fix(desktop): enable the content security policy - #4614

Brings main (a7ea86c) into the PR branch as a merge commit — no rebase,
no force — so the PR's merge ref is rebuilt against current main.

Merged clean: no conflicts, and the resulting tree is byte-identical to
`git merge-tree --write-tree` (fe05a2b).
No manual conflict resolution was performed, so no observer-batching
production or test byte changed in this commit.

Note on CI: this merge does not by itself turn the board green. The two
red Desktop Smoke shard-3 cases are main-branch defects that this branch
inherits through the merge, both root-caused and reproduced on main at
a7ea86c (which cannot contain this PR):

  - inbox-edit.spec.ts:233 expects the composer aria-label "Attach image",
    renamed to "Attach file" on main by d42d60d (#4304); the spec was
    added afterwards by eb6a375 (#2198), so the rename could not have
    updated it. Deterministic: 3/3 red on main in CI, 2/2 reproduced
    locally, 5/5 green with the one-word fix.
  - messaging.spec.ts:606 asserts a single day divider, but the e2e bridge
    seeds #general at now-120s and now-60s; within ~2 minutes of local
    midnight those straddle two calendar days and the non-.first() locator
    trips strict mode. Reproduced on main with page.clock.install pinned to
    00:01:28Z (2 dividers) versus 12:00:00Z (1 divider).

Both fixes belong in their own PR against main, not here.

* origin/main:
  fix(desktop): enable the content security policy (#4614)
  fix(mobile): merge relay recounts with locally seen thread replies (#4633)
  fix(desktop): enable message editing in Inbox (#2198)
  relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) (#4542)
  fix(desktop): outline the selected community (#4969)
  fix(desktop): clamp thread panel to channel surface (#4965)
  style(messages): increase username contrast (#4948)
  fix(desktop): rename generic attachment action from 'Attach image' to 'Attach file' (#2381) (#4304)
  fix(reactions): support max-length custom emoji (#3833)
  feat(desktop): allow leaving your final community (#3621)
  fix(buzz-agent): recover from context-window 400s instead of sticking (#4946)
  docs(persona-pack): fix stale desktop import instructions (#4500)

Co-authored-by: Sami <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>
Signed-off-by: Sami <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>

…igration

* origin/main: (95 commits)
  fix(desktop): virtualize channel member lists (#4991)
  fix(desktop): enforce owner-only access in internal builds (#4053)
  test(desktop): match attachment button label (#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917)
  fix(desktop): enable the content security policy (#4614)
  fix(mobile): merge relay recounts with locally seen thread replies (#4633)
  fix(desktop): enable message editing in Inbox (#2198)
  relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) (#4542)
  fix(desktop): outline the selected community (#4969)
  fix(desktop): clamp thread panel to channel surface (#4965)
  style(messages): increase username contrast (#4948)
  fix(desktop): rename generic attachment action from 'Attach image' to 'Attach file' (#2381) (#4304)
  fix(reactions): support max-length custom emoji (#3833)
  feat(desktop): allow leaving your final community (#3621)
  fix(buzz-agent): recover from context-window 400s instead of sticking (#4946)
  docs(persona-pack): fix stale desktop import instructions (#4500)
  fix(desktop): route macos notification clicks (#4799)
  feat(mobile): sync themes per community (#3767)
  feat(desktop): sync themes per community (#3653)
  feat(desktop): cap OpenClaw agent parallelism at 5 (#4019)
  ...

Signed-off-by: Brad Seiler <[email protected]>

…ings-acp-usage

* origin/main:
  fix(desktop): virtualize channel member lists (#4991)
  fix(desktop): enforce owner-only access in internal builds (#4053)
  test(desktop): match attachment button label (#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917)
  fix(desktop): enable the content security policy (#4614)

Signed-off-by: Fast Fizz <3477b86404413a37d7d55365cc85167ad4d52eb8b8b6587df7fd59fc2b6575d8@buzz.block.builderlab.xyz>

* origin/main: (26 commits)
  fix(desktop): skip native notifications outside app bundles (#5004)
  ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862)
  fix(desktop): virtualize channel member lists (#4991)
  fix(desktop): enforce owner-only access in internal builds (#4053)
  test(desktop): match attachment button label (#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917)
  fix(desktop): enable the content security policy (#4614)
  fix(mobile): merge relay recounts with locally seen thread replies (#4633)
  fix(desktop): enable message editing in Inbox (#2198)
  relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) (#4542)
  fix(desktop): outline the selected community (#4969)
  fix(desktop): clamp thread panel to channel surface (#4965)
  style(messages): increase username contrast (#4948)
  fix(desktop): rename generic attachment action from 'Attach image' to 'Attach file' (#2381) (#4304)
  fix(reactions): support max-length custom emoji (#3833)
  feat(desktop): allow leaving your final community (#3621)
  fix(buzz-agent): recover from context-window 400s instead of sticking (#4946)
  docs(persona-pack): fix stale desktop import instructions (#4500)
  fix(desktop): route macos notification clicks (#4799)
  feat(mobile): sync themes per community (#3767)
  ...

Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>

…-agents-nav

* origin/main:
  Refine agent runtime controls (#5026)
  test(desktop): await thread scroll anchor (#3174)
  Improve desktop mobile pairing flow (#5024)
  feat(desktop): show selected community in rail (#5000)
  fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (#4990)
  fix(desktop): skip native notifications outside app bundles (#5004)
  ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862)
  fix(desktop): virtualize channel member lists (#4991)
  fix(desktop): enforce owner-only access in internal builds (#4053)
  test(desktop): match attachment button label (#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917)
  fix(desktop): enable the content security policy (#4614)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

…n-surface

* origin/main: (44 commits)
  fix(buzz-agent): classify read timeouts distinctly in LLM error messages (#4959)
  Refine agent runtime controls (#5026)
  test(desktop): await thread scroll anchor (#3174)
  Improve desktop mobile pairing flow (#5024)
  feat(desktop): show selected community in rail (#5000)
  fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (#4990)
  fix(desktop): skip native notifications outside app bundles (#5004)
  ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862)
  fix(desktop): virtualize channel member lists (#4991)
  fix(desktop): enforce owner-only access in internal builds (#4053)
  test(desktop): match attachment button label (#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917)
  fix(desktop): enable the content security policy (#4614)
  fix(mobile): merge relay recounts with locally seen thread replies (#4633)
  fix(desktop): enable message editing in Inbox (#2198)
  relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) (#4542)
  fix(desktop): outline the selected community (#4969)
  fix(desktop): clamp thread panel to channel surface (#4965)
  style(messages): increase username contrast (#4948)
  fix(desktop): rename generic attachment action from 'Attach image' to 'Attach file' (#2381) (#4304)
  ...

# Conflicts:
#	desktop/src-tauri/src/commands/mod.rs

…rride (#5242)

## Problem

Two v0.5.6-only regressions were introduced by #4614 (the first enforced
Tauri CSP):

1. **Tab-complete caret regression** — after tab-completing an @mention,
#channel, or :emoji: shortcode, the cursor landed inside the inserted
text instead of after the trailing space. TipTap inserts the correct
text including the trailing space, but without its base stylesheet
(`.ProseMirror { white-space: break-spaces }`) the trailing space
collapses visually and the caret appears mid-name.

2. **Emoji picker unstyled** — the emoji-mart picker rendered as a giant
unstyled layout (oversized search SVG, collapsed grid) because
emoji-mart's shadow-root stylesheet injection was also blocked.

Both symptoms have the same root cause.

## Root Cause

Tauri's build-time asset processor scans `index.html` for inline
`<style>` elements, injects a nonce token, and adds the corresponding
`'nonce-…'` source to `style-src` at runtime. Per the CSP spec, **once a
nonce is present in a directive, the browser ignores `'unsafe-inline'`
for that directive**.

`index.html` contained an inline `<style>` with the boot background
color. When Tauri nonced it and injected `'nonce-…'` into `style-src`,
the intended `style-src 'self' 'unsafe-inline'` became effectively
`style-src 'self' 'nonce-…'` — blocking any runtime stylesheet injection
not covered by a matching nonce:

- TipTap's `injectCSS()` → `createStyleTag()` injecting `.ProseMirror {
white-space: break-spaces; … }`
- emoji-mart's shadow-root `document.createElement('style')` injection

(Inline scripts follow a separate path — they are SHA-256 hashed, not
nonced.)

This only reproduces in packaged builds (where Tauri's custom protocol
serves the HTML and enforces the policy). `tauri dev` loads from the
Vite dev server and is not affected.

## Fix

Move `html { background-color: #000; }` from an inline `<style>` in
`index.html` to `desktop/public/boot.css`, linked via `<link
rel="stylesheet">`. A linked stylesheet is not subject to Tauri's nonce
injection, so `'unsafe-inline'` in `style-src` applies as declared.

The `<link>` is render-blocking (same as the inline style was), so
boot-flash behaviour is identical.

**The production CSP string is unchanged.** This fix makes the policy
apply as intended — no security properties are altered. Will's follow-up
with the security team (Jordan Mecom / Eli Foster, authors of #4614) is
noted for post-ship.

A Tauri-faithful CSP harness for the Vite dev path (so this class of
regression is visible before a packaged build) is tracked as a separate
follow-up.

