fix(desktop): bind duplicate mention selections to exact recipients - #7133

Review verdict: request changes

Reviewed base 4fe451d9c251af59c34a0a890d38499912f7e3da through exact live head 30545075a876136467c07d82abac83ad1904df23. The core exact-recipient binding is a strong fail-closed improvement, but three PR-caused defects remain.

1. Deleted ambiguous recipients survive replacement edits and can be notified by “Send to channel”

buildEditMentionState puts tagged identities it cannot bind into unresolvedMentionPubkeys (desktop/src/features/messages/lib/draftMentionRefs.ts:54-94). submitMessageEdit then copies that original list unchanged into the replacement draft and always emits it as mention reference tags (desktop/src/features/messages/ui/submitMessageEdit.ts:79-86,127-135). Consequently, replacing an ambiguous historical @Scout with @Alice or plain text retains both deleted Scout identities in the edit snapshot.

This is behaviorally significant: after applying the production edit overlay, getSendToChannelSemantics treats the snapshot's mention tags as authoritative (desktop/src/features/messages/lib/sendToChannelSemantics.ts:40-53) and selects the old Scouts from the overlaid p tags instead of Alice. A production-helper repro at this head produced saved refs A+B, notifying edit key C, and forwarded recipients A+B. Existing replacement coverage (submitMessageEdit.test.mjs:163-197) checks only revalidation/save pubkeys, not emitted refs or forwarding.

Author action: rebuild/filter unresolved identities against occurrences still owned by the edited content. Add a production-seam regression for ambiguous historical @Scout → @Alice and → plain text, apply the edit overlay, and assert both emitted refs and send-to-channel recipients. The regression should fail if the filtering is removed.

2. The new exact-recipient representation creates an unbounded, non-wrapping chip

Duplicate selection deliberately authors Display Name (<64 hex characters>) (desktop/src/features/messages/lib/extractMentionPubkeys.ts:34-40). Rendered mentions use InlineChip without the repository's wrapping class (desktop/src/shared/ui/markdown/MarkdownMention.tsx:29-37), while mention chips are inline-flex and only .wrapping-inline-chip enables overflow-wrap:anywhere (desktop/src/shared/styles/globals/markdown.css:67-101). In a narrow pane or at increased text zoom, this new single-token label can overflow/clip the conversation; in the composer it also exposes a long implementation identifier that overwhelms the sentence.

Author action: preserve exact identity for routing while making both composer and rendered presentation bounded and break-safe, with an accessible disambiguation affordance. At minimum apply the established wrapping behavior; preferably show a concise distinguishing fragment while retaining the full identity in profile/accessibility details. Add narrow-pane and increased-zoom coverage for composer, sent message, and edit reopen.

3. The new edit/reopen E2E is focus-flaky

desktop/tests/e2e/mention-recipients.spec.ts:229-236 installs a DOM selection and immediately calls page.keyboard.type() without focusing message-input. Exact-head execution observed the file at 8 pass / 1 fail; repeating the case yielded 2 pass / 1 fail with unchanged editor text at line 238. The screenshot showed edit mode open but no mutation, consistent with keyboard input going nowhere.

Author action: focus the editor after setting the range (or use a helper that establishes both focus and selection), assert focus/caret before typing, and repeat the case enough times to demonstrate stability.

Verification and confidence gaps

• Exact-head full desktop unit suite: 5,828/5,828 passed with clean tree and matching start/end SHA.
• Focused changed-path suite: 173/173 passed; exact-head typecheck/check and build:e2e passed.
• GitHub checks are green/skipped as path-selected and merge state is CLEAN. Current coverage does not catch finding 1, and green E2E does not disprove finding 3's reproduced intermittent actuation failure.
• No live native/Tauri + relay journey was performed. That is a reviewer/release confidence gap, not additional author rework; the PR correctly characterizes its browser evidence as mock-backed.

— :bot: Jude’s code review agent

Re-review verdict: request changes

Re-reviewed base 4fe451d9c251af59c34a0a890d38499912f7e3da through exact live head 0b0a5e9d81c16e9b8020407b2bcb442ac05302b3. The prior recipient-retention, wrapping, and editor-focus blockers are repaired, but this head introduces one PR-caused product regression and leaves a required smoke gate red.

Ordinary composer mentions lose their identity icon

desktop/src/shared/styles/globals/composer.css:282-288 applies padding-inline: 0 and ::before { display: none } to every .mention-chip[spellcheck="false"], rather than only the new qualified full-key representation. This suppresses the established human/agent pseudo-icon for ordinary composer mentions.

The unchanged regression contract at desktop/tests/e2e/mentions.spec.ts:994-999,1022-1037 requires that icon and its human-vs-channel alignment. Required job Desktop Smoke E2E (2) failed that assertion on all three attempts at this exact head: expected delta 1, received 6.64844. The same failure was reproduced locally against the exact built head, with the captured composer showing the literal @ treatment but no person icon.

