rdmsm4x-changelog-20260828-2043-tyrell-chat-recipient-receipts

Implemented a source-only Tyrell chat recipient-receipt milestone so a sender is shown Delivered only after every intended non-sender explicitly acknowledges receipt.

Scope

• Host: rdmsm4x
• Worktree: /Users/richh/dev/_worktrees/tyrell-chat-live-repair-20260828
• Branch: codex/tyrell-chat-live-repair-20260828
• Receipt milestone commit: 4dad30accce268a76381bbe842eca6ea2fe5ec0d
• Parent repair commit: 66fefc991191097c92b25aa5922e483fd9572c33
• No production daemon, canonical main, production SQLite database, remote service, or deployment state was modified.

Changed files

• Sources/TyrellCore/ChatModels.swift
• Sources/TyrellCore/ChatStore.swift
• Sources/TyrellCore/SQLiteStateStore+Chat.swift
• Sources/TyrellCore/ChatServerLogic.swift
• Sources/TyrellAppSupport/ChatTransport.swift
• Sources/TyrellAppSupport/ChatPresentation.swift
• Sources/tyrelld/ChatRoutes.swift
• Sources/tyrell-app/ChatViewModel.swift
• Sources/tyrell-app/FleetChatView.swift
• chat store/server/transport/presentation regression tests and .handoff/chat-live-repair-20260828.md.

What changed and why

• Added an additive chat_message_recipients schema table and migration version 3. Recipient rows are snapshotted at message append time and exclude the sender.
• Added authenticated receipt and sender-only delivery-status routes. A recipient can mark only its own intended row as received; the sender cannot self-receipt. Persisting a message is master acceptance, not recipient delivery.
• Added swappable transport methods and app refresh behavior. The app posts receipts only for messages it received from someone else and refreshes outgoing recipient states from the server.
• UI reports Delivered only after receipt timestamps exist for every intended recipient. It leaves recipient state unknown when unavailable and does not synthesize offline/failed.
• Verified the domain #general channel remains opt-in per bootstrap caller, not domain-wide; no membership expansion was made in this change.

Verification

• swift test passed: 151 core tests, 65 integration tests, 45 AppSupport tests.
• swift build -c release passed in 45.71 seconds; warnings were pre-existing unrelated deprecation/concurrency warnings.
• git diff --check passed before commit.

Rollback and outstanding action

• Rollback is the isolated source commit once created; no live database rollback is needed because no production migration ran.
• Deploy matching tyrelld and Tyrell.app together before runtime use. The old daemon does not expose the receipt routes and its database has not received schema version 3.
• Apple Notes projection is pending: this session runs in a Background launchctl context, where the required Notes automation cannot safely execute. The durable file copy above is present.