Push taps route to the current connection, even when the notification came from another saved server

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

Blocked-by: objectstack-ai/objectstack#29642

Filing category ①. This is a user-visible defect with a named producer. It becomes reachable once saved connections (#152, PR #173) land.

The defect

hooks/usePushRouting.ts takes a notification's route (routeFromPushData) and opens it on the current connection's Console. It never checks which server sent the notification.

With several saved servers, every server registers the same device token. When a user taps a notification from server B while server A is current, B's route opens on A's Console. The page is wrong, and the record may even exist on A.

reach: named producer, hooks/usePushRouting.ts (route taken without a server check). PR #173 documents it as a Known limit and lists it in its Acceptance notes.

Ask

Route a tap to the connection that sent it:
- The notification needs to identify its server. Check what the platform push payload carries today (objectstack push channel contract, feat(spec): push channel protocol face — device registration widening, stored device shape, device contract members, push route, APNs/FCM config by credentialRef objectstack#29218), and whether a host or origin is available.
- If it is, switch to that saved connection (the switch path from Saved connections and the native "切换组织" switcher (organizations and company servers) #152), then open the route.
- If the sender is no longer a saved connection, do not open the route on another host. Show the app, and drop the route.
If the payload carries no server identity, stop and report. The platform side would be its own objectstack card, filed by the seat.

Who acts

The repo:mobile seat dispatches it after #152 lands.

Duplicate check (2026-11-02)

The open and closed mobile cards were read in full (seat enumeration): no card on push routing per connection.

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

Unblocked: Blocked-by #152 merged (678fbe9).

Claim: PM loop round 1
Session: session_01QSeKYnW1Xf6HDSWz1eGAqv
Account: os-justin
Branch: claude/issue-174-push-per-connection
Worktree: mobile-issue-174
Domain: n/a — single-lane repo (repo:mobile)
Seat: repo:mobile#1
File surface: hooks/usePushRouting.ts, lib/push-notifications.ts, app/console.tsx (switch before routing), lib/connections/** (lookup by host only), __tests__/**, docs/HYBRID-SHELL.md, docs/PUSH-NOTIFICATIONS.md, .changeset/174-push-per-connection.md (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default tier (opus) — dispatch-gates --tier --repo objectstack-ai/mobile: no path-derived mandate, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds. usePushRouting(serverUrl, …) at hooks/usePushRouting.ts:29 routes on the current connection with no server check.
Serial constraints cleared: #157 may touch lib/connections/** (ordinary concurrency). #155 may touch app/console.tsx (excursion bar host): the PR that lands second reconciles.

