 
-// similar method is in the sw_scripts/additional-scripts.js file
 export async function logConsoleAndDb(
   message: string,
   isError = false,

src/db/tables/settings.ts

@@ -38,13 +38,16 @@ export type Settings = {
   hasBackedUpSeed?: boolean; // tracks whether the user has backed up their seed phrase
   hideRegisterPromptOnNewContact?: boolean;
   isRegistered?: boolean;
-  // imageServer?: string; // if we want to allow modification then we should make image functionality optional -- or at least customizable
+  imageServer?: string; // image API server URL
   lastName?: string; // deprecated - put all names in firstName
 
   lastAckedOfferToUserJwtId?: string; // the last JWT ID for offer-to-user that they've acknowledged seeing
   lastAckedOfferToUserProjectsJwtId?: string; // the last JWT ID for offers-to-user's-projects that they've acknowledged seeing
   lastAckedStarredPlanChangesJwtId?: string; // the last JWT ID for starred plan changes that they've acknowledged seeing
 
+  // JSON text of NewActivityCursorState (src/libs/newActivity.ts): the alertSearch cursors for the New Activity screen
+  newActivityCursors?: string;
+
   // The claim list has a most recent one used in notifications that's separate from the last viewed
   lastNotifiedClaimId?: string;
   lastViewedClaimId?: string;

src/interfaces/accountView.ts

@@ -37,6 +37,7 @@ export interface AccountSettings {
   notifyingReminderMessage?: string;
   notifyingReminderTime?: string;
   starredPlanHandleIds?: string[];
+  imageServer?: string;
   reminderFastRolloverForTesting?: boolean;
   partnerApiServer?: string;
   profileImageUrl?: string;
@@ -102,6 +103,8 @@ export interface SettingsState {
   activeDid: string;
   apiServer: string;
   apiServerInput: string;
+  imageServer: string;
+  imageServerInput: string;
   partnerApiServer: string;
   partnerApiServerInput: string;
   webPushServer: string;

src/interfaces/alertSearch.ts

@@ -19,15 +19,28 @@
 /**
  * Server-issued ULID on a stored JWT/plan record, used as alertSearch afterId /
  * beforeId. Not an authentication JWT and not a delegated notification JWT.
+ * Superseded by AlertSearchCursor for "what changed since" queries.
  */
 export type AlertSearchCursorUlid = string;
 
+/**
+ * Opaque cursor: a position between changes on one server. Responses return
+ * `nextAfterCursor` and `nextBeforeCursor`; requests send them back as
+ * `afterCursor` (changes after it, oldest first) or `beforeCursor` (changes
+ * before it, newest first). Store it as text and never parse or compare it;
+ * its format belongs to the server (see endorser-ch
+ * CHANGE/PLAN-accurate-cursors.md).
+ */
+export type AlertSearchCursor = string;
+
 /**
  * JWT row from endorser `jwtsWithDidAfterId` (no claim body).
  * Cursor field: `id`.
  */
 export interface AlertSearchClaimRecord {
   id: AlertSearchCursorUlid;
+  /** Server change sequence of this row; ascending within a cursor-path list. */
+  changeSeq?: number;
   issuedAt: string;
   issuer: string;
   subject?: string;
@@ -54,6 +67,8 @@ export interface AlertSearchJwtWithClaimRecord extends AlertSearchClaimRecord {
 export interface AlertSearchPlanRecord {
   handleId: string;
   jwtId: AlertSearchCursorUlid;
+  /** Server change sequence of this row; ascending within a cursor-path list. */
+  changeSeq?: number;
   issuerDid?: string;
   agentDid?: string;
   fulfillsLinkConfirmed?: boolean | number;
@@ -77,6 +92,8 @@ export interface AlertSearchPlanRecord {
  */
 export interface AlertSearchProfileRecord {
   rowId?: number;
+  /** Server change sequence of this row; ascending within a cursor-path list. */
+  changeSeq?: number;
   issuerDid: string;
   updatedAt?: string;
   description: string;
@@ -94,18 +111,43 @@ export interface EndorserAlertSearchData {
   plansNearby: AlertSearchPlanRecord[];
 }
 
+/**
+ * A profile or plan close in meaning to the requester's profile, from partner
+ * `profilesSimilar` / `plansSimilar` (best first; not paged).
+ */
+export interface AlertSearchSimilarProfile {
+  similarity: number;
+  profile: AlertSearchProfileRecord;
+}
+
+export interface AlertSearchSimilarPlan {
+  similarity: number;
+  plan: AlertSearchPlanRecord;
+}
+
 export interface PartnerAlertSearchData {
   profilesNearby: AlertSearchProfileRecord[];
+  profilesSimilar?: AlertSearchSimilarProfile[];
+  plansSimilar?: AlertSearchSimilarPlan[];
 }
 
 /**
  * Endorser GET/POST /api/v2/report/alertSearch body.
- * Per-bucket SQL hitLimit is not currently copied onto this envelope.
- * Timeouts may set `userMessage` instead.
+ * The cursors and `hasMore` are absent from servers that predate cursors.
+ * Timeouts may set `userMessage`; the cursor then does not move.
  */
 export interface EndorserAlertSearchResponse {
   data: EndorserAlertSearchData;
   userMessage?: string;
+  /** Send as `afterCursor` to get what changed after this response. */
+  nextAfterCursor?: AlertSearchCursor;
+  /** Send as `beforeCursor` to scroll back past this response. */
+  nextBeforeCursor?: AlertSearchCursor;
+  /**
+   * A list was cut at its limit: call again in the same direction, with
+   * `afterCursor = nextAfterCursor` or `beforeCursor = nextBeforeCursor`.
+   */
+  hasMore?: boolean;
 }
 
 /**
@@ -114,6 +156,15 @@ export interface EndorserAlertSearchResponse {
 export interface PartnerAlertSearchResponse {
   data: PartnerAlertSearchData;
   userMessage?: string;
+  /** Send as `afterCursor` to get what changed after this response. */
+  nextAfterCursor?: AlertSearchCursor;
+  /** Send as `beforeCursor` to scroll back past this response. */
+  nextBeforeCursor?: AlertSearchCursor;
+  /**
+   * A list was cut at its limit: call again in the same direction, with
+   * `afterCursor = nextAfterCursor` or `beforeCursor = nextBeforeCursor`.
+   */
+  hasMore?: boolean;
 }
 
 /**

src/interfaces/deepLinks.ts

@@ -103,6 +103,10 @@ export const deepLinkQuerySchemas = {
     searchPeople: z.string().optional(),
     hideOnboarding: z.string().optional(),
   }),
+  // The start cursors a daily notification counted from, joined by "."
+  "new-activity": z.object({
+    c: z.string().optional(),
+  }),
   "onboard-meeting-members": z.object({
     password: z.string(),
   }),

src/interfaces/notifyApi.ts

@@ -78,7 +78,10 @@ export interface NotificationRegisterRequest extends NotifyApiTestModeFlag {
 }
 
 /**
- * Body of `POST /notifications/refresh`. The service finds the caller's device
+ * Body of `POST /notifications/refresh`. The Capacitor app no longer calls this
+ * route (WAKEUP_PING → refresh → `api_*` scheduling was retired). These types
+ * remain because notification-wakeup-service still exposes the endpoint.
+ * The service finds the caller's device
  * by `deviceId`, or by `fcmToken` when no `deviceId` is sent, and answers 400
  * when neither is present and non-empty. When both are sent they must name the
  * same device, or the answer is 404.
@@ -170,7 +173,7 @@ export interface DelegatedAlertJwt {
 }
 
 /**
- * Body of `PUT /notifications/alert-authorization` (push) and
+ * Body of `POST /notifications/alert-authorization` (push) and
  * `POST /notify-sms/alert-authorization` (SMS), which validate it with one
  * rule. A stored batch replaces the unused inventory the DID holds in that
  * channel; JWTs already spent stay behind.
@@ -191,6 +194,26 @@ export interface AlertAuthorizationRequestBody {
   jwts: DelegatedAlertJwt[];
 }
 
+/**
+ * Optional alertSearch state carried by either alert-authorization upload.
+ * The cursors replace the channel's stored cursors, so the next daily count
+ * starts from them; `planHandleIds` and `location` are what the daily search
+ * sends, and null clears them. An absent field keeps what the service has.
+ */
+export interface AlertSearchUploadState {
+  /** Letters, digits, `_`, `:` or `-`; at most 64. */
+  endorserAfterCursor?: string;
+  partnerAfterCursor?: string;
+  /** At most 200. */
+  planHandleIds?: string[] | null;
+  location?: {
+    minLocLat: number;
+    maxLocLat: number;
+    minLocLon: number;
+    maxLocLon: number;
+  } | null;
+}
+
 /** Success body of storing a batch, on either alert-authorization route. */
 export interface AlertAuthorizationResponse {
   success: true;
@@ -229,7 +252,7 @@ export interface AlertAuthorizationBatchFailure {
   details: string[];
 }
 
-/** Refusal from `PUT` or `DELETE /notifications/alert-authorization`. */
+/** Refusal from `POST` or `DELETE /notifications/alert-authorization`. */
 export type AlertAuthorizationFailure =
   | AlertAuthorizationBatchFailure
   | NotifyApiUncodedFailure;

src/libs/alertSearch.ts

@@ -1,5 +1,5 @@
 /**
- * Typed alertSearch API contract only. No HTTP client yet.
+ * alertSearch API contract and HTTP client.
  *
  * Hosts: use DEFAULT_ENDORSER_API_SERVER and DEFAULT_PARTNER_API_SERVER from
  * `@/constants/app`. Do not duplicate those constants here.
@@ -14,23 +14,32 @@
  *   notify-api's push or SMS `alert-authorization` route.
  * - Native background pool: `mintBackgroundJwtTokenPool` for daily-notification
  *   plugin prefetch. Unrelated to alertSearch and to the delegated batch.
- * - alertSearch cursor ULID: server-issued record/JWT primary id (26-char
- *   ULID). `afterId` means ids strictly greater than that ULID; `beforeId`
- *   means strictly less. First daily run omits afterId. `beforeId` is for
- *   pagination within a run. These are not auth JWTs and not signed tokens.
+ * - alertSearch cursors: opaque server strings, positions between changes.
+ *   To get what changed: send the stored value as `afterCursor`, store each
+ *   response's `nextAfterCursor`, and while `hasMore` call again with
+ *   `afterCursor = nextAfterCursor`. Every page is complete up to it.
+ *   To scroll back, newest first: send `beforeCursor` (any cursor, eg. a
+ *   `nextAfterCursor`), then `beforeCursor = nextBeforeCursor` while `hasMore`.
+ *   A first run sends neither.
+ * - alertSearch ULIDs (`afterId` / `beforeId`): the older bounds, ignored when
+ *   a cursor is sent. Not auth JWTs and not signed tokens.
  *
- * Truncation: each endorser bucket query uses a server hit-limit (typically
- * 50). That flag is not currently returned on the alertSearch JSON envelope.
- * Timeouts may add `userMessage`. A later caller must still paginate with
- * beforeId when a bucket may be incomplete.
+ * See endorser-ch CHANGE/PLAN-accurate-cursors.md.
  */
 
