Bound NE inbox replay and continue acknowledged catch-up

[torlando-tech]

An accumulated durable event inbox can kill the Network Extension during startup: replay reads every pending row, then expands the entire batch across Python and Swift JSON representations. A captured 12,604-event backlog repeatedly exceeded the kernel's 50 MB limit before acknowledgment, leaving the same backlog to replay on every restart.

Bound each page to 128 events and 256 KiB of event JSON, then continue catch-up after acknowledgment until the inbox is empty. Failed acknowledgments retry after a delay, and generation checks prevent stopped workers from continuing or disturbing a restarted worker. Malformed or oversized rows retain their original payloads in SQLite quarantine and return small cursor-bearing markers so they cannot block the queue.

Validation:

• All 230 configured CI static tests and 5 discovery tests passed locally. Inbox regressions cover a 12,604-event backlog, byte limits including Unicode escaping, non-destructive replay, acknowledgment failure, and quarantine preservation; they now run in CI.
• 6 Swift regression tests passed on an iPhone, covering catch-up without notifications, failed acknowledgment retry, stopping during drain/acknowledgment, and an old acknowledgment completing while a restarted worker is blocked.
• Mutation check: disabling the drain-ownership guard makes the restart regression fail when a third drain starts while the replacement worker is blocked.
• Production build survived a 60-second cold-start device check with zero kernel memory-limit kills and a stable extension PID.
• Full overnight/background-delivery regression remains to be run.

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; the previous coverage gap is addressed and no new actionable issues were found.

Summary

The PR limits durable inbox replay to 128 events and 256 KiB per page. The app continues after successful acknowledgment and delays retries after failure.

• Inbox reads return pages capped by event count and JSON size.
• The app keeps fetching inbox pages until it catches up.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[App requests a page] --> B[Extension reads bounded inbox rows]
    B --> C{Page empty?}
    C -->|Yes| D[Catch-up ends]
    C -->|No| E[App emits events and acknowledges]
    E --> F{Acknowledgment succeeded?}
    F -->|Yes| G{Worker still current?}
    F -->|No| H[Wait before retry]
    H --> G
    G -->|Yes| A
    G -->|No| I[Old worker stops]

Loading

_{Reviews (2) · Last reviewed commit: "Cover restarted drain ownership and fix ..." · Reviewed by Greptile}