Send message history when linking a device (GRYT-1574)

[sivert-io]

GRYT-1574. Build item 9 in docs/pairing-design.md on crypto main. It builds on #28's addOwnDevice and groupPositions and #29's pairing client.

What happens now

A (approving):

• At Approve it notes every group's cursor with groupPositions, then walks the archive through HistoryArchive. That's per conversation, a page at a time, merged newest UTC day first across servers.
• Each day goes through planHistoryChunks, sealHistoryChunk, and a PUT to the relay. A chunk only gets listed once it's uploaded.
• The envelope's history carries the key and the manifest of what's up after at most 5 seconds (or 10 seconds before the approval deadline). Anything after that goes in sealed {t: "history", chunks: [{n, ...entry}], total, final} messages, 180 entries each.
• After the adds comes the tail: every noted message with a seq past the snapshot, and before the add or in an older epoch. Then 60 seconds for late old-epoch ones, and a last message with final.
• A doesn't close the session at the end, because closing deletes the chunks. N closes it.

N (new device):

• Starts fetching as soon as it has written the envelope, newest chunk first, and keeps going as more pages arrive.
• Runs openHistoryChunk against each entry. A chunk that fails is refused, one the relay lost is missing, and both are counted. Neither stops the rest.
• Hands each message to HistorySink once, keyed by scope, conversation and message id.

Both sides get history and subscribeHistory for progress (messages, total, chunks, missing, refused, truncated, complete). Cancel works as before, at any point.

API changes the apps will see

• OwnDeviceAdder needs groupPositions now. MlsDmDriver already has it, so passing the driver works.
• New options: history on both sides, lateWindowMs on A.
• New noteMessage on A. The app calls it for every MLS message it archives while a pairing runs, sent or received, with its seq and epoch. Without it the tail is empty.
• New phase sending on A, and new end reason history_failed on N for when the sink throws.

Relay
auth#45 has no chunk endpoints. The design has them as auth step 4. I built against the shape in the design, with a fake: PUT/GET/DELETE /sessions/:id/chunks/:n, sealed bytes as base64url in {body}. I picked JSON over raw bytes because React Native's fetch is patchy with binary bodies. That's GRYT-1591 now.

Limits
The relay allows 64 messages a session for both sides together. N uses four and the envelope one. So A lists at most 400 + 40 × 180 = 7,600 snapshot chunks, and stops at 248 MiB. Past either, the oldest stay behind and truncated says so.

Least sure about

• The late window is 60 seconds. The design says "as long as MLS keeps the old epoch's keys", and I didn't find a number for that.
• The five-second budget before the envelope. A long history won't fit in it, so most of it goes in later messages, and N waits for the first page until after ready.
• A broken archive read before the envelope fails the whole pairing as relay_error. It could link without history instead.
• An N on core 0.15 paired with an A on this waits in linked for up to an hour, since A no longer closes the session. Both apps take the same core release, so this shouldn't come up.

Not in this PR

• Carrying on after either app restarts within the hour: GRYT-1592.
• The relay's chunk endpoints: GRYT-1591.

Tests (src/pairing/history.test.ts, fake relay and fake clock)

• 5,000 messages in three conversations on two servers over about 600 days. Every message arrives once, batches arrive newest first, and there are more than 400 chunks, so the pages get used.
• A chunk changed on the relay is refused and the rest still arrive.
• A chunk the relay lost is reported as missing.
• The tail: messages land at Approve, during the add, and after it in both the old and the new epoch. No gaps, no repeats, and nothing N reads itself.
• N with no sink finishes on A's last message.
• N cancelling partway ends A with cancelled_by_other.

I checked the tail and ordering tests fail when the tail, the dedupe, the epoch check or the newest-first pick is broken.

Normal review: nothing here is in a review-required path.

🤖 Generated with Claude Code