Job: https://github.com/block/buzz/actions/runs/33666290616/job/100369030400

Author action: scope the literal-prefix/no-pseudo-icon styling to qualified full-key decorations, preserving ordinary human/agent mention icon presentation, then rerun the full smoke matrix green.

Repaired behavior verified

• Historical ambiguous recipients are now filtered against occurrences still owned by replacement content; edit snapshots replace authored mention refs while retaining historical notification tags only as history. Forwarding consumes the latest authoritative snapshot. Causal mutation of this filtering failed 5/14 focused edit tests as expected.
• Full-key composer and rendered labels now wrap within narrow/zoomed hosts and expose full identity through title/aria-label. The production E2E file passed 16/16, and its focus/menu lifecycle case passed 10/10 repeated.
• Edit activation now waits for menu exit, asserts editor focus before typing, and preserves Escape focus restoration.
• Exact-head full Desktop unit suite passed 5,861/5,861 with matching start/end SHA and clean tree. build:e2e and git diff --check passed. The new mention-recipient smoke rows passed in CI; the failure is the ordinary-mention regression above.

Confidence gaps

No native Tauri/live-relay journey or cross-browser accessibility observation was performed. That remains reviewer/release verification, not additional author rework. Desktop Core and two smoke shards were still pending at final sampling; the terminal required failure already blocks this head.

— :bot: Jude’s code review agent

Re-review verdict: request changes

Re-reviewed base 44d19f59a593dfb541bf40dcadbed313ca4a8f97 through exact live head e64ebb8bc8b4072bc4c6baf8af7bd13c41b4e268. The recipient-identity and visible mention-UX repairs now hold, but this head causes two terminal failures in a required Desktop smoke shard.

Two reply/edit journeys cannot open Reply

At desktop/tests/e2e/messaging.spec.ts:3824 and :3911, this head changes the initial Reply interactions from .click({ force: true }) to ordinary .click(). In both affected journeys, the Reply control is rendered, visible, and enabled, but the message-row/composer dock intercepts pointer events until Playwright's 30-second timeout:

• closing a thread while editing a reply preserves the typed edit
• main ArrowUp refuses to replace a dirty thread edit

Both failures were reproduced locally and occur before either journey reaches the new edit-readiness or mention-identity assertions. Adjacent equivalent Reply journeys still use forced clicks. Required Desktop Smoke E2E (3) consequently ended with 275 passed, 1 skipped, 2 flaky-but-passed, and 2 terminal failures.

Job: https://github.com/block/buzz/actions/runs/33704606602/job/100491092843

Author action: restore a reliable initial Reply-opening interaction in both journeys—most directly reinstate { force: true }, or deliberately make a real click unobstructed—while retaining the new expectReplyEditReady checks. Rerun the full Desktop Smoke E2E gate.

Repaired behavior verified

• Exact recipient references remain stable through selection, replacement edits, authoritative edit snapshots, overlay, and forwarding; stale original p tags are not revived, and qualified agent-address tags are filtered against notified recipients.
• Ordinary human mentions again show the shared person icon and agents retain bot treatment.
• Qualified-label wrapping/disclosure, editor focus/caret, keyboard behavior, and narrow/zoom composer → sent → reopen coverage passed focused validation.
• Desktop package suite passed 5,867/5,867; Desktop E2E build/typecheck passed. Desktop Core, smoke shards 1/2/4, relay E2E, both integration shards, macOS build, and security checks were green at this exact head.

Confidence gaps and ownership

• The qualified-label wrapping assertion initially measured one fragment rather than two, then passed on retry. This is a stability confidence gap, not the terminal gate cause. Owner: author/CI follow-up.
• GitHub reports mergeable=CONFLICTING, mergeStateStatus=DIRTY. Conflict presence alone is not a demonstrated product defect, but post-resolution compatibility is unproven. Owner: author to resolve/rebase without dropping mention-snapshot and forwarding semantics; reviewer to recheck the resulting exact head.
• No native Tauri/live-relay journey or cross-browser accessibility observation was performed. Owner: native/release verification if required; no additional author rework is requested on that basis.

— :bot: Jude’s code review agent

:bot: Jude’s code review agent — APPROVE at exact head 886ae4bbb68e28e8d44a1144ad99892acdf735fe against base 5073e075d7e7d95558c57f24d86d5db6196491c4.

No unresolved author-actionable defect was found in the changed-head re-review.

What I verified:

• Exact recipient identity remains pubkey-bound through duplicate-name selection, edit/reopen, rendering, forwarding, and send-to-channel. Explicit selections and authoritative edited-recipient snapshots are not re-resolved from ambiguous display labels.
• Save/send boundaries revalidate eligibility and membership, including the explicit send-without-inviting path; I found no label-based cross-community authorization path in the reviewed recipient call chain.
• Recipient E2E passed 17/17, including edit/reopen, forwarding, absent-roster overlap, ambiguous historical names, focus/menu lifecycle, and narrow/1.5x zoom behavior.
• Both repaired Reply journeys pass with ordinary clicks locally and in hosted exact-head job 100516725335 (run 33713118177).
• Focus transfer, keyboard input, caret adjacency, accessibility-oriented menu behavior, ordinary mention icons, qualified-key disclosure/wrapping, and composer → sent → reopen behavior passed the focused UI coverage.
• Desktop units passed 6,084/6,084; typecheck, repository checks, file-size gate, and diff check passed in the exact-head review worktrees.

Outstanding confidence gaps, not PR defects:

• Required Desktop CI remains red because smoke shard 3 terminates on message-feedback-snapshots.spec.ts:97 (profile-hover alpha mismatch). That test and the sampled profile-hover implementation/style are outside the base→head changed-file set. Current evidence does not support author rework; rerun/triage belongs to the Desktop required-gate owner.
• persistent-agent-audience.spec.ts:537 failed twice and passed retry in that shard. The unchanged row passed 10/10 under CI settings at both exact head and base, so current evidence does not establish a PR-caused regression. Retain it for gate-owner comparison on rerun.
• Native Tauri/OS-delivered input was not exercised; browser E2E covers the production React/CSS seam but not native WKWebView input delivery. This is routed release verification, not author action.

Any new head invalidates this approval.

:bot: Jude’s code review agent

Verdict: APPROVE

Reviewed: 5073e075d7e7d95558c57f24d86d5db6196491c4..886ae4bbb68e28e8d44a1144ad99892acdf735fe (exact head 886ae4bbb68e28e8d44a1144ad99892acdf735fe)

Risk: high — this changes exact mention-recipient identity across composer selection, edits/reopen, rendered references, forwarding, and send-time admission, plus shared interaction/CSS behavior.

Behavior/contracts traced: renderer recipient ownership by pubkey; ambiguous and absent-roster history; authoritative edit snapshots; overlay/reopen/forwarding semantics; membership and eligibility revalidation; ordinary versus qualified mention presentation; Radix menu focus handoff; normal Reply hit targets; narrow/zoom wrapping; Desktop gate selection.

Findings: no unresolved author-actionable defect. The prior stale-recipient forwarding, qualified-label wrapping, editor-focus, ordinary-icon, and Reply-interaction findings are repaired at this head.

Both assigned review lanes independently reached the same result:

• Systems/integration traced selection → save → authorized edit snapshot → overlay/reopen → forwarding/send-to-channel. Recipient identity remains pubkey-bound rather than label-re-resolved; current additions are revalidated at save/send boundaries; stale original notification tags do not regain forwarding authority. The rebased conflict resolution preserves these contracts.
• Product/UI/adversarial validation found ordinary person/agent/channel icons and qualified full-key wrapping coexist, Radix Edit transfers focus correctly while Escape restores the trigger, and composer → sent → reopen remains bounded at 100% and 150% text scaling.

Author action: none.

Verification owner: reviewer/tooling for the outstanding unrelated smoke failure and native/cross-browser confidence gaps; CI/release gate retains its normal merge-gate authority.

Validation at matching clean head:

• Desktop unit package: 6,084/6,084 passed.
• mention-recipients.spec.ts: 17/17 passed.
• Focused product journeys: 9/9 passed.
• Previously failing Reply journeys: 2/2 passed locally and both passed in hosted exact-head job 100516725335.
• pnpm typecheck, pnpm check, file-size gate, and git diff --check: passed.
• Hosted exact-head CI: Desktop Core, smoke shards 1/2/4, Desktop E2E integration/relay, macOS build, and Windows build passed.

Manual/native evidence: mock-Chromium screenshots for composer/sent/reopen at 800×900 and 100%/150% were inspected; labels remained inside their hosts and ordinary icons remained intact. No native Tauri/WKWebView or cross-browser journey was run.

Residual risk / external gate: required Desktop is currently red because smoke shard 3 failed message-feedback-snapshots.spec.ts:97 on a transient hover-alpha snapshot; that spec and the sampled profile-card implementation/style are outside this PR’s base-to-head changed-file set. The same shard also retried persistent-agent-audience.spec.ts:537 before passing; that unchanged row passed 10/10 at both exact head and base in comparative runs. Neither result establishes a PR-caused author defect, so they remain CI/tooling-owned confidence gaps rather than a reason to request changes. Native/live-relay and cross-browser accessibility observation also remain outstanding.