Add lean snapshot presence for profiles and conversations

[wesbillman]

September 21 post-#72 refresh: current delivery state

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Head 2040df1ccb3a425223d7f93abb16516777d640e0, incorporating main aed15028e1a212d909ff93999b72dd118e3fc1d6 with a conflict-free signed-off merge. Existing commits and authorship are preserved; no rebase or force-push.

• Refresh scope: exactly one file differs from the previous 7bb6d79 head: tests/browser/layout.spec.mjs (+27/-28), identical to main’s reviewed fixture repair. No production or presence changes. Restore bottom positioning for ordinary routed threads #72’s thread production/test overlap is now absent from this PR’s diff. Current production delta against main: 859 additions / 68 removals in 14 files; tests/docs are separate.
• Exact-head browser evidence: clean 2040df1, complete layout.spec.mjs and presence.spec.mjs, Chromium + WebKit: 28/28 pass (16 layout, 12 presence), 54.2s, two workers, zero retries. Command: bin/pnpm exec playwright test --config tests/browser/playwright.config.mjs tests/browser/layout.spec.mjs tests/browser/presence.spec.mjs --project chromium --project webkit --no-deps. Production built app/broker with modeled upstream and ephemeral identities; not deployed/native acceptance. No browser cases added or removed by this refresh.
• Normal hooks at 2040df1: pre-commit formatting/lint, pre-push TypeScript, 919/919 tests across 74 related files, design types and guards passed. No bypass. All 13 PR commits have DCO trailers; hosted DCO Check passed at the pushed head. Remote head and diff checks verified.
• Review/evidence reuse: the production bytes are unchanged from the earlier reviewed head. Main’s layout repair was independently reviewed at 798bd53; its stale-anchor mutation failed in both engines there. That mutation evidence is carried forward, not claimed as rerun at 2040df1. The current two-file browser execution above verifies integration.
• Remaining merge gates: post-push snapshot: MERGEABLE, hosted CI queued/running, REVIEW_REQUIRED. New CI run. Repository rules require CI required, DCO Check, and one code-owner approval. No approval or merge performed; pending CI is not a pass. Full local scan, native/real-account acceptance and deployed capacity were not repeated. Historical evidence below remains attributed to its original snapshots.

---

Earlier September 21 refresh at 7bb6d79

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Head 7bb6d7940b5453cfd2680036076c8734f0ba7628, incorporating main 42984601ebe1327006526cb03d5335264b377537 without rewriting existing commits.

• Resolved 12 current-main conflicts while retaining ordinary socket publication/receipt ownership, interest updates, and the separate bounded lossy presence path. Fixed the non-conflicting presence parser call after main introduced an explicit verifier parameter. Updated reduced-history browser fixtures and the Sessions presence fixture.
• Fixed a Nostr interoperability defect: a valid relay-signed custom status (for example busy) now makes only that subject Unknown, not every peer in the snapshot. Signature, event shape, relay authority, requested-subject and uniqueness checks still reject the whole snapshot atomically. Four mixed-status regression cases fail before the fix and pass after it; malformed JSON-like status text is also treated as unsupported because the relay accepts arbitrary string content.
• Design verdict: sound for periodically refreshed, community-local session status, not global Nostr presence or proof that a person is available. Current relay snapshots are authority-signed, omissions mean Offline only after a complete successful read, and local evidence expires after 75s. The relay uses a 180s lease and community/pubkey last-writer-wins across devices. Same-origin Web Locks avoid duplicate window publishers but do not aggregate devices. Tooltip/docs now state these limits. No new relay protocol, polling owner, queue, socket, or direct-adapter parity.
• Combined production diff against main: 878 additions / 74 removals in 15 files, including the separately authorized Restore bottom positioning for ordinary routed threads #72 thread fix. After composing the merge, production follow-ups are 16 additions / 7 removals in two files; tests/docs are separate.

