fix: route channel references across clients

[loganj]

🤖

Summary

Channel references and Buzz deep links now open their destination inside Buzz across mobile and desktop. The table below makes the platform contract explicit.

Platform behavior

Behavior	Platform	Result
#channel references	Mobile + Desktop	Opens the named channel when it resolves. Unknown names remain inert.
buzz://channel/<channel-uuid> rendered as a bare URL, <autolink>, or [labeled link](...)	Mobile + Desktop	Opens the channel in-app. Channel UUIDs are validated and normalized to lowercase.
buzz://message?channel=<uuid>&id=<event-id> rendered in those same three forms	Mobile + Desktop	Opens the channel at the referenced message.
Message links with &thread=<root-id>	Mobile + Desktop	Opens the referenced reply in its thread.
OS-launched channel, message, and thread links	Mobile + Desktop	Opens the same in-app destination. Desktop queues links received before the authenticated router mounts, so cold starts do not lose navigation.
Sentence punctuation after a bare Buzz URL	Mobile + Desktop	Remains prose rather than becoming part of the message ID, thread ID, or invite code. This PR adds mobile handling and preserves the existing desktop message-link behavior; desktop channel-link handling is added in parallel.
Rendered buzz://join?... links	Mobile only	Continues through the in-app join flow. Desktop rendered-message join links are unchanged.
OS-launched buzz://connect, buzz://join, and buzz://add-community links	Desktop only	Existing native community onboarding behavior is unchanged.

Malformed or unsupported buzz:// forms remain inert. Existing HTTP(S), media, external-link, and specialized navigation behavior is unchanged.

Demo

Screen.Recording.2026-08-13.at.12.55.53.PM.mov

Addressed: rendered ChannelDeepLink targets now dispatch through resolvedChannelTap, message/join targets retain the pending-provider path, and regression coverage verifies the injected callback. Exact head 7c4ad10 is independently approved and CI is green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4ad8bdadad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brow]

🤖 Re-review at head b283471af3dfb101c72424813bbf92b061952abd. The angle-bracket blocker from my last pass is fixed. I found one new problem in the same recognizer, so I am not approving yet.

Fixed, and I confirmed it with a control

[label](<buzz://channel/UUID>) and [label](<buzz://message?...>) now keep their destination instead of being rewritten into a nested link, so the tap routes. I checked this two ways rather than trusting the new tests:

• Reverting only link_normalizer.dart to the previous head while keeping this PR's new tests makes both new tests fail. The coverage is genuinely sensitive to the fix, not decorative.
• The old head still reproduces the corruption on the same inputs.

Also confirmed: plain destinations, real autolinks, bare URLs, three repetitions in one message, titled destinations, image syntax, and code spans all still behave. Mobile suite 1354/1354, flutter analyze clean, desktop 4777/4777, tsc clean, Rust lib 2442 passed with the 45 deep-link tests included.

Blocker: quotation marks get pulled into the destination

Codex flagged this on link_normalizer.dart and it has not been answered yet. I measured it, and it is real at this exact head:

See "buzz://channel/550e8400-e29b-41d4-a716-446655440000" here

The closing quote is consumed as part of the URL, so the generated destination ends in ". _trailingPunctuationPattern covers .,!?:; and does not peel quotes, so nothing removes it later. The consequence is not cosmetic:

• A quoted channel link fails to parse and returns nothing, so the link cannot be opened at all.
• A quoted message link parses with a corrupted event id (abc" instead of abc).
• Single quotes behave the same way.

Desktop does not have this problem. Its bare-URL recognizers for channel and message links exclude quote characters from the match, so the same authored text routes there. That is the same cross-client split as the angle-bracket issue, which is what makes it worth blocking on rather than filing.

Scope, so this is not overstated: bare buzz:// linkification is new in this PR, so the buzz cases are new surface. The equivalent HTTP behavior is pre-existing, since the previous bare-URL pattern also stopped only at whitespace and closing brackets. I am charging only the buzz forms and I am not asking for a change to HTTP handling.

Suggested direction: exclude quote delimiters from the bare-link character class, matching what desktop already does. Worth adding a case with a quoted link, since the shipped tests do not cover one.

Non-blocking notes

• The new Rust ownership guard is correct, and its test is timing-weak. Making generation capture atomic with queue insertion is the right fix. But deleting the lock from with_current_generation leaves navigation_enqueue_holds_transition_ownership_through_queue_insertion passing, because the spawned thread usually has not reached its claim by the time the assertion runs. Adding a short delay before the assertion makes it fail without the guard and pass with it, so the guard is load-bearing and only the test is racy. Lock ordering is consistently commit then queue with no inverse, so I did not find a deadlock.
• Splitting deep_link_tests.rs out is a pure move: the set of function names across the two files is identical to the previous single file, and the module is still compiled under #[cfg(test)].

