GET /v1/notifications

Returns the authenticated user's durable in-app inbox newest first. Pages may be short or empty while next_cursor is non-null; continue until next_cursor is null. Visibility checks examine a bounded history window per request. Read state combines individual acknowledgements with the user's mark-all cutoff. Older activity covered by that cutoff stays read if it later becomes visible; newer activity can make an existing group unread. Current visibility is always checked independently. Contract 2 supports 18 kinds. Legacy responses preserve 11 kinds and omit unsupported new-only rows while advancing the cursor; pure mentions never masquerade as direct replies.