[gilgtm]

Summary

Check channel archive state again immediately before a relay-hosted Git push or default-branch pointer compare-and-swap. Preserve the specific archived refusal and deterministic tests around the last check.

This is the final layer of the native stack split from this PR's former combined diff. The prerequisite PRs own the lifecycle API/schema (#8994) and shared channel write gates (#8995). Their tests remain with those implementations.

This is a last check, not a strict object-storage fence. A pointer write whose check passed before archive can still land afterward. The S3 timeout budget is not a server-side guarantee. Repository announcements remain ungated. The documentation retains those limits.

This is the top of the separate guarded lifecycle stack. The planned client-only Solo Workspace and local cache adoption above block/buzz-app#1507 does not require these new relay changes. Keep the stack and its host/plugin companions preserved as drafts. The bottom layer #8994 still has an unresolved hosted Relay E2E failure.

Related issue

NEXUS-4111, design NEXUS-4092. Companion drafts: block/buzz-app#2112 and squareup/buzz-nexus#172. The original #8909 discussion is preserved on this final layer.

Testing

On split head b69763b8c, all relay targets compile, 140 Git unit tests pass, and all 10 MinIO integration tests pass (four push tests and six settings tests). The integration tests used isolated NEXUS-4111 services and two fresh disposable databases, removed after the runs. The assembled tree matches the separately integrated original feature plus main exactly. Prior combined head c924969 passed 10 local MinIO Git tests and 140 Git API unit tests. The existing no-turn native/human acceptance belongs to the original relay/host/plugin pins. It does not exercise this newer-main integration or the real-worker launch race and active-turn stop barrier.

The original combined validation also disclosed broad buzz-db failures and a leaky create_respects_the_members_add_policy result that were not fully attributed. These are not erased by the split. All stack PRs remain draft; auto-merge is off. No deployment or lifecycle activation is authorized.

All just ci recipes passed on the assembled top head b69763b8c across the original run and recovery of its final recipes. The original runner stopped without a terminal result; no single uninterrupted just ci exit was recorded.

Validation record from the previous combined snapshots

Historical evidence only. These checks do not establish acceptance of the split or its newer-main integration.

• On the reviewed snapshot 54f4edd: Postgres integration tests for guarded archive and restore, the gate on each write path, workflows and community-deletion fences (archive_gate_postgres_tests.rs, lifecycle_postgres_tests.rs), and Git tests against MinIO. Each new guard was removed once to confirm a test fails.
• On the merged head (cb33c265b): focused Postgres lanes pass (buzz-db 59/59, buzz-relay 118/118), including the auto-join tests from feat(relay): auto-join new community members to default channels #8594 and the archive-gate tests. The archive-gate concurrency test fails when either new auto-join gate is removed. On c9249696e, the Git MinIO tests (10/10, run locally) and the api::git:: unit tests (140/140) pass. An agent review of the integration found no blockers. cargo fmt and cargo clippy --workspace --all-targets -D warnings are clean.
• Native app: The exact reviewed relay/host/plugin pins passed the authorized no-turn native scenarios on a disposable Mac: family archive, default and opt-in restore, search entry, and restart after a WebView cache/plugin journal wipe. The host event archive was retained. No agent turn ran; the real-worker race and active-turn stop barrier remain untested. These native results predate integration with current main.
• Known gaps:
  • In the focused buzz-relay run, create_respects_the_members_add_policy passed but was reported as leaky. Not attributed.
  • The full buzz-db lib lane is not green locally. Most failures also occur on the base commit; a few did not reproduce on rerun and are not attributed.
  • The Git MinIO tests in track_c_tests::external_infra_minio_tests do not run in CI (this predates the PR).
  • Human testing is pending.

Generated with Codex