+import type { Axios } from "axios";
+
+import type { BoundingBox } from "@/interfaces/accountView";
 import type {
+  AlertSearchCursor,
   AlertSearchCursorUlid,
   CombinedAlertSearchData,
+  EndorserAlertSearchData,
   EndorserAlertSearchResponse,
+  PartnerAlertSearchData,
   PartnerAlertSearchResponse,
 } from "@/interfaces/alertSearch";
+import { getHeaders } from "@/libs/endorserServer";
 
 export const ENDORSER_ALERT_SEARCH_PATH = "/api/v2/report/alertSearch";
 export const PARTNER_ALERT_SEARCH_PATH = "/api/partner/alertSearch";
@@ -47,6 +56,10 @@ export interface AlertSearchLocationBBox {
  * GET is the planned daily method; the server also accepts POST.
  */
 export interface AlertSearchRequestParams {
+  /** Changes after this cursor, oldest first; the ID and date bounds are then ignored. */
+  afterCursor?: AlertSearchCursor;
+  /** Changes before this cursor (and after `afterCursor`, if given), newest first. */
+  beforeCursor?: AlertSearchCursor;
   afterId?: AlertSearchCursorUlid;
   beforeId?: AlertSearchCursorUlid;
   afterDate?: string;
@@ -59,11 +72,180 @@ export interface AlertSearchRequestParams {
   planHandleIds?: string[];
   planIds?: string[];
   handleIds?: string[];
+  /** Partner only: bounding box for profilesSimilar / plansSimilar (everywhere without it). */
+  similarLocation?: AlertSearchLocationBBox;
 }
 
 export type {
+  AlertSearchCursor,
   AlertSearchCursorUlid,
   CombinedAlertSearchData,
   EndorserAlertSearchResponse,
   PartnerAlertSearchResponse,
 };
+
+export type AlertSearchServer = "endorser" | "partner";
+
+/** The data each server returns, with the partner similar lists always present. */
+export interface AlertSearchServerData {
+  endorser: EndorserAlertSearchData;
+  partner: Required<PartnerAlertSearchData>;
+}
+
+/** One alertSearch page, or the merge of several pages in one direction. */
+export interface AlertSearchResult<S extends AlertSearchServer> {
+  data: AlertSearchServerData[S];
+  nextAfterCursor?: AlertSearchCursor;
+  nextBeforeCursor?: AlertSearchCursor;
+  /** A list was cut at its limit (after the last page fetched, for a merge). */
+  hasMore: boolean;
+  userMessage?: string;
+}
+
+export function emptyAlertSearchData<S extends AlertSearchServer>(
+  server: S,
+): AlertSearchServerData[S] {
+  return (server === "endorser"
+    ? {
+        claims: [],
+        personalPlanContributions: [],
+        trackedPlanUpdates: [],
+        trackedPlanClaims: [],
+        plansNearby: [],
+      }
+    : {
+        profilesNearby: [],
+        profilesSimilar: [],
+        plansSimilar: [],
+      }) as unknown as AlertSearchServerData[S];
+}
+
+/**
+ * The search box the person saved, in alertSearch's shape. alertSearch and the
+ * notification service both take min/max latitude and longitude.
+ */
+export function alertSearchLocationFromBox(
+  bbox: BoundingBox | undefined,
+): AlertSearchLocationBBox | undefined {
+  if (!bbox) return undefined;
+  return {
+    minLocLat: bbox.minLat,
+    maxLocLat: bbox.maxLat,
+    minLocLon: bbox.westLong,
+    maxLocLon: bbox.eastLong,
+  };
+}
+
+/**
+ * Fetch one alertSearch page. POST, so the starred handle IDs and the area
+ * travel in the body.
+ */
+export async function fetchAlertSearchPage<S extends AlertSearchServer>(
+  axios: Axios,
+  server: S,
+  baseUrl: string,
+  activeDid: string,
+  params: AlertSearchRequestParams,
+): Promise<AlertSearchResult<S>> {
+  const path =
+    server === "endorser"
+      ? ENDORSER_ALERT_SEARCH_PATH
+      : PARTNER_ALERT_SEARCH_PATH;
+  const headers = await getHeaders(activeDid);
+  const response = await axios.post(baseUrl + path, params, { headers });
+  const body = response.data as
+    | EndorserAlertSearchResponse
+    | PartnerAlertSearchResponse;
+  const data = { ...emptyAlertSearchData(server), ...(body.data || {}) };
+  return {
+    data: data as AlertSearchServerData[S],
+    nextAfterCursor: body.nextAfterCursor,
+    nextBeforeCursor: body.nextBeforeCursor,
+    hasMore: body.hasMore === true,
+    userMessage: body.userMessage,
+  };
+}
+
+/** A key that identifies one row of any alertSearch list, for merging pages. */
+function alertSearchRowKey(row: unknown): string | undefined {
+  if (row === null || typeof row !== "object") return undefined;
+  const record = row as Record<string, unknown>;
+  const inner = (record.profile ?? record.plan) as
+    | Record<string, unknown>
+    | undefined;
+  const source = inner && typeof inner === "object" ? inner : record;
+  for (const key of ["id", "jwtId", "rowId", "handleId", "issuerDid"]) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") {
+      return key + ":" + value;
+    }
+  }
+  return undefined;
+}
+
+/** Concatenate each list of two pages, dropping repeated rows. */
+export function mergeAlertSearchData<T extends object>(acc: T, page: T): T {
+  const merged: Record<string, unknown[]> = {};
+  for (const key of Object.keys(acc) as Array<keyof T & string>) {
+    const seen = new Set<string>();
+    const out: unknown[] = [];
+    const accList = (acc[key] as unknown[]) || [];
+    const pageList =
+      ((page as Record<string, unknown>)[key] as unknown[]) || [];
+    for (const row of [...accList, ...pageList]) {
+      const rowKey = alertSearchRowKey(row);
+      if (rowKey !== undefined) {
+        if (seen.has(rowKey)) continue;
+        seen.add(rowKey);
+      }
+      out.push(row);
+    }
+    merged[key] = out;
+  }
+  return merged as T;
+}
+
+/**
+ * Page forward from `afterCursor` while `hasMore`, up to `maxPages`, and merge.
+ * Without `afterCursor` (and no other bound) one page is the whole result: the
+ * server returns its most recent rows.
+ *
+ * @returns the merge; `hasMore` is true when it stopped at `maxPages` with more
+ *   to read, and `nextAfterCursor` is where the merge ends
+ */
+export async function collectAlertSearchForward<S extends AlertSearchServer>(
+  fetchPage: (
+    params: AlertSearchRequestParams,
+  ) => Promise<AlertSearchResult<S>>,
+  server: S,
+  params: AlertSearchRequestParams,
+  maxPages: number,
+): Promise<AlertSearchResult<S>> {
+  let result: AlertSearchResult<S> = {
+    data: emptyAlertSearchData(server),
+    hasMore: false,
+  };
+  let pageParams = params;
+  const messages: string[] = [];
+  for (let page = 0; page < maxPages; page++) {
+    const pageResult = await fetchPage(pageParams);
+    if (pageResult.userMessage) messages.push(pageResult.userMessage);
+    result = {
+      data: mergeAlertSearchData(result.data, pageResult.data),
+      nextAfterCursor: pageResult.nextAfterCursor,
+      nextBeforeCursor: result.nextBeforeCursor ?? pageResult.nextBeforeCursor,
+      hasMore: pageResult.hasMore,
+    };
+    if (
+      !pageResult.hasMore ||
+      !params.afterCursor ||
+      !pageResult.nextAfterCursor ||
+      pageResult.nextAfterCursor === pageParams.afterCursor
+    ) {
+      break;
+    }
+    pageParams = { ...params, afterCursor: pageResult.nextAfterCursor };
+  }
+  if (messages.length > 0) result.userMessage = messages.join(" ");
+  return result;
+}

src/libs/endorserServer.ts

@@ -23,7 +23,7 @@ import { LRUCache } from "lru-cache";
 import * as R from "ramda";
 
 import { DEFAULT_IMAGE_API_SERVER, NotificationIface } from "../constants/app";
-import { NOTIFICATION_TIMEOUTS } from "../composables/useNotifications";
+import { NOTIFICATION_TIMEOUTS } from "../utils/notificationUtils";
 import { createNotifyHelpers } from "../utils/notify";
 import { NOTIFY_PERSONAL_DATA_ERROR } from "../constants/notifications";
 import { Contact } from "../db/tables/contacts";
@@ -127,7 +127,7 @@ export const BLANK_GENERIC_SERVER_RECORD: GenericCredWrapper<GenericVerifiableCr
 
 // This is used to check for hidden info.
 // See https://github.com/trentlarson/endorser-ch/blob/0cb626f803028e7d9c67f095858a9fc8542e3dbd/server/api/services/util.js#L6
-const HIDDEN_DID = "did:none:HIDDEN";
+export const HIDDEN_DID = "did:none:HIDDEN";
 
