[upstream-sync] block/buzz 9e0c6b432..eedcd886a (14 commits)

.github/workflows/release.yml

@@ -1117,6 +1117,63 @@ jobs:
             ${{ steps.artifacts.outputs.exe }}
             ${{ steps.artifacts.outputs.sig }}
 
+  desktop-release-smoke:
+    name: Desktop release smoke
+    if: github.repository == 'block/buzz'
+    runs-on: ubuntu-latest
+    needs: setup
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.cache/ms-playwright
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ needs.setup.outputs.source_sha }}
+          persist-credentials: false
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+      - name: Install desktop dependencies
+        run: just desktop-install-ci
+      - name: Get Playwright version
+        id: pw-version
+        run: echo "version=$(cd desktop && node -e \"console.log(require('@playwright/test/package.json').version)\")" >> "$GITHUB_OUTPUT"
+      - name: Restore Playwright browser cache
+        id: playwright-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}
+          key: playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
+      - name: Install Playwright Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: cd desktop && pnpm exec playwright install chromium
+      - name: Install Playwright system dependencies
+        run: cd desktop && pnpm exec playwright install-deps chromium
+      - name: Save Playwright browser cache
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}
+          key: playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
+      - name: Build test relay
+        run: cargo build --profile ci -p buzz-relay
+      - name: Run deterministic correctness smoke
+        env:
+          BUZZ_E2E_RELAY_BIN: ${{ github.workspace }}/target/ci/buzz-relay
+          BUZZ_RELEASE_SMOKE_ARTIFACT_DIR: ${{ github.workspace }}/release-smoke-artifacts
+        run: just desktop-release-smoke
+      - name: Upload release-smoke diagnostics
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: desktop-release-smoke
+          path: |
+            release-smoke-artifacts
+            desktop/test-results
+            desktop/playwright-release-smoke-report
+          if-no-files-found: warn
+          retention-days: 14
+
   assemble-manifest:
     name: Assemble multi-platform latest.json
     # Only the tag-bound setup path can reach this job.
@@ -1132,20 +1189,40 @@ jobs:
     #
     # Reachable here without weakening upstream: accept either darwin-aarch64 lane
     # (their `if:` conditions are complementary, so exactly one ever runs), and
-    # accept `skipped` only for the signed x64 lane, which no fork can run. On
-    # block/buzz every lane still has to succeed.
+    # accept `skipped` only for the signed x64 lane and `desktop-release-smoke`,
+    # neither of which a fork can run. On block/buzz every lane still has to
+    # succeed.
+    #
+    # `desktop-release-smoke` (upstream #5699) is the third instance of exactly the
+    # failure described above, and it arrived the same way: upstream added the
+    # condition, our side had rewritten the surrounding block, and git merged the
+    # new line in with no conflict at all — only the `needs:` list below conflicted.
+    # The job is pinned `if: github.repository == 'block/buzz'`, so it reports
+    # `skipped` here forever. Requiring its success would silently strand
+    # latest.json again while every artifact uploaded fine.
     if: |
       always() &&
       needs.setup.result == 'success' &&
       (needs.release.result == 'success' || needs.release-macos-unsigned.result == 'success') &&
       (needs.release-macos-x64.result == 'success' || needs.release-macos-x64.result == 'skipped') &&
       needs.release-linux.result == 'success' &&
       needs.release-windows.result == 'success' &&
+      (needs.desktop-release-smoke.result == 'success' ||
+       needs.desktop-release-smoke.result == 'skipped') &&
       github.ref == format('refs/tags/desktop-v{0}', needs.setup.outputs.version)
     runs-on: ubuntu-latest
     # FORK-LOCAL PATCH (adrienlacombe/buzz): release-macos-unsigned added. It is
     # the fork's darwin-aarch64 provider, mutually exclusive with `release`.
-    needs: [setup, release, release-macos-unsigned, release-macos-x64, release-linux, release-windows]
+    needs:
+      [
+        setup,
+        release,
+        release-macos-unsigned,
+        release-macos-x64,
+        release-linux,
+        release-windows,
+        desktop-release-smoke,
+      ]
     timeout-minutes: 10
     permissions:
       contents: write

Justfile

@@ -276,6 +276,10 @@ desktop-e2e-smoke:
 desktop-e2e-integration: _ensure-migrations
     cd {{desktop_dir}} && pnpm test:e2e:integration
 
+# Run the deterministic desktop correctness smoke against an isolated local relay
+desktop-release-smoke:
+    ./scripts/run-desktop-release-smoke.sh
+
 # Run only the e2e specs changed vs origin/main (both projects) before pushing
 desktop-e2e-pre-push: _ensure-migrations
     git fetch origin main

TESTING.md

@@ -155,9 +155,49 @@ buzz messages thread --channel "$CHANNEL" --event "$EVENT_ID" | jq .
 
 A successful run prints `{"event_id":"…","accepted":true,"message":""}` for
 the send, and the message body in the `get` output. `thread` returns `[]`
-for a leaf message — populated only after a reply comes in (see §5).
+for a leaf message — populated only after a reply comes in (see §6).
 
-### 5. Going deeper
+### 5. Verify a roster beyond 1,000 members
+
+Use the focused live-relay script when changing channel membership, discovery,
+or reconciliation. It proves the three boundaries that DB-only tests cannot:
+the relay-served kind 39002 includes a member at roster position 1,501, that
+identity can publish a channel message, and targeted reconciliation preserves
+its discoverability.
+
+Run this only against an isolated local database. The script inserts fixture
+members directly, then drives discovery and messaging through the release CLI
+and relay. Keep the release relay from step 3 running and use its configured
+relay key for authoritative replacement:
+
+```bash
+export PATH="$PWD/target/release:$PATH"
+export DATABASE_URL="postgres://buzz:buzz_dev@localhost:5432/buzz_roster_e2e"
+export BUZZ_RELAY_URL="http://localhost:3030"  # match the relay from step 3
+export RELAY_URL="ws://localhost:3030"
+export BUZZ_RELAY_PRIVATE_KEY="<same key used by buzz-relay>"
+
+scripts/e2e-large-channel-roster.sh
+```
+
+Success is directly observable as four `PASS` lines. The first and fourth
+include a member count greater than 1,000 and the same late-member pubkey; the
+second includes the accepted kind 9 event ID, and the third proves targeted
+repair left kind 39000/39001 IDs and tags unchanged:
+
+```text
+PASS discovery-before-republish channel=<uuid> members=1502 late_pubkey=<hex>
+PASS late-member-action event_id=<hex>
+PASS targeted-repair-preserves-metadata-and-admin-events channel=<uuid>
+PASS discovery-after-republish channel=<uuid> members=1502 late_pubkey=<hex>
+```
+
+The script refuses debug binaries and refuses a `buzz` or `buzz-admin` resolved
+outside this checkout's `target/release`. It also requires the targeted admin
+operation to use `BUZZ_RELAY_PRIVATE_KEY`; never substitute an ephemeral signer
+for an authoritative replacement.
+
+### 6. Going deeper
 
 For full coverage of every CLI command (54 subcommands across 12 groups),
 follow [`crates/buzz-cli/TESTING.md`](crates/buzz-cli/TESTING.md).