Skip to content

fix(mobile): keep a superseded roster read out of the offline snapshot - #9452

Merged
brow merged 2 commits into
mainfrom
tomb/mobile-members-snapshot-fence
Nov 13, 2026
Merged

brow merged 2 commits into
mainfrom
tomb/mobile-members-snapshot-fence

Conversation

@brow

@brow brow commented Nov 13, 2026 •

Copy link
Copy Markdown
Collaborator

The channel member list keeps a snapshot of the last roster it read, which it shows while the relay is disconnected. When two roster updates arrive close together, the member list starts a read for each. If the first read answered after the second, it still wrote its older roster over the snapshot. The live list stayed correct, but once the app went offline it showed the older roster: for example, a member just removed, or a bot role just changed, came back.

A read that a later read has replaced no longer writes the snapshot. The snapshot cache numbers each read of a channel's roster, and only the latest read for that channel may write. A read that ends because nothing is watching the list any more (the user leaves the screen mid-read, or a one-off lookup such as sending a message) still writes, since its roster is the newest one.

Validation

New tests, which fail without this change:

  • Two roster updates arrive, the second read answers first and the first answers after it, with a roster, with no roster event, or with an empty roster. Once disconnected, the member list still shows the newer roster.
  • A roster update arrives and the user leaves before its read answers. Once disconnected, the member list shows that newer roster. (This passes on main and guards against fencing on disposal, which an earlier version of this PR did.)

The rest of the channel management tests pass unchanged. Full mobile test suite and flutter analyze pass.

The race itself needs two roster reads to answer out of order and then a disconnect, which a device run can't reliably produce. An automated run on an iPhone 12 mini signed in to Block's Builderlab (profile build of this head) covered the roster paths it touches: cold start, searching for and opening buzz-mobile, its details (86 members) and its member list (49 people, roles shown), scrolling it, backgrounding the app for 60 seconds, resuming, and reopening the member list, which loaded the same roster.

Regressions

None. A replaced read's result was already discarded for the live list; now it is also kept out of the offline snapshot. Reads that nothing replaced write the snapshot as before.

When two roster updates arrive close together, the member list reads the
roster twice. If the first read answered last, it wrote its older roster
over the snapshot the app shows while disconnected, so offline a member
just removed, or a bot role just changed, came back. Skip the snapshot
write for a read that a later one has replaced.

Co-authored-by: corey <2dafccf60ea6d431a568f6d67fc60016c1b2a51e415e09dc8b213b8e3606cf54@buzz.block.builderlab.xyz>
Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@buzz.block.builderlab.xyz>
Signed-off-by: Tom Brow <[email protected]>
@brow

brow commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 13, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-13T20:32:20.571265Z 2aa1de4 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 6df1430008

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Disposal also fires when the last watcher leaves mid-read, which dropped
the newest roster from the offline snapshot. Number each read per
channel scope in the snapshot cache and let only the latest one write.

Co-authored-by: perfie <1fc92b08616bef6025a30fa24528ba2417d2a0c82f2c67b62e7f912089235028@buzz.block.builderlab.xyz>
Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@buzz.block.builderlab.xyz>
Signed-off-by: Tom Brow <[email protected]>
@brow

brow commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 2aa1de44c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@brow
brow marked this pull request as ready for review November 13, 2026 20:30
@brow
brow requested a review from a team as a code owner November 13, 2026 20:30
@brow
brow deployed to codex-review November 13, 2026 20:30 — with GitHub Actions Active
@github-actions github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 13, 2026
@github-actions

Copy link
Copy Markdown

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

  • Exact PR diff: 59ae028a360242d43ffbfdafca8a76eda00484d9...2aa1de44c7902db5a9ec68319a1debefedddf05f
  • Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.


Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings in the authorized PR range. Reviewed generation fencing, roster refresh paths, provider disposal, and relay/account/channel scoping.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

  • Review used read-only source and history inspection. Builds and tests were not executed, as instructed.

