The new worker cleared a leftover app badge inside its activation and
waited for it. A browser that never settles that call keeps the worker
activating, so it never takes over its pages and every offline path is
gone. The badge is now cleared beside the activation, best effort.
The sign-in journey expects the page's own sentence for a wrong
password, not the server's text.
Moving the navigation into the shared helper took both sign-in hand-offs
out of what the headerless-transport guard walks, which only reads the
component and page trees. The helper now only clears the offline copies
with the capped wait, and each page navigates itself. The device
registration test checks the end of the no-device rest inside the test
that already pairs an iPhone instead of a copy of it.
Merging the previous release in kept this branch's older numbers for
telegram-webhook-handlers.ts (1335 lines, handleCallback 590), although
the file is unchanged at 1319 and 582, the numbers the previous release
recorded. The gap sat inside the ratchet's slack, so nothing flagged it.
The register refusal codes, the end of the no-device rest, the
no-recipient annotation and the sign-in shell comment had each grown a
function the size ratchet holds. The codes become constants, the rest
ends through a helper beside the one that starts it, and the
annotation moves into that helper. The settings Web Push card dropped
under the limit when its subscription post moved out, so its entry goes.
The sign-in page and the profile take-over page each cleared the offline
copies with the same capped wait before leaving for the identity
provider, with the limit written down twice. leaveForSingleSignOn does
it once for both.
A send with no browser subscribed, no iPhone paired or a transport the
operator has not set up no longer counts as a failure, but nothing else
replaced it. The mood reminder and the daily briefing retry every
minute until delivered, so such a channel wrote a skipped row each
minute, for good; the dispatch still counted as an attempt, so the
watchdog and status alerts took it as announced; and the status screen
said "active" with no hint why nothing arrived.
The channel now rests for an hour after such a send, with the reason on
its status, and the send does not count as an attempt. Subscribing a
browser or pairing an iPhone ends the rest at once.
The record fence journey called the page cache its positive control,
but signed-in pages are never stored, so the entry it counted was the
install precache, and the half inside the record repeated a claim that
holds by construction now that the worker keeps no API answers. The
comment now names the precache, and inside the record the journey reads
the IndexedDB dashboard snapshot, which must be missing or still the
caller's own.
Sign-out removes the push row first, through the raw fetch helper, which
has no default timeout. On a connection that is up but carries nothing,
the sign-out waited for the browser's own timeout before the logout
request even started. The removal now gives up after five seconds.
The dose tag comment still explained the clear push sent for a logged
dose, the session-end wipe comment still named the worker's API cache as
a live layer, and the worker's header and foreign-origin note did not
match what the worker stores and when it resumes.
The light-theme fix painted the strip behind the white status bar only
in the signed-in shell. The sign-in, registration and take-over pages
and the onboarding shell padded the strip without painting it, so after
a sign-out in the installed iOS app the clock was white on near-white.
They now use the same shell-safe-area band.
The Web Push test answered a refused push with `ok: false` and the
sender's `reason`, but the Test button reads `meta.errorCode`, so it
only said "Test failed". The answer now carries `upstream_rejected`, or
`connection_failed` when no push service answered.
The test push used the administrator's test title, which put the brand
first in several languages; it has its own title now.
The German sentence dropped its article, and the Spanish one read as if
the sign-out had been the session's own state ("Tu sesión sigue
abierta"); it now says the person is still signed in.
The hint for iPhone and iPad Safari ended with "turn on push here", but
the button reads "Enable push"; it now names the button in every
language. The hint is two sentences of steps, so it is shown as content
rather than muted, and the French one uses the typographic apostrophe
like its neighbours.
The offline strip joins two sentences, and both ended on "once you're
back online"; in French it ran to four lines on a phone, and the
Russian one was ungrammatical. The first sentence now only says that
changes can't be saved.
On Back, the shell set the list's saved offset again on every frame
while the list was still shorter than that offset. Someone who started
scrolling in that time was pulled back, and a list whose data took more
than a second ended up where the skeleton allowed. The restore now stops
at the first wheel, touch, key or pointer input and keeps trying for up
to three seconds.
