[gilgtm]

Summary

Add the relay contract for guarded task archive and restore: signed requests, lifecycle tokens, validated task-parent edges, atomic family changes, and authenticated state reads. The additive migration and both schema definitions stay with their admission and purge coverage.

This is the first layer of the stack that replaces the combined #8909 diff. The lifecycle flag defaults off. Do not enable it until the write-gate and Git layers have landed and the combined feature has been accepted. State reads remain available for recovery when the flag is off. The default subtree bound is 250 channels; the state request bound is 1,000.

This stack implements guarded archive and restore. It is separate from the planned client-only Solo Workspace and local cache adoption above block/buzz-app#1507. That path uses existing relay protocols and does not require this stack. Keep all three lifecycle layers as drafts. The hosted Relay E2E job on this layer failed at test_invite_claim_auto_joins_default_channel while waiting for a kind-44100 notification; attribution remains open.

Related issue

NEXUS-4111. This reuses the existing feature issue and implementation; it adds no separate product scope. Closest existing PR: #8909. Host companion: block/buzz-app#2112.

Testing

On split head ff27111a2, cargo check --locked -p buzz-relay --all-targets passes, the six lifecycle protocol/digest tests pass, and 17 focused PostgreSQL checks pass through scripts/postgres-test-run.sh. The database run includes guarded archive/restore, malformed and stale requests, child/TTL races, rollback floor, and desired-state/migration admission and purge. It uses the existing isolated NEXUS-4111 Postgres/Redis services and per-test databases. The previous native/human feature pass belongs to the pre-stack pins and does not validate the newer-main integration. This PR remains draft. No deployment or activation.

Stack and rollback

The next layer puts all ordinary channel mutations under the archive gates. The final layer checks Git pointer writes. Revert dependents before this layer; the migration is additive and contains no data backfill. Rolling back below the lifecycle-aware writer after feature activation requires a separate rollout decision.

All just ci recipes passed on the assembled top head b69763b8c across the original run and recovery of its final recipes. The original runner stopped without a terminal result; no single uninterrupted just ci exit was recorded.

Generated with Codex