TheZwiss/backspace — documented rules

**GET / PATCH /api/settings/instance** (routes/settings.ts, admin, the pair GeneralPanel uses) gain supportCardEnabled: the shared type InstanceAdminSettings gains the field, rowToAdminSettings maps it, and the PATCH accepts a boolean and otherwise answers sendError(reply, 400, 'field_not_boolean', { field: 'supportCardEnabled' }), the existing code the route uses for its other boolean fields.

429 with the shared error body ({ error, code: 'rate_limited', statusCode: 429 }, see [localization.md](localization.md)) plus retryAfter in whole seconds, and the plugin's own Retry-After header.

429 with the shared error body ({ error, code: 'rate_limited', statusCode: 429 }, see [localization.md](localization.md)) plus retryAfter in whole seconds, and the plugin's own Retry-After header.

429 with the shared error body ({ error, code: 'rate_limited', statusCode: 429 }, see [localization.md](localization.md)) plus retryAfter in whole seconds, and the plugin's own Retry-After header.

Space.directoryListed is carried on every space response and in the WebSocket ready payload.

The target is named one of two ways (SendFriendRequest in packages/shared/src/types.ts):

instanceId (InstanceInfoResponse.instanceId, string) is this instance's persistent **epoch** — the incarnation UUID minted once by ensureDefaults and stable across restarts (see database.md → Instance Settings).

InstanceStreamingLimits.directoryEnabled is also carried on GET /settings/streaming, read-only there, so a non-admin's space settings can tell whether the instance allows listing.

TelemetryStatus is { enabled: boolean | null, id: string | null, lastDay: string | null, lastError: { day, status } | null, askDue: boolean }, where enabled: null means the instance was never asked and askDue says whether the admin should see the ask now (always while never answered, never after a yes, and after a no again from the next minor release on; telemetry.md §7).

TelemetryStatus is { enabled: boolean | null, id: string | null, lastDay: string | null, lastError: { day, status } | null, askDue: boolean }, where enabled: null means the instance was never asked and askDue says whether the admin should see the ask now (always while never answered, never after a yes, and after a no again from the next minor release on; telemetry.md §7).

TelemetryStatus is { enabled: boolean | null, id: string | null, lastDay: string | null, lastError: { day, status } | null, askDue: boolean }, where enabled: null means the instance was never asked and askDue says whether the admin should see the ask now (always while never answered, never after a yes, and after a no again from the next minor release on; telemetry.md §7).

TelemetryStatus is { enabled: boolean | null, id: string | null, lastDay: string | null, lastError: { day, status } | null, askDue: boolean }, where enabled: null means the instance was never asked and askDue says whether the admin should see the ask now (always while never answered, never after a yes, and after a no again from the next minor release on; telemetry.md §7).

TelemetryStatus is { enabled: boolean | null, id: string | null, lastDay: string | null, lastError: { day, status } | null, askDue: boolean }, where enabled: null means the instance was never asked and askDue says whether the admin should see the ask now (always while never answered, never after a yes, and after a no again from the next minor release on; telemetry.md §7).

**FederationRelayRequest.sourceInstanceId** stamps the sender's current epoch on every relay;

**needsAttentionReason** ('auth_failures' | 'peer_reset_detected' | 'repeer_incomplete' | null) is now included on each GET /federation/peers peer object so the client can raise the persistent Reset-cleanup banner only for reset-detected peers and surface an "incomplete Re-peer" warning for repeer_incomplete.

**State.** A conversation is { key, copies: Map<origin, DmCopy>, pinnedOrigin }, a copy is { origin, channel, keySource }, at most one copy per key and origin.

**State.** A conversation is { key, copies: Map<origin, DmCopy>, pinnedOrigin }, a copy is { origin, channel, keySource }, at most one copy per key and origin.

**State.** A conversation is { key, copies: Map<origin, DmCopy>, pinnedOrigin }, a copy is { origin, channel, keySource }, at most one copy per key and origin.

**State.** A conversation is { key, copies: Map<origin, DmCopy>, pinnedOrigin }, a copy is { origin, channel, keySource }, at most one copy per key and origin.

RemoteLoginRequiredError is an HttpError carrying a registered code (federation_different_password, 409, or federated_registration_closed, 403, by reason), minted by the client rather than by a route, so describeError says it in the user's language anywhere it does surface as a message.

The live ConnectedInstance.error field is a separate, unrendered string for the console and stays English.

A settings section carries a count (SettingsSection.badgeCount) when the number matters, or a dot (SettingsSection.badgeDot) when only the existence does.

A settings section carries a count (SettingsSection.badgeCount) when the number matters, or a dot (SettingsSection.badgeDot) when only the existence does.

inRecoveryMode (private to the store, guards loadFile(recovery.html) re-entry / loop prevention) and updateConfirmed (local to main.ts:initAutoUpdater, controls whether updater errors get pushed to the renderer).

keybinds: KeybindConfig[] — current bindings synced from renderer

pressedKeys: Set<number> — currently held keys (djb2 hashes)

activeActions: Set<string> — actions whose keybind is currently satisfied

window: BrowserWindow | null — target for IPC sends

started: boolean — whether uIOhook is running

Space carries directoryListed everywhere a space is serialised: the spaces routes, the explore routes, and the WebSocket ready payload.

