Add lean snapshot presence for profiles and conversations

[wesbillman]

Updated by Brain on behalf of Wes (@wesbillman); presence implementation and DCO commits are attributed to Brain. Reused thread and fixture corrections preserve Pinky’s authorship and sign-offs.

Summary

One lean replacement for the frozen approaches in #39 and #47. This PR replaces their implementation; it does not itself close either old PR.

• Periodic, bounded snapshots for profile/message/thread presence; no presence subscriptions, live/snapshot reconciliation, extra socket, or durable publication queue.
• Reuse session/socket owners, one app input source and standard Web Locks. Same-socket lossy renewal; ordinary chat admission stays separate and actual server cooldowns remain shared.
• 256 mounted-author cap with profile priority and explicit overflow Unknown; fixed 100ms initial batching, ≥5s starts, 60–65s refresh, 75s display-evidence expiry.
• Include contributor scope/necessity guardrails and docs/presence.md with the approved tradeoffs.

Combined production diff versus main 7ce898e: 869 additions / 75 removals across 15 files. This includes the separately authorized thread correction from #72 (19 additions / 6 removals). The presence repair itself is 19 additions / 16 removals across five existing files, within its under-60-line checkpoint. The combined total exceeds the earlier 850-addition checkpoint by 19; this accounting was surfaced before pushing. No tests or safety behavior were removed to lower the count.

Current repair and verification

Head: 7063d6976894d92499e51bc2d30be96714250b31, based on main 7ce898eb6f77ca4fb95f06a7c7789f63245dee28.

• Presence no longer waits for global HTTP/setup idleness. Existing optional-flight limits, five-second pacing and actual relay cooldowns remain.
• Publication distinguishes accepted (true), known locally unsent (null), and refused/unconfirmed (false). Only locally unsent current status retries after 5–6 seconds through the existing renewal timer; no replay queue or optimistic Online.
• Reuses Restore bottom positioning for ordinary routed threads #72 commits 8b9082e and 05b873e (local cherry-picks d2404c5 and ef3ca39). Extends the link fixture with its required Unknown presence contract; cold-opening coverage gates warming and selects the current editable composer. No retries or relaxed deadlines/counts.
• Built-app outcome: in Chromium and WebKit, relay-accepted Online publication, visible timeline Online and successful chat publication occur while an ordinary HTTP response and channel EOSE remain held. Production app/broker, local modeled relay and ephemeral identities; not a deployed-account measurement.
• All three complete affected browser files pass 20/20, one worker, no retries (presence, composer-links, navigation-thread-history). Seven focused owner files pass 100/100. pnpm check passes. These ran at ef3ca39 plus the exact patch committed as ab5083f; the pre/post-commit binary patch SHA-256 matches b7595efec2ebcfa4afd2ba3d6485e3518d03aa961bb6cd131b2e8b7ab50fe444.
• Ten changed-call-site reversions each produce the expected regression assertion failure in a separate mutation checkout; restoration hash verified after every mutation. This audits this repair, not every call site in the original feature.
• Pinky's independent review found no blocker in the five-file production patch, SHA-256 56ff2058b2f3755ff3d1f98de0654925d05ac1c561697ffa9db533cae25db3e2. Requested doc correction applied; production hash unchanged.
• Normal commit and push hooks passed; push hook at ab5083f: TypeScript and 788 tests in 65 related files. All outgoing commits have sign-offs; no force-push or hook bypass.
• Hosted run at ab5083f failed one WebKit shard: 102 pass / one emoji-picker hit-test failure. Failed job. Its trace identifies the 13th result below the browser viewport after the standalone narrow fixture reflows.
• 7063d69 adds three test lines only: scroll the complete picker region into view before geometry and edge-hit checks. No production change, assertion removal, timeout/retry increase, or tolerance change. Pinky's independent source review found no blocker at file SHA-256 df75646737b6e0aeb36422ba39819dd69462e1e433726f6ce470bcb21f18f95a.
• The corrected complete emoji file passes Chromium locally. macOS WebKit stops earlier at the unchanged editor-containment assertion (emoji.spec.mjs:298): 0.234375px overflow, reproduced with identical values on clean main 7ce898e. That unrelated assertion and product code remain unchanged; no complete local WebKit pass is claimed.
• Diagnostic copies bypassed only that earlier baseline-proven assertion to reach the picker and forced its bottom to ~1102px in a 950px viewport. In both engines the original hit-test fails without the correction and the journey passes with it. Those copies are not committed and are not acceptance evidence for the intact file; Linux CI must run that file.
• Commit/push hooks at 7063d69 pass, including TypeScript and 788 related tests. Remote head verified. One post-push hosted check: DCO successful; CI started, not yet green; review required. Current run. Repository requires CI required, DCO Check and code-owner approval. No merge or live-app restart.