Verified evidence and remaining gates

• At clean 7bb6d79, complete presence.spec.mjs in Chromium + WebKit: 12/12 pass, 33.1s, two workers, zero retries. Exercises held snapshots versus send/cold entry, shared mounted timeline/thread demand, 300-author overflow, real same-origin Web Lock handoff, and presence during held ordinary HTTP/unfinished subscription setup. Production built app and broker with modeled upstream/ephemeral identities, not deployed relay acceptance.
• Normal pre-push at 7bb6d79: TypeScript, 919/919 tests in 74 related files, design types and guards pass. No hook bypass. An earlier pre-push failed on a missing Sessions test fixture (fixed), then the unchanged app-composition case hit its existing five-second deadline once. It passed isolated at c98cb0a (1.55s) and in the final hook (1.98s); timeout/assertions unchanged. This is not a claim that every timing flake is eliminated.
• During the initial integrated 4b9ee78 browser run, all 32 navigation/composer cases passed across both engines; presence failures exposed the verifier-call/fixture integration defects fixed afterward. Those earlier 32 passes are not reattributed to final-head execution.
• Mongo and Princess Donut cleared the integrated transport/consumer conflict seams at 4b9ee78; Mordecai cleared the final status/trust/docs patch at exact 7bb6d79. Independent lanes were source-only. Carl verified producer semantics and integrated their findings.
• All PR commits carried sign-offs. Hosted run at 7bb6d79 subsequently failed both engine 1/2 shards on panel restoration yields to a new wheel reading position (113 other passes per failing shard), making CI required fail. Completed run. The layout fixture repair is now on main and incorporated in 2040df1; this old run is not current-head evidence. DCO passed; no approval or merge was performed.
• Full scan, native/real-account acceptance, deployed capacity, and all original feature mutation/lifecycle/browser-idle audits were not repeated. Earlier evidence below remains attributed to its original snapshots.

---

Historical implementation and earlier repair record

Updated by Brain on behalf of Wes (@wesbillman); presence implementation and DCO commits are attributed to Brain. Reused thread and fixture corrections preserve Pinky’s authorship and sign-offs.

Summary

One lean replacement for the frozen approaches in #39 and #47. This PR replaces their implementation; it does not itself close either old PR.

• Periodic, bounded snapshots for profile/message/thread presence; no presence subscriptions, live/snapshot reconciliation, extra socket, or durable publication queue.
• Reuse session/socket owners, one app input source and standard Web Locks. Same-socket lossy renewal; ordinary chat admission stays separate and actual server cooldowns remain shared.
• 256 mounted-author cap with profile priority and explicit overflow Unknown; fixed 100ms initial batching, ≥5s starts, 60–65s refresh, 75s display-evidence expiry.
• Include contributor scope/necessity guardrails and docs/presence.md with the approved tradeoffs.

Combined production diff versus main 7ce898e: 869 additions / 75 removals across 15 files. This includes the separately authorized thread correction from #72 (19 additions / 6 removals). The presence repair itself is 19 additions / 16 removals across five existing files, within its under-60-line checkpoint. The combined total exceeds the earlier 850-addition checkpoint by 19; this accounting was surfaced before pushing. No tests or safety behavior were removed to lower the count.

Current repair and verification

Head: 7063d6976894d92499e51bc2d30be96714250b31, based on main 7ce898eb6f77ca4fb95f06a7c7789f63245dee28.

