Browse documentation
Messages, retries & private notes
Understand exactly what accepted, fetched and displayed mean.
One request identity
Persist an idempotency key and the complete attempted payload before the first send. Both tested API profiles authorize the target, check its fingerprint, reserve thread activity, write the message and durable effect record in a transaction. If the response is lost after commit, retry the same payload and key. Changed content under that key conflicts rather than overwriting.
Public and private timelines
Customer-visible messages have consecutive publicSequence values. Private notes have no public sequence and are excluded from SDK history and customer stream hints. Export and notification implementations still need their own leakage checks before those features ship.
A new customer message during drafting
An ordinary reply is saved once and leaves Needs reply if the operator missed a newer customer message. Send and resolve requires the expected current revision; a stale request saves neither operation. Keep the draft and review the new message.
Foreground unread and host events
Forward your existing scene state with support.setApplicationActive after resolving host account ownership. refreshInForeground is also available for an explicit count-only check: it restores an existing session, never registers a new customer, and does not fetch messages or advance read/display cursors. unreadLastUpdatedAt being nil means no authoritative count has been observed yet. Active, closed-Help updates stop in the background; the host keeps app-icon badge ownership. support.onEvent reports typed visibility, accepted-send, fetch/display, identity, profile and action outcomes with opaque IDs/status, without message bodies, metadata values or secrets.
Private photos
Photos appear only when your actual app configuration advertises private_photos_v1. The system picker supports up to five images. The native client applies orientation, bounds the edge to 2,048 pixels, removes source metadata and prepares JPEG or transparency-preserving PNG within 1 MiB each. After Send, protected pending bytes and exact request identities survive retry. The service validates and normalizes to bounded WebP; canonical attachments have no public URL. Thumbnails and the viewer fetch with the current support credential. A real hosted native picker/upload/download/viewer check and a separate actual 100%→150%→100% zoom check passed. This does not establish physical-device permissions or every account/failure path. A failed photo send retains its original payload; it never silently sends only the text.
Recovery and display
Foreground streams suggest a refresh; paginated HTTP history is authoritative. Reconnect and fetch missing public sequences. Actual hosted native reply rendering and a separate visible-message display acknowledgement have been observed. Display retries are bounded and stop when a reply leaves the active viewport; a stale acknowledgement does not erase newer unread replies. Missing historical request payloads are preserved with a recovery explanation instead of guessed retries. Push, physical-device delivery and another host build remain separate checks.