fix(relay): refresh channel state after access-revoked closure - #106
Merged
Merged
Conversation
Signed-off-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>
wesbillman
commented
Sep 21, 2026
wesbillman
left a comment
Collaborator
Author
There was a problem hiding this comment.
Carl, an automated reviewer, commenting via Wes’s GitHub account.
Source review clear
No actionable code, product, or security blocker found at head bde993b942190dc80ce8fea65fef2b58717c57b4 against base 6201ab6aa5e916b95ca22f48ab1457e8812e2792. This is a comment, not approval or merge authorization.
- Authority and recovery:
session.ts:1106–1120treats a newly failed channel route as a hint to the existing coalesced discovery owner. CLOSED alone does not archive or revoke membership. Complete viewer-scoped roster evidence and relay-authored metadata still control removal/archive; unchanged access, explicit non-member denial, terminal route failure, and deliberate retry retain their existing semantics. - Lifecycle and coverage: traced direct WebSocket and broker snapshot production through the session, discovery/store, and sidebar projection. The new tests drive the real CLOSED parser and session/store/selector, covering archived/unchanged/removed outcomes, failed reads and retry, duplicate/stale notifications, coalescing, disposal, and fresh restriction after route retry. Existing forced-discovery ownership retains hints arriving during a read; no new retry framework or lifecycle owner is introduced.
- Evidence limits: two independent source lanes ran on Blox without checking out or executing PR code. Existing hosted checks were 12/12 successful in the 16:34 UTC exact-head snapshot; GitHub still reported merge gating blocked. No live relay, native UI, browser acceptance, or local test run was performed. The fixture signs its discovery events but bypasses the concrete transport signature verifier; it proves authority/state coordination, not cryptographic transport integration. The external relay's exact CLOSED wording was not independently corroborated in the reviewed repository, so this is not a reproduction of the historical incident. A relay-source or wire-capture citation would strengthen that evidence, without requiring broader string matching or a larger fix.
wesbillman
added a commit
to block/buzz
that referenced
this pull request
Sep 22, 2026
Pinky is updating this PR on Wes’s behalf. ## Summary - Treat exact `CLOSED restricted: channel access revoked` on a known channel-scoped live subscription as a hint to refresh authoritative channel state. - Reuse `useLiveChannelUpdates`’ existing debounced, idle-aware query refresh. Keep terminal retirement, explicit membership denial, and polling unchanged. - Cover archived, unchanged, removed, and failed authoritative results; burst coalescing; irrelevant/stale frames; exact-reason rejection; and unmount cleanup with seven production-path regression cases. The hint does **not** establish archive or membership state. This closes a missed-update recovery gap without changing the relay or blindly retrying subscriptions. Related symptom report: #7026 (not claimed fully resolved; archived-channel delete policy is separate). Related new-client fix: block/buzz-app#106 Originating conversation: buzz://message?channel=cb38cd5a-c920-40a1-b770-e9b89c289476&id=d22c1eed473016cf1f73c889a4cc88f1491ee092cfe3794575f8fea8003aa19e ## Review follow-up and main integration At **`51ec7482ad1e600bd02ea6b9ed265db8a70e7266`**, based on main **`c213d90d5c450e2e579505da4a4145f528ecbcf2`**: - Addressed Jude’s P2: a known channel-scoped live subscription closed with `restricted: not a channel member` stays terminal but must not refresh channels. - Mutation verification: replacing the exact reason predicate with `startsWith("restricted:")` produced **6,588 passes / 1 expected failure**, specifically the new no-refresh assertion (`actual: 1`, `expected: 0`). Restored the exact predicate; the final full suite passed **6,589/6,589**. - Resolved both conflicts with #7790, retaining main’s paced/cancellable subscriptions and this PR’s hint after terminal cleanup/drain cancellation. The fixture advances the production drain with a consistent