The sign-in page and the profile take-over page waited for the offline
copies to be cleared before leaving for the identity provider, with no
limit. WebKit can leave an IndexedDB open unsettled after the installed
app returns from the background, and the button then did nothing. The
wait is now capped at one and a half seconds.
The menu's sign-out pushed the sign-in page onto the history. Back then
reopened the page just signed out of, and the edge sent the next person
to the sign-in page with that page as `next`, so their first sign-in on
the device landed where the last person had been. The sign-out now
replaces the page.
A refetch of the account that answered 401 or 403 now signs the person
out and clears the offline copies, which is right for HealthLog's own
answer. But a self-hosted instance behind a forward-auth proxy or a
firewall can get a 401 or 403 that HealthLog never wrote, and that
signed a person out whose session was fine.
HealthLog's error envelope always names a code, so only a 401 or 403
that carries one is read as the session's end; one without is treated
like a network failure and keeps the last known state. The tests now
give the account route the answer the server really sends.
Once the sign-in and registration pages read codes instead of the
server's prose, a taken username or address said only "Registration
failed", an expired invitation said "You don't have permission for
this", and a passkey this server does not know, a passkey sign-in that
took too long, an unreadable passkey answer, a single-sign-on-only
server and an already signed-in visitor all said "Login failed".
The registration route now names its refusals (auth.register.taken for
both 409s, auth.register.invite_invalid for a refused invitation), and
those codes, the three passkey refusals, oidc_only and
auth.already_authenticated get a sentence in every language.
Subscribing re-enabled a disabled channel but left the failure counter
and cooldown on one that was still enabled. Failures counted before the
new subscription (no browser left, a push service outage) kept every
reminder skipped until the cooldown ran out, and one more transient
failure switched the channel off. Subscribing now resets them too.
A browser also kept the row of an account whose session ended without a
sign-out, so the next person on it saw that account's reminders. An
endpoint is one browser: subscribing now removes other accounts' rows
for it, and the settings card, which posts its subscription on open,
claims the browser for whoever uses it now.
The server set the Home Screen badge only through the clear push sent
for each logged dose, and that push is gone. A device whose last clear
left a count (one forgotten dose, an update in the middle of the day)
kept that number on the icon for good, since iOS never clears a web
app's badge by itself.
The worker now clears the badge once on activate. The badge handling in
the push handler, the unused outstanding-dose counter and the test of a
payload no server sends are removed, and the self-hosting guide no
longer promises the clear push or the badge.
The sign-in refusals carry only their status's generic code, so once the
sign-in page read codes, a wrong password, a wrong second-factor code
and a refused security key all said "Your session has ended", and a
lockout said "too many requests just now".
localizedSignInError reads a generic 401 as the step's own failure and a
generic 429 as "Too many attempts. Wait a few minutes and try again.";
a code the step names itself keeps its sentence. The password, passkey,
code and security-key steps use it. The rate-limit sentence moves from
auth.claim to auth.signInRateLimited, since the claim page and the
sign-in page now share it, and the Korean one takes the polite form the
rest of the catalogue uses.
Only the menu's sign-out removed this browser's push subscription. The
sign-out buttons on the registration page and the profile take-over page,
which exist so someone else can use the browser next, left it behind, and
the next person kept seeing the last account's reminders. All three now
go through one signOutRequest.
The browser's own subscription is now removed only once the server has
confirmed the sign-out; the server row still goes first, while the
session can name it. A refused sign-out stores the row again, so the
person who is still signed in keeps push. The logout test pins the new
order and the refusal.
The helper file is renamed web-push-subscription.ts, since it now also
saves a subscription for the settings card.
The Web Push card reads its state from the browser only. When the server
had lost the row, or the channel had been switched off, the card said
enabled and no reminder came. Opening the card now posts the subscription
the browser holds, which stores the row and turns the channel back on.
A refused post (demo, push off instance-wide) changes nothing on screen.
