v0.0.38: FC-P4 complete — session versioning, wire envelope, auto-backup

FC-P4-T1: Session State Versioning
- RatchetState serialize/deserialize with [MAGIC:0xFC][VERSION:1][bincode]
- Legacy (raw bincode) still loads — backward compatible
- Client + WASM both use versioned format
- 2 new tests: roundtrip + legacy compat

FC-P4-T2: WireMessage Versioning Envelope
- Format: [WZ magic][version:u8][length:u32 BE][bincode payload]
- Server + client + WASM accept both envelope and legacy on receive
- Client still sends raw bincode (server handles both)
- Future version → "update required" error instead of crash
- 3 new tests: roundtrip, legacy compat, future version rejection

FC-P4-T3: Periodic Auto-Backup
- Every 5 minutes, encrypts sessions+contacts+sender_keys to ~/.warzone/backups/
- HKDF-derived key from seed, ChaCha20-Poly1305 AEAD
- Atomic writes (temp file + rename), rotates to keep last 3
- /backup command for manual trigger

127 tests passing (was 122)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/crates/warzone-server/src/routes/messages.rs

@@ -9,9 +9,9 @@ use warzone_protocol::message::WireMessage;
 use crate::errors::AppResult;
 use crate::state::AppState;
 
-/// Try to extract the message ID from raw bincode-serialized WireMessage bytes.
+/// Try to extract the message ID from raw WireMessage bytes (envelope or legacy).
 fn extract_message_id(data: &[u8]) -> Option<String> {
-    if let Ok(wire) = bincode::deserialize::<WireMessage>(data) {
+    if let Ok(wire) = warzone_protocol::message::deserialize_envelope(data) {
         match wire {
             WireMessage::KeyExchange { id, .. } => Some(id),
             WireMessage::Message { id, .. } => Some(id),

warzone/crates/warzone-server/src/routes/web.rs

@@ -50,7 +50,7 @@ async fn pwa_manifest() -> impl IntoResponse {
 
 async fn service_worker() -> impl IntoResponse {
     ([(header::CONTENT_TYPE, "application/javascript")], r##"
-const CACHE = 'wz-v19';
+const CACHE = 'wz-v20';
 const SHELL = ['/', '/wasm/warzone_wasm.js', '/wasm/warzone_wasm_bg.wasm', '/icon.svg', '/manifest.json'];
 
 self.addEventListener('install', e => {
@@ -287,7 +287,7 @@ let pollTimer = null;
 let ws = null;  // WebSocket connection
 let wasmReady = false;
 
-const VERSION = '0.0.37';
+const VERSION = '0.0.38';
 let DEBUG = true;  // toggle with /debug command
 
 // ── Receipt tracking ──

warzone/crates/warzone-server/src/routes/ws.rs

@@ -21,9 +21,9 @@ use warzone_protocol::message::WireMessage;
 
 use crate::state::AppState;
 
-/// Try to extract the message ID from raw bincode-serialized WireMessage bytes.
+/// Try to extract the message ID from raw WireMessage bytes (envelope or legacy).
 fn extract_message_id(data: &[u8]) -> Option<String> {
-    if let Ok(wire) = bincode::deserialize::<WireMessage>(data) {
+    if let Ok(wire) = warzone_protocol::message::deserialize_envelope(data) {
         match wire {
             WireMessage::KeyExchange { id, .. } => Some(id),
             WireMessage::Message { id, .. } => Some(id),
@@ -147,7 +147,7 @@ async fn handle_socket(socket: WebSocket, state: AppState, fingerprint: String)
                         }
 
                         // Call signal side effects
-                        if let Ok(WireMessage::CallSignal { ref id, ref sender_fingerprint, ref signal_type, .. }) = bincode::deserialize::<WireMessage>(message) {
+                        if let Ok(WireMessage::CallSignal { ref id, ref sender_fingerprint, ref signal_type, .. }) = warzone_protocol::message::deserialize_envelope(message) {
                                 use warzone_protocol::message::CallSignalType;
                                 let now = chrono::Utc::now().timestamp();
                                 match signal_type {