Generated by Codex Security Review |
Requested by: @brow |
Workflow run

@kazemek21 kazemek21 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kyle reviewed this PR and the Nexus review-tracker notes and approved with no comments.

Posted by Codex (gpt-6.1-sol) on behalf of kylez.

@brow
brow merged commit 15c65c7 into main Nov 13, 2026
60 checks passed
@brow
brow deleted the tomb/mobile-members-snapshot-fence branch November 13, 2026 22:37
wpfleger96 added a commit that referenced this pull request Nov 14, 2026
* origin/main: (24 commits)
  docs(readme): point desktop readers at block/buzz-app and describe where each client lives (#9493)
  test(cli,db): freeze the assertion test clock and give pool release tests a test-lane acquire budget (#9442)
  test(desktop): unmount every TerminalSubstrate tree before the window closes (#9440)
  fix(mobile): drop the iOS share extension from the build until it's signed (#9489)
  chore(release): release Buzz Desktop version 0.5.30 (#9491)
  perf(mobile): parse each event's thread reference once (#9460)
  perf(mobile): load only the directory when search opens (#9466)
  perf(mobile): stop rebuilding Home's channel list when a route covers it (#9459)
  perf(mobile): ask typing subscriptions only for the typing window (#9454)
  perf(mobile): skip avatar URL parsing for non-HTTP URLs (#9448)
  perf(mobile): download the identity archive list only when it changed (#9445)
  perf(mobile): don't treat a Control Center pull as a resume (#9443)
  fix(mobile): keep a superseded roster read out of the offline snapshot (#9452)
  perf(mobile): read channel bot roles from the member list (#9451)
  perf(mobile): read Activity once per reconnect (#9455)
  fix(mobile): offer role controls for agents (#9475)
  perf(mobile): stop rebuilding the native nav bar on every scrolled frame (#9458)
  perf(mobile): keep verified-name batches open as people are added (#9450)
  perf(mobile): read only changed custom emoji sets on reconnect (#9446)
  perf(mobile): keep latest-message times on a directory load (#9457)
  ...

Signed-off-by: Will Pfleger <[email protected]>

# Conflicts:
#	crates/buzz-cli/src/desktop_provider.rs
bostonaholic added a commit that referenced this pull request Nov 14, 2026
…eaction-recipients

* origin/main: (111 commits)
  perf(acp): avoid repeated observer batch serialization (#9483)
  docs(readme): point desktop readers at block/buzz-app and describe where each client lives (#9493)
  test(cli,db): freeze the assertion test clock and give pool release tests a test-lane acquire budget (#9442)
  test(desktop): unmount every TerminalSubstrate tree before the window closes (#9440)
  fix(mobile): drop the iOS share extension from the build until it's signed (#9489)
  chore(release): release Buzz Desktop version 0.5.30 (#9491)
  perf(mobile): parse each event's thread reference once (#9460)
  perf(mobile): load only the directory when search opens (#9466)
  perf(mobile): stop rebuilding Home's channel list when a route covers it (#9459)
  perf(mobile): ask typing subscriptions only for the typing window (#9454)
  perf(mobile): skip avatar URL parsing for non-HTTP URLs (#9448)
  perf(mobile): download the identity archive list only when it changed (#9445)
  perf(mobile): don't treat a Control Center pull as a resume (#9443)
  fix(mobile): keep a superseded roster read out of the offline snapshot (#9452)
  perf(mobile): read channel bot roles from the member list (#9451)
  perf(mobile): read Activity once per reconnect (#9455)
  fix(mobile): offer role controls for agents (#9475)
  perf(mobile): stop rebuilding the native nav bar on every scrolled frame (#9458)
  perf(mobile): keep verified-name batches open as people are added (#9450)
  perf(mobile): read only changed custom emoji sets on reconnect (#9446)
  ...

Signed-off-by: Matthew Boston <[email protected]>

This branch was successfully deployed

1 active deployment
codex-review — 2aa1de44 Deployed Nov 13, 2026 by brow via Run Codex Security Review #15063
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codex-security-review-current The posted Codex security review matches its recorded range.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants