024e44c2c5
The refusal `679d5249` added is gone, and with it the last reason it existed. **The per-viewer field had to go first.** `ChatMessage.isUserMessage` was a boolean about one reader stored on a row that belongs to the group: a transcript line is deduped by the group event behind it, and `reconcileMarmotLine` lets the fresher row win, so whichever profile indexed the event last decided whose message it looked like. A member's own messages would draw as somebody else's and flip back when the other profile caught up -- on every line in the room. It is `senderIdentity` now, and `ChatMessage.isFrom(userPublicKey)` asks the question. The identity is the fact about the message; whether it is yours is a question only a reader can ask. Not derivable from `senderPublicKey`, which for a Marmot line is the kind:445's ephemeral signer -- the same trap the comment on `fromGroupEventResult` already records someone falling into. `answeredRequests` takes the asking profile for the same reason: the other profile's approval is not this one's to be credited with. The backfill is exact, and exact for the reason the bug could not happen yet: the boolean was only safe to store because a room belonged to one profile, so a line marked as the user's was sent by that room's one member, and `ChatRoomMembership` says who. `isUserMessage` is named by no index or constraint, so `DROP COLUMN` takes it and `ChatMessage`'s three cascading children are untouched. **Removing the refusal was not enough.** The Welcome branch keyed on the *room*, so a Welcome that found one fell through and did nothing -- the accidental silent refusal that `679d5249` was written to make legible in the first place. It asks about this profile's membership now, and the body it guards already does the right thing for a joiner: the room's upsert is idempotent, the bundle consumed is their own, the roster is the group's, and `adopt` files a statement the group already signed. `TYPE_WELCOME_REFUSED_OTHER_PROFILE` stays, written by nothing and still rendered. Devices that ran the older build hold lines of that type, and a transcript that cannot draw a line it is holding is worse than one drawing an obsolete notice. `WelcomeForOtherProfileJvmTest` becomes `SecondProfileJoinsGroupJvmTest` and asserts the opposite of what it used to: two memberships of one room, two distinct ratchet states, the holder's untouched, no refusal line, and the key package spent like any other join's. 1216 tests, 0 failures. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
195 KiB
195 KiB