fix(chat-store): translate relay revoke targets to local identity

[jlucaso1]

A peer's sender revoke carries its own perspective of key.fromMe. Reading that bit as the local direction missed the peer's row and created an own-author tombstone. Resolve live relay target identity before the existing author-aware lookup, including admin revokes naming this account's PN/LID.

Refs #230. Base main 196b278, engine unchanged at 9e24e4c0.

• Sender revokes derive author/direction from the authenticated envelope.
• Peer admin revokes compare participants only against this account's normalized PN/LID. Own-envelope keys keep their separate translation branch.
• Existing author/direction collision guards remain unchanged. No schema migration or legacy-data repair. The proposed opposite-direction placeholder heuristic also matches a legitimate own-phone revoke plus an unrelated peer ID collision; a regression preserves that case.
• History materialization is unchanged. This PR does not claim its producers have the same nested-key perspective.

Validation on synthetic databases:

• Red on main: three regression failures, including ambiguous ID, wrong collision target, and own-account admin miss.
• Green: 330 chat-store tests passed, 4 ignored; final revoke matrix 5/5.
• fmt and chat-store Clippy, all targets/features with warnings denied, passed.
• Matrix includes peer DM/group, participant present, admin own PN/LID/device/third party, own phone, before/after target, duplicates, redelivery, close/reopen, and author/direction collisions. No authenticated WhatsApp execution or process-crash claim.

Protocol evidence: whatspec 1f5167c4cebf263edaf001e06a2497f213c55793, WA 2.3000.1047483476, schema 4.3.0; all 579 bundle hashes and setHash verified. WAWebE2EProtoUtils.translateKeyToLocalReference in bundle f1Q5yyJIapQ.js, SHA256 430cb8979511aada95178605faa35a8483446f677ce6d1fe0fd66333c7879eee, module offsets [442807,459798). Exact release asset.

Integration: independent of the writer retention and operation-ACK branches for #232/#231. The combined synthetic branch applies this PR, writer retention #235, and operation ACK correlation #236. Cross-branch validation is complete.

Final combined integration at 8f894e0: 365 chat-store tests passed, 4 ignored; fmt and chat-store Clippy all targets/features with warnings denied passed. This includes the after-send barrier cancellation fix, ACK pressure/rollback/cancellation cases, automatic SQLite lock recovery and the combined operation ACK × revoke identity test. Tests ran exclusively after clearing the package's shared artifacts. The session outgoing-admission test and session Clippy all targets/features also passed. Engine and Cargo.lock remain unchanged.

Final-head CI passed.

The user authorized preparing these PRs for merge and resolving their remaining checks on 2026-10-07. Merge, release, real-account execution and destructive migrations remain outside this step.

Resume validation on 2026-10-07: the final PR heads passed local formatting and Clippy checks. The combined synthetic worktree passed 366 chat-store tests and the complete native workspace passed 2035 tests, with 23 ignored and no failures; native workspace Clippy, WASM type checking and the workflow's WASM Clippy gate passed. This repeated the two integration tests from 8f894e0 and added ACK-before/after-registration, rollback, revoke collision and reopen coverage locally. No production-code changes, engine changes or Cargo.lock changes were needed. #236 remains stacked on #235; #234 is independent.

---

Summary by cubic

Fixes relayed revokes so a peer's sender revoke is resolved against the local account instead of the sender's fromMe perspective, which previously missed the peer's row and created an own-author tombstone.

• Sender revokes derive author and direction from the authenticated envelope; admin revokes match participants only against this account's normalized PN/LID.
• Own-envelope keys keep their separate translation branch; author/direction collision guards and history materialization are unchanged.
• No schema migration or legacy-data repair required.

Validation: synthetic matrix covers peer/group DMs, admin own PN/LID/device/third-party, duplicates, redelivery, close/reopen, and ID collisions; 330 chat-store tests pass, Clippy clean on all targets.

^{Written for commit 39a31ba. Summary will update on new commits.}

Review disposition (2026-10-07): the suggestion to restrict participant-less fromMe=false relay keys to direct chats was checked against WhatsApp Web 2.3000.1047483476 and not adopted. In WAWebE2EProtoUtils.translateKeyToLocalReference, the peer-envelope branch sets local fromMe=true when participant decoding yields no Wid, without a direct-chat guard. This PR preserves that behavior. Verified source: bundle release asset, f1Q5yyJIapQ.js, SHA-256 430cb8979511aada95178605faa35a8483446f677ce6d1fe0fd66333c7879eee, module byte range [442807,459797). No protocol change is needed for this finding.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0c582ec0-5afb-42c2-97c6-811c8d269c2f

📥 Commits

Reviewing files that changed from the base of the PR and between 196b278 and 39a31ba.

📒 Files selected for processing (5)

• crates/chat-store/src/materialize.rs
• crates/chat-store/src/store/inbound.rs
• crates/chat-store/tests/common/mod.rs
• crates/chat-store/tests/edits.rs
• crates/chat-store/tests/revoke_identity.rs

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T12:59:25.646304Z	39a31ba	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 39a31ba0ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".