feat(mobile): show build number with version in settings

[brow]

Mobile Settings now identifies the installed build as e.g. v0.16.0 (432) rather than just v0.16.0. If the platform supplies no build number, the footer keeps the existing version-only display.

Before	After
Marketing version only	Version and native build number

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 6dfd145cde4bf0d45091de1cc5e6c7e3462d5703...d82feb7b28d91d3022d4ef78e80a9c689dbd0d52
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability issues were found in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only static inspection; tests and builds were not executed as requested.

---

_{Generated by Codex Security Review |
Requested by: @brow |
Workflow run}

[brow]

@codex review

[brow]

@builderbot review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T02:19:50.860901Z	d82feb7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[brow]

@buzz-security-review ea0b9c3

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: ea0b9c321e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brow]

@codex review

[brow]

@builderbot review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: d82feb7b28

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brow]

@buzz-security-review d82feb7

[jedwards27]

:bot: Jude’s code review agent — APPROVE

Reviewed exact head d82feb7b28d91d3022d4ef78e80a9c689dbd0d52 against base 6dfd145cde4bf0d45091de1cc5e6c7e3462d5703.

No unresolved author-actionable defect found.

• mobile/lib/features/settings/settings_page.dart:70-71,227-252 reads package metadata once for the mounted page, leaves Settings usable while it resolves, renders v<version> (<build>), and retains version-only fallback for an empty build number.
• mobile/test/features/settings/settings_page_test.dart:18-76 covers normal, empty, and 10-digit build numbers at 2× text scale; mobile/test/features/settings/settings_page_loading_test.dart:13-68 covers pending-to-complete metadata through the production method-channel seam. Independent mutation checks made the build-number assertions fail before restoration.
• crates/buzz-relay/src/handlers/event.rs:1522-1534,1667-1679 is test-fixture compatibility only; the changed handler subset passed 24 tests with 4 ignored.
• The longer footer remains centered, noninteractive text with one semantics owner and no added focus target or styling/contrast change.

Exact-head validation on clean trees: full just mobile-test passed (2,236 passed / 4 skipped, plus 3 push-unconfigured tests); focused changed settings tests passed (15); cargo test -p buzz-relay handlers::event::tests:: -- --nocapture passed (24 / 4 ignored); git diff --check passed. Mobile, Rust, PostgreSQL, security, macOS, Windows, and build CI gates are green.

Non-blocking confidence gaps: no independent installed iOS/Android artifact or VoiceOver/TalkBack observation. Full local buzz-relay testing had six unrelated media-test Sqlx(PoolTimedOut) failures after 1,047 passes; focused changed tests and exact-head CI passed. Desktop smoke shard 2 failed after exhausting retries because an unrelated file-upload test never observed upload-progress; the PR changes no Desktop source, while smoke shards 1/3/4 and Desktop Core passed.

Author action: none.
Verification owner: mobile release/artifact validation for native metadata and screen-reader behavior; CI/tooling owner for the unrelated flaky Desktop and local database-test failures.

[jedwards27]

:bot: Jude’s code review agent

APPROVE — reviewed exact head d82feb7b28d91d3022d4ef78e80a9c689dbd0d52 against base 6dfd145cde4bf0d45091de1cc5e6c7e3462d5703.

Findings

No unresolved author-actionable defect.

The mobile Settings path reads PackageInfo.fromPlatform() once, remains usable while metadata is pending, renders v<version> (<buildNumber>), and preserves the existing version-only fallback when the native build number is empty. Tests exercise normal, empty, and long Android-shaped build numbers at 2× text scaling and the pending-to-complete package-info method-channel path. The two relay edits only repair test fixtures for the current synchronous auth mutex.

Author action: none.

Verification owner: reviewer/tooling or the mobile release gate for optional independent installed-artifact confirmation.

Exact-head validation

• just mobile-install — pass.
• just mobile-check — pass.
• Full just mobile-test — pass on unchanged-head rerun: 2,236 passed / 4 skipped, followed by 3 unconfigured-build tests passed. An initial run had two push-export timing/order failures; the rerun and exact-head Clients / Mobile gate passed.
• Changed Settings tests — pass; mutation from build-aware formatting to version-only output made the intended cases fail before restoration.
• cargo test -p buzz-relay handlers::event::tests:: -- --nocapture — 24 passed / 4 ignored.
• git diff --check — pass.
• Exact-head mobile, Rust, PostgreSQL, security, macOS, Windows-build, and DCO gates passed.

The full local cargo test -p buzz-relay had 1,047 passes and six media-test Sqlx(PoolTimedOut) failures; the changed handler subset passed. The exact-head Desktop smoke shard 2 gate also failed while other desktop shards passed; this PR changes no Desktop production source, and the failure propagates only through aggregate Desktop jobs. These are confidence gaps, not evidence of a PR-caused defect.

Residual risk

Neither lane independently launched an exact-head packaged iOS/Android artifact or captured VoiceOver/TalkBack output. The PR screenshot, source inspection, widget tests, mutation proof, and exact-head mobile CI support approval, but native metadata retrieval and screen-reader pronunciation remain release/tooling-owned verification.

Cleanup: reviewer worktrees removed; no disposable REPOS/*-carl checkout remains.