Earlier implementation evidence (not reattributed to current head)

Original implementation state: 199e8b059898f7e57a6c5409d36f85a824d1f3b2 plus the changes committed as f9fd81c. The follow-up c75b768 restores the ordinary broker character-limit contract (presence alone gets the byte cap) and updates real-host cleanup coverage to match and remove exact listener identities.

• TypeScript + staged-file Biome pass. Original push hook: 707 tests in 59 related files pass at c75b768; hook failures were fixed, not bypassed.
• On f9fd81c production bytes: 16/16 presence/profile/thread-unread browser cases in Chromium/WebKit. Real built app and production broker; modeled upstream and disposable identities. Includes send/receive while presence is held, 300 distinct thread authors, 256-author cap/overflow, all 300 released reply authors Unknown during a held replacement response, and real same-origin Web Lock handoff with resumed publication.
• Existing opening/scroll full files: 8/8 pass, including 640-message traversal, DOM bounds, live edits and reading anchors.
• Matched baseline versus implementation: three runs per engine/state, 24 opening cases. 300-author cold full-traversal/render medians ~4.25s in both states/engines; warm channel medians Chromium 15.3→18.1ms and WebKit 40→40ms, all <100ms. Cold channel outliers are unattributed. These are fixture diagnostics, not relay-scale or universal latency claims.
• Independent design, first-slice and final seven-line row-source reviews reported no remaining blockers on the reviewed production manifests. The resolved integration through main 06737cc also received a scoped independent source review with no remaining source blocker; that is not feature/performance signoff for the subsequent 7ce898e integration.

Validation gaps

• Hosted CI at the current head is not yet certified. Full just scan, native checks and the complete browser suite were not repeated locally for this small repair; earlier measurements above remain attributed to their own snapshots.
• Additional lifecycle/transport mutation regressions and the real-browser idle/input journey were exercised locally before the previous main merge. Those six test-only edits remain separate and do not certify this head; the ten repair-specific mutations above are current.
• No native or real-account launches/writes were performed. Deployed relay-load capacity and attended/native UI acceptance remain outside the fixture evidence. Wes's running checkout is untouched and is not running this repair.

Originating Buzz channel: 2128346d-ae35-4e44-98f7-5f278fe7b60d (presence-sensing), thread d7b76d481ab011f1f2d260739a4ea5a9d28fa510d67ce32a24d701f2f95a01cd.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Review result: no actionable code findings at this head

Reviewed head c75b768639c3ee8a6e0213878bf43ae3e57ea076, current target base 06737cc1af201950d916992e04ab2bd28756498f, and diff from merge base 199e8b059898f7e57a6c5409d36f85a824d1f3b2. This is a comment review, not approval or a merge-readiness certification.

The integrated review covered profile/message/thread consumers, bounded mounted-author demand and overflow, whole-response trust and omission semantics, visibility/disconnect/cache/access invalidation, activity and Web Lock ownership, same-socket lossy publication, and separation from ordinary HTTP/socket admission. Three independent review lanes returned with no actionable code defects; I reconciled their findings against the owning code and consumers. The snapshot-only design and documented lossy/Unknown behavior were treated as requirements, not defects requiring a return to live reconciliation.

Independently verified on clean c75b768

• bin/pnpm exec vitest run: 1,275 tests passed in 125 files.
• bin/pnpm test:browser presence.spec.mjs --project chromium --project webkit --no-deps: 10/10 passed, using the built app and production broker with modeled upstream/disposable identities. Covers chat while snapshots are held, 300-author cap/overflow/remount, and actual cross-window Web Lock handoff.
• bin/pnpm typecheck and merge-base git diff --check: passed. A focused controlled-clock probe also confirmed reconnect fences a held old snapshot, preserves the five-second start gate, and disposes timers. HEAD and tracked cleanliness were checked before/after the runs.

Remaining readiness work, separate from code findings

The draft conflicts with current main. Integrate and revalidate the combined result; this review does not certify a hypothetical merge. Actual browser idle → Away publication → input → Online publication, the documented mutation audit, and the full required batch/native coverage remain outstanding. The hosted snapshot exposed successful Semgrep, zizmor and DCO checks, but no functional CI result. The focused browser command above intentionally did not run dependent measurement projects or the rest of the browser suite.

One existing upstream limitation is worth retaining explicitly: the relay presence producer uses get_presence_bulk(...).await.unwrap_or_default(), so a Redis failure can be returned as HTTP-success empty presence and displayed as Offline. I checked the producer at block/buzz@beb5b5348b16eda96284c7f06bda2303e8019729, crates/buzz-relay/src/api/bridge.rs:2054–2118. This is not a client regression or a request to expand this PR into relay changes; the normal relay-signed kind-20001/p-tag/status wire shape matches the client.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source review: clear, not merge-ready

Reviewed 2f77fb6 against exact base/merge-base 7ce898e. No actionable PR-introduced code defect found in the supported broker-backed presence slice. All three independent review lanes returned and were integrated.