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv
os-dev-report

{
  "issue": 174,
  "status": "blocked",
  "branch": "claude/issue-174-push-per-connection",
  "pr": null,
  "session": "session_01QSeKYnW1Xf6HDSWz1eGAqv",
  "premise_still_valid": false,
  "summary": "Stopped on the card's own stop condition: the platform push payload carries no server identity, so no PR. The mobile defect itself is real (hooks/usePushRouting.ts:29 routes every tap on the current serverUrl), but there is nothing in the payload to route by. Measured on objectstack origin/main aca58cdb: no push channel exists (service-messaging/src has email, inbox, sms and http/webhook channels only; channel.ts:7 names APNs/FCM in prose), and packages/spec/src/api/push-delivery.zod.ts is ABSENT (control leg: packages/spec/src/system/email-config.zod.ts present on the same ref). The only push payload contract is in objectstack-ai/objectstack#29218, an open draft PR (head aff751de, spec slice of objectstack-ai/objectstack#29067 / objectstack-ai/objectstack#29041): push-delivery.zod.ts:90-99 PushDeliveryDataSchema = z.object with exactly two keys, notificationId (line 91, required) and route (line 92, optional, PushRouteSchema lines 72-85 = same-server relative path only). No host, origin, server URL or tenant key; ADR-0012 line 426 gives the push renderer output as title, body, data, sound, badge with no identity either. APNs and FCM tell the app nothing about the sender, and every saved server registers the same device token, so the shell cannot derive the sender locally; per the ruling no route-shape heuristic was attempted. The platform side is a new objectstack card for the seat to file (options in open_questions); the cheapest moment is before objectstack-ai/objectstack#29218 merges. Branch was pushed empty as the probe (push succeeded, no 403) and carries no commits; worktree removed.",
  "tests": "none run: no code written (stop condition). Evidence reads only: git show origin/main and git cat-file -e on objectstack (shallow checkout; absent-file reading paired with a present control file on the same ref), git show aff751de:packages/spec/src/api/push-delivery.zod.ts, REST reads of objectstack PR 29218 and issues 29041, 29067, 29068.",
  "gates": "NOT MEASURED: tsc, eslint, jest, reason: no diff (stop condition, no PR). pnpm install in the worktree exit 0 (it was started backgrounded with an ampersand, a deviation from the foreground rule; it finished before any later step).",
  "dogfood_battery": "n/a: no PR",
  "mcp_calls": "0",
  "api_writes": "1: POST repos/objectstack-ai/mobile/issues/174/comments (this report, via post-stamped.mjs); git push of the empty branch is not a REST write",
  "open_questions": [
    {
      "question": "How should a push name the server that sent it, so the shell can match it against saved connections by host (lib/connections/model.ts normalizes to host[:port])? This is a public contract name in packages/spec, so it is the spec seat's and maintainer's call, filed as an objectstack card by the mobile seat.",
      "options": [
        "A: the push channel adds a server-origin key to PushDeliveryDataSchema from the server's configured public URL. Cost: one optional key in objectstack-ai/objectstack#29218 plus one line in the objectstack-ai/objectstack#29041 channel; a server reachable under several hostnames or behind a rewriting proxy emits an origin the shell did not save, so the tap is dropped (safe, but the feature silently fails for those deployments).",
        "B: the Console sends the origin it was loaded from (window.location.origin, the host the shell saved) in RegisterDeviceRequest, the server stores it on the UserDevice row, and the push channel echoes that row's value into the push data. Cost: one optional member each on RegisterDeviceRequestSchema, UserDeviceSchema and PushDeliveryDataSchema, all in objectstack-ai/objectstack#29218 before merge, plus the Console bridge registration call; matches exactly the host the shell knows, independent of proxy config.",
        "C: no platform change; the shell keeps routing on the current connection and documents the limit. Cost: zero; the card's defect stays."
      ],
      "recommendation": "B, because it echoes the exact host the shell saved for that device row, so matching needs no knowledge of the server's public URL, and all three members are widenings that fit inside objectstack-ai/objectstack#29218 before it merges (one PR instead of a second widening later). Then mobile #174 resumes with a host lookup and the #152 switch path."
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: objectstack-ai/objectstack#29041 · noted, not filed: the planned contract (objectstack-ai/objectstack#29218 push-delivery.zod.ts:35-48) says the shell never opens route verbatim and resolves app-relative values like /opportunity/123 through resolveNotificationTarget, while mobile lib/push-notifications.ts routeFromPushData opens route verbatim after safeConsoleRoute and docs/PUSH-NOTIFICATIONS.md documents a url key the planned contract does not carry. Observation only: the contract is unmerged and no producer exists. Dedupe words: push route resolve, actionUrl app-relative, routeFromPushData verbatim, push payload url key"
  ]
}

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

Release: claim 6581414167 (session session_01QSeKYnW1Xf6HDSWz1eGAqv, branch claude/issue-174-push-per-connection, which has no commits).

The premise is falsified, the card's own stop condition. The dev's report is comment 6581547684, re-checked by the seat:

PushDeliveryDataSchema (feat(spec): push channel protocol face — device registration widening, stored device shape, device contract members, push route, APNs/FCM config by credentialRef objectstack#29218 head aff751de, push-delivery.zod.ts:90-99) carries only notificationId and route.
The file is absent on objectstack main.

