Private-message history

Name: History recovery Purpose: Let approved devices read older originals using retained encrypted access from eligible devices. Scenario: A newly approved device visits Messages, validates a donor transfer and the original signature, and can still read after a reload. Private keys and plaintext stay browser-side. Sources: service (source unavailable), browser crypto (source unavailable), operations and API.

Name: Sender assistance Purpose: Let original senders contribute access to their outgoing messages for approved recipient keys. Scenario: A sender visits an ordinary page and supplies encrypted access; subsequent combined checks omit that donor's retained contribution without consulting recipient read or recovery receipts. Another donor and explicit legacy repair remain possible. Sources: service (source unavailable), contribution store (source unavailable).

Name: Messaging history eligibility Purpose: Avoid dedicated background history synchronization for accounts with no messages. Scenario: An unused account browses quietly. Its first send or receipt changes the next unread response and enables synchronization on ordinary refresh, including on a new device. Eligibility is derived account history, not membership or a browser-local usage marker. Sources: message store (source unavailable), coordinator (source unavailable).

Name: Unread status Purpose: Report unread conversations and supply account history eligibility through the existing authenticated status request. Scenario: Navigation and conversation lists refresh the same unread state; the coordinator shares validated identity-bound eligibility with history sync without adding another discovery request. Unread/read semantics and existing retry controls are retained. Sources: unread coordinator (source unavailable), read state (source unavailable).

Name: Private foreground key activity Purpose: Help recently used same-account devices receive recovery material promptly without starving older devices. Scenario: Approved sign-in or foreground unread refresh records private coalesced activity. Three recent-target selections alternate with a stable-order fairness selection; background sync and recipient activity never promote a sender's targets. Sources: activity and schedule store (source unavailable), scheduler (source unavailable).

Name: Bounded history continuation Purpose: Finish useful recovery during an ordinary visible visit, then stop repeated work. Scenario: Ten-original, sixteen-attempt background turns yield between batches and honor admission delays. Foreground readers take priority between turns. Settled revision-aware passes use one small response; new relevant data reopens recovery. A recorded submitting key is a verification hint, not proof of the original encrypted signer; bounded fallback preserves other approved signers and existing send acceptance. Sources: coordinator (source unavailable), service (source unavailable), acceptance.