feat(desktop): show private per-Desktop last-heard observations

[loganj]

Current verification — September 4

Exact-head CI SUCCESS, attempt 2: https://github.com/block/buzz/actions/runs/33891880665 . The cancellation regression passed on the same-head rerun, with all 695 selected buzz-agent tests passing (1 skipped). PostgreSQL 381/381 selected tests passed in the prior successful lane. No source changes or weakened guards. Earlier local/pending evidence below is historical. Live two-Desktop acceptance remains unperformed; this remains a draft, not a merge or deployment claim.

Latest restack receipt

Head 7284ffb2adb20156cb72e9538c5d9ddabd68209f, tree 3285243055238ad443daa01e76c59447eff9becb, now based on #7330 329554051b04e3d9d46e009067dc7d58bcee7711. Both freshness commits are patch-identical by range-diff; the only inherited delta is the one-line u64 source assertion correction. Original CI run 33889816973 Desktop Core failure was that assertion; current normal CI supersedes it. Validation listed below is the recovered pre-restack evidence, not a fresh native/live acceptance claim. No freshness behavior or size change.

Summary

Adds owner-private per-Desktop last-heard observations to the known Desktop list. This is host inventory/freshness, not agent presence, readiness, death detection, or remote controls.

• Kind 30181 uses signed, NIP-44 self-encrypted, bounded owner/community-scoped payloads. Registry, production admission, author-only fanout and FTS exclusion extend existing private-kind behavior.
• Native preparation signs a fresh observation for the persisted local Desktop coordinate without rewriting its immutable profile. Native reads authenticate and decrypt before returning host/time rows.
• Startup publishes/reads every 60 seconds and on relay reconnect. Owner/community changes and cancelled queries fence late results. An optional shared transport guard prevents a cancelled pulse from sending after rate-limit or reconnect waits (already-dispatched sends cannot be recalled).
• Known Desktop rows stay visible without pulse renewal. The UI shows Unknown / Recent / Stale last-heard time, updates aging every 30 seconds, retains cached observations on read failure, and labels partial inventory. A future sender clock is explicitly unknown, not recent.
• History/live replacement races use newest signed sender Unix seconds, then lower event ID, rather than arrival order. Same-second races and clock skew remain accepted advisory limitations.

Stack / related work

Depends only on private Desktop list #7330, branch feat/private-desktop-list-9c2da321, verified base head 329554051b04e3d9d46e009067dc7d58bcee7711. Topology: main → Desktop list → this freshness draft → capability details.

No #7327 pagination changes or development-auth hardening ancestry/code are introduced. Closest related draft is #7330; previous broad Multiverse foundations are protected references, not parents. This PR changes 19 files, +673/-30 (703 gross lines); the small expansion over the preserved ~600-line slice is regression-backed cancellation/ordering repair and adapting tests to main-based production auth.

Validation

• Final targeted/broader Desktop-list, observation and relay frontend tests: 187 passed / 1 failed (188 total). All feature and new regression tests pass. The failure is inherited from feat(desktop): list private known Desktops #7330: relayReconnectReplay.test.mjs still expects MAX_TIMESTAMP_DRIFT_SECS: i64, while admission now uses u64; reported to the parent writer.
• Rust workspace and native formatting pass. Changed TypeScript Biome checks pass.
• TypeScript check remains blocked by the same 8 pre-existing calendar/react-day-picker dependency errors, none in changed files.
• Reused evidence on unchanged freshness Rust source from preserved 45dece95: core 2 passed; DB 122 passed / 252 ignored; relay/DB all-target clippy passed; recovered author-only observation fanout 1 passed. These are pre-restack results, not newly claimed final-head execution.
• Production HTTP/WS owner/outsider/community isolation and FTS tests now extend feat(desktop): list private known Desktops #7330's feature-scoped production-auth fixture instead of the removed auth/pagination fixture. Discovery/format checked; Postgres execution and final-head Rust compilation not established locally.

Draft limitations

No native app / real two-host / live relay acceptance or screenshot acceptance was performed. Prior native build was blocked by sherpa-onnx download/DNS; dependencies were not installed or changed to work around it. Full just ci / service-backed integration was not run locally; ordinary publication CI supplies additional evidence. No service/config/production changes made. Capability details and remote lifecycle controls are later work.

[loganj]

Final-head validation disposition

Head 7284ffb2adb20156cb72e9538c5d9ddabd68209f, unchanged parent 329554051b04e3d9d46e009067dc7d58bcee7711. Actual PostgreSQL job 101093672861 executed 381 selected tests: all passed, including authenticated private observation/profile HTTP/WS query/storage and aged-profile production-ingest retry. Desktop Core, smoke and relay integrations passed.

The remaining historical Rust failure is buzz-agent::fake_llm::cancelled_turn_with_usage_emits_notification_before_response. The test writes cancellation to child stdin and immediately releases the fake HTTP response; a pipe flush does not prove the child processed cancellation. The full unexpected prompt frame is absent from the log, so this is a supported synchronization diagnosis, not a proven error-frame root cause. The buzz-agent source tree/dependencies are unchanged across base/list/freshness. Follow-up: capture unexpected frame, await cancel ACK while retaining notification/response frames, then release the HTTP gate. Preserve usage-before-response assertions; no production cancellation guard should be relaxed.

Requested failed-job rerun only at the same head, attempt 2: https://github.com/block/buzz/actions/runs/33891880665 . No source correction or automatic waiver claimed. The 703-line slice remains intact: removing privacy/cancellation/ordering regressions merely to reach the approximate 600-line target would reduce safety rather than scope. No dormant dependency or unrelated cleanup added.

[loganj]

Final CI outcome

Run https://github.com/block/buzz/actions/runs/33891880665 attempt 2 completed SUCCESS, with head unchanged at 7284ffb2adb20156cb72e9538c5d9ddabd68209f and base 329554051b04e3d9d46e009067dc7d58bcee7711.

The original cancellation case executed and passed in Rust job 101117684576; all 695 selected buzz-agent tests passed (1 skipped). Existing successful Desktop/native/PG/integration evidence is retained. No source changes, test weakening, or production cancellation changes were made. The earlier fixture synchronization follow-up remains valid despite this pass. Live two-Desktop acceptance and merge are not claimed.