The platform decision is filed as objectstack-ai/objectstack#29642 (recommendation B: round-trip the Console's loaded origin through device registration).

State: pm:dispatched → pm:blocked, assignee cleared. Resume from the existing branch once #29642 is ruled and its contract change is installable from a platform release.

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

Unblocked: Blocked-by objectstack-ai/objectstack#29642 closed as completed. Its ruling B is on objectstack main (c9246279a5) in all three places:

Spec: RegisterDeviceRequestSchema, UserDeviceSchema and PushDeliveryDataSchema each carry an optional origin (PR feat(spec): push delivery data names the server that sent it — RegisterDeviceRequest, UserDevice and PushDeliveryData gain an optional origin objectstack#29767).
Server: notifications: store the push device's origin on sys_user_device and copy it into push data (ruling B on #29642, server half) objectstack#29768 stores it on the device row and copies it into push data (PR feat(messaging): store a push device's origin at registration and carry it in every push to the device objectstack#30705).
Console: ui/apps/console/src/nativePushRegistration.ts sends window.location.origin on registration.

The shell reads wire data, not an installed package, so the cross-repo unlock is the merged contract. Deployments that run an older server send no origin, and the dispatch order covers that case.

Claim: PM loop round 4
Session: session_01QSeKYnW1Xf6HDSWz1eGAqv
Account: os-justin
Branch: claude/issue-174-push-per-connection
Worktree: mobile-issue-174
Domain: n/a — single-lane repo (repo:mobile)
Seat: repo:mobile#1
File surface: hooks/usePushRouting.ts, lib/push-notifications.ts, app/console.tsx (switch before routing), lib/connections/** (lookup by origin only), stores/server-store.ts (only if the lookup needs it), __tests__/**, docs/HYBRID-SHELL.md, docs/PUSH-NOTIFICATIONS.md, .changeset/174-push-per-connection.md (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: default tier (opus) — no path-derived mandate, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: hooks/usePushRouting.ts routes every tap on the current connection | no platform path covers it; the platform now names the sender in push data | every user with two or more saved connections who taps a push
Thread-read: 6591322674
Premise: holds. On main at 8e4235f, usePushRouting(serverUrl, onRoute) resolves every tap with routeFromResponse(response, serverUrl) on the current connection and reads no sender.
Serial constraints cleared: none. #186 is dispatched in the same round with a disjoint file surface. The branch from round 1 has no commits, so there is no Resume-from. Landing: the maintainer merges, because seat landing is suspended (see #160).