virtual clock; it does not stub or bypass admission. - Integration crossed the session file’s 1,200-line ceiling (1,207). Extracted only this PR’s exact predicate/listener set into `relayChannelAccessRevocations.ts`, with unchanged session ownership and cleanup. No limit change, new timer, retry policy, or unrelated refactor. Final feature diff: 46 production additions across three files, plus the 333-line regression fixture. - Independent read-only review of the integration and final extraction found no blocking findings. This is not GitHub approval. ## Validation At exact pushed head **`51ec7482ad1e600bd02ea6b9ed265db8a70e7266`**: - Mandatory hooks passed without bypasses: desktop lint/policy checks, TypeScript, repository file-size gate, branch-skew check, and full desktop suite **6,589/6,589**, zero failed/cancelled/skipped. - Working tree clean after push. DCO passed on GitHub. - Fresh hosted CI and Desktop Release Candidate checks are running; prior-head green checks are not evidence for this head. Re-review requested from `jedwards27`; the changes-requested review and required approval remain for the reviewer to update. ## Evidence boundaries - Native IPC is stubbed; the fixture exercises actual subscription creation, raw CLOSED dispatch, mounted hook, authoritative query refresh, and IPC result conversion. It does not exercise native discovery or rendered sidebar behavior. Existing in-flight refresh retention remains source/helper-test coverage rather than a new integrated case. - No native app launch, live archive mutation, or release certification. This fixes a demonstrated recovery mechanism, not proof of the exact original incident ordering. - The initial broad local `just ci` attempt hit a 300-second timeout compiling `buzz-voice`; full local `just ci` remains incomplete. Current delivery uses mandatory path-scoped hooks and fresh hosted CI; no unrelated native/mobile lane was bypassed or claimed rerun locally. --------- Signed-off-by: Pinky <5f5ab050ec58ae208332edd544ebf705221e24c1b86d82a6ca07038a7a8f6ac9@buzz.block.builderlab.xyz> Co-authored-by: Pinky <5f5ab050ec58ae208332edd544ebf705221e24c1b86d82a6ca07038a7a8f6ac9@buzz.block.builderlab.xyz>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
restricted: channel access revokedas a hint to refresh authoritative roster/metadata using the existing coalesced owner.15 production lines in the session owner; no relay, sidebar, polling, retry-framework, or protocol changes. Human guidance for the FOUNDATION edit was obtained in the originating Buzz thread. This fixes the identified recovery gap, not a claim to have reproduced the historical session ordering.
Regression evidence
The new Node/Vitest integration uses the real
subscribeRelayTrafficandcreateRelaySession, real signed discovery events, controlled finite reads and the productionsidebarSectionsselector. It deliberately omits the archive EVENT, feeds actual CLOSED, and verifies the archived starred row disappears only after authoritative discovery.Coverage also includes unchanged access, authoritative removal, roster/metadata failures and explicit retry, non-channel/unrelated errors, repeated aggregate snapshots/stale CLOSED, concurrent channel coalescing, disposal and fresh restriction after deliberate route retry. Existing explicit membership-denial behavior is retained.
Fail-then-pass: at base
6201ab6, seven of the initial eight cases failed because CLOSED produced no discovery read; the same eight passed after the production fix. Final regression file has 11 passing cases.Validation
At head
bde993b942190dc80ce8fea65fef2b58717c57b4:6201ab6; working tree clean before push.No browser cases added or removed: this change is protocol/state coordination, observable below the browser through the production sidebar selector. No native GUI, live relay archive mutation, or app relaunch performed. Hosted broad CI and independent/code-owner review pending; kept draft until those gates are resolved. The separate old-desktop PR addresses that client's distinct query-invalidation path.
Origin: Buzz workflows-plugin channel
cb38cd5a-c920-40a1-b770-e9b89c289476, threadd22c1eed473016cf1f73c889a4cc88f1491ee092cfe3794575f8fea8003aa19e.