## Files Changed

- `desktop/index.html` — replace inline `<style>` with `<link
rel="stylesheet" href="/boot.css" />`
- `desktop/public/boot.css` — new file, the extracted `html {
background-color: #000; }` plus rationale comment
- `desktop/src-tauri/tests/csp.rs` — update comment: nonce for styles,
SHA-256 for the boot script

## Testing

- `just desktop-typecheck` ✅
- `just desktop-test` ✅ (4535/4535)
- `just desktop-tauri-test` ✅ (all Rust tests including `csp.rs`)
- Packaged validation: `pnpm tauri build --debug` completed; compiled
binary bakes `style-src 'self' 'unsafe-inline'` with no nonce source
injected ✅

---------

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

…rride (block#5242)

## Problem

Two v0.5.6-only regressions were introduced by block#4614 (the first enforced
Tauri CSP):

1. **Tab-complete caret regression** — after tab-completing an @mention,
#channel, or :emoji: shortcode, the cursor landed inside the inserted
text instead of after the trailing space. TipTap inserts the correct
text including the trailing space, but without its base stylesheet
(`.ProseMirror { white-space: break-spaces }`) the trailing space
collapses visually and the caret appears mid-name.

2. **Emoji picker unstyled** — the emoji-mart picker rendered as a giant
unstyled layout (oversized search SVG, collapsed grid) because
emoji-mart's shadow-root stylesheet injection was also blocked.

Both symptoms have the same root cause.

## Root Cause

Tauri's build-time asset processor scans `index.html` for inline
`<style>` elements, injects a nonce token, and adds the corresponding
`'nonce-…'` source to `style-src` at runtime. Per the CSP spec, **once a
nonce is present in a directive, the browser ignores `'unsafe-inline'`
for that directive**.

`index.html` contained an inline `<style>` with the boot background
color. When Tauri nonced it and injected `'nonce-…'` into `style-src`,
the intended `style-src 'self' 'unsafe-inline'` became effectively
`style-src 'self' 'nonce-…'` — blocking any runtime stylesheet injection
not covered by a matching nonce:

- TipTap's `injectCSS()` → `createStyleTag()` injecting `.ProseMirror {
white-space: break-spaces; … }`
- emoji-mart's shadow-root `document.createElement('style')` injection

(Inline scripts follow a separate path — they are SHA-256 hashed, not
nonced.)

This only reproduces in packaged builds (where Tauri's custom protocol
serves the HTML and enforces the policy). `tauri dev` loads from the
Vite dev server and is not affected.

## Fix

Move `html { background-color: #000; }` from an inline `<style>` in
`index.html` to `desktop/public/boot.css`, linked via `<link
rel="stylesheet">`. A linked stylesheet is not subject to Tauri's nonce
injection, so `'unsafe-inline'` in `style-src` applies as declared.

The `<link>` is render-blocking (same as the inline style was), so
boot-flash behaviour is identical.

**The production CSP string is unchanged.** This fix makes the policy
apply as intended — no security properties are altered. Will's follow-up
with the security team (Jordan Mecom / Eli Foster, authors of block#4614) is
noted for post-ship.

A Tauri-faithful CSP harness for the Vite dev path (so this class of
regression is visible before a packaged build) is tracked as a separate
follow-up.

## Files Changed

- `desktop/index.html` — replace inline `<style>` with `<link
rel="stylesheet" href="/boot.css" />`
- `desktop/public/boot.css` — new file, the extracted `html {
background-color: #000; }` plus rationale comment
- `desktop/src-tauri/tests/csp.rs` — update comment: nonce for styles,
SHA-256 for the boot script

## Testing

- `just desktop-typecheck` ✅
- `just desktop-test` ✅ (4535/4535)
- `just desktop-tauri-test` ✅ (all Rust tests including `csp.rs`)
- Packaged validation: `pnpm tauri build --debug` completed; compiled
binary bakes `style-src 'self' 'unsafe-inline'` with no nonce source
injected ✅

---------

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

This change enables a Tauri content security policy that limits
executable content to the packaged application and does not allow inline
scripts.

Relay, media, asset, and Tauri IPC schemes remain available for desktop
compatibility. The policy contains the impact of a future renderer
injection; it does not itself remove an injection bug.

## Testing

- `git diff --check origin/main...codex/security-desktop-csp`
- Rebased onto `origin/main` at `5c98932`
- Full CI pending

Originating Buzz thread:
`buzz://message?channel=3928fe05-df61-4b5d-b9c7-d623b9b10ea1&id=3c6c02312f763fbe0d2bfc33a6c1a362f91d0354f3d18b039cf7a0558c1439d1`

---------

Signed-off-by: Jordan Mecom <[email protected]>
Signed-off-by: Eli Foster <[email protected]>
Co-authored-by: Eli Foster <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>
Signed-off-by: bhargavms <[email protected]>

…rride (block#5242)

## Problem

Two v0.5.6-only regressions were introduced by block#4614 (the first enforced
Tauri CSP):

1. **Tab-complete caret regression** — after tab-completing an @mention,
#channel, or :emoji: shortcode, the cursor landed inside the inserted
text instead of after the trailing space. TipTap inserts the correct
text including the trailing space, but without its base stylesheet
(`.ProseMirror { white-space: break-spaces }`) the trailing space
collapses visually and the caret appears mid-name.

2. **Emoji picker unstyled** — the emoji-mart picker rendered as a giant
unstyled layout (oversized search SVG, collapsed grid) because
emoji-mart's shadow-root stylesheet injection was also blocked.

Both symptoms have the same root cause.

## Root Cause

Tauri's build-time asset processor scans `index.html` for inline
`<style>` elements, injects a nonce token, and adds the corresponding
`'nonce-…'` source to `style-src` at runtime. Per the CSP spec, **once a
nonce is present in a directive, the browser ignores `'unsafe-inline'`
for that directive**.

`index.html` contained an inline `<style>` with the boot background
color. When Tauri nonced it and injected `'nonce-…'` into `style-src`,
the intended `style-src 'self' 'unsafe-inline'` became effectively
`style-src 'self' 'nonce-…'` — blocking any runtime stylesheet injection
not covered by a matching nonce:

- TipTap's `injectCSS()` → `createStyleTag()` injecting `.ProseMirror {
white-space: break-spaces; … }`
- emoji-mart's shadow-root `document.createElement('style')` injection

(Inline scripts follow a separate path — they are SHA-256 hashed, not
nonced.)

This only reproduces in packaged builds (where Tauri's custom protocol
serves the HTML and enforces the policy). `tauri dev` loads from the
Vite dev server and is not affected.

## Fix

Move `html { background-color: #000; }` from an inline `<style>` in
`index.html` to `desktop/public/boot.css`, linked via `<link
rel="stylesheet">`. A linked stylesheet is not subject to Tauri's nonce
injection, so `'unsafe-inline'` in `style-src` applies as declared.

The `<link>` is render-blocking (same as the inline style was), so
boot-flash behaviour is identical.

**The production CSP string is unchanged.** This fix makes the policy
apply as intended — no security properties are altered. Will's follow-up
with the security team (Jordan Mecom / Eli Foster, authors of block#4614) is
noted for post-ship.

A Tauri-faithful CSP harness for the Vite dev path (so this class of
regression is visible before a packaged build) is tracked as a separate
follow-up.

## Files Changed

- `desktop/index.html` — replace inline `<style>` with `<link
rel="stylesheet" href="/boot.css" />`
- `desktop/public/boot.css` — new file, the extracted `html {
background-color: #000; }` plus rationale comment
- `desktop/src-tauri/tests/csp.rs` — update comment: nonce for styles,
SHA-256 for the boot script

## Testing

- `just desktop-typecheck` ✅
- `just desktop-test` ✅ (4535/4535)
- `just desktop-tauri-test` ✅ (all Rust tests including `csp.rs`)
- Packaged validation: `pnpm tauri build --debug` completed; compiled
binary bakes `style-src 'self' 'unsafe-inline'` with no nonce source
injected ✅

---------

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Signed-off-by: bhargavms <[email protected]>

* origin/main:
  fix(buzz-agent): classify read timeouts distinctly in LLM error messages (block#4959)
  Refine agent runtime controls (block#5026)
  test(desktop): await thread scroll anchor (block#3174)
  Improve desktop mobile pairing flow (block#5024)
  feat(desktop): show selected community in rail (block#5000)
  fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (block#4990)
  fix(desktop): skip native notifications outside app bundles (block#5004)
  ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (block#3862)
  fix(desktop): virtualize channel member lists (block#4991)
  fix(desktop): enforce owner-only access in internal builds (block#4053)
  test(desktop): match attachment button label (block#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (block#4917)
  fix(desktop): enable the content security policy (block#4614)

Signed-off-by: Alessandro Joabar <[email protected]>

…ings-acp-usage

* origin/main:
  fix(desktop): virtualize channel member lists (block#4991)
  fix(desktop): enforce owner-only access in internal builds (block#4053)
  test(desktop): match attachment button label (block#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (block#4917)
  fix(desktop): enable the content security policy (block#4614)

Signed-off-by: Fast Fizz <3477b86404413a37d7d55365cc85167ad4d52eb8b8b6587df7fd59fc2b6575d8@buzz.block.builderlab.xyz>

…-agents-nav

* origin/main:
  Refine agent runtime controls (block#5026)
  test(desktop): await thread scroll anchor (block#3174)
  Improve desktop mobile pairing flow (block#5024)
  feat(desktop): show selected community in rail (block#5000)
  fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (block#4990)
  fix(desktop): skip native notifications outside app bundles (block#5004)
  ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (block#3862)
  fix(desktop): virtualize channel member lists (block#4991)
  fix(desktop): enforce owner-only access in internal builds (block#4053)
  test(desktop): match attachment button label (block#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (block#4917)
  fix(desktop): enable the content security policy (block#4614)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

* origin/main:
  fix(buzz-agent): classify read timeouts distinctly in LLM error messages (block#4959)
  Refine agent runtime controls (block#5026)
  test(desktop): await thread scroll anchor (block#3174)
  Improve desktop mobile pairing flow (block#5024)
  feat(desktop): show selected community in rail (block#5000)
  fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (block#4990)
  fix(desktop): skip native notifications outside app bundles (block#5004)
  ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (block#3862)
  fix(desktop): virtualize channel member lists (block#4991)
  fix(desktop): enforce owner-only access in internal builds (block#4053)
  test(desktop): match attachment button label (block#4993)
  fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (block#4917)
  fix(desktop): enable the content security policy (block#4614)

Signed-off-by: Alessandro Joabar <[email protected]>

This change enables a Tauri content security policy that limits
executable content to the packaged application and does not allow inline
scripts.

Relay, media, asset, and Tauri IPC schemes remain available for desktop
compatibility. The policy contains the impact of a future renderer
injection; it does not itself remove an injection bug.

## Testing

- `git diff --check origin/main...codex/security-desktop-csp`
- Rebased onto `origin/main` at `049080e`
- Full CI pending

Originating Buzz thread:
`buzz://message?channel=3928fe05-df61-4b5d-b9c7-d623b9b10ea1&id=3c6c02312f763fbe0d2bfc33a6c1a362f91d0354f3d18b039cf7a0558c1439d1`

---------

Signed-off-by: Jordan Mecom <[email protected]>
Signed-off-by: Eli Foster <[email protected]>
Co-authored-by: Eli Foster <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>

…rride (block#5242)

## Problem

Two v0.5.6-only regressions were introduced by block#4614 (the first enforced
Tauri CSP):

1. **Tab-complete caret regression** — after tab-completing an @mention,
#channel, or :emoji: shortcode, the cursor landed inside the inserted
text instead of after the trailing space. TipTap inserts the correct
text including the trailing space, but without its base stylesheet
(`.ProseMirror { white-space: break-spaces }`) the trailing space
collapses visually and the caret appears mid-name.

2. **Emoji picker unstyled** — the emoji-mart picker rendered as a giant
unstyled layout (oversized search SVG, collapsed grid) because
emoji-mart's shadow-root stylesheet injection was also blocked.

Both symptoms have the same root cause.

## Root Cause

Tauri's build-time asset processor scans `index.html` for inline
`<style>` elements, injects a nonce token, and adds the corresponding
`'nonce-…'` source to `style-src` at runtime. Per the CSP spec, **once a
nonce is present in a directive, the browser ignores `'unsafe-inline'`
for that directive**.

`index.html` contained an inline `<style>` with the boot background
color. When Tauri nonced it and injected `'nonce-…'` into `style-src`,
the intended `style-src 'self' 'unsafe-inline'` became effectively
`style-src 'self' 'nonce-…'` — blocking any runtime stylesheet injection
not covered by a matching nonce:

- TipTap's `injectCSS()` → `createStyleTag()` injecting `.ProseMirror {
white-space: break-spaces; … }`
- emoji-mart's shadow-root `document.createElement('style')` injection

(Inline scripts follow a separate path — they are SHA-256 hashed, not
nonced.)

This only reproduces in packaged builds (where Tauri's custom protocol
serves the HTML and enforces the policy). `tauri dev` loads from the
Vite dev server and is not affected.

## Fix

Move `html { background-color: #000; }` from an inline `<style>` in
`index.html` to `desktop/public/boot.css`, linked via `<link
rel="stylesheet">`. A linked stylesheet is not subject to Tauri's nonce
injection, so `'unsafe-inline'` in `style-src` applies as declared.

The `<link>` is render-blocking (same as the inline style was), so
boot-flash behaviour is identical.

**The production CSP string is unchanged.** This fix makes the policy
apply as intended — no security properties are altered. Will's follow-up
with the security team (Jordan Mecom / Eli Foster, authors of block#4614) is
noted for post-ship.

A Tauri-faithful CSP harness for the Vite dev path (so this class of
regression is visible before a packaged build) is tracked as a separate
follow-up.

## Files Changed

- `desktop/index.html` — replace inline `<style>` with `<link
rel="stylesheet" href="/boot.css" />`
- `desktop/public/boot.css` — new file, the extracted `html {
background-color: #000; }` plus rationale comment
- `desktop/src-tauri/tests/csp.rs` — update comment: nonce for styles,
SHA-256 for the boot script

## Testing

- `just desktop-typecheck` ✅
- `just desktop-test` ✅ (4535/4535)
- `just desktop-tauri-test` ✅ (all Rust tests including `csp.rs`)
- Packaged validation: `pnpm tauri build --debug` completed; compiled
binary bakes `style-src 'self' 'unsafe-inline'` with no nonce source
injected ✅

---------

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

…rride (block#5242)

## Problem

Two v0.5.6-only regressions were introduced by block#4614 (the first enforced
Tauri CSP):

1. **Tab-complete caret regression** — after tab-completing an @mention,
#channel, or :emoji: shortcode, the cursor landed inside the inserted
text instead of after the trailing space. TipTap inserts the correct
text including the trailing space, but without its base stylesheet
(`.ProseMirror { white-space: break-spaces }`) the trailing space
collapses visually and the caret appears mid-name.

2. **Emoji picker unstyled** — the emoji-mart picker rendered as a giant
unstyled layout (oversized search SVG, collapsed grid) because
emoji-mart's shadow-root stylesheet injection was also blocked.

Both symptoms have the same root cause.

## Root Cause

Tauri's build-time asset processor scans `index.html` for inline
`<style>` elements, injects a nonce token, and adds the corresponding
`'nonce-…'` source to `style-src` at runtime. Per the CSP spec, **once a
nonce is present in a directive, the browser ignores `'unsafe-inline'`
for that directive**.

`index.html` contained an inline `<style>` with the boot background
color. When Tauri nonced it and injected `'nonce-…'` into `style-src`,
the intended `style-src 'self' 'unsafe-inline'` became effectively
`style-src 'self' 'nonce-…'` — blocking any runtime stylesheet injection
not covered by a matching nonce:

- TipTap's `injectCSS()` → `createStyleTag()` injecting `.ProseMirror {
white-space: break-spaces; … }`
- emoji-mart's shadow-root `document.createElement('style')` injection

(Inline scripts follow a separate path — they are SHA-256 hashed, not
nonced.)

This only reproduces in packaged builds (where Tauri's custom protocol
serves the HTML and enforces the policy). `tauri dev` loads from the
Vite dev server and is not affected.

## Fix

Move `html { background-color: #000; }` from an inline `<style>` in
`index.html` to `desktop/public/boot.css`, linked via `<link
rel="stylesheet">`. A linked stylesheet is not subject to Tauri's nonce
injection, so `'unsafe-inline'` in `style-src` applies as declared.

The `<link>` is render-blocking (same as the inline style was), so
boot-flash behaviour is identical.

**The production CSP string is unchanged.** This fix makes the policy
apply as intended — no security properties are altered. Will's follow-up
with the security team (Jordan Mecom / Eli Foster, authors of block#4614) is
noted for post-ship.

A Tauri-faithful CSP harness for the Vite dev path (so this class of
regression is visible before a packaged build) is tracked as a separate
follow-up.

## Files Changed

- `desktop/index.html` — replace inline `<style>` with `<link
rel="stylesheet" href="/boot.css" />`
- `desktop/public/boot.css` — new file, the extracted `html {
background-color: #000; }` plus rationale comment
- `desktop/src-tauri/tests/csp.rs` — update comment: nonce for styles,
SHA-256 for the boot script

## Testing

- `just desktop-typecheck` ✅
- `just desktop-test` ✅ (4535/4535)
- `just desktop-tauri-test` ✅ (all Rust tests including `csp.rs`)
- Packaged validation: `pnpm tauri build --debug` completed; compiled
binary bakes `style-src 'self' 'unsafe-inline'` with no nonce source
injected ✅

---------

Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

## Summary

Moves the packaged-app CSP guards from `desktop/src-tauri/tests/csp.rs`
to `desktop/src/app/contentSecurityPolicy.test.mjs`. No production code
changes beyond one added `export`.

`csp.rs` never touched Rust app code. All seven tests parse
`tauri.conf.json` and compare CSP strings. The MediaPipe check also
`include_str!`'d
`desktop/src/features/profile/lib/animatedAvatarCapture.ts` and pulled
the `MEDIAPIPE_WASM_BASE` literal out by splitting the text. That made a
Tauri test depend on a frontend file. With path-filtered CI (#8156), a
change to only that `.ts` file would skip the check.

The JS version imports `MEDIAPIPE_WASM_BASE` directly (it's now
exported) and reads `src-tauri/tauri.conf.json` from disk. The
`desktop/**` CI filter covers both files, so the check runs in Desktop
JS whenever either one changes, and the filter needs no cross-boundary
special case.

The seven tests and their assertions carry over one-for-one, along with
their rationale comments.

**What got simpler:** we delete a 204-line Rust integration test, the
`include_str!` of a frontend file, and the hand-rolled string-literal
scraper, and the CI path filter doesn't need to know about this file.

### Related issue

Addresses the CSP coupling raised in review of #8156. Related: #4614
(introduced the guards).

### Testing

- New suite on Linux: 7/7 pass.
- I falsified each test by mutating the real policy or code, one
mutation at a time. Each mutation fails exactly the matching test, and
the suite passes again once restored:
  - moved `MEDIAPIPE_WASM_BASE` outside `@mediapipe/`
  - dropped `'wasm-unsafe-eval'`
  - dropped the MediaPipe scope from `script-src`
  - added a bare `https://cdn.jsdelivr.net/` origin
  - added `'unsafe-inline'`
  - removed `img-src`
  - dropped `ws:` from `connect-src`
  - made the pinned-source predicate always pass
- Blox `just ci` at tree `5664c6ce` (same tree as head `f798f94b`):
- Passed: fmt, clippy, desktop/Tauri/web checks,
security-review/file-size checks, `desktop-test` (6,819 + 139 jsdom),
`desktop-build`, `desktop-tauri-check`, `desktop-tauri-test`,
`web-build`.
- `test-unit`: 94/95 suites pass. The two failing `buzz-acp`
`git_bootstrap` tests fail because the workstation's Git 2.43 predates
the credential `authtype` protocol. They pass 4/4 with Git 2.51, and
this PR touches no `crates/`.
- Not run: `mobile-check`/`mobile-test`, because the workstation can't
reach pub.dev. No `mobile/` changes.
- Hosted CI green:
https://github.com/block/buzz/actions/runs/37801901659. This PR selects
the Tauri lanes because it deletes `src-tauri/tests/csp.rs`. Later edits
that only touch the constant select Desktop JS only.

---------

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

* fix(chart): own the Datadog version label on every workload Pod (#7876)

## Summary

Every chart-managed Pod now carries a chart-owned
`tags.datadoghq.com/version` label derived from the deployed image,
instead of a value each wrapper restates once per workload.

Covered Pod templates:
- relay Deployment (`templates/deployment.yaml`)
- pairing relay (`templates/pairing-relay.yaml`)
- storage-accounting CronJob
(`templates/storage-accounting-cronjob.yaml`)
- operator jobs, including the deletion drain
(`templates/_operator-jobs.tpl`)

**Source order:** `image.tag`, then `image.digest`, then
`Chart.AppVersion` (`buzz.imageVersionSource`). Tag-first is deliberate:
- The rendered value matches the `sha-<commit>` pins wrappers already
carry, so upgrading to this chart does not roll any Pods.
- An image promotion only has to write `image.tag` + `image.digest`. No
per-workload label edit is needed.

Exact runtime identity stays exact in two places. The image reference is
`repository@digest` when a digest is pinned.
`BUZZ_STORAGE_SNAPSHOT_CODE_SHA` (persisted as `code_sha`) is still
digest-first.

**Label safety:** `buzz.imageVersionLabel` maps any OCI tag or digest to
a valid label value.
- Valid values already in Datadog's normal form (lowercase, no `__`)
pass through byte for byte, so `sha-<hex>` and `1.2.3-rc.4` are
unchanged. Datadog lowercases tag values and collapses `__`, so any
other value is hashed rather than allowed to report the same version as
a different revision.
- A digest keeps 63 hex characters.
- Anything else is replaced by the first 63 hex characters of its
SHA-256.
- Exactly 63 lowercase hex characters is reserved for the hashed and
digest forms, so a rendered label cannot be fed back as a tag to make
two revisions collide.
- When both tag and digest are set, the label names the tag even if they
disagree; the digest still pins what runs.

**Precedence:** a `tags.datadoghq.com/version` supplied through any
workload's `podLabels` is ignored. Every other label, including
`tags.datadoghq.com/env` and `/service`, passes through unchanged.
Overriding instead of failing means a wrapper with a stale pin is
corrected by the upgrade itself. The chart bump and the wrapper cleanup
don't have to land together.

**What got simpler:** one image identity instead of N. Wrappers delete
their per-workload version pins. Image promotion tooling no longer needs
a "mirror the tag into a label path" feature. One shared helper
(`buzz.podLabelsWithVersion`) replaces four `podLabels` passthroughs.

Chart `0.1.10 → 0.1.11`, with an `artifacthub.io/changes` entry.
Documented in the chart README ("Datadog version label") and
`docs/deployment-identity.md`.

Note: a vendor-namespaced label now renders unconditionally in an OSS
chart. This is in tension with
[VISION_SOVEREIGN.md](../blob/main/VISION_SOVEREIGN.md). The label is
inert without the operator-supplied `tags.datadoghq.com/service`/`env`,
and the chart already ships vendor-specific defaults (e.g.
`sidecar.istio.io/inject`).

### Testing

Run on a Blox (Linux) workstation at tree `41634b7ca` (helm v3.16.4,
helm-unittest 0.8.2, the CI versions):
- `helm lint deploy/charts/buzz`: 0 failed
- `helm unittest deploy/charts/buzz`: 12 suites, **85/85 passed**

New `tests/version_label_test.yaml` checks the relay, pairing relay, and
deletion drain: tag wins over a stale `podLabels` pin, the label is
stamped with no `podLabels`, and digest-only images get a label-safe
value. `tests/storage_accounting_test.yaml` covers the same cases for
the CronJob, plus the `Chart.AppVersion` fallback.

Mutation checks:
- Reverting any one template to the plain `podLabels` passthrough fails
tests.
- Switching the source order to digest-first fails tests.
- Restoring the case-insensitive passthrough fails the three
Datadog-normalization tests (uppercase, `__`, uppercased 63-hex).

No Rust, desktop, web, or mobile sources changed.

## Linear tracking

Related work: [BUZZ-215](https://linear.app/squareup/issue/BUZZ-215).

---------

Signed-off-by: tornquist <[email protected]>
Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Claude Opus 5 <[email protected]>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

* feat(db): advance an empty partition catch-all under bounded locks (#7993)

## Summary

Adds bounded, serialized advancement of an empty right-edge partition
catch-all for `events` and `delivery_log`. The repaired catalogs
currently end in an empty catch-all from 2027-01-01, and the merged
manager (#6515) only audits them. Without this change, January writes
land in the catch-all, after which only an operator can move them.

When `BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED=true`, each relay keeps six
dedicated monthlies after the current month. It does this at startup and
on every audit interval by replacing the empty catch-all with canonical
monthlies and a new canonical `<table>_p_future` after the horizon. From
today's catalogs the first run creates January–March 2027 and moves the
catch-all to April 2027.

## Safety design

- **Refuse before locking.** The following return `operator_required`
without taking any table lock:
  - a populated catch-all, or one whose occupancy is unknown;
- a catch-all with child-only triggers, which the replacements would not
inherit;
  - a misaligned bound;
  - a `DEFAULT`, anomalous or pending-detach child;
  - a name collision.
- **One winner.** A schema-scoped `pg_try_advisory_xact_lock` is taken
before any DDL. Losers report `skipped_locked` and never issue DDL. The
winner re-plans from a fresh audit before taking any table lock and
checks for collisions. A runner that lost a race therefore sees the
committed layout as a no-op, not as colliding names.
- **Writer lock order.** First `ONLY` the parent is locked `ACCESS
EXCLUSIVE` under a 2 s `lock_timeout`. Then each foreign-key counterpart
(today only `communities`) is locked in OID order `SHARE ROW EXCLUSIVE
NOWAIT`, then the catch-all `NOWAIT`.
- The counterparts are read again once the parent is locked, and that
set is the one locked. Any FK DDL on or to the parent conflicts with the
parent lock, so the set can't change after that. An FK committed while
maintenance waited is therefore locked `NOWAIT` too, so attaching never
waits on it under the parent lock. The read before the lock remains as a
cheap early refusal.
- This is the order an insert takes locks (parent, then the FK check on
`communities`), so maintenance cannot deadlock with ingest. The internal
manual runbook used to lock `communities` first; it now uses this order
too.
- `SHARE ROW EXCLUSIVE` is the strongest lock the DDL takes on
`communities`; measured on PG 16 and 17, the catch-all `DROP` takes
none, as long as the catch-all's only foreign keys are those inherited
from the parent. A catch-all with its own foreign key, or one that
another table's foreign key references, is refused: once before any
lock, and again after the catch-all lock, where the check is
authoritative. Readers and other writers' `FOR KEY SHARE` checks
proceed. A concurrent `communities` writer makes the run fail fast with
`lock_timeout`.
  - A `40P01` deadlock victim is also reported as `lock_timeout`.
- Parents that are referenced by a foreign key, or that reference an
inherited table, are refused, including when such a key commits while
maintenance waits on the parent.
- **Re-plan under lock.** The catalog is re-audited under those locks.
The transaction proceeds only if the plan is unchanged.
- **Bounded.** `statement_timeout` 5 s,
`idle_in_transaction_session_timeout` 5 s, and a 10 s client deadline
per table. A deadline-abandoned connection is closed, never returned to
the pool, and the server rolls back anything uncommitted. If the
deadline fires after `COMMIT` was sent, the change may have landed; the
next audit reports the truth. The orphaned backend keeps its locks until
its in-flight statement ends, at most `statement_timeout`.
- **Verify before commit.** The changed catalog is re-audited inside the
transaction for bounds, canonical kinds, trigger parity and catch-all
emptiness, and serving safety must not regress. It also checks that
every new child has valid, ready clones of each parent index and
validated clones of each PK/unique/FK constraint.

- **Audits tolerate a concurrent advance.** Catalog rows come from the
statement snapshot, but `pg_get_expr` renders from current catalog
state. So an audit that overlaps another relay's `DROP` of a catch-all
can see a partition that no longer exists. The read-only audit detects
this (a NULL bound, or `42P01` from the emptiness probe) and retries up
to twice with a fresh snapshot.
- **Fail fast on audit probes.** If another relay's audit is probing the
catch-all's emptiness, the catch-all `NOWAIT` lock fails and the run
reports `lock_timeout`. The parent lock is then released immediately,
and the next runner or interval completes the advance.

Uncovered-month creation (`BUZZ_PARTITION_MANAGER_CREATE_ENABLED`,
default `true`) now runs through the same locked transaction, replacing
the unlocked per-month `CREATE`. That flag remains the kill switch for
all automatic partition DDL: with it off, advancement is disabled too.
With advancement disabled (the default) the periodic loop stays
read-only and startup behaves as before, apart from the locking.

A runner that planned DDL always re-audits before returning, even when a
peer did the work, so it never reports the pre-maintenance layout. A
serialized re-plan that finds only disabled work reports
`skipped_disabled`.

## Behavior changes

- The relay audit horizon and the `buzz-admin partition-audit` default
are now 6 months (`PARTITION_MANAGER_MONTHS_AHEAD`), up from 3. Until
advancement is enabled, months already covered by the catch-all make
`degraded` true. That correctly reports a runway under six months.
- New metric `buzz_partition_maintenance_runs_total{table,outcome}` with
outcomes `noop | skipped_disabled | created | advanced | skipped_locked
| operator_required | lock_timeout | deadline | error`.
`buzz_partition_create_attempts_total` keeps its per-month `created |
skipped_covered | error` labels. `error` there still means a DDL or
collision failure; `lock_timeout` and `deadline` runs add nothing to it,
and only `buzz_partition_maintenance_runs_total` records them.
- `ensure_future_partitions` (free function and `Db` method) is removed;
`maintain_partitions` is the one entry point.
- New advisory-lock label `lock_type="partition_maintenance"`.

## Rollout

Enable `BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED` per environment in BPCI:
`bb-block-staging` first, then production. The staging canary proves a
real advance because the six-month horizon already extends past January.
Fallback: rerun the internal manual runbook, which uses the same
parent-first lock order as of 2026-10-05. It keeps `ACCESS EXCLUSIVE` on
the counterparts, because its detach/attach can drop FK triggers on
them.

## Testing

- `cargo test -p buzz-db --lib partition`: 17 unit tests. The 10 new
ones cover:
- plans: repaired layout, policy gating, no-op, refusal states including
child-only triggers, December→January;
  - the create kill switch also stopping advancement;
  - the month cap at exactly 120;
- per-month metric outcomes for transient failures versus DDL failures;
  - the mid-audit-drop retry classifier.
- `cargo test -p buzz-db --lib partition -- --ignored` (PostgreSQL 17):
48/48 on 9 consecutive runs, including 17 new tests:
  - advance to the canonical layout, with routing and idempotent rerun;
  - replacing a canonically named catch-all in one transaction;
  - populated catch-all refused in under 1 s while the parent is locked;
  - a `communities` writer making the run fail fast and roll back;
  - a `communities` reader not blocking the advance;
- an in-flight insert's FK check, and its write to `communities`, behind
queued maintenance completing without a deadlock;
- a foreign key committed while maintenance waits on the parent, with a
writer on its new counterpart, failing fast as `lock_timeout` on that
table instead of waiting under the parent lock;
- a foreign key referencing `events`, committed while maintenance waits
on the parent, being refused under the parent lock;
- a catch-all's own foreign key, or a foreign key referencing it, being
refused before the parent lock with the key intact, and a catch-all key
committed while maintenance waits on the parent being refused after the
catch-all lock;
  - a `40P01` deadlock victim being classified as `lock_timeout`;
  - parent contention timing out without blocking the other table;
  - held advisory lock skipping with no DDL;
- concurrent runners converging, with at most a transient
`lock_timeout`;
- a stale audit after a concurrent advance being a no-op, and the losing
runner returning the committed layout;
- a re-plan that finds only disabled work reporting `skipped_disabled`;
  - an audit retrying when a listed partition is dropped mid-audit;
  - a catch-all with a child-only trigger being refused;
- client deadline abandoning the attempt and closing the session (scoped
to the test's own blocked backend);
  - catch-all name collision;
  - incoming foreign key refused.
- Mutation checks:
- restoring the old counterpart-first `ACCESS EXCLUSIVE` order fails the
reader test (`lock_timeout`) and the writer test (a ~1 s deadlock wait);
- dropping `NOWAIT` from the counterpart lock, or allowing a populated
catch-all, fails the matching tests;
- removing the parent-locked counterpart re-read fails the committed-FK
tests (the parent is held 2.06 s waiting on the new counterpart), and
ignoring its refusal fails the referencing-FK test;
- locking the counterparts `SHARE ROW EXCLUSIVE` before the parent fails
the writer test;
  - removing either catch-all foreign-key check fails its test.
- Full PostgreSQL lane: 716/718. Both failures are timing-sensitive
tests outside partition code, and each passes 3/3 when run alone:
  - `hanging_redis_peer_times_out_before_the_health_listener_binds`;
-
`readiness_check_cancellation_balances_waiter_and_inflight_connection`.
- `cargo clippy -p buzz-db -p buzz-relay -p buzz-admin --all-targets -D
warnings` and `cargo fmt --check` are clean.

## Related

Refs #2396.

This PR conflicts textually with #7994 (partition audit observability
follow-ups) in `crates/buzz-db/src/store/partition.rs` and
`crates/buzz-relay/src/main.rs`. Whichever PR merges second will be
rebased onto the other.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Ian Oberst <[email protected]>
Co-authored-by: Ian Oberst <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>

* feat: raise hosted community limit to fifty (#8186)

## Summary
- Raise the stock relay active ownership quota from 5 to 50 for creation
and ownership transfer. Raise the absolute lifetime quota from 20 to 50
reserved hosts; completed owner deletions still permanently consume
lifetime capacity to bound create/delete host squatting.
- Honor the owner-list `can_create` projection across Desktop settings,
create flow, and onboarding instead of imposing a client-side count.
Display server `quota_used` / `quota_limit` when available; when the
projection is missing, let the server's `limit_reached` decide.
- Cover 49→50 and 50→51 admissions, deleted-owner lifetime exhaustion,
and rendered create gates under 5/50, 0/50 exhausted, and missing
projections.

## Verification
- Desktop full `pnpm test` and `pnpm typecheck` pass after the 50-cap
update; `cargo fmt --all -- --check` passes. Four targeted Playwright
cases and `pnpm build:e2e` passed for the original dynamic-quota change
at the previous commit, before changing test fixtures from 20 to 50.
- `cargo test -p buzz-db --lib` cannot compile here: macOS dyld rejects
the `sqlx_macros` dylib with `mis-aligned LINKEDIT string pool` on this
host before the crate's tests run. CI must validate the DB package.

## Rollout / manual validation
- Confirm `BUZZ_MAX_COMMUNITIES_PER_OWNER` is unset or 50 on **every**
production relay replica; this per-process cached override takes
precedence over the stock default.
- Confirm Builderlab's list/create/transfer proxy passes the relay's
`quota_used`, `quota_limit`, `can_create`, and `limit_reached` without
its own 5-community gate. Its backing implementation is not in this repo
and was not verified here.
- Human test: with an owner at 49 live communities, create the fiftieth,
verify the fifty-first returns `limit_reached`; transfer into an owner
at 49 then at 50 and confirm the same boundary. Check a deleted-owner
account at 0 active/50 lifetime displays the generic limit and disables
creation. This manual check remains outstanding.

---------

Signed-off-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>

* docs(nip-ap): add teams and kind:44300 instructions versions (#8191)

🤖 This PR adds two things to NIP-AP: a Teams section, and `kind:44300`
instructions versions, an owner-private history of each agent's and each
team's instructions. Today instructions are edited in place, so there's
no way to see past edits, tie a behavior change to an edit, or roll
back.

**Teams.** A team is identified by owner, community, and team id, using
the same id grammar as the `kind:30178` `d` tag. The section defines
what membership means (scoped by owner and community, not channel
membership, follows the team's current instructions), how team
instructions combine with an agent's own at launch, and the existing
rule that an agent in several teams can't start if their instructions
differ. How a client stores its private team records stays
client-defined, so this doesn't standardize discovering another client's
private teams.

**`kind:44300`.** A regular event, so every save is a new event and a
subject's events are its history. Each event names exactly one subject:
an agent (`p`) or a team (`t`). Content is NIP-44 encrypted to the owner
as `v1:` plus the raw text, which keeps empty text representable and
caps `content` at 218,548 bytes for the 128 KiB text limit. Current is
the newest version, and history pages with the `until` + `before_id`
cursor so versions saved in the same second are never skipped. Restore
and Reset to template append a new version. Launch order for an agent's
own instructions is its current version, then the linked `30175` prompt,
then a definition-less `30177`. The relay keeps it author-only on every
read surface, excludes it from search, and applies the subject filter
before `LIMIT`. Deletion requests for these versions must carry `["k",
"44300"]` and get the same author-only treatment, since they reveal
version ids and deletion times. A `30178` share is a snapshot: saving a
version doesn't change an existing share.

**Changes to existing spec text:**
- Removed the sentence saying `kind:30176`'s body is untouched "so
device sync keeps its contract". The current desktop client doesn't sync
teams through `30176`.
- Reworded the `30178` `d` tag rationale so it no longer refers to a
`30176` head.
- The "30175 beats 30177" rule now says a current `44300` version beats
both for an agent's instructions.
- Replaced the stale search bullet. It claimed no shared-gated kind is
in an FTS allowlist; search indexes those kinds, and each result passes
the per-event visibility check before delivery.

Relay and desktop implementation follow in separate PRs once this is
approved.

---------

Signed-off-by: Will Pfleger <[email protected]>
Signed-off-by: Paul <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@buzz.block.builderlab.xyz>
Co-authored-by: Paul <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@buzz.block.builderlab.xyz>

* fix(push): stop backfilling messages on lease activation (#8178)

Remove the 120-second message scan from push lease activation and
renewal. Subsequent eligible messages continue through the existing
database trigger. The lease protocol, schema, trigger, and advisory-lock
order remain unchanged.

Related enqueue-gating work: #2145. No duplicate open PR or issue found.

### Validation

- All 18 PostgreSQL push persistence tests pass against isolated
desired-state databases after review changes.
- The existing concurrency test verifies activation waits for an
in-flight insert and a subsequent message queues once. The retention
fixture activates its lease before inserting its message.
- Formatting and PostgreSQL test discovery pass. The earlier full local
run passed repository lint/static checks, native desktop pre-push
checks, and every non-ACP integration step.
- Broad local checks hit unrelated ACP idle/keepalive timing failures. A
serial retry passed two affected tests but still failed the keepalive
deadline test. The pre-push hook was skipped with author authorization
after its other checks passed.

---------

Signed-off-by: Tom Brow <[email protected]>

* fix(mobile): simplify notification settings (#8199)

Keep notification settings as a separate card with a single
“Notifications” toggle. Remove the section heading, bell, all subtitles
(including permission/capability and pending opt-out messages), and the
iOS settings button.

Toggle callbacks, capability visibility, persisted opt-in/out, and relay
synchronization are unchanged. The disable failure is being investigated
separately. This intentionally removes the pending warning rather than
claiming to fix synchronization. Tom explicitly requested removal of the
immediate opt-out synchronization warning and all other status text;
this is an intentional exception to the pending-feedback guidance in
VISION_MOBILE.md. [Codex’s finding is answered against that agreed
scope](https://github.com/block/buzz/pull/8199#discussion_r4225426842).

No new tests. Delete tests for the removed permission/settings UI and
remove obsolete display assertions from existing recovery tests while
preserving their opt-out synchronization coverage.

Closest related issue:
[#7826](https://github.com/block/buzz/issues/7826). No duplicate cleanup
PR found.

### Validation

Mobile formatting/static analysis passed. The full existing mobile suite
passed (3,216 tests; 4 skipped), plus the three unconfigured-build tests
and gateway recipe checks. Existing opt-out recovery tests exercised the
switch, persisted tombstone, snapshot synchronization, and successful
relay retry.

Before/after renders use the existing Flutter widget fixture with
synthetic data and mocked native navigation. No simulator or TestFlight
run was performed. After merge, validate the settings row and on/off
flow in the next iOS candidate; remote disable failure remains a
separate investigation.

GitHub CI also passed the mobile tests, unconfigured-build tests, and
gateway recipe checks. The [security
review](https://github.com/block/buzz/actions/runs/37863885299)
completed successfully. The [Android
build](https://github.com/block/buzz/actions/runs/37863554077/job/113605025305)
passed. The iOS simulator build, native accessibility checks, and
unsigned iOS release build passed. [All required CI
checks](https://github.com/block/buzz/actions/runs/37863554077) are
green.

### Before and after

Headless Flutter widget fixture, with synthetic data and mocked native
navigation.

| Before | After |
| --- | --- |
| ![Notification settings
before](https://raw.githubusercontent.com/block/buzz/8334767435a2896656df7bcc497dcb64a1846d92/pr-8199--before.png)
| ![Notification settings
after](https://raw.githubusercontent.com/block/buzz/8334767435a2896656df7bcc497dcb64a1846d92/pr-8199--after.png)
|

Signed-off-by: Tom Brow <[email protected]>

* fix(mobile): keep thread content visible while positioning replies (#8134)

Opening a mobile thread could blank the original message while the app
positioned replies. This affected empty and populated threads, including
links to a specific reply.

Keep one original-message widget mounted and usable throughout
positioning. It follows a measured placeholder in the reply list, which
becomes visible only at its final position. This preserves media and
reaction ownership, supports scrolling through tall originals, and
excludes the head from input and accessibility when it leaves the
viewport.

### Validation

- Added production-path frame regressions for empty, short, long, and
deep-linked threads; two video lifecycle cases verify exactly one
initialization and disposal, including completion after navigation away.
- Added coverage for dragging, mouse-wheel and accessibility scrolling,
removal of offscreen and app-bar-covered head semantics, and scrolling
to the interactive bottom of a 70-line original message. Removing the
accessibility exclusion or restoring the raw viewport-top boundary fails
both long-thread regressions; restoring the duplicated head fails the
lifecycle test.
- Mobile dependency setup, analysis, the full mobile test suite, and
unconfigured-push tests passed. The native iOS simulator debug build
passed after integrating main, including the conflict resolution for the
new Buzz icon API. The current tree passed 3,076 mobile tests (four
skipped) and three unconfigured-push tests, and the updated native
simulator build passed.
- Exercised empty, three-reply, forty-reply, and older-reply deep-link
flows on an iPhone 17 Pro simulator against an isolated local relay with
a disposable identity. Confirmed correct head accessibility coordinates
and absence when offscreen. The local posterless-video fixture rendered
its attachment fallback; native decoding success is not claimed.
Resource ownership is covered through the production preview-loader
seam. [Updated simulator
captures](https://github.com/block/buzz/pull/8134#issuecomment-6047098230).
- Added delayed-hydration regressions for mouse-wheel and explicit
accessibility scrolling through the persistent head. Both preserve a
visible reading anchor across hydration and viewport resizing; removing
the user-scroll lifecycle callbacks makes both fail. Repeated empty,
populated, and older-reply deep-link opening with the updated native
build against the retained isolated relay.
- Entered and sent a reply from the disposable simulator identity
against the isolated local relay. The app displayed the reply and
cleared the composer, and the relay database confirmed persistence.
Software keyboard open/close remains unverified because the simulator
did not display it.
- Agent review feedback was addressed. Personal mobile testing is not
applicable under the author's standing exception.

Post-merge validation: repeat empty, populated, and deep-linked thread
opening in the integrated mobile candidate, including keyboard
open/close and sending a reply before release.

buzz-review-completed

---------

Signed-off-by: Tom Brow <[email protected]>

* feat(buzz-db): run push enqueue and channel TTL refresh in app code (#8135)

## Summary

Moves the producer side of the two event follow-up triggers into
application code. The triggers stay in place, so both producers run
until a later change drops the triggers after this ships to every pod.

Builds on #8130 (`AdmittedTx`). Refs BUZZ-176.

### Push match enqueue

New `store::event_follow_up::enqueue_push_match` replaces the
`events_enqueue_push_match` trigger
(`schema/functions/enqueue_push_match_job.sql`, migration 0023) and
matches it exactly:

- Same kind allowlist (9, 40002, 45001, 45003), now `PUSH_MATCH_KINDS`.
- Takes the same SHARED `buzz_push_gate:<community>` advisory lock as
its own statement, so under READ COMMITTED the lease check gets a
snapshot taken after the lock is granted. Lease activations still take
it EXCLUSIVE in `push.rs`.
- Same lease predicate (`active AND endpoint_enabled AND expires_at >
now`), then `INSERT push_match_queue ... ON CONFLICT DO NOTHING`.
- Fails closed: any error rejects the event, as the trigger did.

It runs right after the INSERT, only when the insert affected a row. The
consumer side (claims, `lease_until`, attempts, reaper) is already
app-owned and is unchanged.

### Channel TTL refresh

`AdmittedTx` now records every channel that received an event (except
kind 9007 and channel-less events). `AdmittedTx::commit()` refreshes
their `ttl_deadline` as the last statement before COMMIT, which keeps
the commit-time behavior of the deferred `events_refresh_channel_ttl`
trigger (migration 0024):

- One savepoint per channel, in sorted order, under the same SHARED
`buzz_channel_ttl:<community>:<channel>` lock.
- Runs the same `UPDATE` with the same `archived_at`/`deleted_at`
filters as its own statement after the lock, so its snapshot follows the
lock grant. Its `ttl_seconds IS NOT NULL` qual filters a permanent
channel before any tuple lock, so a permanent channel's row is never
locked. An ephemeral channel's row lock is held through the remaining
refreshes and the COMMIT round trip (the trigger held it only inside
COMMIT).
- Lock keys come from one builder per protocol
(`channel::channel_ttl_lock_key`, `push::push_gate_lock_key`), shared by
the SHARED and EXCLUSIVE sides. The shared push-gate wait is observed
through `observe_advisory_lock(LockType::PushGate, …)`.
- On failure it rolls back the savepoint, logs a warning, and increments
`buzz_db_channel_ttl_refresh_failures_total{reason}`, where `reason` is
`lock_timeout` or `error`. The event still commits, matching the
trigger's `EXCEPTION WHEN OTHERS`. A cancelled statement (`57014`) still
rejects the transaction, because plpgsql never caught that either.
- While both producers run, an app refresh that hits `lock_timeout` is
counted, and then the trigger retries it inside COMMIT and may succeed.
So during the dual window the failure counter can over-report and the
worst-case wait doubles. Both go away when the retirement PR drops the
triggers, after which the counter is exact.

### Call sites

Every production `INSERT INTO events` calls
`event_follow_up::after_admitted_insert`:

- `insert_event_on`
- `insert_event_with_thread_metadata_tx`
- `LockedMemberSnapshot::replace_member_event`
- `replace_addressable_event`
- `publish_nip43_membership_locked`
- `accept_lease_event` (kind 30350, a no-op today, kept so the policy
has no exceptions)

`replace_parameterized_event_in_transaction_impl` inserts inside the
`parameterized_replace` savepoint. It enqueues the push job inside the
savepoint, so a rollback to that savepoint also drops the job, and
records the TTL channel only after the savepoint is released.

The two rolled-back verification probes (`verify_floor_guard_behavior`,
`verify_channel_roster_fence_behavior`) are named exceptions, because
they never commit.

### Source policy

`tests/observability_source.rs` adds
`every_production_event_insert_runs_the_follow_up_hook`. It scans every
`crates/*/src` and fails on any function that inserts into `events`
without the hook. Matching is normalized (letter case, whitespace, `\`
continuations, `\n`/`\t`/`\r` escapes, optional `public.`). The file is
masked once first: comments (`//`, nested `/* */`) and string,
raw-string (including `br"`/`cr"`), and char literals become spaces.
`#[cfg(test)]` markers, `fn` signatures and the hook are all found in
that masked view, so a marker in a comment (even a multiline block
comment) strips nothing, an `fn` line inside a multiline string doesn't
split a function, and a commented-out or quoted hook doesn't count. SQL
is still matched in the original text. A table test pins the masker's
output for each literal form. A fixture test pins what the scan rejects
(no hook, push without TTL, a hook in a line comment, block comment, or
string, lowercase or line-broken or escaped SQL, writers after test-only
items or under comment mentions) and what it ignores (writers in
`#[cfg(test)] mod`). A floor of seven hooked writers catches a scan that
silently stops seeing writers.

### Tests

`src/store/event_follow_up_postgres_tests.rs` is the contract suite from
the BUZZ-176 discovery work, ported to the `AdmittedTx` API. It is a
crate-internal `#[cfg(test)]` module because it runs `SET LOCAL`
timeouts and in-transaction reads through the crate-private
`AdmittedTx::conn()`. It runs on both the desired and migration schemas,
in two arms:

- **dual**: production during the migration window, with the triggers
and the app code both running.
- **app-only**: drops both triggers in the disposable database (and
asserts no partition clones remain), the way the retirement migration
will.

The trigger-only baseline is the base branch, where the same suite
passed before this change. The suite also pins the two branches that
differ from "swallow everything": a `lock_timeout` failure increments
`buzz_db_channel_ttl_refresh_failures_total{reason="lock_timeout"}`
exactly once, and a statement cancel (`57014`) during the refresh
rejects the event with no row, job, or deadline change.

## What got simpler

Nothing yet. This adds a parallel producer during the migration window.
It is what lets the follow-up PR delete two plpgsql functions, two
triggers, and the "keep in sync with migrations/00xx" duplication
between `schema/functions/` and `push.rs`.

## Verification

Rebased onto `main` @ `745501962`. All runs used a Linux cloud
workstation with the pinned toolchain (rustc/clippy 1.95.0, hermit), and
the tree was clean before and after each run. The final head,
`c5a06a82`, changes only `crates/buzz-db/tests/observability_source.rs`
compared with `1eb11bde` (via `fbc9a598`, `7c0baa41`, `9199992c` and
`d405b2f6`). Production source is identical between the two.

| Check | SHA | Result |
|---|---|---|
| `cargo fmt --check`, `cargo clippy -p buzz-db --all-targets -D
warnings` | `fbc9a598` | pass |
| `cargo clippy` (workspace) | `1eb11bde` | pass |
| source policy (`--test observability_source`), fmt, buzz-db clippy |
`c5a06a82` | 17/17, pass, pass |
| `cargo test --locked -p buzz-db` (non-PG) | `c5a06a82` | 148 lib + 17
policy + 5 doctests |
| source policy (`--test observability_source`) | `fbc9a598` | 16/16 |
| `cargo test --locked -p buzz-db` (non-PG) | `fbc9a598` | 148 lib + 16
policy + 5 doctests |
| contract suite (`store::event_follow_up_postgres_tests`,
desired/migration × dual/app-only) | `1eb11bde` | 4/4 |
| buzz-db PG full | `1eb11bde` | 464/464 |
| buzz-relay PG | `1eb11bde` | 378/378 |
| GitHub CI | `fbc9a598` | 53 pass, 0 fail (Codex security review
pending) |

**Falsifications** (each mutation made the named test fail, then was
reverted):
- dropping the `relay_members` hook → policy names
`publish_nip43_membership_locked`
- no-op push producer → app-only arms fail, dual arms pass (trigger
covers)
- skipping the TTL refresh → app-only fails on the deadline; dual fails
on the failure-metric assertion
- swallowing `57014` → all four arms fail
- dropping the metric increment → all four arms fail
- unanchored `#[cfg(test)]` match, or no escape handling → fixture test
fails
- a `#[cfg(test)]` constructor that skips admission, added inside `impl
AdmittedTx` (indented or as a column-0 `mod`) →
`admitted_tx_is_constructed_only_by_admitting_constructors` fails;
putting the strip back into the constructor scan → its fixture test
fails
- at `7c0baa41`: `accept_lease_event`'s hook commented out and the real
call made through an alias → policy names `accept_lease_event` (the same
mutation passes under the `fbc9a598` policy); hook matching on unmasked
text → the comment/string fixtures fail
- at `9199992c`/`d405b2f6`: no nested block-comment depth, no
string-escape skip, no `br"`/`cr"` raw-literal prefix, or no raw-string
branch at all in the masker → the follow-up fixture test fails
- at `c5a06a82`: finding `#[cfg(test)]` in the unmasked text →
`writer_after_block_commented_cfg_test` is no longer reported; finding
`fn` signatures in the unmasked text → `writer_after_raw_string_example`
is no longer reported; no `cr` raw prefix → the masker table test fails
on `cr"`
- unhooked writers appended to `side_effects.rs` (after test-only items,
under a doc-comment mention, with an escaped newline) → policy names
each

**Live relay E2E**: an independent reviewer ran this at `1eb11bde`
against a real relay and CLI, with PostgreSQL 17 and Redis 7, the
follow-up triggers absent, and no partition clones.
- A kind 9 on a TTL channel advanced the shortened deadline by about 580
s. On a permanent channel, the deadline stayed NULL.
- Each accepted event produced exactly one pending `push_match_queue`
row with the same event id.
- An exact signed replay was a no-op.
- While the exclusive TTL lock was held, the event and its job stayed
invisible and the deadline didn't change. After release, both persisted
once.
- Roster create/join/add/remove kept SQL and wire state in step
(1→2→3→2), with one current 39002 head.
- NIP-33 replace, duplicate, stale, failure and retry cases all passed.

Limits: the push lease was a SQL fixture, and push consumers were
disabled. Kind 30023 is global, so channel-scoped TTL on the
parameterized path is covered only by the PG contracts. No live relay
rerun was done at `fbc9a598`, because that delta is test-only.

**Latency** (measured at pre-rebase `f8380927`, same production delta;
debug build on loopback, 1,000 samples per cell, EVENT→OK): head
app-only p50/p99 3.80/4.58 ms (permanent) and 3.87/4.64 ms (TTL),
against base trigger-only 3.49–3.53/4.00–4.03 ms and 3.56–3.62/4.30–4.46
ms. About +0.3 ms p50, from the extra client round trips (lock, UPDATE,
savepoints, push lock/insert) that the triggers ran server-side. One
debug loopback run, not a production p99.

Not measured: contention from many writers on one hot TTL channel, where
each writer now waits on the channel row lock for about two more client
round trips (RELEASE SAVEPOINT and COMMIT) than with the trigger. In
review, a burst of 8 concurrent posts to one TTL channel committed with
no deadlock or lock timeout. Watch send p99 and `pg_locks` waits on
`channels` during rollout.

**Known pre-existing, not touched here:**
`api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo` is
flaky when Redis is present. It returns a 504 in 4 of 5 runs at base
`745501962` and 2 of 5 at `fbc9a598`, always at the same assertion. No
CI lane selects it.

---------

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

* fix(mobile): normalize relay URL before disabling push (#8201)

Communities joined with a `ws://` or `wss://` relay URL cannot disable
push: the opt-out path passes that URL directly to the HTTP-only NIP-11
fetcher, fails before publishing the inactive lease, and leaves the
durable retry pending. This was reproduced in USB logs from TestFlight
0.20.1 (49).

Normalize the URL with the existing push relay HTTP helper before
fetching metadata, matching the revocation outbox's handling. No
settings UI changes. Related: #8199 removes the status text but does not
fix this synchronization failure; no duplicate fix found.

### Validation

Four regression cases exercise the real community deactivator through
its HTTP boundary. The WebSocket cases fail with the device's exact
exception before the fix; all four pass afterward. All 37 focused
community/revocation tests and targeted Flutter analysis pass. An
initial full mobile run had three failures (recount timing and native
export timeout/order); all three passed in isolated reruns. The full
mobile checks and test suite passed on retry. The local repository-wide
gate stopped during Rust compilation without a final result; a full
local pass is not claimed. [GitHub
CI](https://github.com/block/buzz/actions/runs/37865048873) passed,
including mobile tests, Android build, Swift tests, iOS simulator build,
and unsigned iOS release build. [Codex
review](https://github.com/block/buzz/pull/8201#issuecomment-6071795750)
reported no major issues.

The installed TestFlight build is unchanged. After this fix lands,
validate that upgrading the same installation clears its existing
pending opt-out and leaves the relay lease inactive, without toggling
notifications back on.

Signed-off-by: Tom Brow <[email protected]>

* fix(desktop): repair the Windows notification shim's false denial on read (#5600)

Addresses #2445. Closely related to #2483 -- see "Relationship to #2483"
below; I am happy to close this in favour of that one.