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv
os-dev-report

{
  "issue": 174,
  "status": "done",
  "branch": "claude/issue-174-push-per-connection",
  "pr": "https://github.com/objectstack-ai/mobile/pull/192",
  "session": "session_01QSeKYnW1Xf6HDSWz1eGAqv",
  "premise_still_valid": true,
  "summary": "A tapped push now opens on the saved connection whose origin equals the push data's origin, compared byte for byte (lib/connections/model.ts connectionByOrigin over originOf(serverUrl); the stored form keeps the scheme, so the PM assumption holds). lib/push-notifications.ts pushTapTarget applies the four ruled tap rules plus the MDM lock: only lockedHost is open to a tap, and while the managed address is pending every tap drops. hooks/usePushRouting.ts holds each tap until the connections are loaded and the app lock is open, then switches with the store's select, checks the switch stuck, and only then routes. Real seam, measured: the hook is mounted in app/_layout.tsx, which is outside the claim surface and changed by 2 lines at the call site. app/console.tsx needed no change, because switch-then-route already delivers the route to the new document (held until ready); a ConsoleScreen pin and a reversed-order control prove it. Judgement call on the app lock: before this change a tap navigated under the overlay at once, and the switcher is refused while locked. A push switch now waits for unlock like the switcher does, and the rule-1 route waits with it. Deviation: my first commit carried a model-named trailer I wrote myself. I amended it to the model-free pair and pushed with --force-with-lease pinned to the sha I had last pushed, before any PR existed, with all five objectstack AGENTS.md section-3 conditions met.",
  "tests": "Head f5f9a36. npx jest --ci --coverage: Test Suites 49/49, Tests 1092/1092, exit 0. Cold: npx jest --ci --no-cache __tests__/components/ConsoleScreen.test.tsx: 20/20 in 8.2 s, exit 0. New or rewritten: usePushRouting.test.ts has 14 hook cases (rules 1-4, url key on the sender's Console, no route means no switch, MDM drop, app-lock hold then switch on unlock, latest held tap wins, waits for load, cold start through lock and switch routed once, cold start from a removed server opens nothing); push-notifications.test.ts covers pushSenderFromResponse and pushTapTarget (byte-for-byte refusals, lock, pending lock); model.test.ts covers connectionByOrigin and the stored round trip; ConsoleScreen.test.tsx adds 2 switch-order pins. Ablation via objectstack scripts/ablation-replace.mjs (mutation landed with anchor 1 to 0 and the blob changed; restore proven with blob equal to HEAD and git diff HEAD empty): (1) origin match made to answer the first saved connection for any string origin: 15 failed / 70 passed, red were connectionByOrigin x3, pushTapTarget x4, and hook rule 2, rule 2 url, rule 3, MDM lock, app-lock hold, waits-for-load and both cold-start cases. (2) app-lock guard removed: 2 failed / 14 passed (app-lock hold, cold start). (3) control with the ConsoleScreen pin's order reversed: the case goes red, with the navigate script gated to https://erp.example.com (the old document). No build/dist step exists here: jest transforms source.",
  "gates": "Local, head f5f9a36, exit codes captured before any pipe (scratchpad issue-174/exit-codes.txt): npx tsc --noEmit exit 0; npx eslint . --ext .ts,.tsx exit 0; npx jest --ci --coverage exit 0; cold ConsoleScreen exit 0. These are the full CI set of this repo (lint-typecheck.yml: tsc + eslint; ci.yml: jest --ci --coverage), derived by hand from .github/workflows because mobile has no dispatch-gates.mjs. PR check-runs at f5f9a36 when reported: Lint & Type Check in_progress, Code Quality in_progress.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — POST repos/objectstack-ai/mobile/pulls (relay pr_create, draft, no labels or assignees; run 42733291023; read-back 8362 bytes sent and stored, identical) and POST repos/objectstack-ai/mobile/issues/174/comments (this report, post-stamped.mjs). git push, including one --force-with-lease before the PR, is not a REST write.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: docs/PUSH-NOTIFICATIONS.md Prerequisites still says the server device registry and push channel were never built; objectstack-ai/objectstack#29041 is closed as completed. This is doc drift, not a filing class, and it is in the PR's Acceptance notes.",
    "carrier: objectstack-ai/objectstack#29750 · noted, not filed: the round-1 observation (the shell opens route verbatim while the contract says app-relative routes are resolved) is answered on the Console side. On objectstack origin/main, ui/apps/console/src/App.tsx hosts the shell's route through nativeShellRouteTarget, so the mobile verbatim hand-off is not a defect."
  ]
}

repo:mobile#1 · os-justin · session_01QSeKYnW1Xf6HDSWz1eGAqv

ACCEPT → PR #192 (head f5f9a36), seat record on the PR. Seat landing is suspended, so the maintainer merges; Fixes #174 closes this card on merge.

Navigation Menu

Repository navigation

Push taps route to the current connection, even when the notification came from another saved server #174

The defect

Ask

Who acts

Duplicate check (2026-11-02)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Push taps route to the current connection, even when the notification came from another saved server #174

Description

The defect

Ask

Who acts

Duplicate check (2026-11-02)

Activity

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 10, 2026

objectstack-fleet commented on Nov 10, 2026

objectstack-fleet commented on Nov 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions