Preserve mobile chat drafts and bound delivery waits

[phucnguyen1707]

Dependency Integration

This branch now integrates the reviewed Next.js dependency fix from #104 through a merge retaining that commit as an ancestor. The combined tree passes the local production-critical audit and full pre-commit checks; the updated branch's remote CI must also pass before merge. The earlier failed audit belongs to the older head.

Next.js 16.3.3 addresses GHSA-p293-qw3h-jr36 and GHSA-2xp9-vwfh-vxw4. The former is Windows-specific; actual deployed exposure has not been assessed. Production audit now reports zero critical issues, but high/moderate/low and dev-tool advisories remain. No audit ignores or CI checks were relaxed, and this is not a clean-audit or production-safety claim.

Summary

• Preserve chat drafts after rejection or uncertain delivery without overwriting new typing. Provide explicit restore/discard controls for a saved draft and never auto-resend a timed-out POST.
• Bound chat transport waiting, including delayed authentication and response parsing; abort/ignore work from obsolete sessions and prevent rapid duplicate submissions.
• Pass safe errors into both host/viewer panels. Count only newly received unread messages after a successful initial history load and known user identity.

Verification

• 251 mobile tests passed, including actual panel/hook integration, delayed transport, room changes, draft recovery and unread regressions. Added abort-triggered fetch/body rejection and late-body hook-state checks; only history polling reconciles a committed message after a timed-out response.
• Mobile typecheck and lint passed.
• Repository pre-commit checks passed, including lint, types, format, tests, script tests and build. Unchanged packages reused Turbo cache; web build and 885 web tests also passed locally.
• Android and iOS JS/assets exports passed. The Android bundle verification confirmed a single React 18.3.1 runtime.
• Repeated 18 browser/HTTP checkpoints on the integrated dependency tree, with actual fetch and timers but DOM-native and Supabase adapters. Separately passed 11 input/method/security-header checks against the compiled Next production server in a loopback-only namespace.
• Cold web typecheck without .next or a prior typecheck cache, and generated Android screen-share configuration checks passed.
• Exact diff reviewed by Claude Opus before push.

Native Release Gate

These tests use controlled native/network boundaries, not a device or simulator. Before releasing, verify keyboard/layout, loss of connectivity during a send, draft restoration and leaving/rejoining a call on Android/iOS. Aborting or timing out a POST does not prove that the server rejected it; the UI explicitly warns that manual resending can duplicate delivery. This does not introduce server-side exactly-once delivery.

No EAS build, store submission, production configuration change or paid service was triggered. Existing media/signaling behavior is outside this chat-only change.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.9 ⏵ 16.3.3	-2	+75	+1

View full report