## The problem

On Windows the notification plugin's injected shim decides its
permission at startup like this
([`guest-js/init.ts:12-18`](https://github.com/tauri-apps/plugins-workspace/blob/v2/plugins/notification/guest-js/init.ts)):

```ts
if (window.Notification.permission !== 'default' || __TEMPLATE_windows__) {
  return await Promise.resolve(window.Notification.permission === 'granted')
}
return await invoke('plugin:notification|is_permission_granted')
```

`__TEMPLATE_windows__` is replaced with the literal `true` on Windows,
so the `||` short-circuits and the shim compares its own
freshly-initialised `'default'` against `'granted'` -- `false` -- and
stamps **`denied`**. The line that would ask the backend is unreachable,
and the backend would have said yes: `permission_state()` returns
`PermissionState::Granted` unconditionally on desktop.

So on every launch of the Windows app, `window.Notification.permission`
is `denied` and nothing in the OS is denying anything.

## Why the toggle is only half of it

`getDesktopNotificationPermissionState()` trusts that value, so
`refreshPermission()` reports `denied` at mount, and this effect in
`hooks.ts` runs before the user touches anything:

```ts
React.useEffect(() => {
  if (settings.desktopEnabled && (permission === "denied" || permission === "unsupported")) {
    setSettings((current) => ({ ...current, desktopEnabled: false }));
  }
}, [permission, settings.desktopEnabled]);
```

It writes `desktopEnabled: false` and persists it. Measured on a real
install: with alerts successfully enabled and `desktopEnabled` persisted
as `true`, a clean relaunch comes back with it persisted as `false`.

That means fixing only the enable path leaves a Windows user re-enabling
alerts after every restart.

## What this changes

One place: `getDesktopNotificationPermissionState()` repairs the bogus
value instead of reporting it.

```ts
if (
  window.Notification.permission === "denied" &&
  isTauri() &&
  isWindowsPlatform()
) {
  try {
    return await requestDesktopNotificationAccess();
  } catch {
    return window.Notification.permission;
  }
}
```

`requestPermission()` is the only call that reaches the backend, and on
Windows it raises no prompt, returns `Granted`, and rewrites the shim's
cached value -- so this is self-limiting: the next read short-circuits
as `granted` and never requests again. There is a test for exactly that.

Repairing at the read rather than at the toggle fixes every consumer at
once, including `sendDesktopNotification()`, which gates delivery on
`=== "granted"` and would otherwise drop notifications at boot.

- `denied` stays terminal on macOS, on Linux, and on ordinary Windows
web pages.
- A denial that survives the request is still reported as `denied`.
- A rejected request falls back to the current value instead of
propagating; callers do not handle rejections today.
- Adds `isWindowsPlatform()` to `shared/lib/platform.ts`, alongside the
existing `isMacPlatform()` / `isLinuxPlatform()`.
- No new dependencies. No changes to `hooks.ts` or to notification
delivery.

## Verification on a real Windows 11 install

Buzz Desktop 0.5.9 release build, Windows 11 Home 10.0.26200, WebView2
151.0.4129.72, attached over CDP. Clean boot, nothing injected:

```
window.Notification.permission                -> "denied"
localStorage[...].desktopEnabled              -> false      (written by the effect above)

await window.Notification.requestPermission() -> "granted"
window.Notification.permission                -> "granted"

new window.Notification("Buzz", { body: ... })
ToastNotificationManager::History
  .GetHistory("xyz.block.buzz.app")           -> 3 -> 4     (real toast delivered)
CreateToastNotifier(...).Setting              -> Enabled
```

The OS was permissive throughout: no `ToastEnabled` override, no
notification policy keys under HKCU or HKLM, and the app present under
`HKCU\...\Notifications\Settings\xyz.block.buzz.app`. Full detail in
[this
comment](https://github.com/block/buzz/pull/2483#issuecomment-5255972424).

To be precise about scope: this confirms the mechanism the patch relies
on, measured on a stock release build. The patched build itself is
covered by the unit tests below, not by a packaged Windows run.

## Tests

`pnpm test` -- full desktop suite. New cases in `lib/desktop.test.mjs`:

- Windows Tauri repairs the shim's false denied state on read
- the repaired state is cached, so later reads do not request again
- a denial that survives the request is reported as denied
- denied stays terminal outside the Windows Tauri app (Windows web,
Linux Tauri, Linux web)
- granted is returned untouched and never triggers a request

Plus `shared/lib/platform.test.mjs` for `isWindowsPlatform()` across
`Win32` / `Win64` / `Windows` and `MacIntel` / `Darwin` / `Linux
x86_64`.

## Relationship to #2483

#2483 fixes the same root cause at the toggle: it retries the request
inside `setDesktopEnabled`. That makes the toggle work, which is what
#2445 reports, and its `ensureDesktopNotificationPermission` helper is a
nicer shape than an inline condition.

The difference is where the repair happens. Because #2483 leaves the
mount-time read as `denied`, the effect quoted above still turns the
setting off on every launch, so the fix does not survive a restart.
Repairing at the read covers the toggle path too, since
`setDesktopEnabled` calls `refreshPermission()` first and finds
`granted`.

The two overlap: both add `isWindowsPlatform()` to `platform.ts`, so
whichever lands second needs a trivial rebase. If maintainers prefer
#2483's shape, the equivalent of this PR is to call its helper from
`refreshPermission` as well as from `setDesktopEnabled` -- I am glad to
close this and send that instead. I did not want to push changes into
someone else's open PR uninvited.

## Once this lands

#2445 can close. I am running a per-machine launcher workaround for a
small Windows team until then, which this makes unnecessary.

Signed-off-by: VSCteam <[email protected]>

* test(desktop): move CSP guards from Rust to the desktop JS suite (#8172)

## Summary

Moves the packaged-app CSP guards from `desktop/src-tauri/tests/csp.rs`
to `desktop/src/app/contentSecurityPolicy.test.mjs`. No production code
changes beyond one added `export`.

`csp.rs` never touched Rust app code. All seven tests parse
`tauri.conf.json` and compare CSP strings. The MediaPipe check also
`include_str!`'d
`desktop/src/features/profile/lib/animatedAvatarCapture.ts` and pulled
the `MEDIAPIPE_WASM_BASE` literal out by splitting the text. That made a
Tauri test depend on a frontend file. With path-filtered CI (#8156), a
change to only that `.ts` file would skip the check.

The JS version imports `MEDIAPIPE_WASM_BASE` directly (it's now
exported) and reads `src-tauri/tauri.conf.json` from disk. The
`desktop/**` CI filter covers both files, so the check runs in Desktop
JS whenever either one changes, and the filter needs no cross-boundary
special case.

The seven tests and their assertions carry over one-for-one, along with
their rationale comments.

**What got simpler:** we delete a 204-line Rust integration test, the
`include_str!` of a frontend file, and the hand-rolled string-literal
scraper, and the CI path filter doesn't need to know about this file.

### Related issue

Addresses the CSP coupling raised in review of #8156. Related: #4614
(introduced the guards).

### Testing

- New suite on Linux: 7/7 pass.
- I falsified each test by mutating the real policy or code, one
mutation at a time. Each mutation fails exactly the matching test, and
the suite passes again once restored:
  - moved `MEDIAPIPE_WASM_BASE` outside `@mediapipe/`
  - dropped `'wasm-unsafe-eval'`
  - dropped the MediaPipe scope from `script-src`
  - added a bare `https://cdn.jsdelivr.net/` origin
  - added `'unsafe-inline'`
  - removed `img-src`
  - dropped `ws:` from `connect-src`
  - made the pinned-source predicate always pass
- Blox `just ci` at tree `5664c6ce` (same tree as head `f798f94b`):
- Passed: fmt, clippy, desktop/Tauri/web checks,
security-review/file-size checks, `desktop-test` (6,819 + 139 jsdom),
`desktop-build`, `desktop-tauri-check`, `desktop-tauri-test`,
`web-build`.
- `test-unit`: 94/95 suites pass. The two failing `buzz-acp`
`git_bootstrap` tests fail because the workstation's Git 2.43 predates
the credential `authtype` protocol. They pass 4/4 with Git 2.51, and
this PR touches no `crates/`.
- Not run: `mobile-check`/`mobile-test`, because the workstation can't
reach pub.dev. No `mobile/` changes.
- Hosted CI green:
https://github.com/block/buzz/actions/runs/37801901659. This PR selects
the Tauri lanes because it deletes `src-tauri/tests/csp.rs`. Later edits
that only touch the constant select Desktop JS only.

---------

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

* chore(release): release Buzz Desktop version 0.5.28

Co-authored-by: Release Automation <[email protected]>
Signed-off-by: Will Pfleger <[email protected]>

---------

Signed-off-by: tornquist <[email protected]>
Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Signed-off-by: Ian Oberst <[email protected]>
Signed-off-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Signed-off-by: Will Pfleger <[email protected]>
Signed-off-by: Paul <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@buzz.block.builderlab.xyz>
Signed-off-by: Tom Brow <[email protected]>
Signed-off-by: VSCteam <[email protected]>
Signed-off-by: Will Pfleger <[email protected]>
Co-authored-by: Luke Tornquist <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>
Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-authored-by: Ian Oberst <[email protected]>
Co-authored-by: Ian Oberst <[email protected]>
Co-authored-by: Kalvin C <[email protected]>
Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Co-authored-by: Will Pfleger <[email protected]>
Co-authored-by: Paul <4a1bfa0013bc6d14a8d600d8bf6392efefbd2a26ac3c96c9b2a106b0d12297ca@buzz.block.builderlab.xyz>
Co-authored-by: Tom Brow <[email protected]>
Co-authored-by: VSCteam <[email protected]>
Co-authored-by: Will Pfleger <[email protected]>
Co-authored-by: Release Automation <[email protected]>