chore: Fix app

agents-docs/features/message-integrity.md

@@ -1,6 +1,14 @@
 # Message Integrity
 
-Signed, append-only **message revisions** give P2P chat a verifiable history without central message storage. The materialized `Message` row in local SQLite/IDB is a cache; peers converge via inventory snapshots and revision events.
+> **Area:** messaging
+> **Status:** Active
+> **Last updated:** 2026-07-05
+
+## Overview
+
+Signed, append-only **message revisions** give P2P chat a verifiable history without central message storage. The materialized `Message` row in local SQLite/IDB is a cache; peers converge via inventory snapshots (`revision`, `headHash`) and `message-revision` events.
+
+Parent transport and sync context: [messaging.md](messaging.md).
 
 ## Responsibilities
 
@@ -15,7 +23,7 @@ Signed, append-only **message revisions** give P2P chat a verifiable history wit
 | --- | --- |
 | Product client (`toju-app`) | Revision construction, merge, verification, P2P broadcast, local persistence |
 | Signaling server (`server`) | `PUT /api/users/me/signing-key`, `GET /api/users/:id/signing-public-key` — key directory only, no message storage |
-| Electron / mobile persistence | `revision` + `headHash` on message rows; revision audit log (IDB store / SQLite meta) |
+| Electron / mobile persistence | `revision` + `headHash` on message rows; revision audit log in IDB store (browser), SQLite `meta` table (Electron **and Capacitor** — keys `message-revision:<messageId>:<revision>`) |
 
 Plugin API messages may emit unsigned revisions (`plugin-edit` / `plugin-delete`) when the actor is a synthetic plugin user.
 
@@ -47,7 +55,23 @@ Plugin API messages may emit unsigned revisions (`plugin-edit` / `plugin-delete`
 | `PUT` | `/api/users/me/signing-key` | Bearer | `{ publicKeyJwk }` — stores Ed25519 public JWK on the user row |
 | `GET` | `/api/users/:id/signing-public-key` | Public | `{ publicKeyJwk }` — used by peers to verify signatures |
 
-Registration runs automatically after login/register via `AuthenticationService`.
+Registration runs automatically after **home** login/register via `AuthenticationService` — see [authentication.md](authentication.md) for foreign-server scope.
+
+## Multi-device relay (`account_sync`)
+
+`message-revision` chat events are relayable to sibling connections via WebSocket `account_sync` (alongside legacy `chat-message` paths documented in [authentication.md](authentication.md)). Inventory convergence still prefers P2P data-channel sync when peers are connected.
+
+## Related
+
+- [authentication.md](authentication.md) — signing-key registration, `account_sync` chat batches
+- [signaling.md](signaling.md) — `account_sync` envelope
+- [mobile-capacitor.md](mobile-capacitor.md) — Capacitor `meta` revision keys
+
+## Changelog
+
+| Date | Change |
+|------|--------|
+| 2026-07-05 | Capacitor meta persistence; account_sync cross-ref; signing registration scope |
 
 ## Degraded-mode behavior