• Presence no longer waits for global HTTP/setup idleness. Existing optional-flight limits, five-second pacing and actual relay cooldowns remain.
• Publication distinguishes accepted (true), known locally unsent (null), and refused/unconfirmed (false). Only locally unsent current status retries after 5–6 seconds through the existing renewal timer; no replay queue or optimistic Online.
• Reuses Restore bottom positioning for ordinary routed threads #72 commits 8b9082e and 05b873e (local cherry-picks d2404c5 and ef3ca39). Extends the link fixture with its required Unknown presence contract; cold-opening coverage gates warming and selects the current editable composer. No retries or relaxed deadlines/counts.
• Built-app outcome: in Chromium and WebKit, relay-accepted Online publication, visible timeline Online and successful chat publication occur while an ordinary HTTP response and channel EOSE remain held. Production app/broker, local modeled relay and ephemeral identities; not a deployed-account measurement.
• All three complete affected browser files pass 20/20, one worker, no retries (presence, composer-links, navigation-thread-history). Seven focused owner files pass 100/100. pnpm check passes. These ran at ef3ca39 plus the exact patch committed as ab5083f; the pre/post-commit binary patch SHA-256 matches b7595efec2ebcfa4afd2ba3d6485e3518d03aa961bb6cd131b2e8b7ab50fe444.
• Ten changed-call-site reversions each produce the expected regression assertion failure in a separate mutation checkout; restoration hash verified after every mutation. This audits this repair, not every call site in the original feature.
• Pinky's independent review found no blocker in the five-file production patch, SHA-256 56ff2058b2f3755ff3d1f98de0654925d05ac1c561697ffa9db533cae25db3e2. Requested doc correction applied; production hash unchanged.
• Normal commit and push hooks passed; push hook at ab5083f: TypeScript and 788 tests in 65 related files. All outgoing commits have sign-offs; no force-push or hook bypass.
• Hosted run at ab5083f failed one WebKit shard: 102 pass / one emoji-picker hit-test failure. Failed job. Its trace identifies the 13th result below the browser viewport after the standalone narrow fixture reflows.
• 7063d69 adds three test lines only: scroll the complete picker region into view before geometry and edge-hit checks. No production change, assertion removal, timeout/retry increase, or tolerance change. Pinky's independent source review found no blocker at file SHA-256 df75646737b6e0aeb36422ba39819dd69462e1e433726f6ce470bcb21f18f95a.
• The corrected complete emoji file passes Chromium locally. macOS WebKit stops earlier at the unchanged editor-containment assertion (emoji.spec.mjs:298): 0.234375px overflow, reproduced with identical values on clean main 7ce898e. That unrelated assertion and product code remain unchanged; no complete local WebKit pass is claimed.
• Diagnostic copies bypassed only that earlier baseline-proven assertion to reach the picker and forced its bottom to ~1102px in a 950px viewport. In both engines the original hit-test fails without the correction and the journey passes with it. Those copies are not committed and are not acceptance evidence for the intact file; Linux CI must run that file.
• Commit/push hooks at 7063d69 pass, including TypeScript and 788 related tests. Remote head verified. One post-push hosted check: DCO successful; CI started, not yet green; review required. Current run. Repository requires CI required, DCO Check and code-owner approval. No merge or live-app restart.

Earlier implementation evidence (not reattributed to current head)

Original implementation state: 199e8b059898f7e57a6c5409d36f85a824d1f3b2 plus the changes committed as f9fd81c. The follow-up c75b768 restores the ordinary broker character-limit contract (presence alone gets the byte cap) and updates real-host cleanup coverage to match and remove exact listener identities.

• TypeScript + staged-file Biome pass. Original push hook: 707 tests in 59 related files pass at c75b768; hook failures were fixed, not bypassed.
• On f9fd81c production bytes: 16/16 presence/profile/thread-unread browser cases in Chromium/WebKit. Real built app and production broker; modeled upstream and disposable identities. Includes send/receive while presence is held, 300 distinct thread authors, 256-author cap/overflow, all 300 released reply authors Unknown during a held replacement response, and real same-origin Web Lock handoff with resumed publication.
• Existing opening/scroll full files: 8/8 pass, including 640-message traversal, DOM bounds, live edits and reading anchors.
• Matched baseline versus implementation: three runs per engine/state, 24 opening cases. 300-author cold full-traversal/render medians ~4.25s in both states/engines; warm channel medians Chromium 15.3→18.1ms and WebKit 40→40ms, all <100ms. Cold channel outliers are unattributed. These are fixture diagnostics, not relay-scale or universal latency claims.
• Independent design, first-slice and final seven-line row-source reviews reported no remaining blockers on the reviewed production manifests. The resolved integration through main 06737cc also received a scoped independent source review with no remaining source blocker; that is not feature/performance signoff for the subsequent 7ce898e integration.