 /**
  * Validates if a string is a valid DID

src/libs/newActivity.ts

@@ -0,0 +1,391 @@
+/**
+ * New Activity: the alertSearch buckets, and the cursors that say what the
+ * person has seen.
+ *
+ * Read state has two layers, stored together as JSON in the settings column
+ * `newActivityCursors`:
+ * - The visit window, one cursor per server. The summary counts every bucket
+ *   from its start, the same point the notification service counts from once
+ *   the visit is uploaded to it.
+ * - A window per bucket, on that bucket's server. A detail page counts from the
+ *   end of its last load, so opening it marks the bucket read.
+ *
+ * A visit started less than {@link SAME_VISIT_MS} ago is the same visit: the
+ * next summary load counts from the same start, so reloading the summary does
+ * not zero the counts. A bucket opened since that start counts from the end of
+ * its own list instead ({@link summaryStart}).
+ */
+
+import type { AlertSearchCursor } from "@/interfaces/alertSearch";
+import type {
+  AlertSearchRequestParams,
+  AlertSearchServer,
+  AlertSearchServerData,
+} from "./alertSearch";
+
+export const NEW_ACTIVITY_BUCKETS = [
+  "claims",
+  "personalPlanContributions",
+  "trackedPlanUpdates",
+  "trackedPlanClaims",
+  "plansNearby",
+  "profilesNearby",
+  "profilesSimilar",
+  "plansSimilar",
+] as const;
+
+export type NewActivityBucket = (typeof NEW_ACTIVITY_BUCKETS)[number];
+
+/** What a bucket needs before it can hold anything. */
+export type NewActivityPrerequisite = "none" | "starred" | "location";
+
+export interface NewActivityBucketInfo {
+  key: NewActivityBucket;
+  server: AlertSearchServer;
+  /** Heading on the summary and the detail page; `n` is the count. */
+  label: (n: number) => string;
+  /** One sentence for the detail page. */
+  description: string;
+  needs: NewActivityPrerequisite;
+}
+
+function plural(n: number, one: string, many: string): string {
+  return n === 1 ? one : many;
+}
+
+export const NEW_ACTIVITY_BUCKET_INFO: Record<
+  NewActivityBucket,
+  NewActivityBucketInfo
+> = {
+  claims: {
+    key: "claims",
+    server: "endorser",
+    label: (n) => plural(n, "Claim About You", "Claims About You"),
+    description:
+      "Offers, gifts, and other claims by others that name you as giver or recipient.",
+    needs: "none",
+  },
+  personalPlanContributions: {
+    key: "personalPlanContributions",
+    server: "endorser",
+    label: (n) =>
+      plural(
+        n,
+        "Gift or Offer on Your Projects",
+        "Gifts & Offers on Your Projects",
+      ),
+    description:
+      "Gifts and offers to or from projects you created or are agent for.",
+    needs: "none",
+  },
+  trackedPlanUpdates: {
+    key: "trackedPlanUpdates",
+    server: "endorser",
+    label: (n) =>
+      plural(
+        n,
+        "Starred Project With Changes",
+        "Starred Projects With Changes",
+      ),
+    description: "Edits to projects you starred.",
+    needs: "starred",
+  },
+  trackedPlanClaims: {
+    key: "trackedPlanClaims",
+    server: "endorser",
+    label: (n) =>
+      plural(
+        n,
+        "Gift or Offer on Starred Projects",
+        "Gifts & Offers on Starred Projects",
+      ),
+    description: "Gifts and offers to or from projects you starred.",
+    needs: "starred",
+  },
+  plansNearby: {
+    key: "plansNearby",
+    server: "endorser",
+    label: (n) => plural(n, "Project Nearby", "Projects Nearby"),
+    description: "Projects created or edited in your search area.",
+    needs: "location",
+  },
+  profilesNearby: {
+    key: "profilesNearby",
+    server: "partner",
+    label: (n) => plural(n, "Profile Nearby", "Profiles Nearby"),
+    description: "Profiles created or edited in your search area.",
+    needs: "location",
+  },
+  profilesSimilar: {
+    key: "profilesSimilar",
+    server: "partner",
+    label: (n) => plural(n, "Profile Like Yours", "Profiles Like Yours"),
+    description:
+      "Profiles whose description is close in meaning to yours, best match first.",
+    needs: "none",
+  },
+  plansSimilar: {
+    key: "plansSimilar",
+    server: "partner",
+    label: (n) =>
+      plural(
+        n,
+        "Project Matching Your Profile",
+        "Projects Matching Your Profile",
+      ),
+    description:
+      "Projects whose description is close in meaning to your profile, best match first.",
+    needs: "none",
+  },
+};
+
+export function isNewActivityBucket(
+  value: unknown,
+): value is NewActivityBucket {
+  return (
+    typeof value === "string" &&
+    (NEW_ACTIVITY_BUCKETS as readonly string[]).includes(value)
+  );
+}
+
+/** The rows of one bucket in a server's alertSearch data. */
+export function bucketRows<S extends AlertSearchServer>(
+  data: AlertSearchServerData[S],
+  bucket: NewActivityBucket,
+): unknown[] {
+  return ((data as unknown as Record<string, unknown[]>)[bucket] ||
+    []) as unknown[];
+}
+
+export interface CursorPair {
+  endorser: AlertSearchCursor;
+  partner: AlertSearchCursor;
+}
+
+/**
+ * The span one load counted: from `from` (absent before any cursor was known)
+ * up to `to`, the cursor the server returned. `at` is when the visit began;
+ * `seenAt` is when `to` was recorded, and `fromSeenAt` when `from` was.
+ */
+export interface ActivityWindow<T> {
+  from?: T;
+  to: T;
+  at: string;
+  seenAt?: string;
+  fromSeenAt?: string;
+}
+
+export type NotificationChannel = "fcm" | "sms";
+
+export interface NewActivityCursorState {
+  visit?: ActivityWindow<CursorPair>;
+  buckets?: Partial<
+    Record<NewActivityBucket, ActivityWindow<AlertSearchCursor>>
+  >;
+  /** The cursors last sent to the notification service, per channel. */
+  uploaded?: Partial<Record<NotificationChannel, CursorPair>>;
+}
+
+/** How long a visit lasts: loads inside it count from the same start. */
+export const SAME_VISIT_MS = 30 * 60 * 1000;
+
+/** The stored JSON, or an empty state when it is missing or unreadable. */
+export function parseNewActivityCursorState(
+  text: string | undefined | null,
+): NewActivityCursorState {
+  if (!text) return {};
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+export function serializeNewActivityCursorState(
+  state: NewActivityCursorState,
+): string {
+  return JSON.stringify(state);
+}
+
+function isSameVisit<T>(
+  window: ActivityWindow<T> | undefined,
+  now: Date,
+): boolean {
+  if (!window) return false;
+  const started = Date.parse(window.at);
+  return !Number.isNaN(started) && now.getTime() - started < SAME_VISIT_MS;
+}
+
+/** Where a load counts from: the same start inside a visit, else the last end. */
+export function windowStart<T>(
+  window: ActivityWindow<T> | undefined,
+  now: Date,
+): T | undefined {
+  return isSameVisit(window, now) ? window?.from : window?.to;
+}
+
+/** The window to store after a load that counted from `windowStart` up to `to`. */
+export function nextWindow<T>(
+  window: ActivityWindow<T> | undefined,
+  to: T,
+  now: Date,
+): ActivityWindow<T> {
+  if (window && isSameVisit(window, now)) {
+    return {
+      ...(window.from !== undefined ? { from: window.from } : {}),
+      ...(window.fromSeenAt ? { fromSeenAt: window.fromSeenAt } : {}),
+      to,
+      at: window.at,
+      seenAt: now.toISOString(),
+    };
+  }
+  return {
+    ...(window?.to !== undefined
+      ? { from: window.to, fromSeenAt: window.seenAt ?? window.at }
+      : {}),
+    to,
+    at: now.toISOString(),
+    seenAt: now.toISOString(),
+  };
+}
+
+function seenTime<T>(window: ActivityWindow<T> | undefined): number {
+  const time = Date.parse(window?.seenAt ?? window?.at ?? "");
+  return Number.isNaN(time) ? 0 : time;
+}
+
+/** When the cursor that {@link windowStart} returns was recorded. */
+function startTime<T>(
+  window: ActivityWindow<T> | undefined,
+  now: Date,
+): number {
+  if (!isSameVisit(window, now)) return seenTime(window);
+  const time = Date.parse(window?.fromSeenAt ?? window?.at ?? "");
+  return Number.isNaN(time) ? 0 : time;
+}
+
+/**
+ * Where the summary counts a bucket from: the visit's start (or `fallback`,
+ * the notification link's cursors, when the visit has none), unless this
+ * bucket's list was opened after that start was recorded, in which case the
+ * end of that list. Opening a list therefore drops its count on the summary
+ * while the other buckets keep theirs for the rest of the visit.
+ */
+export function summaryStart(
+  state: NewActivityCursorState,
+  bucket: NewActivityBucket,
+  now: Date,
+  fallback?: CursorPair,
+): AlertSearchCursor | undefined {
+  const server = NEW_ACTIVITY_BUCKET_INFO[bucket].server;
+  const visitStart =
+    windowStart(state.visit, now)?.[server] ?? fallback?.[server];
+  const bucketWindow = state.buckets?.[bucket];
+  if (!bucketWindow) return visitStart;
+  if (visitStart === undefined) return bucketWindow.to;
+  return seenTime(bucketWindow) > startTime(state.visit, now)
+    ? bucketWindow.to
+    : visitStart;
+}
+
+/**
+ * Where the Home screen counts a bucket from: the end of whichever load the
+ * person saw last, the summary's or this bucket's own list. Unlike
+ * {@link windowStart} it never reaches back to the start of a visit, so a list
+ * just opened shows nothing new on Home.
+ */
+export function unseenStart(
+  state: NewActivityCursorState,
+  bucket: NewActivityBucket,
+): AlertSearchCursor | undefined {
+  const visitTo = state.visit?.to[NEW_ACTIVITY_BUCKET_INFO[bucket].server];
+  const bucketWindow = state.buckets?.[bucket];
+  if (!bucketWindow) return visitTo;
+  if (visitTo === undefined) return bucketWindow.to;
+  return seenTime(bucketWindow) >= seenTime(state.visit)
+    ? bucketWindow.to
+    : visitTo;
+}
+
+/**
+ * The `c` query value in notification links: the endorser and partner cursors
+ * joined by ".", which appears in neither server's cursor format.
+ */
+export function joinCursorPair(pair: CursorPair): string {
+  return pair.endorser + "." + pair.partner;
+}
+
+export function parseCursorParam(
+  value: string | undefined | null,
+): CursorPair | undefined {
+  if (!value) return undefined;
+  const dot = value.indexOf(".");
+  if (dot <= 0 || dot === value.length - 1) return undefined;
+  return { endorser: value.slice(0, dot), partner: value.slice(dot + 1) };
+}
+
+export function sameCursorPair(
+  a: CursorPair | undefined,
+  b: CursorPair | undefined,
+): boolean {
+  return (
+    a !== undefined &&
+    b !== undefined &&
+    a.endorser === b.endorser &&
+    a.partner === b.partner
+  );
+}
+
+/**
+ * Request params for a load that starts at `cursor`. Without one, the request
+ * carries no cursor or ID, and the server answers with its most recent rows
+ * and its latest cursors.
+ */
+export function startParams(
+  cursor: AlertSearchCursor | undefined,
+): AlertSearchRequestParams {
+  return cursor ? { afterCursor: cursor } : {};
+}
+
+/**
+ * The state with a visit ending at `latest`, as if the person had looked at
+ * everything up to it: nothing before it counts as new. The visit's start is
+ * long past, so the next load counts from `latest`.
+ */
+export function seededState(
+  state: NewActivityCursorState,
+  latest: CursorPair,
+  now: Date,
+): NewActivityCursorState {
+  return {
+    ...state,
+    visit: {
+      to: latest,
+      at: new Date(0).toISOString(),
+      seenAt: now.toISOString(),
+    },
+  };
+}
+
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+
+/**
+ * The ULID immediately before `id` in sort order, so that `afterId` set to it
+ * includes `id` itself. Undefined for a value that is not a ULID or is all
+ * zeros.
+ */
+export function ulidJustBefore(id: string): string | undefined {
+  const upper = id.toUpperCase();
+  if (!/^[0-9A-HJKMNP-TV-Z]{26}$/.test(upper)) return undefined;
+  const chars = upper.split("");
+  for (let i = chars.length - 1; i >= 0; i--) {
+    const index = CROCKFORD.indexOf(chars[i]);
+    if (index > 0) {
+      chars[i] = CROCKFORD[index - 1];
+      return chars.join("");
+    }
+    chars[i] = CROCKFORD[CROCKFORD.length - 1];
+  }
+  return undefined;
+}

src/libs/util.ts

@@ -266,6 +266,87 @@ export interface ConfirmerData {
   numConfsNotVisible: number;
 }
 
