feat(multiverse): mounted Start Restart and Move controls

[loganj]

Draft scope

Mount one live lifecycle/Stop receiver and Known Desktops controls. Start/Move choose destination; Restart resolves current host. Exact retry keeps signed bytes; unavailable provisioning is visible. Mounted interaction regression test.

Depends on feat/lifecycle-client-16211fef; part of six dependent drafts atop #7347 (dfce9ba3). Frozen inventory/Stop heads are unchanged. Head: 9800686a59d81e17528ce79fa891b357cca8f886.

Evidence

The composed candidate 5ec1955862d11bd9c01b7e3318f09b7076101423 passed full just ci, 6,266 frontend tests, production artifact build, 3,178 native unit + 10 integration tests, and native/workspace Clippy. This is composed-candidate evidence, not a claim that each earlier unmounted slice independently exercises the whole feature. Splitting changed no product bytes.

Earlier direct package attempts exposed environment limitations: relay media tests lacked a configured PostgreSQL pool; a direct buzz-db source-attribution guard failed in the unchanged production source; the first separate PostgreSQL lane failed local setup before tests. Full just ci subsequently passed its configured lanes. Separate populated PostgreSQL/private relay evidence is being collected, not assumed green.

Explicitly unperformed / not delivered

• No two-Desktop/two-Mac lifecycle walkthrough, successful real relocation, or real process-tree cleanup acceptance. These are documented limits, not a drafting gate.
• No deployed host-owned broker credential provisioner. Production Start/Restart cannot spawn a new keyless runtime until that integration is supplied; the current provider returns provisioning_unavailable. Injected success tests are not deployed provisioning evidence.
• No keys, files, configuration, or workspaces transferred. No auth weakening, arbitrary signer, or keyful launch fallback.
• Draft only: no merge, deployment, release artifact, or technical approval claimed.

Product authority

Approved Multiverse semantics: newer sender seconds/lower event-ID ties; scoped Stop; current-host-only Restart; failed/interrupted Move has no automatic continuation. This follows the settled Multiverse design rather than the older provider/key-transfer vision in VISION_REMOTE_AGENTS.md.

Origin channel: f45d3304-dcf0-44e8-a46d-bcd63b235fbc
Origin thread: 16211fefcee85904f49802ce5e1709bf24b4895401a944f0585e70233c4e4d39
Owner drafting direction: 4ed62424758aea3898b084f9e24d7fd9791d7dc53738d01ed1c0dbbae1adb8e7.

CI slice correction — 2026-09-04

Current head: 4e7b31e0dc6ab265c6f10f173dbe503e3eeeb814. CI attempt 1 fixed a split-only Clippy failure: #7352 introduced provision before its receiver caller existed. The stub and its two imports now arrive with #7353 instead. No lint suppression was added. #7352's corrected source passed native fmt, full native workspace tests, and desktop-tauri-clippy locally. #7353–#7355 were rebased; each resulting source tree is identical to its respective previously validated head (verified with git diff --exit-code). The composed tip is 4e7b31e0dc6ab265c6f10f173dbe503e3eeeb814, source-identical to 2f26d5f3. Remote checks are being followed on the new heads; not yet claimed green.

Review disposition: self-review complete, no submitted GitHub technical review at this readback. No independent approval claimed. The launch-provisioning integration and native walkthrough limitations above remain unchanged.

Mounted integration correction

Current head: 9800686a59d81e17528ce79fa891b357cca8f886. Test-only follow-up scopes the existing Stop host-label assertion to the host list (the new destination option uses the same label). The mounted smoke path now also exercises Start provisioning refusal and exact-byte retry. pnpm test:e2e:smoke desktop-stop.spec.ts passed; full frontend suite passed all 6,266 tests. Product sources are unchanged from 4e7b31e0; prior native/relay/DB evidence is reused. Fresh CI is running. The screenshot is mock-IPC evidence, not real launch acceptance.

[loganj]

Additional exact-head validation

At composed tip 5ec1955862d11bd9c01b7e3318f09b7076101423, the separate PostgreSQL lane now passes 260/260 (all buzz-db ignored PostgreSQL tests plus the Desktop transport tests). This includes populated migration 0049 and both lifecycle kinds through authenticated HTTP/WS privacy and exact-request duplicate redelivery.

The previous 259/260 result was a fixture URL spelling issue: an unchanged test strips postgres:// literally; the initial local admin URL used postgresql://. Using the test-supported URL spelling resolved it with no product change.

Full composed just ci, 6,266 frontend tests, 3,178 native unit + 10 integration tests and Clippy remain passed. Real two-Desktop/process-cleanup acceptance and deployed broker provisioning remain explicitly unperformed/unimplemented; this evidence does not establish real relocation.