Before this release, a send with no browser subscription counted as a
failure, and five of them, or one 410, switched the WEB_PUSH channel off.
Subscribing again stored the browser but left the channel off, so the
card read "enabled", a test push arrived, and no reminder was ever sent.
Subscribing now re-enables the channel, but nothing prompts the people
already caught to subscribe again.
The migration re-enables every WEB_PUSH channel the dispatcher switched
off (a disabled_reason is set; a channel switched off by hand has none)
whose account still has a subscription, and clears the counter, the
cooldown and the last failure the same way reEnableChannel does.
This reverts commit 0d41abcda. With the entry hidden, Settings, AI showed
the stored Coach memory instead, and that card reads the conversation
list: an account without any AI provider then made a Coach request on a
page that should make none. Settings lists the Coach while its module is
on, as before.
Carries the targets read at read level, the two new error codes
(`customMetric.name_taken`, `auth.mfa.already_active`) and the
notification categories' description without its em dash.
The Settings Coach entry now follows whether the Coach can answer, as
the sidebar does, with Settings, AI keeping the stored memory in reach.
A managed record has no Settings, AI, so while its Coach could not
answer yet (no operator key, no consent) the guardian lost the only way
to the record's Coach data scope and its switch. For a managed record
the entry follows the module switch alone again.
The Playwright project list still named the deleted onboarding AI
offer spec. The CoachPlan comments said the review writes
`outcomeEncrypted` and surfaces it behind a flag; nothing writes or
reads it now, and the column is marked internal. Comments that named
`resolveProvider` as the resolver now name the chain, and the function
itself says it is test-only.
The fixtures added with these fixes switched the type checker off with
`as never`, which the realism ratchet refuses to see grow. They now carry
their types, three webhook mocks needed no cast at all, and the lowered
counts, with the targets route's one fewer version stamp, are written
back.
The child-band change left the classification dividing by the record's
height where it had checked the adult-band height, which the type checker
refused. Both now read the same value.
Since a codeless refusal reads by its status, three answers lost their
meaning. A failed ChatGPT sign-in poll said "Error saving" instead of
asking to start the sign-in again; it now falls back to the sign-in's
own failure sentence. A dose-history import still running when the
card stopped watching said "Nothing was written" although the job may
still write; that case now has its own sentence. Setting up an
authenticator while one is active answered "setup failed"; the route
now sends `auth.mfa.already_active`, which says to disable the active
one first, in every locale.
The plan review rule told the Coach to read how a plan went from its
progress line, but a progress line exists only for an active plan, and
the review sets the plan to reviewed the morning its reminder surfaces.
For the plan being discussed there was nothing to read, so the model
could make a result up. The rule now reads a result only from a
progress line the snapshot carries, and otherwise asks how it went.
The notification categories' contract description, which lands in the
published API document, and a handful of new code comments and test
titles used em dashes; the house style keeps them out of new prose.
The three deletes gained an Undo toast that calls the restore route,
but the destructive-control registry still listed them as tombstoned
with no restore, with comments saying they would become restorable the
day a surface offered the undo. The correlation card test's header
still described the disabled "Coming soon" action it no longer tests.
The done screen's "AI is optional" line is a sentence the person reads,
set in muted text, which the UI standards keep for meta. It is body
text now. Its test asserted the absence of strings deleted from every
bundle in the same change, so it could not fail; it now checks that the
line is not muted, that the screen links to the AI settings once, and
that no button sits beside the link.
The form read every 409 as "a metric with this name already exists".
Now that it keeps one idempotency key across taps, a second tap while
the first create is still running also answers 409, and the form told
the person their name was taken. The create and rename routes send
`customMetric.name_taken` with the clash, and the form matches the code.
The vault picker and the Coach's attachment picker each wrote their own
"showing the newest 50" line, which the UI standards leave to
`ListCapNotice`, and with a search running past fifty matches the line
still said "Search to find an older document". Both pickers now share
`DocumentPickerCapNotice` on `ListCapNotice`, which takes the sentence
to show, and a running search asks for a narrower one.
Marc-André Bombeck