+export interface ConfirmationRecord {
+  issuer: string; // may be HIDDEN
+  issuedAt?: string; // missing from servers without confirmationsForClaim
+  jwtId?: string; // the confirmation's own claim; missing like issuedAt
+}
+
+export interface ConfirmationsData {
+  confirmations: ConfirmationRecord[]; // excluding the claim issuer, newest first
+  confsVisibleToIdList: string[]; // list of DIDs that can see any hidden confirmer
+  hitLimit: boolean; // there may be more before the last of these confirmations
+  requesterConfirmed: boolean; // even if that confirmation is not in this page
+  totalCount: number; // across all pages
+}
+
+/**
+ * @param claimJwtId the JWT ID of the claim, not a handle
+ * @param beforeId the jwtId of the last confirmation already retrieved, for the next page
+ * @return the confirmations of the claim, newest first, excluding the issuer
+ */
+export async function retrieveConfirmations(
+  apiServer: string,
+  claimJwtId: string,
+  claimIssuerId: string,
+  userDid: string,
+  beforeId?: string,
+): Promise<ConfirmationsData | undefined> {
+  const url =
+    apiServer +
+    "/api/v2/report/confirmationsForClaim?claimId=" +
+    encodeURIComponent(serverUtil.stripEndorserPrefix(claimJwtId)) +
+    (beforeId ? "&beforeId=" + encodeURIComponent(beforeId) : "");
+  const headers = await serverUtil.getHeaders(userDid);
+  try {
+    const response = await axios.get(url, { headers });
+    const records: Array<
+      ConfirmationRecord & { issuerVisibleToDids?: string[] }
+    > = response.data.data || [];
+    return {
+      confirmations: records.map((record) => ({
+        issuer: record.issuer,
+        issuedAt: record.issuedAt,
+        jwtId: record.jwtId,
+      })),
+      confsVisibleToIdList: R.uniq(
+        records.flatMap((record) => record.issuerVisibleToDids || []),
+      ),
+      hitLimit: !!response.data.hitLimit,
+      requesterConfirmed: !!response.data.requesterConfirmed,
+      totalCount: response.data.totalCount ?? records.length,
+    };
+  } catch (error) {
+    if (!axios.isAxiosError(error) || error.response?.status !== 404) {
+      throw error;
+    }
+    // This server predates confirmationsForClaim, so get all the confirmers without dates.
+    const confirmerInfo = await retrieveConfirmerIdList(
+      apiServer,
+      claimJwtId,
+      claimIssuerId,
+      userDid,
+    );
+    if (!confirmerInfo) {
+      return undefined;
+    }
+    const confirmations = [
+      ...confirmerInfo.confirmerIdList.map((issuer) => ({ issuer })),
+      ...R.repeat(
+        { issuer: serverUtil.HIDDEN_DID },
+        Math.max(confirmerInfo.numConfsNotVisible, 0),
+      ),
+    ];
+    return {
+      confirmations,
+      confsVisibleToIdList: confirmerInfo.confsVisibleToIdList,
+      hitLimit: false,
+      requesterConfirmed: confirmerInfo.confirmerIdList.includes(userDid),
+      totalCount: confirmations.length,
+    };
+  }
+}
+
 // // This is meant to be a second argument to JSON.stringify to avoid circular references.
 // // Usage: JSON.stringify(error, getCircularReplacer())
 // // Beware: we've seen this return "undefined" when there is actually a message, eg: DatabaseClosedError: Error DEXIE ENCRYPT ADDON: Encryption key has changed
@@ -336,10 +417,36 @@ export async function retrieveConfirmerIdList(
   }
 }
 
+// Confirming these makes no sense: a confirmation of a confirmation, or of a reaction.
+const UNCONFIRMABLE_CLAIM_TYPES = ["AgreeAction", "Emoji"];
+
+export const isConfirmableClaimType = (claimType?: string) => {
+  return !UNCONFIRMABLE_CLAIM_TYPES.includes(claimType || "");
+};
+
 /**
  * @returns true if the user can confirm the claim
  * @param veriClaim is expected to have fields: claim, claimType, and issuer
  */
+export function isClaimTheUserCanConfirm(
+  isRegistered: boolean,
+  veriClaim: GenericCredWrapper<GenericVerifiableCredential>,
+  activeDid: string,
+  confirmerIdList: string[] = [],
+): boolean {
+  return (
+    isRegistered &&
+    isConfirmableClaimType(veriClaim.claimType) &&
+    !confirmerIdList.includes(activeDid) &&
+    veriClaim.issuer !== activeDid &&
+    !containsHiddenDid(veriClaim.claim)
+  );
+}
+
+/**
+ * @returns true if the claim is a give and the user can confirm it
+ * @param veriClaim is expected to have fields: claim, claimType, and issuer
+ */
 export function isGiveRecordTheUserCanConfirm(
   isRegistered: boolean,
   veriClaim: GenericCredWrapper<GenericVerifiableCredential>,
@@ -347,11 +454,13 @@ export function isGiveRecordTheUserCanConfirm(
   confirmerIdList: string[] = [],
 ): boolean {
   return (
-    isRegistered &&
     isGiveAction(veriClaim) &&
-    !confirmerIdList.includes(activeDid) &&
-    veriClaim.issuer !== activeDid &&
-    !containsHiddenDid(veriClaim.claim)
+    isClaimTheUserCanConfirm(
+      isRegistered,
+      veriClaim,
+      activeDid,
+      confirmerIdList,
+    )
   );
 }
 

src/libs/webShareTarget.ts

@@ -0,0 +1,52 @@
+/**
+ * Web Share Target handoff (web build only).
+ *
+ * public/sw.js receives the POST from the manifest's share_target, stores the
+ * photo in Cache Storage under these keys, and redirects to /shared-photo.
+ * Keep the constants in sync with public/sw.js.
+ */
+
+import { logger } from "../utils/logger";
+
+const SHARE_TARGET_CACHE = "share-target";
+const SHARED_PHOTO_KEY = "/share-target/photo";
+const FILE_NAME_HEADER = "X-File-Name";
+
+export interface WebSharedPhoto {
+  blob: Blob;
+  fileName: string;
+}
+
+/**
+ * Registers public/sw.js, which handles the share target POST.
+ */
+export function registerWebShareTargetWorker(): void {
+  if (!("serviceWorker" in navigator)) {
+    return;
+  }
+  navigator.serviceWorker.register("/sw.js").catch((error) => {
+    // Not fatal: only sharing into the app depends on the worker.
+    logger.warn("[WebShareTarget] Service worker registration failed", error);
+  });
+}
+
+/**
+ * Returns the photo stashed by the service worker and removes it, or null
+ * when there is none (or Cache Storage is unavailable).
+ */
+export async function takeWebSharedPhoto(): Promise<WebSharedPhoto | null> {
+  if (typeof caches === "undefined") {
+    return null;
+  }
+  const cache = await caches.open(SHARE_TARGET_CACHE);
+  const response = await cache.match(SHARED_PHOTO_KEY);
+  if (!response) {
+    return null;
+  }
+  const blob = await response.blob();
+  const fileName = decodeURIComponent(
+    response.headers.get(FILE_NAME_HEADER) || "",
+  );
+  await cache.delete(SHARED_PHOTO_KEY);
+  return { blob, fileName };
+}

src/main.capacitor.ts

@@ -48,6 +48,7 @@ import {
   configureNativeFetcherIfReady,
   initializeNativePushAndFirebaseMessaging,
   onNotificationAuthMayBeReady,
+  runLegacyApiNotificationsCleanupOnce,
 } from "@/services/notifications";
 
 logger.log("[Capacitor] 🚀 Starting initialization");
@@ -361,6 +362,8 @@ setTimeout(async () => {
     );
     await registerDeepLinkListener();
     logger.info(`[Main] 🎉 Deep link system fully initialized!`);
+    // One-time: remove persisted legacy api_* schedules from pre-retirement installs
+    await runLegacyApiNotificationsCleanupOnce();
     // Firebase Messaging (JS) + Capacitor PushNotifications (FCM/APNs token, delivery listeners)
     await initializeNativePushAndFirebaseMessaging();
     // Configure native fetcher for API-driven daily notifications (activeDid + JWT)

src/main.common.ts

@@ -9,6 +9,10 @@ import "./assets/styles/tailwind.css";
 import { FontAwesomeIcon } from "./libs/fontawesome";
 import Camera from "simple-vue-camera";
 import { logger } from "./utils/logger";
+import {
+  isDatabaseStartupError,
+  recordStartupError,
+} from "./utils/startupError";
 
 // Global Error Handler
 function setupGlobalErrorHandler(app: VueApp) {
@@ -22,6 +26,12 @@ function setupGlobalErrorHandler(app: VueApp) {
       info,
       component: instance?.$options.name || "unknown",
     });
+    if (isDatabaseStartupError(err)) {
+      // Nothing works without the database: show the recovery options instead.
+      recordStartupError(err);
+      router.replace("/start");
+      return;
+    }
     alert(
       (err instanceof Error ? err.message : "Something bad happened") +
         " - Try reloading or restarting the app.",

src/main.web.ts

@@ -1,20 +1,57 @@
-import { initializeApp } from "./main.common";
 import { logger } from "./utils/logger";
+import { registerWebShareTargetWorker } from "./libs/webShareTarget";
 
 const platform = process.env.VITE_PLATFORM;
 
-// PWA service worker is automatically registered by VitePWA plugin
-
-const app = initializeApp();
-
-// Note: Worker initialization is now handled by WebPlatformService
-// This ensures single-point database access and prevents double migrations
-if (platform === "web" || platform === "development") {
-  logger.debug(
-    "[Web] Database initialization will be handled by WebPlatformService",
-  );
-} else {
-  logger.debug("[Web] SQL not initialized for platform", { platform });
+/**
+ * Browsers withhold crypto.subtle outside secure contexts (HTTPS, localhost,
+ * 127.0.0.1, [::1]), and identity creation cannot run without it. Addresses
+ * like http://[::]:8000 or http://192.168.x.x would otherwise fail later with
+ * a misleading "could not open its data" startup error. main.common is loaded
+ * only after this check because importing the router starts navigation.
+ */
+function showInsecureContextError(): void {
+  const container = document.getElementById("app");
+  if (!container) {
+    return;
+  }
+  container.innerHTML = `
+    <section style="max-width: 40rem; margin: 3rem auto; padding: 0 1rem; font-family: sans-serif; line-height: 1.5;">
+      <h1 style="font-size: 1.25rem; font-weight: 600;">Time Safari Cannot Start Here</h1>
+      <p>This page must be opened over HTTPS or from <code>localhost</code>.</p>
+      <p>The browser does not treat <code></code> as secure, so it disables the cryptography the app uses for identities.</p>
+      <p>On a local server, use <code>http://localhost:PORT/</code> instead of <code>http://[::]:PORT/</code> or <code>http://0.0.0.0:PORT/</code>.</p>
+    </section>`;
+  const originCode = container.querySelectorAll("code")[1];
+  if (originCode) {
+    originCode.textContent = window.location.origin;
+  }
 }
 
