fix(t099): notification & transport reliability

[duongdev]

Closes the notification + transport reliability cluster from the deep review (t099). Four P1 "notifications silently stop" fixes on the phone, plus the server/client hardening P2s. One PR, four commit boundaries.

What & why

C1 — push recovery (fix(push)): the foreground re-validate was a dead // TODO and the SW-message listener was bound to the wrong target (dead on every platform) — so t095's headline recovery never actually ran. Now the visibility gate re-validates for real, the listener is on the container, and boot reconciles the deviceId by push endpoint (which survives a localStorage wipe) before reading device-keyed ui-state, so mutes/master/toggle stop silently pointing at an orphaned id. Intent = the durable server flag. Endpoint rotation now re-binds a client-asserted deviceId instead of orphaning per-device prefs.

C2 — Slack capture continuity (fix(slack), ADR-0016): the sweep watermark was memory-only, so every deploy/restart re-seeded from "now" and silently dropped the downtime window. Now {watermark, seeded} persists to slack-sweep-state.json (debounced atomic write + SIGTERM flush) and resumes on boot. Stale creds self-heal: markCredsStale re-extracts over the live side-channel socket; if still stuck, it closes the keeper-owned parked tab for a fresh token — never a user pin (t098).

C3 — server hardening (fix(server)): WS heartbeat + bufferedAmount backpressure so a suspended iPad can't buffer frames unbounded (or pace every viewer to ~1fps); all JSON persistence is atomic write-temp-rename; a malformed/undecryptable POST body is now a 400 (not a masked {} that could wipe pins/config) + config/pins shape guards; the 15s sweep backstop is single-flighted so a 429 sleep can't stack duplicate sweeps.

C4 — client resilience (fix(client)): the reconnect driver no longer wedges on a rejected /api/connect; one throwing listener or failed E2E decode no longer poisons the whole downlink chain; a foreground wake-resync probe kills the "frozen frame labelled Connected" bug after a suspend; the resize reissue preserves the quality tier + t054 rate ceiling instead of hardcoding quality 80; and the health endpoint routes through the E2E crypto bridge.

Verification (AFK-green)

• pnpm test 993 · pnpm test:e2e 47 · pnpm typecheck clean · pnpm build clean · node --check both backends · check:changed exit 0.
• New pure modules TDD'd; e2e keystones cover endpoint-rotation recovery + body validation. Reconnect-retry + backpressure are unit-covered (harness is HTTP-only). Full details + the non-blocking device checklist are in docs/tasks/done/099-*.md.

Needs a real device before merge (non-blocking)

Lock-screen push arrival, badge count, revoked-sub self-heal on foreground, Slack token-rotation recovery, suspend/resume shows a live frame. Checklist in the task file.

[dokploy-2026-03-01-6ei3s7]

Dokploy Preview Deployment

Name	Status	Preview	Updated (UTC)
cdp-browser-app	✅ Done	Preview URL	2026-07-07T08:56:26.796Z