Validation gaps

• Hosted CI at the current head is not yet certified. Full just scan, native checks and the complete browser suite were not repeated locally for this small repair; earlier measurements above remain attributed to their own snapshots.
• Additional lifecycle/transport mutation regressions and the real-browser idle/input journey were exercised locally before the previous main merge. Those six test-only edits remain separate and do not certify this head; the ten repair-specific mutations above are current.
• No native or real-account launches/writes were performed. Deployed relay-load capacity and attended/native UI acceptance remain outside the fixture evidence. Wes's running checkout is untouched and is not running this repair.

Originating Buzz channel: 2128346d-ae35-4e44-98f7-5f278fe7b60d (presence-sensing), thread d7b76d481ab011f1f2d260739a4ea5a9d28fa510d67ce32a24d701f2f95a01cd.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Review result: no actionable code findings at this head

Reviewed head c75b768639c3ee8a6e0213878bf43ae3e57ea076, current target base 06737cc1af201950d916992e04ab2bd28756498f, and diff from merge base 199e8b059898f7e57a6c5409d36f85a824d1f3b2. This is a comment review, not approval or a merge-readiness certification.

The integrated review covered profile/message/thread consumers, bounded mounted-author demand and overflow, whole-response trust and omission semantics, visibility/disconnect/cache/access invalidation, activity and Web Lock ownership, same-socket lossy publication, and separation from ordinary HTTP/socket admission. Three independent review lanes returned with no actionable code defects; I reconciled their findings against the owning code and consumers. The snapshot-only design and documented lossy/Unknown behavior were treated as requirements, not defects requiring a return to live reconciliation.

Independently verified on clean c75b768

• bin/pnpm exec vitest run: 1,275 tests passed in 125 files.
• bin/pnpm test:browser presence.spec.mjs --project chromium --project webkit --no-deps: 10/10 passed, using the built app and production broker with modeled upstream/disposable identities. Covers chat while snapshots are held, 300-author cap/overflow/remount, and actual cross-window Web Lock handoff.
• bin/pnpm typecheck and merge-base git diff --check: passed. A focused controlled-clock probe also confirmed reconnect fences a held old snapshot, preserves the five-second start gate, and disposes timers. HEAD and tracked cleanliness were checked before/after the runs.

Remaining readiness work, separate from code findings

The draft conflicts with current main. Integrate and revalidate the combined result; this review does not certify a hypothetical merge. Actual browser idle → Away publication → input → Online publication, the documented mutation audit, and the full required batch/native coverage remain outstanding. The hosted snapshot exposed successful Semgrep, zizmor and DCO checks, but no functional CI result. The focused browser command above intentionally did not run dependent measurement projects or the rest of the browser suite.

One existing upstream limitation is worth retaining explicitly: the relay presence producer uses get_presence_bulk(...).await.unwrap_or_default(), so a Redis failure can be returned as HTTP-success empty presence and displayed as Offline. I checked the producer at block/buzz@beb5b5348b16eda96284c7f06bda2303e8019729, crates/buzz-relay/src/api/bridge.rs:2054–2118. This is not a client regression or a request to expand this PR into relay changes; the normal relay-signed kind-20001/p-tag/status wire shape matches the client.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source review: clear, not merge-ready

Reviewed 2f77fb6 against exact base/merge-base 7ce898e. No actionable PR-introduced code defect found in the supported broker-backed presence slice. All three independent review lanes returned and were integrated.

