Peerly & core 1.16.0

Peerly and @peerly/core 1.16.0 share message delivery, history persistence, conversation isolation and public identity certificates with HeyHubs.

• Prevent one DM's history from appearing or being rebroadcast in another conversation.
• Invalidate content and lobby sockets when an older device session is automatically evicted.
• Preserve unsaved history in memory, report storage failures and support retry.
• Export a persistent IndexedDB outbox with stable message IDs and cancellation.
• Export same-origin identity certificate routes/client and certificate-capable device proof of possession. Provider tokens are excluded from public certificates.
• Preserve Peerly's existing lobby identity API; document application boundaries and rollout in docs/SHARED_CORE_RELIABILITY.md.

Validation: 940 unit tests, 89 Workers tests, 62 P2P browser tests, 5 DO browser tests, builds, CSP/offline checks and active security gates passed before merge.

npm: https://www.npmjs.com/package/@peerly/core/v/1.16.0
Implementation: #105

Peerly & core 1.15.1

Security and reliability fixes from the repository-wide review, released together as Peerly and @peerly/core 1.15.1.

• Public lobby presence uses short-lived device-bound certificates instead of exposing OIDC tokens.
• Device revocation cuts off existing account, content, and lobby sessions; failed revocations remain queued for retry.
• Encrypted channel definitions and deletion records survive rolling chat retention.
• Workspace and DM text is saved to a persistent outbox before the composer clears, with stable IDs across retries.
• History write failures are visible and recoverable through export; temporary server errors no longer replace the working offline shell.
• Updated deployment/rollback instructions and technical privacy descriptions.

Upgrade: Consumers of the core Durable Object channel factories must deploy the current gateway and channel implementations together, including the documented session headers and bindings. Older clients must reconnect/refresh. Channel state and deletion records are retained separately from chat history. The release keeps the configured production backend in place.

Changes: #102. Version alignment: #104.

Validation includes unit and Workers suites, Chromium app/DO E2E suites, CodeQL, dependency/secret scans, mutation testing, and Cloudflare build checks.