fix: skip ack when DisabledFeatures.Signal is set

The library was acking inbound `<message>` envelopes when
DisabledFeatures.Signal was on, on the rationale of "tell the server
to stop retrying." That's wrong: the runner has not actually received
or decrypted the message — only the downstream client (e.g. a Baileys
behind a proxy) has. Acking on its behalf prematurely tells WA the
message was delivered, defeating retry semantics and offline-buffer
flows where the downstream client may not be reachable yet.

With this change, the disabled branch is a true no-op for message
delivery. The ack travels back through the same path the message
went out (e.g. customer's Baileys → Bartender → SendNode on the
runner's whatsmeow → real WA) once the downstream client confirms
processing.

Godoc on DisabledFeatures.Signal updated to match the new behavior.

Author: purpshell

client.go

@@ -71,13 +71,13 @@ type RawNodeHandler func(ctx context.Context, node *waBinary.Node) (modified *wa
 // the library assumes is running. Toggle deliberately; the surrounding
 // code does not paper over the resulting gaps.
 type DisabledFeatures struct {
-	// Signal disables the library's Signal-session machinery. When set,
-	// incoming `<message>` envelopes are not decrypted (the library acks
-	// them so the server stops retrying, but no plaintext is produced
-	// and no UndecryptableMessage event is dispatched for the skip),
-	// and the periodic prekey-upload loop becomes a no-op. Combine with
-	// [RawNodeHandler] to forward the raw envelopes to the system that
-	// actually owns the Signal session.
+	// Signal disables the library's Signal-session machinery. When set:
+	//   - Incoming `<message>` envelopes are not decrypted and not
+	//     ack'd. The actual decrypting client downstream is responsible
+	//     for ack'ing once it has processed the message.
+	//   - The periodic prekey-upload loop is a no-op.
+	// Combine with [RawNodeHandler] to forward the raw envelopes to the
+	// system that actually owns the Signal session.
 	Signal bool
 }
 

message.go

@@ -61,9 +61,10 @@ func (cli *Client) handleEncryptedMessage(ctx context.Context, node *waBinary.No
 			defer cli.maybeDeferredAck(ctx, node)(&cancelled)
 			cancelled = cli.handlePlaintextMessage(ctx, info, node)
 		} else if cli.DisabledFeatures.Signal {
-			// External system owns the Signal session; ack so the server
-			// stops retrying but skip all local decrypt + identity work.
-			cli.sendAck(ctx, node, 0)
+			// External system owns the Signal session. We do not decrypt
+			// and we do not ack: the actual decrypting client (e.g. a
+			// downstream Baileys behind a proxy) is responsible for
+			// ack'ing once it has received and processed the message.
 		} else {
 			cli.decryptMessages(ctx, info, node)
 		}