GET /api/settings/streaming (InstanceStreamingLimits, readable by any signed-in user) carries directoryEnabled too, so the space settings panel of a non-admin can tell whether the instance allows listing.

Each entry is { origin, instanceName, federatedRegistrationOpen, id, name, description, icon, banner, avatarColor, visibility, memberCount, createdAt }, the DirectoryEntry shape in packages/shared.

directoryBrowseEnabled lives on InstanceAdminSettings, behind GET /api/settings/instance, which is admin-only, and a member surface must not carry an admin-only read.

**Naming a message across instances.** Each instance holds its own copy of a federated message under its own local id, so a relay event that points at another message names it with FederationMessageRef { messageId, messageHomeInstance }: the message's id on the instance that created it, and that instance's origin.

**Naming a message across instances.** Each instance holds its own copy of a federated message under its own local id, so a relay event that points at another message names it with FederationMessageRef { messageId, messageHomeInstance }: the message's id on the instance that created it, and that instance's origin.

Replies (message.replyTo, filled by dmReplyRefForRelay in queueDmRelay and in the sync endpoint) and reactions (reaction.messageId + reaction.messageHomeInstance, filled by the WS reaction handlers and in the sync endpoint) both use it.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

Every entry carries id, federatedId, ownerId, ownerHomeUserId, ownerHomeInstance, createdAt, name, icon, metadataUpdatedAt, members and lastMessage, with null (or 0 for metadataUpdatedAt) where the channel has no value.

On the client every 429 throws RateLimitError, an HttpError with status 429, the body's own code when the route sends one and rate_limited otherwise, plus retryAfter, so describeError localizes it like any other server error and the auth pages keep their countdown.

**MessageWithUser** extends Message with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: MessageWithUser | null

**MessageWithUser** extends Message with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: MessageWithUser | null

**MessageWithUser** extends Message with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: MessageWithUser | null

**MessageWithUser** extends Message with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: MessageWithUser | null

**MessageWithUser** extends Message with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: MessageWithUser | null

**MessageWithUser** extends Message with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: MessageWithUser | null

**DmMessageWithUser** extends DmMessage with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: DmMessageWithUser | null

**DmMessageWithUser** extends DmMessage with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: DmMessageWithUser | null

**DmMessageWithUser** extends DmMessage with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: DmMessageWithUser | null

**DmMessageWithUser** extends DmMessage with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: DmMessageWithUser | null

**DmMessageWithUser** extends DmMessage with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: DmMessageWithUser | null

**DmMessageWithUser** extends DmMessage with: user: User, attachments: Attachment[], embeds: Embed[], reactions: Reaction[], replyTo?: DmMessageWithUser | null

All friend events use the friendship field of FederationRelayEvent:

Profile snapshots (FederationRelayProfileSnapshot) carry { username, displayName, avatar, avatarColor, banner, bio } for hydrating replicated user stubs on the receiving instance.

Profile snapshots (FederationRelayProfileSnapshot) carry { username, displayName, avatar, avatarColor, banner, bio } for hydrating replicated user stubs on the receiving instance.

Profile snapshots (FederationRelayProfileSnapshot) carry { username, displayName, avatar, avatarColor, banner, bio } for hydrating replicated user stubs on the receiving instance.

Profile snapshots (FederationRelayProfileSnapshot) carry { username, displayName, avatar, avatarColor, banner, bio } for hydrating replicated user stubs on the receiving instance.

Profile snapshots (FederationRelayProfileSnapshot) carry { username, displayName, avatar, avatarColor, banner, bio } for hydrating replicated user stubs on the receiving instance.

Profile snapshots (FederationRelayProfileSnapshot) carry { username, displayName, avatar, avatarColor, banner, bio } for hydrating replicated user stubs on the receiving instance.

Field name, Type string, Required yes, Validation trimmed, 1-100 chars

Field icon, Type string, Required no, Validation Upload filename

Field banner, Type string, Required no, Validation Upload filename

Field avatarColor, Type AvatarColor, Required no, Validation Must be in AVATAR_COLORS random if omitted

Field visibility, Type SpaceVisibility, Required no, Validation 'public' / 'request' / 'private' defaults to 'private'

Field description, Type string, Required no, Validation trimmed, max 200 chars

AudioManager.releaseInputStream() closes that gap: it disconnects inputSource, detaches each capture track's onended handler and .stop()s it, nulls currentStream, resets currentInputDeviceId to 'default', and bumps streamGeneration so the next join re-acquires instead of short-circuiting.

Input device changes flow through AudioManager.setInputDevice(deviceId) (serialized chain).

When inputDeviceId === 'default' and a stream is active, AudioInputSection shows a Currently using: <label> subline by reading AudioManager.getCurrentInputDeviceId() and looking up the label in inputLabels.

Mic device changes therefore unpublish/republish via AudioManager.getFreshTrack().