-app.mount("#app");
+if (!window.isSecureContext) {
+  logger.error("[Web] Not a secure context; app will not start", {
+    origin: window.location.origin,
+  });
+  showInsecureContextError();
+} else {
+  import("./main.common").then(({ initializeApp }) => {
+    const app = initializeApp();
+
+    // Note: Worker initialization is now handled by WebPlatformService
+    // This ensures single-point database access and prevents double migrations
+    if (platform === "web" || platform === "development") {
+      logger.debug(
+        "[Web] Database initialization will be handled by WebPlatformService",
+      );
+    } else {
+      logger.debug("[Web] SQL not initialized for platform", { platform });
+    }
+
+    app.mount("#app");
+
+    // Handles the manifest's share_target POST (see public/sw.js)
+    if (platform === "web") {
+      registerWebShareTargetWorker();
+    }
+  });
+}

src/plugins/NotificationInspectorPlugin.ts

@@ -11,7 +11,7 @@ export type PendingNotificationInfo = {
 
 export interface NotificationInspectorPlugin {
   getPendingNotifications(): Promise<{ pending: PendingNotificationInfo[] }>;
-  /** Android only: whether the build has a Firebase config (-PfirebaseEnabled). */
+  /** Android only: whether this build included Firebase (off only with -PfirebaseEnabled=false). */
   isFirebaseConfigured(): Promise<{ configured: boolean }>;
 }
 

src/router/index.ts

@@ -6,11 +6,14 @@ import {
   RouteRecordRaw,
 } from "vue-router";
 import { logger } from "../utils/logger";
+import {
+  isDatabaseStartupError,
+  recordStartupError,
+} from "../utils/startupError";
 import {
   retrieveAccountDids,
   generateSaveAndActivateIdentity,
 } from "../libs/util";
-import { includeDevToolkitRoutes } from "../utils/includeDevToolkitRoutes";
 
 const routes: Array<RouteRecordRaw> = [
   {
@@ -34,9 +37,10 @@ const routes: Array<RouteRecordRaw> = [
     component: () => import("../views/ClaimCertificateView.vue"),
   },
   {
+    // shared links to the former gift-confirmation page; the claim page has the same details
     path: "/confirm-gift/:id?",
     name: "confirm-gift",
-    component: () => import("../views/ConfirmGiftView.vue"),
+    redirect: (to) => ({ name: "claim", params: { id: to.params.id } }),
   },
   {
     path: "/contact-amounts",
@@ -92,6 +96,15 @@ const routes: Array<RouteRecordRaw> = [
       requiresAuth: false,
     },
   },
+  {
+    path: "/dev/notifications",
+    name: "dev-notifications",
+    component: () => import("../views/dev/NotificationDebugView.vue"),
+    meta: {
+      title: "Notification Debug",
+      requiresAuth: false,
+    },
+  },
   {
     path: "/did/:did?",
     name: "did",
@@ -178,6 +191,11 @@ const routes: Array<RouteRecordRaw> = [
     name: "new-activity",
     component: () => import("../views/NewActivityView.vue"),
   },
+  {
+    path: "/new-activity/:bucket",
+    name: "new-activity-bucket",
+    component: () => import("../views/NewActivityBucketView.vue"),
+  },
   {
     path: "/new-edit-account",
     name: "new-edit-account",
@@ -269,8 +287,6 @@ const routes: Array<RouteRecordRaw> = [
     component: () => import("../views/SharedPhotoView.vue"),
   },
 
-  // /share-target is also an endpoint in the service worker
-
   {
     path: "/start",
     name: "start",
@@ -291,19 +307,6 @@ const routes: Array<RouteRecordRaw> = [
     name: "user-profile",
     component: () => import("../views/UserProfileView.vue"),
   },
-  ...(includeDevToolkitRoutes
-    ? ([
-        {
-          path: "/dev/notifications",
-          name: "dev-notifications",
-          component: () => import("../views/dev/NotificationDebugView.vue"),
-          meta: {
-            title: "Notification Debug",
-            requiresAuth: false,
-          },
-        },
-      ] satisfies Array<RouteRecordRaw>)
-    : []),
   // Catch-all route for 404 errors - must be last
   {
     path: "/:pathMatch(.*)*",
@@ -342,6 +345,12 @@ const errorHandler = (
 ) => {
   // Handle the error here
   logger.error("Caught in top level error handler:", error, to, from);
+  if (isDatabaseStartupError(error)) {
+    // Nothing works without the database: show the recovery options instead.
+    recordStartupError(error);
+    router.replace("/start");
+    return;
+  }
   alert("Something is very wrong. Try reloading or restarting the app.");
 
   // You can also perform additional actions, such as displaying an error message or redirecting the user to a specific page
@@ -426,17 +435,8 @@ router.beforeEach(async (to, _from, next) => {
       timestamp: new Date().toISOString(),
     });
 
-    // Store error details so StartView can display them
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    const errorStack = error instanceof Error ? error.stack || "" : "";
-    try {
-      sessionStorage.setItem(
-        "startupError",
-        JSON.stringify({ message: errorMessage, stack: errorStack }),
-      );
-    } catch {
-      // sessionStorage may be unavailable
-    }
+    // Store error details so StartView can display them with recovery options
+    recordStartupError(error);
 
     // Keep diagnostic pages reachable when identity creation fails (e.g. a
     // failed migration leaves every DB call throwing), so the user can open

src/services/PlatformService.ts

@@ -209,13 +209,20 @@ export interface PlatformService {
    */
   retrieveSettingsForActiveAccount(): Promise<Record<string, unknown> | null>;
 
-  // --- PWA/Web-only methods (optional, only implemented on web) ---
+  // --- Startup-failure recovery (optional, only implemented on native mobile) ---
   /**
-   * Registers the service worker for PWA support (web only)
+   * Opens the share sheet with a copy of the raw database file, so a user
+   * whose database cannot be opened can still save it or send it to support.
+   * It contains their keys, so the UI must say so.
    */
-  registerServiceWorker?(): void;
+  shareDatabaseFile?(): Promise<void>;
 
   /**
-   * Returns true if PWA is enabled (web only)
+   * Copies the database file aside (into the app's files directory) and then
+   * deletes it, so the next start builds a fresh database. The caller is
+   * expected to reload the app afterward.
+   * @returns the backup file's URI, or undefined when there was no file to back up
+   * @throws if the backup copy fails (the original is never deleted without one)
    */
+  resetDatabase?(): Promise<string | undefined>;
 }

src/services/migrationService.ts

@@ -153,6 +153,17 @@ class MigrationRegistry {
 // Create a singleton instance of the migration registry
 const migrationRegistry = new MigrationRegistry();
 
+/** The migration's SQL followed by the statement that records it as applied. */
+function withMigrationRecord(migration: Migration): string {
+  // A trailing "--" comment ends at its newline, so check what's left without comments.
+  const terminated = migration.sql
+    .replace(/--[^\n]*/g, "")
+    .trim()
+    .endsWith(";");
+  const name = migration.name.replace(/'/g, "''");
+  return `${migration.sql}\n${terminated ? "" : ";\n"}INSERT INTO migrations (name) VALUES ('${name}');\n`;
+}
+
 /**
  * Register a migration with the migration service
  *
@@ -282,19 +293,15 @@ export async function runMigrations<T>(
         logger.debug(`[Migration] Executing SQL for: ${migration.name}`);
         logger.debug(`[Migration] SQL content: ${migration.sql}`);
 
-        // Execute the migration SQL directly - it should be atomic
-        // The SQL itself should handle any necessary transactions
-        const execResult = await sqlExec(migration.sql);
+        // The record goes in the same batch as the migration, which the native
+        // plugin runs as one transaction: if the app dies between the two, a
+        // migration that can't run twice (like 001) would fail every launch.
+        const execResult = await sqlExec(withMigrationRecord(migration));
 
         logger.debug(
           `[Migration] SQL execution result: ${JSON.stringify(execResult)}`,
         );
 
-        // Record that the migration was applied
-        await sqlExec("INSERT INTO migrations (name) VALUES (?)", [
-          migration.name,
-        ]);
-
         logger.debug(`✅ [Migration] Successfully applied: ${migration.name}`);
         appliedCount++;
       } catch (error) {