• Traced profile, timeline and thread demand through the session-owned 256-author directory, complete validated snapshots, Unknown/expiry semantics, and access/cache/connection/disposal boundaries. The current-main avatar, typing, workflow and transport integrations preserve those owners.
• Traced the single app input source, Web Lock renewal ownership, same-socket ephemeral publication, generation/abort fences, optional admission and shared cooldowns. Preserved the approved periodic/lossy behavior: ordinary traffic may starve presence; no presence REQ, added socket, durable queue or direct-adapter parity is required.
• Validation remains blocked: exact-head GitHub Actions run 34955866487 failed browser measurements, all four browser-journey shards and CI required. JavaScript, Rust/tool integration, Windows and DCO passed. Failure annotations inspected do not establish the cause; I have not classified these failures as unrelated or flaky. Resolve or explicitly disposition the hosted failures before calling this merge-ready.

This automation performed source/metadata inspection only on the authorized laptop: no checkout, dependency installation, build, tests or PR-code execution. Earlier browser/runtime results do not certify this integrated head. Current-head browser acceptance, native/real-account behavior, deployed capacity, full idle/input integration and the complete mutation audit remain unverified. This is a COMMENT, not an approval.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source re-review: no actionable code findings

Reviewed head 7063d69 against exact base/merge-base 7ce898e. This is a COMMENT, not approval or merge-readiness certification.

Reused the completed whole-feature review at 2f77fb6 for unchanged source and reviewed the four-commit repair delta with its owning functions and consumers. All three independent review lanes returned and were reconciled.

• Presence: bounded HTTP reads and same-socket publication can now progress during ordinary requests/channel setup while retaining separate one-flight/five-second admission and actual shared cooldowns. Only definitely locally-unsent null gets the 5–6s retry, sampling current activity through the existing timer. Refusal/unconfirmed outcomes retain the minute interval; teardown fences remain, and acceptance never directly paints Online. This intentionally supersedes the earlier review's ordinary-traffic starvation allowance, not the approved snapshot/lossy contract.
• Thread integration: mounted ordinary roots clear the navigation deadline without skipping bounded-history positioning. Intervening user input wins; exact-message reveal/focus and history anchoring retain their existing owner. Inspected the added held-pagination, abort and real-navigation-deadline regression sources.
• Emoji test correction: the only change after ab5083f scrolls the standalone fixture into the viewport before geometry/hit testing (emoji.spec.mjs:514–516). Relative dimensions, clipped-pane containment and every visible result's edge hit assertions remain intact. No production change or demonstrated assertion weakening.

Validation limits

This pass used pinned source/metadata only on the authorized laptop: no checkout edits, installs, builds or test execution. Pinned base-to-head git diff --check passed. Earlier runtime results and author-reported repair tests are not independent validation of this head.

The inspected current-head Actions run 34973567147 was still in progress; this review does not assert a terminal green result or classify predecessor failures as flakes. Resolve or explicitly disposition the current hosted gate before merge readiness. The documented native/real-account/deployed-capacity limits, full browser idle → Away → input → Online integration, full-feature mutation audit and remaining complete-batch coverage are not certified by this source review.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Automated source review: clear, not approval

Head 7063d69, exact base/merge-base 7ce898e. No actionable code findings.

This automation carries forward the completed integrated source review of this exact head. I revalidated its pinned source hashes, reread the repair delta and responsible owners, and integrated an independent check of the thread/UI evidence boundary. The earlier three review lanes are complete; no lane remains outstanding.

• Bounded snapshot presence and same-socket renewal preserve session ownership, honest Unknown/expiry semantics, ordinary-traffic coexistence and actual shared cooldowns. Only definitely locally-unsent null receives the short current-status retry; refusal/unconfirmed outcomes retain the minute interval.
• Ordinary thread presentation clears its navigation deadline without bypassing bounded-history positioning or user intent. Exact-target reveal/focus remains separate. The emoji change scrolls the standalone fixture into view before the retained geometry, containment and edge-hit assertions.
• Limits: source/metadata only on the authorized laptop, with no PR-code execution. Pinned base-to-head git diff --check passed. CI was not refreshed because the required CI Results tool preflight could not be established; the earlier review’s in-progress CI snapshot is not a current result. Verify/disposition the hosted gate before merge readiness. Direct-adapter presence parity remains excluded; native/attended-account behavior, deployed capacity, full browser idle/input integration, complete mutation coverage and full/local-only runtime acceptance are not certified.

This is a COMMENTED review, not approval or merge-readiness certification.