[loganj]

Final self-review delta: head 2f26d5f3581329299beaefd9481d757104eaa646 additionally persists a superseded Stop outcome before replying, so explicit duplicate delivery retains exact signed outcome bytes. Full native suite passes at this head (3,178 unit + 10 integration tests) with serialized test execution, and native Clippy passes. The first concurrent native rerun hit the existing forced-discovery shared-counter test; serialization resolved it. Frontend/relay/DB sources are unchanged from the prior full evidence. Fresh remote CI is running. Independent technical review is not claimed.

[loganj]

CI slice correction — 2026-09-04

Current head: 4e7b31e0dc6ab265c6f10f173dbe503e3eeeb814. CI attempt 1 fixed a split-only Clippy failure: #7352 introduced provision before its receiver caller existed. The stub and its two imports now arrive with #7353 instead. No lint suppression was added. #7352's corrected source passed native fmt, full native workspace tests, and desktop-tauri-clippy locally. #7353–#7355 were rebased; each resulting source tree is identical to its respective previously validated head (verified with git diff --exit-code). The composed tip is 4e7b31e0dc6ab265c6f10f173dbe503e3eeeb814, source-identical to 2f26d5f3. Remote checks are being followed on the new heads; not yet claimed green.

Review disposition: self-review complete, no submitted GitHub technical review at this readback. No independent approval claimed. The launch-provisioning integration and native walkthrough limitations above remain unchanged.

[loganj]

Mounted Start/Restart/Move controls

Product source: 9800686a59d81e17528ce79fa891b357cca8f886 (product-identical to 4e7b31e0). Captured with the updated Stop + lifecycle smoke path; native IPC is mocked, not a two-Desktop launch. The test passed and verifies exact-byte retry for Stop and Start.

Provisioning unavailable

The destination and current-host-only Restart controls are mounted. Start reports the missing launch provisioner explicitly; no new process is claimed.

[loganj]

CI follow-through: receiver failure must not move app chrome

Fixed at 110374bd4ce1daf77509a830a56ee9725fe313f0. The global receiver now uses the existing notification host, with one persistent, dismissible warning per receiver. Scope exit/reconnect retires its warning; late rejected initialization cannot recreate it.

The smoke fixture now explicitly forces lifecycle-history admission to fail. The warning must be visible and the original macOS navigation center must remain at y=23, with the existing fixed sizes/traffic-light clearance unchanged. Default mock history admission succeeds rather than incidentally invoking an unsupported command.

Validation of the working delta committed verbatim as this head: all 6,267 frontend tests, TypeScript, Biome and all four Stop/chrome mounted smoke tests passed. New unit coverage checks deduplication, scope cleanup and late rejection. Prior native/relay/PostgreSQL evidence remains applicable: this delta changes no native or relay product source. Self-review only; no submitted independent technical review.

This screenshot uses mocked native IPC, not real cross-Desktop process execution. Fresh CI: https://github.com/block/buzz/actions/runs/33929050884

Workflow investigation: the original CI artifact put Hello {{trig in the trigger condition rather than the message-step textarea. Retry 1 reached autocomplete but had a 279-pixel background displacement diff. A local pre-controls comparison at #7354 3f50260b reproduced the same 438-pixel macOS snapshot mismatch as the repaired candidate (workflow-header toggle and trigger icon); the missing-listbox race was not reproduced locally. No workflow assertions or snapshots were changed. Current Linux CI will establish the repaired head's disposition.

[loganj]

Final current-head CI disposition

110374bd4ce1daf77509a830a56ee9725fe313f0 is terminal green: https://github.com/block/buzz/actions/runs/33929050884 . All four smoke shards (including workflow/chrome), Desktop Core, macOS/Windows builds, Rust checks and both relay-backed Desktop E2E integration shards passed. This supersedes the red 9800686a run, not its historical findings.

The six Start/Restart/Move drafts remain open and conflict-free. #7350/#7352/#7353/#7354/#7355 are green at their current heads. #7351 remains terminal red only on the separately classified unchanged workflow smoke failure; its frontend/smoke trees match green #7350. No independent GitHub technical review has been submitted on these drafts; self-review is complete, not independent approval.

Native two-Desktop discovery/Stop/reconnect/process-cleanup acceptance remains unperformed and documented, per the request to continue drafting without it. Real keyless launch is an implementation gap: broker_launch::provision returns ProvisioningUnavailable; Start cannot create a new keyless runtime and Restart checks provisioning before stopping its current child. Completing the launch path requires the host-owned scoped-session issuer/adapter plus a broker-capable native runtime. Neither these green checks nor mocked screenshots establish working relocation. Nothing merged or deployed.