src/services/newActivity.ts

@@ -0,0 +1,447 @@
+/**
+ * Loads for the New Activity summary and detail pages, and the upload that
+ * keeps the notification service counting from the same point.
+ *
+ * The cursors and windows are described in `@/libs/newActivity`.
+ */
+
+import type { Axios } from "axios";
+
+import type { AlertSearchCursor } from "@/interfaces/alertSearch";
+import type { AlertSearchUploadState } from "@/interfaces/notifyApi";
+import {
+  type AlertSearchLocationBBox,
+  type AlertSearchRequestParams,
+  type AlertSearchResult,
+  type AlertSearchServer,
+  collectAlertSearchForward,
+  fetchAlertSearchPage,
+} from "@/libs/alertSearch";
+import {
+  bucketRows,
+  type CursorPair,
+  NEW_ACTIVITY_BUCKETS,
+  NEW_ACTIVITY_BUCKET_INFO,
+  type NewActivityBucket,
+  type NewActivityCursorState,
+  seededState,
+  startParams,
+  summaryStart,
+  unseenStart,
+  windowStart,
+} from "@/libs/newActivity";
+
+/** Pages read per server for the summary counts; past that a count shows "+". */
+export const SUMMARY_MAX_PAGES = 4;
+/** Pages read for a detail page before offering "Show more". */
+export const DETAIL_MAX_PAGES = 10;
+/** Pages to step back through looking for one of this bucket's rows. */
+export const EARLIER_MAX_PAGES = 5;
+
+export interface NewActivityContext {
+  axios: Axios;
+  endorserServer: string;
+  partnerServer: string;
+  activeDid: string;
+  /** Starred projects; the tracked buckets are empty without them. */
+  planHandleIds: string[];
+  /** The saved search area; the nearby buckets are empty without it. */
+  location?: AlertSearchLocationBBox;
+}
+
+/** Whether a bucket can hold anything with this context's inputs. */
+export function bucketIsAvailable(
+  ctx: Pick<NewActivityContext, "planHandleIds" | "location">,
+  bucket: NewActivityBucket,
+): boolean {
+  const needs = NEW_ACTIVITY_BUCKET_INFO[bucket].needs;
+  if (needs === "starred") return ctx.planHandleIds.length > 0;
+  if (needs === "location") return ctx.location !== undefined;
+  return true;
+}
+
+function serverBaseUrl(ctx: NewActivityContext, server: AlertSearchServer) {
+  return server === "endorser" ? ctx.endorserServer : ctx.partnerServer;
+}
+
+/** The inputs every request to a server carries, besides its bounds. */
+function serverInputs(
+  ctx: NewActivityContext,
+  server: AlertSearchServer,
+): AlertSearchRequestParams {
+  const inputs: AlertSearchRequestParams = {};
+  if (ctx.location) inputs.location = ctx.location;
+  if (server === "endorser" && ctx.planHandleIds.length > 0) {
+    inputs.planHandleIds = ctx.planHandleIds;
+  }
+  return inputs;
+}
+
+function pageFetcher<S extends AlertSearchServer>(
+  ctx: NewActivityContext,
+  server: S,
+) {
+  return (params: AlertSearchRequestParams) =>
+    fetchAlertSearchPage(
+      ctx.axios,
+      server,
+      serverBaseUrl(ctx, server),
+      ctx.activeDid,
+      { ...serverInputs(ctx, server), ...params },
+    );
+}
+
+export interface ServerCounts {
+  /** Undefined for a bucket whose inputs are missing. */
+  counts: Partial<Record<NewActivityBucket, number>>;
+  /** A count is a lower bound: the read stopped with more to go. */
+  hitLimit: boolean;
+  /** Per bucket, when this server's buckets were read from different starts. */
+  bucketHitLimit?: Partial<Record<NewActivityBucket, boolean>>;
+  /** Where this read ended: the start of the next visit. */
+  to?: AlertSearchCursor;
+  userMessage?: string;
+  error?: string;
+}
+
+export interface NewActivityCounts {
+  endorser: ServerCounts;
+  partner: ServerCounts;
+}
+
+function errorText(error: unknown): string {
+  if (error && typeof error === "object") {
+    const response = (error as { response?: { data?: { error?: unknown } } })
+      .response;
+    const serverError = response?.data?.error;
+    if (typeof serverError === "string") return serverError;
+    if (serverError && typeof serverError === "object") {
+      const message = (serverError as { message?: unknown }).message;
+      if (typeof message === "string") return message;
+    }
+    const message = (error as { message?: unknown }).message;
+    if (typeof message === "string") return message;
+  }
+  return "The request failed.";
+}
+
+async function countServer(
+  ctx: NewActivityContext,
+  server: AlertSearchServer,
+  from: AlertSearchCursor | undefined,
+): Promise<ServerCounts> {
+  try {
+    const result = await collectAlertSearchForward(
+      pageFetcher(ctx, server),
+      server,
+      startParams(from),
+      SUMMARY_MAX_PAGES,
+    );
+    const counts: Partial<Record<NewActivityBucket, number>> = {};
+    for (const bucket of NEW_ACTIVITY_BUCKETS) {
+      if (
+        NEW_ACTIVITY_BUCKET_INFO[bucket].server === server &&
+        bucketIsAvailable(ctx, bucket)
+      ) {
+        // with no start, the rows are the server's latest, not new ones
+        counts[bucket] =
+          from === undefined ? 0 : bucketRows(result.data, bucket).length;
+      }
+    }
+    return {
+      counts,
+      hitLimit: from !== undefined && result.hasMore,
+      to: result.nextAfterCursor,
+      userMessage: result.userMessage,
+    };
+  } catch (error) {
+    return { counts: {}, hitLimit: false, error: errorText(error) };
+  }
+}
+
+/** Counts for every bucket since `from` (each server independently). */
+export async function countNewActivity(
+  ctx: NewActivityContext,
+  from: Partial<CursorPair> | undefined,
+): Promise<NewActivityCounts> {
+  const [endorser, partner] = await Promise.all([
+    countServer(ctx, "endorser", from?.endorser),
+    countServer(ctx, "partner", from?.partner),
+  ]);
+  return { endorser, partner };
+}
+
+export interface BucketCount {
+  count: number;
+  /** The count is a lower bound: the read stopped with more to go. */
+  hitLimit: boolean;
+}
+
+export interface UnseenCounts {
+  /** Undefined for a bucket whose inputs are missing or whose server failed. */
+  buckets: Partial<Record<NewActivityBucket, BucketCount>>;
+  errors: string[];
+}
+
+interface StartGroup {
+  server: AlertSearchServer;
+  from?: AlertSearchCursor;
+  buckets: NewActivityBucket[];
+  result: ServerCounts;
+}
+
+/**
+ * Counts for each available bucket from its own start. Buckets on the same
+ * server with the same start share one read.
+ */
+async function countFromStarts(
+  ctx: NewActivityContext,
+  startOf: (bucket: NewActivityBucket) => AlertSearchCursor | undefined,
+): Promise<StartGroup[]> {
+  const groups = new Map<string, Omit<StartGroup, "result">>();
+  for (const bucket of NEW_ACTIVITY_BUCKETS) {
+    if (!bucketIsAvailable(ctx, bucket)) continue;
+    const server = NEW_ACTIVITY_BUCKET_INFO[bucket].server;
+    const from = startOf(bucket);
+    const key = server + " " + (from ?? "");
+    const group = groups.get(key) ?? { server, from, buckets: [] };
+    group.buckets.push(bucket);
+    groups.set(key, group);
+  }
+  return Promise.all(
+    [...groups.values()].map(async (group) => ({
+      ...group,
+      result: await countServer(ctx, group.server, group.from),
+    })),
+  );
+}
+
+/**
+ * Counts for the summary: each bucket from {@link summaryStart}. Each server's
+ * `to`, the end of the visit, comes from the read that started at the visit's
+ * start, so a capped read leaves the rest for the next visit; when every
+ * bucket on the server has its own start, from a read that was not capped.
+ * A server with any failed read reports the error and no `to`.
+ */
+export async function countSummaryActivity(
+  ctx: NewActivityContext,
+  state: NewActivityCursorState,
+  now: Date,
+  fallback?: CursorPair,
+): Promise<NewActivityCounts> {
+  const groups = await countFromStarts(ctx, (bucket) =>
+    summaryStart(state, bucket, now, fallback),
+  );
+  const visitStart = windowStart(state.visit, now) ?? fallback;
+  const serverCounts = (server: AlertSearchServer): ServerCounts => {
+    const own = groups.filter((group) => group.server === server);
+    const counts: ServerCounts = {
+      counts: {},
+      hitLimit: false,
+      bucketHitLimit: {},
+    };
+    for (const group of own) {
+      const result = group.result;
+      if (result.error) {
+        counts.error ??= result.error;
+        continue;
+      }
+      counts.userMessage ??= result.userMessage;
+      counts.hitLimit ||= result.hitLimit;
+      for (const bucket of group.buckets) {
+        counts.counts[bucket] = result.counts[bucket];
+        counts.bucketHitLimit![bucket] = result.hitLimit;
+      }
+    }
+    if (!counts.error) {
+      const ending =
+        own.find((group) => group.from === visitStart?.[server]) ??
+        own.find((group) => !group.result.hitLimit) ??
+        own[0];
+      counts.to = ending?.result.to;
+    }
+    return counts;
+  };
+  return {
+    endorser: serverCounts("endorser"),
+    partner: serverCounts("partner"),
+  };
+}
+
+/**
+ * Counts for the Home screen: each bucket from {@link unseenStart}. A person
+ * who has opened no list since the summary costs one read per server.
+ */
+export async function countUnseenActivity(
+  ctx: NewActivityContext,
+  state: NewActivityCursorState,
+): Promise<UnseenCounts> {
+  const counted = await countFromStarts(ctx, (bucket) =>
+    unseenStart(state, bucket),
+  );
+  const unseen: UnseenCounts = { buckets: {}, errors: [] };
+  for (const { buckets, result } of counted) {
+    if (result.error) {
+      if (!unseen.errors.includes(result.error)) {
+        unseen.errors.push(result.error);
+      }
+      continue;
+    }
+    for (const bucket of buckets) {
+      unseen.buckets[bucket] = {
+        count: result.counts[bucket] ?? 0,
+        hitLimit: result.hitLimit,
+      };
+    }
+  }
+  return unseen;
+}
+
+/** The sum of the known counts, as the notification service totals them. */
+export function totalNewActivity(counts: NewActivityCounts): number {
+  let total = 0;
+  for (const server of ["endorser", "partner"] as const) {
+    for (const value of Object.values(counts[server].counts)) {
+      total += value ?? 0;
+    }
+  }
+  return total;
+}
+
+/** The pair to store as the end of this visit, when both servers answered. */
+export function countsEndPair(
+  counts: NewActivityCounts,
+): CursorPair | undefined {
+  return counts.endorser.to && counts.partner.to
+    ? { endorser: counts.endorser.to, partner: counts.partner.to }
+    : undefined;
+}
+
+export interface BucketPage {
+  rows: unknown[];
+  /** Forward: the cursor to store, where this read ended. */
+  nextAfterCursor?: AlertSearchCursor;
+  /** Backward: where to continue for earlier rows. */
+  nextBeforeCursor?: AlertSearchCursor;
+  hasMore: boolean;
+  userMessage?: string;
+}
+
+/** Every row of one bucket from `from` forward, up to DETAIL_MAX_PAGES. */
+export async function loadBucket(
+  ctx: NewActivityContext,
+  bucket: NewActivityBucket,
+  from: AlertSearchCursor | undefined,
+): Promise<BucketPage> {
+  const server = NEW_ACTIVITY_BUCKET_INFO[bucket].server;
+  const result: AlertSearchResult<AlertSearchServer> =
+    await collectAlertSearchForward(
+      pageFetcher(ctx, server),
+      server,
+      startParams(from),
+      DETAIL_MAX_PAGES,
+    );
+  // with no start, the rows are the server's latest, not new ones
+  return {
+    rows: from === undefined ? [] : bucketRows(result.data, bucket),
+    nextAfterCursor: result.nextAfterCursor,
+    nextBeforeCursor: result.nextBeforeCursor,
+    hasMore: from !== undefined && result.hasMore,
+    userMessage: result.userMessage,
+  };
+}
+
+/**
+ * Rows of one bucket before `before`, newest first. Pages are cut across all
+ * of a server's lists, so a page can hold none of this bucket while more
+ * remain; this steps back up to EARLIER_MAX_PAGES looking for some.
+ */
+export async function loadBucketEarlier(
+  ctx: NewActivityContext,
+  bucket: NewActivityBucket,
+  before: AlertSearchCursor,
+): Promise<BucketPage> {
+  const server = NEW_ACTIVITY_BUCKET_INFO[bucket].server;
+  const fetchPage = pageFetcher(ctx, server);
+  let cursor = before;
+  for (let page = 0; page < EARLIER_MAX_PAGES; page++) {
+    const result = await fetchPage({ beforeCursor: cursor });
+    const rows = bucketRows(result.data, bucket);
+    const moved =
+      !!result.nextBeforeCursor && result.nextBeforeCursor !== cursor;
+    if (rows.length > 0 || !result.hasMore || !moved) {
+      return {
+        rows,
+        nextBeforeCursor: result.nextBeforeCursor,
+        hasMore: result.hasMore && moved,
+        userMessage: result.userMessage,
+      };
+    }
+    cursor = result.nextBeforeCursor as AlertSearchCursor;
+  }
+  return { rows: [], nextBeforeCursor: cursor, hasMore: true };
+}
+
+/**
+ * The latest cursors, for a notification upload when notifications are turned
+ * on: the first daily count then starts from now instead of from old rows.
+ * Each server answers on its own; one that fails is left out.
+ */
+export async function latestCursorPair(
+  ctx: NewActivityContext,
+): Promise<Partial<CursorPair>> {
+  const [endorser, partner] = await Promise.allSettled([
+    pageFetcher(ctx, "endorser")({}),
+    pageFetcher(ctx, "partner")({}),
+  ]);
+  const latest: Partial<CursorPair> = {};
+  if (endorser.status === "fulfilled" && endorser.value.nextAfterCursor) {
+    latest.endorser = endorser.value.nextAfterCursor;
+  }
+  if (partner.status === "fulfilled" && partner.value.nextAfterCursor) {
+    latest.partner = partner.value.nextAfterCursor;
+  }
+  return latest;
+}
+
+/**
+ * A state with a visit to count from. With none yet (the person has never
+ * loaded New Activity or Home, nor turned on notifications), this asks each
+ * server for its latest cursor and returns a visit ending there, so nothing
+ * before it shows as new. The state is returned unchanged when it has a visit
+ * or a server did not answer; `seeded` says whether to save it.
+ */
+export async function seedIfNeeded(
+  ctx: NewActivityContext,
+  state: NewActivityCursorState,
+  now: Date,
+): Promise<{ state: NewActivityCursorState; seeded: boolean }> {
+  if (state.visit) return { state, seeded: false };
+  const latest = await latestCursorPair(ctx);
+  if (!latest.endorser || !latest.partner) return { state, seeded: false };
+  return {
+    state: seededState(
+      state,
+      { endorser: latest.endorser, partner: latest.partner },
+      now,
+    ),
+    seeded: true,
+  };
+}
+
+/**
+ * The upload body fields for a channel's alert authorization. A server
+ * without a cursor is left out, and the service keeps (or, with none stored,
+ * seeds) its own.
+ */
+export function alertSearchUploadState(
+  ctx: Pick<NewActivityContext, "planHandleIds" | "location">,
+  cursors: Partial<CursorPair> | undefined,
+): AlertSearchUploadState {
+  return {
+    ...(cursors?.endorser ? { endorserAfterCursor: cursors.endorser } : {}),
+    ...(cursors?.partner ? { partnerAfterCursor: cursors.partner } : {}),
+    planHandleIds: ctx.planHandleIds.length > 0 ? ctx.planHandleIds : null,
+    location: ctx.location ?? null,
+  };
+}