• Traced profile, timeline and thread demand through the session-owned 256-author directory, complete validated snapshots, Unknown/expiry semantics, and access/cache/connection/disposal boundaries. The current-main avatar, typing, workflow and transport integrations preserve those owners.
• Traced the single app input source, Web Lock renewal ownership, same-socket ephemeral publication, generation/abort fences, optional admission and shared cooldowns. Preserved the approved periodic/lossy behavior: ordinary traffic may starve presence; no presence REQ, added socket, durable queue or direct-adapter parity is required.
• Validation remains blocked: exact-head GitHub Actions run 34955866487 failed browser measurements, all four browser-journey shards and CI required. JavaScript, Rust/tool integration, Windows and DCO passed. Failure annotations inspected do not establish the cause; I have not classified these failures as unrelated or flaky. Resolve or explicitly disposition the hosted failures before calling this merge-ready.

This automation performed source/metadata inspection only on the authorized laptop: no checkout, dependency installation, build, tests or PR-code execution. Earlier browser/runtime results do not certify this integrated head. Current-head browser acceptance, native/real-account behavior, deployed capacity, full idle/input integration and the complete mutation audit remain unverified. This is a COMMENT, not an approval.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source re-review: no actionable code findings

Reviewed head 7063d69 against exact base/merge-base 7ce898e. This is a COMMENT, not approval or merge-readiness certification.

Reused the completed whole-feature review at 2f77fb6 for unchanged source and reviewed the four-commit repair delta with its owning functions and consumers. All three independent review lanes returned and were reconciled.

• Presence: bounded HTTP reads and same-socket publication can now progress during ordinary requests/channel setup while retaining separate one-flight/five-second admission and actual shared cooldowns. Only definitely locally-unsent null gets the 5–6s retry, sampling current activity through the existing timer. Refusal/unconfirmed outcomes retain the minute interval; teardown fences remain, and acceptance never directly paints Online. This intentionally supersedes the earlier review's ordinary-traffic starvation allowance, not the approved snapshot/lossy contract.
• Thread integration: mounted ordinary roots clear the navigation deadline without skipping bounded-history positioning. Intervening user input wins; exact-message reveal/focus and history anchoring retain their existing owner. Inspected the added held-pagination, abort and real-navigation-deadline regression sources.
• Emoji test correction: the only change after ab5083f scrolls the standalone fixture into the viewport before geometry/hit testing (emoji.spec.mjs:514–516). Relative dimensions, clipped-pane containment and every visible result's edge hit assertions remain intact. No production change or demonstrated assertion weakening.

Validation limits

This pass used pinned source/metadata only on the authorized laptop: no checkout edits, installs, builds or test execution. Pinned base-to-head git diff --check passed. Earlier runtime results and author-reported repair tests are not independent validation of this head.

The inspected current-head Actions run 34973567147 was still in progress; this review does not assert a terminal green result or classify predecessor failures as flakes. Resolve or explicitly disposition the current hosted gate before merge readiness. The documented native/real-account/deployed-capacity limits, full browser idle → Away → input → Online integration, full-feature mutation audit and remaining complete-batch coverage are not certified by this source review.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Automated source review: clear, not approval

Head 7063d69, exact base/merge-base 7ce898e. No actionable code findings.

This automation carries forward the completed integrated source review of this exact head. I revalidated its pinned source hashes, reread the repair delta and responsible owners, and integrated an independent check of the thread/UI evidence boundary. The earlier three review lanes are complete; no lane remains outstanding.

• Bounded snapshot presence and same-socket renewal preserve session ownership, honest Unknown/expiry semantics, ordinary-traffic coexistence and actual shared cooldowns. Only definitely locally-unsent null receives the short current-status retry; refusal/unconfirmed outcomes retain the minute interval.
• Ordinary thread presentation clears its navigation deadline without bypassing bounded-history positioning or user intent. Exact-target reveal/focus remains separate. The emoji change scrolls the standalone fixture into view before the retained geometry, containment and edge-hit assertions.
• Limits: source/metadata only on the authorized laptop, with no PR-code execution. Pinned base-to-head git diff --check passed. CI was not refreshed because the required CI Results tool preflight could not be established; the earlier review’s in-progress CI snapshot is not a current result. Verify/disposition the hosted gate before merge readiness. Direct-adapter presence parity remains excluded; native/attended-account behavior, deployed capacity, full browser idle/input integration, complete mutation coverage and full/local-only runtime acceptance are not certified.

This is a COMMENTED review, not approval or merge-readiness certification.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Current-main refresh: no remaining actionable findings

Verified PR head 7bb6d7940b5453cfd2680036076c8734f0ba7628 against incorporated main 42984601ebe1327006526cb03d5335264b377537.

The refresh preserves main’s socket-publication owner and interest updates while retaining the approved separate lossy presence path. Resolved semantic parser and fixture integration regressions. The concrete interoperability finding is fixed: valid relay-signed unsupported status is Unknown per subject, while valid peers remain usable and malformed/forged/duplicate/wrong-author snapshots still fail atomically.

The presence approach is proportionate for recent community-local session status. It is not universal Nostr presence or proof of human availability: the relay uses a 180s lease and one last-writer-wins value per community/pubkey across devices; Web Locks only dedupe same-origin windows. Tooltip and documentation now make that distinction explicit. No relay redesign is needed for the approved scope.

At exact clean 7bb6d79: 12/12 presence browser cases pass in Chromium/WebKit; normal pre-push passes TypeScript, 919 tests in 74 related files, and design checks. Four new mixed-status cases demonstrated fail-before/pass-after. Earlier integrated-head navigation/composer coverage was 32/32; see the updated description for exact-state attribution, the transient app-composition timeout, independent lane scope, and deferred broader/native validation.

GitHub confirms this head is conflict-free and DCO passed. Hosted CI was running at the post-push check; repository-required CI and code-owner approval remain gates. This is a validation/review record, not an approval or permission to merge.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source re-review: clear, not approval

Reviewed head 2040df1 against exact base/merge-base aed1502. No actionable code findings. Both source-review lanes completed and were integrated.

• Verified reuse, not assumed reuse: all 32 files in the current PR delta have identical blobs to previously reviewed 7bb6d7940b5453cfd2680036076c8734f0ba7628. The only head-to-head change is tests/browser/layout.spec.mjs (+27/−28), byte-identical to current main. The merge introduces no new production changes; #72’s thread-production overlap is absent from the net PR diff. Rechecked the current ownership graph and critical snapshot trust, optional admission, publication and lifecycle seams.
• Layout repair: inspected the complete journey and shared anchor helpers. It sends bounded real wheel input with directional progress, requires a different reading message, keeps the original anchor visible to prevent a vacuous pass, then checks the new message’s viewport position and non-paging behavior. No timeout/retry relaxation or weakened final geometry assertion found.
• Current gates: the fresh exact-head snapshot has all 12 checks successful, including CI required (workflow 35651818277). GitHub reports MERGEABLE, but BLOCKED / REVIEW_REQUIRED: required code-owner approval remains. This COMMENT does not supply that approval.

The approved periodic, bounded, community-local snapshot and lossy same-socket renewal design is preserved. Unknown/expiry behavior, relay authority and atomic validation, supported-status isolation, ordinary-traffic coexistence, and locally-unsent versus refused publication outcomes retain their owners. No added socket, durable queue, subscriptions or direct-adapter parity is required.

Validation limits: this automation performed source/metadata inspection on the pinned Blox bare object store only. No checkout, install, build, tests or PR-code execution. Hosted CI is existing evidence, not a local test run. Native/attended-account behavior, deployed capacity, full browser activity/idle integration and complete mutation coverage remain outside this source verdict. Earlier runtime evidence remains attributed to its original snapshots.