fork sync: merge block/buzz main (2026-09-01)

[yjc801]

Resolves #106. Merges block/buzz main (571c1902d) into fork main
(109c5992e). Opened as a PR rather than pushed directly because the
main: PR gate ruleset blocks direct pushes.

Upstream commits merged (4)

• fix(desktop): scope composer autocomplete to focus (fix(desktop): scope composer autocomplete to focus block/buzz#6860)
• feat(desktop): add isolated named demo builds (feat(desktop): add isolated named demo builds block/buzz#6407)
• fix(model-capabilities): humanize databricks goose model names (fix(model-capabilities): humanize databricks goose model names block/buzz#7135)
• feat(db): add NIP-FI identity and final-admission schema foundation (feat(db): add NIP-FI identity and final-admission schema foundation block/buzz#6994)

Conflict resolved (1 file)

desktop/src-tauri/src/managed_agents/reserved_env_keys.rs — purely
additive. Both sides appended one entry to RESERVED_ENV_KEYS at the same
position, with no overlap in meaning:

• fork: BUZZ_ACP_REPLAY_FLOOR, the per-deploy wake replay floor written into
  launch.policy_env by wake-on-mention deploys
  (commands/agents_deploy.rs, crates/buzz-waker/src/effects.rs).
• upstream (feat(desktop): add isolated named demo builds block/buzz#6407): BUZZ_AGENT_CONFIG_DIR, the demo-build agent config root
  introduced with build_identity.rs.

Kept both, fork entry first so it stays adjacent to BUZZ_ACP_SETUP_PAYLOAD,
each with its own explanatory comment. Neither key matches the credential
filters in buzz-terminal's reserved_keys_are_covered guard, so that
cross-crate test is unaffected.

Silent-merge review

The other seven files touched by both sides auto-merged; I read each one to
confirm the result is coherent rather than merely conflict-free:

• migration.rs — upstream's if !is_demo_build() guard around
  migrate_legacy_app_data_dir / sync_shared_agent_data landed above the
  fork's backfill_agent_community_scope, which still runs before
  fold_personas_into_agent_store as its comment requires.
• nest.rs — upstream replaced NEST_DIR_DEV with
  build_identity::nest_name(); NEST_DIR_PROD is still referenced, so no
  dead-code fallout.
• runtime.rs — upstream's apply_demo_config_home(&mut command)? is
  present after the descriptor.env loop and before apply_effort_env, as
  upstream placed it.
• useMentions.ts — upstream's event.key === "Tab" && !event.shiftKey
  survived the fork's surrounding rewrite of the same handler.
• lib.rs, Justfile, agents.spec.ts — non-overlapping hunks.

Fork-only surfaces spot-checked as intact after the merge:
home_community_allows, BUZZ_ACP_REPLAY_FLOOR, xyz.waggle.app.dev /
WAGGLE_IDENTIFIER_PREFIX, backfill_agent_community_scope.

Pre-existing upstream nit, deliberately not fixed here to keep the sync
faithful: nest.rs:322 doc-links [NEST_DIR_DEV], which block#6407 deleted.
The dangling link is present in upstream/main itself.

Verification

just ci — pass end to end (exit 0), run with the ambient BUZZ_ACP_*
vars stripped so they can't leak into buzz-acp's own default-value tests.
Covers check (workspace + tauri fmt and clippy, desktop/web/mobile checks,
security-review-check, file-size ratchet), test-unit, desktop-test,
desktop-build, desktop-tauri-check, desktop-tauri-test, web-build,
mobile-test. 6266 tests passed across 39 Rust suites, 0 failed; Flutter
2019/2019.

The file-size ratchet passes untouched — worth noting because it is what
forced the two file splits on the previous sync (#105); this merge does not
push any file past its inherited ceiling.

Extra checks for the schema half of the merge, since block#6994 adds 1957 lines
of SQL:

• All 42 migrations apply cleanly to a real Postgres
  (each file in its own transaction, ON_ERROR_STOP=1), including the two
  new NIP-FI ones.
• Schema drift decreases. pgschema plan --file schema/schema.sql
  against a migration-built database reports 14 modify / 5 drop after this
  merge versus 15 modify / 5 drop before it. Diffing the two object lists,
  the sole difference is community_write_fence_excluded_table, which
  drifted before and now matches — feat(db): add NIP-FI identity and final-admission schema foundation block/buzz#6994 updated schema.sql and 0042 in
  lockstep. Every other drift item is byte-identical to the pre-merge
  baseline, i.e. pre-existing and not introduced here. No NIP-FI object
  appears in the drift at all.

Not run: just test (the integration suite). It needs Postgres and
Redis; Postgres is up on this host but there is no Redis and no Docker
daemon, so I could not run it and am not claiming otherwise. Scope note in
mitigation: this merge changes no buzz-relay, buzz-auth, or
buzz-db runtime source — the only buzz-db change is the migrator's own
unit tests asserting the new migration count and contents, which
test-unit does run, plus the two migration files validated against real
Postgres above.

Resolved by Will for the buzz-fork-sync routine.