src/services/newActivityContext.ts

@@ -0,0 +1,37 @@
+/**
+ * Build a {@link NewActivityContext} from the account settings, the same way
+ * on the summary, the detail pages and the notification toggles.
+ */
+
+import type { Axios } from "axios";
+
+import {
+  DEFAULT_ENDORSER_API_SERVER,
+  DEFAULT_PARTNER_API_SERVER,
+} from "@/constants/app";
+import * as databaseUtil from "@/db/databaseUtil";
+import type { Settings } from "@/db/tables/settings";
+import type { BoundingBox } from "@/interfaces/accountView";
+import { alertSearchLocationFromBox } from "@/libs/alertSearch";
+import type { NewActivityContext } from "./newActivity";
+
+export function buildNewActivityContext(
+  axios: Axios,
+  activeDid: string,
+  settings: Settings,
+): NewActivityContext {
+  const searchBoxes = databaseUtil.parseJsonField<
+    Array<{ name: string; bbox: BoundingBox }>
+  >(settings.searchBoxes, []);
+  return {
+    axios,
+    endorserServer: settings.apiServer || DEFAULT_ENDORSER_API_SERVER,
+    partnerServer: settings.partnerApiServer || DEFAULT_PARTNER_API_SERVER,
+    activeDid,
+    planHandleIds: databaseUtil.parseJsonField<string[]>(
+      settings.starredPlanHandleIds,
+      [],
+    ),
+    location: alertSearchLocationFromBox(searchBoxes[0]?.bbox),
+  };
+}

src/services/notifications/NativeNotificationService.ts

@@ -13,30 +13,8 @@
 
 import { Capacitor } from "@capacitor/core";
 import type { PushNotificationSchema } from "@capacitor/push-notifications";
-import type {
-  NotificationRefreshRequest,
-  NotificationRefreshResponse,
-} from "@/interfaces/notifyApi";
 import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
-import { getOrCreateDeviceId } from "./deviceId";
 import { REMINDER_ID_DAILY_REMINDER } from "./reminderIds";
-import { configureNativeFetcherIfReady } from "./nativeFetcherConfig";
-import {
-  getNotificationApiBaseUrl,
-  getTestMode,
-} from "./NotificationDebugConfig";
-import {
-  logRefreshFailure,
-  logRefreshStarted,
-  logRefreshSuccess,
-  logScheduleReplacement,
-} from "./notificationLog";
-import {
-  getNotificationApiHeaders,
-  logSkippingRefreshDueToMissingAuth,
-  notificationApiFailureMessage,
-  readNotificationApiBody,
-} from "./notificationApiAuth";
 import { logNotification } from "./NotificationDebugEvents";
 
 /**
@@ -563,200 +541,14 @@ export class NativeNotificationService implements NotificationServiceInterface {
   }
 }
 
-export type RefreshNotificationsResult = {
-  ok: boolean;
-  scheduledCount: number;
-  status?: number;
-  errorMessage?: string;
-};
-
 /**
- * Re-applies native API fetcher credentials (JWT pool, active DID) so background
- * notification workers can run. No UI; safe from push handlers while backgrounded.
- */
-export async function refreshNotificationsWithDiagnostics(options?: {
-  source?: string;
-}): Promise<RefreshNotificationsResult> {
-  const startedAt = performance.now();
-  const source = options?.source;
-  logRefreshStarted(source);
-
-  if (!Capacitor.isNativePlatform()) {
-    const errorMessage = "not a native platform";
-    logRefreshFailure(startedAt, errorMessage, undefined, source);
-    return {
-      ok: false,
-      scheduledCount: 0,
-      errorMessage,
-    };
-  }
-
-  try {
-    const auth = await getNotificationApiHeaders("refresh");
-    if (!auth.ok) {
-      logSkippingRefreshDueToMissingAuth();
-      logRefreshFailure(startedAt, auth.message, undefined, source);
-      return {
-        ok: false,
-        scheduledCount: 0,
-        errorMessage: auth.message,
-      };
-    }
-
-    let deviceId: string | undefined;
-    try {
-      deviceId = await getOrCreateDeviceId();
-    } catch (err) {
-      logger.warn(
-        "[NativeNotificationService] Could not obtain deviceId; skipping refresh",
-        err,
-      );
-    }
-    if (!deviceId) {
-      // The service finds the device by deviceId or fcmToken and answers 400
-      // without either, so there is no request worth sending.
-      const errorMessage = "no deviceId (cannot identify this device)";
-      logRefreshFailure(startedAt, errorMessage, undefined, source);
-      return { ok: false, scheduledCount: 0, errorMessage };
-    }
-
-    const body: NotificationRefreshRequest = {
-      deviceId,
-      platform: Capacitor.getPlatform(),
-      testMode: getTestMode(),
-    };
-    const baseUrl = getNotificationApiBaseUrl();
-    const res = await fetch(`${baseUrl}/notifications/refresh`, {
-      method: "POST",
-      headers: auth.headers,
-      body: JSON.stringify(body),
-    });
-
-    if (!res.ok) {
-      const errorMessage = notificationApiFailureMessage(
-        res.status,
-        await readNotificationApiBody(res),
-      );
-      logger.warn("[NativeNotificationService] refreshNotifications failed", {
-        status: res.status,
-        statusText: res.statusText,
-        errorMessage,
-      });
-      logRefreshFailure(startedAt, errorMessage, res.status, source);
-      return {
-        ok: false,
-        scheduledCount: 0,
-        status: res.status,
-        errorMessage,
-      };
-    }
-
-    const payload = (await res.json()) as NotificationRefreshResponse;
-    const scheduledCount = Array.isArray(payload?.nextNotifications)
-      ? payload.nextNotifications.length
-      : 0;
-    await applyNotificationRefreshPayload(payload);
-    logRefreshSuccess(startedAt, scheduledCount, source);
-    return { ok: true, scheduledCount };
-  } catch (err) {
-    logger.error("[NativeNotificationService] Refresh failed", err);
-    const message = err instanceof Error ? err.message : String(err);
-    logRefreshFailure(startedAt, message, undefined, source);
-    return { ok: false, scheduledCount: 0, errorMessage: message };
-  }
-}
-
-export async function refreshNotifications(): Promise<void> {
-  await refreshNotificationsWithDiagnostics();
-}
-
-export type NotificationRefreshPayload = {
-  shouldNotify?: boolean;
-  nextNotifications?: Array<{ timestamp?: number }>;
-};
-
-// `handleCapacitorPushNotificationReceived` and `applyNotificationRefreshPayload` are used by
-// DEV notification simulation tooling; they must stay production-safe because that tooling
-// exercises real flows. (`applyNotificationRefreshPayload` is also used by production refresh.)
-
-/**
- * Apply a "refresh notifications" payload by clearing and scheduling timestamps via the native plugin.
- *
- * This is the shared implementation used by:
- * - production refresh flow (`refreshNotifications` fetching from backend)
- * - dev-only debug flows (mock refresh with local payloads)
- *
- * Important: This function intentionally mirrors production behavior and does not introduce
- * any scheduling logic in UI layers.
- */
-export async function applyNotificationRefreshPayload(
-  payload: unknown,
-): Promise<void> {
-  if (!Capacitor.isNativePlatform()) {
-    return;
-  }
-
-  const data = payload as NotificationRefreshPayload;
-  const nextNotifications = data?.nextNotifications;
-  if (!Array.isArray(nextNotifications)) {
-    return;
-  }
-
-  const timestamps = nextNotifications
-    .map((n) => (n as { timestamp?: unknown })?.timestamp)
-    .filter((t): t is number => typeof t === "number" && Number.isFinite(t));
-
-  if (timestamps.length === 0) {
-    logNotification("Schedule replacement skipped (no valid timestamps)");
-    return;
-  }
-
-  // Keep existing behavior: ensure background worker credentials are current.
-  await configureNativeFetcherIfReady();
-
-  logScheduleReplacement(timestamps.length);
-
-  if (typeof DailyNotification.clearApiNotifications !== "function") {
-    logger.warn(
-      "[NativeNotificationService] API notification clear unavailable (plugin clearApiNotifications missing); cannot replace schedule",
-    );
-    logNotification(
-      "Schedule replacement aborted (API notification clear unavailable on plugin)",
-    );
-    return;
-  }
-
-  logNotification("Clearing API notifications before refresh");
-  await DailyNotification.clearApiNotifications();
-  logNotification("Cleared API notifications");
-
-  if (typeof DailyNotification.scheduleApiNotifications !== "function") {
-    logger.warn(
-      "[NativeNotificationService] scheduleApiNotifications not available on plugin; cannot apply timestamps",
-    );
-    logNotification(
-      "Schedule replacement aborted (scheduleApiNotifications unavailable)",
-    );
-    return;
-  }
-
-  await DailyNotification.scheduleApiNotifications({ timestamps });
-  logNotification(
-    `Schedule replacement applied (${timestamps.length} timestamp(s))`,
-  );
-}
-
-/**
- * Silent FCM/APNs data push: refresh native notification pipeline when requested by backend.
+ * Capacitor push delivery hook. Legacy WAKEUP_PING → /notifications/refresh
+ * consumption was retired; AlertSearch uses visible FCM notifications and is
+ * not handled here. Keep logging for diagnostics without scheduling api_* work.
  */
 export async function handleCapacitorPushNotificationReceived(
   notification: PushNotificationSchema,
 ): Promise<void> {
-  if (notification.data?.type === "WAKEUP_PING") {
-    logNotification("WAKEUP_PING handler — invoking refresh");
-    await refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" });
-    return;
-  }
   const type =
     typeof notification.data?.type === "string"
       ? notification.data.type

