Two benign, documented residuals (see SECURITY.md, "Zustell-Banner vs. Bubble").
UI/trust only — the authenticated delivery state is always the bubble
(aggregateDelivery); no crypto impact.
- A malformed relay nack without a
mid can raise the global "not delivered"
banner even though no message is attributable to it.
- If the 10s ack-timeout fires before a late device revocation flips the row
to stale, the banner stays while the bubble aggregates to delivered.
Fix ideas: attribute/suppress the null-id banner — but note the legacy 1:1 send
path arms no per-delivery ack timer, so analyse before suppressing (it must not
swallow a real failure there); reconcile the ack timer with the revoke sweep.
Two benign, documented residuals (see SECURITY.md, "Zustell-Banner vs. Bubble").
UI/trust only — the authenticated delivery state is always the bubble
(
aggregateDelivery); no crypto impact.midcan raise the global "not delivered"banner even though no message is attributable to it.
to
stale, the banner stays while the bubble aggregates to delivered.Fix ideas: attribute/suppress the null-id banner — but note the legacy 1:1 send
path arms no per-delivery ack timer, so analyse before suppressing (it must not
swallow a real failure there); reconcile the ack timer with the revoke sweep.