[ricardovfreixo]

Why

The web inbox already shows the recipient's quoted commit and images on starred commits. The signed mobile notification API uses the same resources, but never loads those relations, so native clients cannot render those previews.

Companion mobile draft: NativePHP/dev-null-app#79 (refs NativePHP/dev-null-app#71). It links this API change and the independent rank-metadata PR #836.

Changes

• Load recipient-owned quoted commits and starred-commit images for both GET /api/v1/notifications and GET /api/v1/notifications/{notification}/group.
• Reuse the web inbox's existing constrained eager-load helpers. Another person's quoted commit remains unavailable (approved or private); a deleted recipient-owned quote is returned as the existing minimal tombstone. Batch-load quoted authors after the privacy constraint, avoiding reliance on automatic relationship loading.
• Keep grouping, filters, pagination, read-marking and signed authentication unchanged. No resource classes, dependencies or migrations changed.

This is an API-only companion change: mobile quote/image previews require this to be merged and deployed to the backend they connect to. Level/rank details are a separate dependency already covered by #836; this PR deliberately does not duplicate that work.

Verification

• composer test: passed, including lint/Rector, PHPStan/TypeScript, type coverage and frontend tests.
• Full PHP suite: 3,972 passed, 100% code coverage; type coverage 100%.
• Frontend unit suite: 305 passed (plus 128 node:test checks).
• Required full pest --parallel --ci --coverage --exactly=100.0 run also passed.
• Regression tests cover both API endpoints, text-plus-image/image-only stars, recipient-owned live/deleted quotes, approved/private foreign-quote exclusion, and constant query counts with automatic relationship loading disabled.

Tests ran against a dedicated local test database. No production data or runtime deployment was changed.

Complete mobile delivery / remaining gates

This API-only PR is independently testable with the local verification above; no runtime deployment was performed and no claim about current remote CI is made.

• App draft: Add native notification centre and reliable Log navigation NativePHP/dev-null-app#79 — rebased onto app 29a838d, including feat: clickable links and preview cards for links in commits #73/Original post remains in activity log after deleting my reply #75/feat: add commits and replies tabs to profiles #76.
• NativePHP core companion: Add Android tab reselect and preserve native screen state NativePHP/mobile-air#588 — public pinned ref f06d13ccc80e597b86600e442a2dd2407ac0ab5e.
• NativePHP UI companion: Add pager-aware native list scroll targets NativePHP/mobile-ui#162 — public pinned ref 28753b7ea337349243330c1f531ed61f386a2c6d.

The app's tracked manifest/lock include both source refs; no hidden vendor/generated-shell patches or local path repositories are required. Its full PHP suite passed 1,297 tests / 12,591 assertions after installation from the public ZIP archives. The SDK changes address separate native Log reselect, return-to-existing-feed and saveable-pane-state behavior; they are not part of this API diff and do not block testing it independently.

The app draft contains dependency/setup instructions, the required php -d memory_limit=1G Android rebuild commands, all companion links, and outstanding native compilation/JVM/instrumentation/phone/screenshot gates. PHP checks do not prove native pixel-offset restoration or the reported idle behavior. Full quote/image/rank parity still requires this API and #836 to be merged and deployed; opening the PRs does not deploy them.