src/services/notifications/NotificationDebugService.ts

@@ -1,14 +1,12 @@
 /**
  * DEV-only notification testing utilities.
  *
- * IMPORTANT:
- * This service intentionally routes through the same production notification
- * orchestration paths used by refresh flows, wakeup pushes, and replacement.
- * Avoid adding duplicate scheduling logic here.
+ * Legacy WAKEUP_PING → /notifications/refresh → api_* tooling was removed in
+ * the Phase 2 retirement. Remaining helpers cover FCM registration, AlertSearch
+ * authorization upload, backend URL overrides, and pending-notification inspection.
  */
 
 import { Capacitor } from "@capacitor/core";
-import type { PushNotificationSchema } from "@capacitor/push-notifications";
 import type {
   DebugSendWakeupRequest,
   DebugSendWakeupResponse,
@@ -38,12 +36,6 @@ import {
   notificationApiFailureMessage,
   readNotificationApiBody,
 } from "./notificationApiAuth";
-import {
-  applyNotificationRefreshPayload,
-  handleCapacitorPushNotificationReceived,
-  refreshNotificationsWithDiagnostics,
-  type NotificationRefreshPayload,
-} from "./NativeNotificationService";
 import { truncateFcmTokenForLog } from "./notificationLog";
 import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
 import { NotificationInspector } from "@/plugins/NotificationInspectorPlugin";
@@ -179,19 +171,10 @@ export const NotificationDebugService = {
     return result;
   },
 
-  async triggerBackendRefresh(): Promise<void> {
-    await refreshNotificationsWithDiagnostics({ source: "debug panel" });
-  },
-
-  /** Local simulation: same API call as a WAKEUP_PING handler (no push payload). */
-  async simulateWakeupViaRefresh(): Promise<void> {
-    logNotification("WAKEUP_PING simulation (local refresh API only)");
-    await refreshNotificationsWithDiagnostics({
-      source: "WAKEUP_PING simulation",
-    });
-  },
-
-  /** Full pipeline: backend `/debug/send-wakeup` → FCM → native WAKEUP_PING handler. */
+  /**
+   * Backend `/debug/send-wakeup` → FCM only. App no longer consumes WAKEUP_PING
+   * for api_* scheduling; kept for FCM delivery diagnostics until backend Phase 3.
+   */
   async sendRealWakeupPing(): Promise<SendRealWakeupPingResult> {
     logNotification("Real WAKEUP_PING requested");
 
@@ -264,62 +247,6 @@ export const NotificationDebugService = {
     }
   },
 
-  generateMockNotifications(
-    intervalMs: number = 60_000,
-  ): NotificationRefreshPayload {
-    const now = Date.now();
-    const future1 = now + intervalMs;
-    const future2 = now + intervalMs * 2;
-
-    return {
-      shouldNotify: true,
-      nextNotifications: [{ timestamp: future1 }, { timestamp: future2 }],
-    };
-  },
-
-  async triggerMockRefresh(intervalMs?: number): Promise<void> {
-    logNotification("Mock refresh requested");
-
-    const payload = this.generateMockNotifications(intervalMs);
-    const timestamps = payload.nextNotifications?.map((n) => n.timestamp) ?? [];
-    logNotification(`Mock payload generated (${timestamps.length} timestamps)`);
-
-    if (!Capacitor.isNativePlatform()) {
-      logNotification("Mock refresh skipped: not running on native platform");
-      return;
-    }
-
-    await applyNotificationRefreshPayload(payload);
-    logNotification("Mock refresh applied");
-  },
-
-  async simulateWakeupPing(): Promise<void> {
-    logNotification("Simulating WAKEUP_PING (production push handler)");
-
-    if (!Capacitor.isNativePlatform()) {
-      logNotification("WAKEUP_PING simulation skipped: not native platform");
-      return;
-    }
-
-    const notification = {
-      title: "WAKEUP_PING",
-      body: "",
-      id: "dev_wakeup_ping",
-      data: { type: "WAKEUP_PING" },
-    } as unknown as PushNotificationSchema;
-
-    await handleCapacitorPushNotificationReceived(notification);
-  },
-
-  async runFloodTest(intervalMs?: number): Promise<void> {
-    logNotification("Flood test started (20 sequential refreshes)");
-    for (let i = 0; i < 20; i++) {
-      logNotification(`Flood iteration ${i + 1}/20`);
-      await this.triggerMockRefresh(intervalMs);
-    }
-    logNotification("Flood test completed");
-  },
-
   async clearNotifications(): Promise<void> {
     logNotification("Clear notifications (debug panel)");
 

src/services/notifications/alertAuthorization.test.ts

@@ -1,9 +1,14 @@
 import type { AlertAuthorizationBatch } from "./alertAuthorizationBatch";
 import {
   type AlertAuthorizationDependencies,
+  revokeAlertSearchAuthorization,
   uploadAlertSearchAuthorization,
 } from "./alertAuthorization";
 import { alertSearchNotifyTimeUtcFromLocalNineAm } from "./alertSearchNotifyTime";
+import {
+  authorizeInAppNewActivity,
+  revokeInAppNewActivity,
+} from "./newActivityInAppSubscription";
 
 jest.mock("@/libs/crypto/vc", () => ({
   ETHR_DID_PREFIX: "did:ethr:",
@@ -100,7 +105,7 @@ function createDependencies(overrides?: {
 }
 
 describe("uploadAlertSearchAuthorization", () => {
-  it("uploads the minted batch with authenticated PUT semantics", async () => {
+  it("uploads the minted batch with authenticated POST semantics", async () => {
     const { dependencies, fetchMock, mintMock, authMock } =
       createDependencies();
     const minted = createMintedBatch();
@@ -124,7 +129,7 @@ describe("uploadAlertSearchAuthorization", () => {
     expect(url).toBe(
       "https://notification-backend.invalid/notifications/alert-authorization",
     );
-    expect(init.method).toBe("PUT");
+    expect(init.method).toBe("POST");
     expect(init.headers).toEqual({
       "Content-Type": "application/json",
       Authorization: "Bearer access-token-fixture",
@@ -238,3 +243,141 @@ describe("uploadAlertSearchAuthorization", () => {
     });
   });
 });
+
+function alertAuthorizationUrl(call: unknown[]): string {
+  return String(call[0]);
+}
+
+describe("revokeAlertSearchAuthorization", () => {
+  it("deletes alert authorization with the upload path's authenticated headers", async () => {
+    const { dependencies, fetchMock, mintMock, authMock } =
+      createDependencies();
+
+    const result = await revokeAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({ ok: true, status: 200 });
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(authMock).toHaveBeenCalledWith(undefined, ACTIVE_DID);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(init.method).toBe("DELETE");
+    expect(init.body).toBeUndefined();
+    expect(init.headers).toEqual({
+      "Content-Type": "application/json",
+      Authorization: "Bearer access-token-fixture",
+    });
+  });
+
+  it("does not unregister the FCM device registration", async () => {
+    const { dependencies, fetchMock } = createDependencies();
+
+    await revokeAlertSearchAuthorization(dependencies);
+
+    const urls = fetchMock.mock.calls.map(alertAuthorizationUrl);
+    expect(urls).toEqual([
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    ]);
+    expect(urls.some((url) => url.includes("/notifications/register"))).toBe(
+      false,
+    );
+    expect(fetchMock.mock.calls[0][1].method).not.toBe("POST");
+  });
+
+  it("rejects notification auth bypass before submission", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies({
+      bypassAuth: true,
+    });
+
+    const result = await revokeAlertSearchAuthorization(dependencies);
+
+    expect(result.ok).toBe(false);
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("surfaces a coded refusal without treating it as revoked", async () => {
+    const { dependencies, fetchMock } = createDependencies({
+      response: createResponse(500, {
+        success: false,
+        error: "ALERT_AUTHORIZATION_DELETE_FAILED",
+        message: "Could not delete AlertSearch authorization.",
+        jwt: "must-not-be-returned",
+      }),
+    });
+
+    const result = await revokeAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({
+      ok: false,
+      status: 500,
+      errorCode: "ALERT_AUTHORIZATION_DELETE_FAILED",
+      errorMessage: "Could not delete AlertSearch authorization.",
+    });
+    expect(JSON.stringify(result)).not.toContain("must-not-be-returned");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
+  });
+});
+
+describe("in-app New Activity AlertSearch subscription", () => {
+  it("uploads AlertSearch authorization when the setting is enabled", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies();
+    const reportError = jest.fn();
+
+    const result = await authorizeInAppNewActivity(reportError, dependencies);
+
+    expect(result.ok).toBe(true);
+    expect(mintMock).toHaveBeenCalledWith(ACTIVE_DID);
+    expect(reportError).not.toHaveBeenCalled();
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(init.method).toBe("POST");
+  });
+
+  it("deletes alert authorization when the setting is disabled", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies();
+    const reportError = jest.fn();
+
+    const revoked = await revokeInAppNewActivity(reportError, dependencies);
+
+    expect(revoked).toBe(true);
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(reportError).not.toHaveBeenCalled();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
+    expect(alertAuthorizationUrl(fetchMock.mock.calls[0])).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(
+      fetchMock.mock.calls.some((call) =>
+        alertAuthorizationUrl(call).includes("/notifications/register"),
+      ),
+    ).toBe(false);
+  });
+
+  it("reports a failed delete and does not treat it as revoked", async () => {
+    const { dependencies, fetchMock } = createDependencies({
+      response: createResponse(500, {
+        success: false,
+        message: "Could not delete AlertSearch authorization.",
+      }),
+    });
+    const reportError = jest.fn();
+
+    const revoked = await revokeInAppNewActivity(reportError, dependencies);
+
+    expect(revoked).toBe(false);
+    expect(reportError).toHaveBeenCalledTimes(1);
+    expect(reportError).toHaveBeenCalledWith(
+      "Could not delete AlertSearch authorization.",
+    );
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchMock.mock.calls[0][1].method).toBe("DELETE");
+  });
+});