fix(relay): use current APNs registration routing for queued jobs

[juliusmarminge]

A queued APNs job can retain a valid token after registration changes its bundle ID or APNs environment. Sending old routing metadata can produce a permanent APNs rejection and invalidate the current token.

Use the current registration's routing after validating the queued token. This handles both stale routing snapshots and older jobs that omit routing metadata. It follows up the review of merged #10849.

Validation: all 49 APNs delivery tests pass, including both delivery kinds with changed bundles, changed APNs environments, and omitted legacy fields. Tests assert the actual HTTP host and topic. Relay typecheck and targeted lint pass. Queue routing changes have no visual layout changes.

Implemented with GPT-6 in Codex.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 4816bbd3-9bcf-4858-9ae8-3a476b7810ff

📥 Commits

Reviewing files that changed from the base of the PR and between 4743626 and dc9d4e6.

📒 Files selected for processing (2)

• infra/relay/src/agentActivity/ApnsDeliveries.test.ts
• infra/relay/src/agentActivity/ApnsDeliveries.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

APNs signed delivery jobs now use the device’s current bundle ID and APS environment when the delivery token still matches. Tests cover Live Activity, push-notification, and legacy jobs without signed routing metadata.

Changes

APNs routing validation

Layer / File(s)	Summary
Signed target revalidation and delivery routing infra/relay/src/agentActivity/ApnsDeliveries.ts, infra/relay/src/agentActivity/ApnsDeliveries.test.ts	Signed Live Activity and push-notification jobs no longer become stale when only bundle ID or APS environment metadata changes. Delivery uses the current registration for the APNs endpoint and topic. Tests cover current routing metadata and legacy jobs without signed metadata.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to dc9d4

Token-matching APNs jobs now route using the device’s current bundle and environment metadata, with coverage for Live Activity, notification, and legacy jobs. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: using the current APNs registration routing for queued jobs.
Description check	✅ Passed	The description explains what changed, why it was needed, how it was validated, and that there are no UI changes. It does not use the template headings or include the checklist, but the required infor…

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch notification-core/apns-registration-followup

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at dc9d4e6

Macroscope's review found this PR approvable — The change is narrowly scoped to correcting APNs bundle and environment routing for queued deliveries while preserving existing token and freshness checks. Targeted tests cover both delivery types and legacy or changed registration metadata.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+12 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+9 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.1 KiB	57.1 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	0 B (0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.0 KiB	−11 B (−0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+11 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.8 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 3e6f856 · PR result: dc9d4e6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.