CI

Desktop Smoke E2E (3) is red, and it is not caused by this PR. messaging.spec.ts "compact link preview image geometry truncates long titles to one line" fails identically on main at this PR's own merge base, same shard, same assertion on naturalWidth timing out. The spec file is byte-identical between base and head and the PR touches no link-preview or media code. The Desktop job is only the aggregate gate over that shard. Everything else is success or skipped.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb9960835a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[loganj]

Exact head bb9960835aa2c08d6314b20cb35d546311d43c87 is frozen and ready for maintainer re-review.

What changed since the prior maintainer review:

• The superseded launch-restore profile tail now carries captured workspace ownership/relay through reconciliation and checks ownership immediately before external writes.
• Workspace-generation capture and navigation enqueue are atomic under the transition commit mutex, closing the stale insertion race.
• Mobile preserves authored angle-bracket Buzz Markdown destinations and now keeps closing single/double quotes outside bare Buzz URLs, so channel UUIDs and message event IDs remain valid.
• The oversized Rust test module was mechanically relocated; production code was unchanged by that split.
• All PR-range commits, including the two final deltas, are authored and signed by Logan; implementing-agent attribution remains in co-author trailers.

Exact-head evidence:

• Rust workspace: 2442 passed, 14 ignored; integration/doc suites green.
• Desktop TypeScript: 4777 passed.
• Targeted mobile: 116 passed before the quote fix; focused normalizer suite after it: 14/14 passed.
• Full mobile after the quote fix: 1351 passed, with the same four unrelated current-main Flutter ListTile-behind-DecoratedBox assertion failures in untouched channel/search tests.
• Rust formatting, Dart formatting, desktop file-size ratchet, and git diff --check pass.
• DCO is green.
• Fresh CI is terminal. Every applicable lane passes except Desktop Smoke E2E (3) and its aggregate Desktop gate. The failure is the known messaging.spec.ts “compact link preview image geometry truncates long titles to one line” naturalWidth == 0 image-load flake; it persisted through retries and was independently reproduced on this PR’s merge base with the spec byte-identical and no link-preview/media files changed here. Other one-attempt flakes recovered inside Playwright retries.

All substantive review threads have replies with exact-head evidence and are resolved. @brow the angle-bracket blocker and the quote-delimiter sibling are both fixed and covered at this head. @wesbillman requesting fresh review of this frozen head; GitHub still carries the historical CHANGES_REQUESTED decision from 130db86.

[loganj]

Final-head correction for reviewers: bb996083..417e7a88 is one Logan-authored/signed commit that closes the bare-Buzz prose-delimiter family after Codex identified typographic quotes.

Instead of enumerating the latest characters, the normalizer now uses Unicode Pe closing punctuation, Pf final quotes, and Terminal_Punctuation, with ASCII apostrophe/quotation mark as the only documented exceptions. Channel and message regressions cover 15 quote/bracket pairs and ideographic/full-width terminators. Existing HTTP(S) normalization is unchanged. Focused suite is 14/14; formatting and diff-check pass; Carl’s required pre-push Royals pass found no blockers.

@wesbillman the earlier request pointed at bb996083; please review frozen final head 417e7a88d9440e5fc520da6b798150b2970b8736. No review was submitted after the earlier request before this publication. The prior exact-head CI evidence still applies except for this two-file mobile boundary delta; fresh CI/DCO are running now. The unrelated Smoke (3) image-load flake remains documented with merge-base reproduction.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 417e7a88d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exclude typographic closers from bare channel links

When a bare desktop link is enclosed in typographic quotes, such as “buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32”, this pattern consumes the closing ”, while the trailing-punctuation pattern does not remove it. MarkdownChannelDeepLink then passes the corrupted URL to parseChannelLink, which rejects the non-UUID path and renders an inert span, so the channel cannot be opened; stop at or peel common Unicode prose closers.

Useful? React with 👍 / 👎.

[brow]

🤖 Re-review at head 417e7a88d9440e5fc520da6b798150b2970b8736 (merge base 45f4b91a3, unchanged). Disposition: one blocker, so I am not approving at this head.

Both prior blockers are fixed, and I confirmed the coverage is sensitive. The angle-bracket destination [label](<buzz://channel/UUID>) now renders a single working link, and the ASCII-quote case from the previous round routes correctly. Reverting only link_normalizer.dart to the previous head while keeping the new tests fails those tests, so the new arms actually pin the fix rather than passing incidentally. The move from character enumeration to Unicode Pe/Pf/Terminal_Punctuation is the better shape, and I verified it leaves HTTP(S) normalization and inline code untouched.

Blocker: the quote gap moved from mobile to desktop instead of closing

This is Codex's finding in this thread, unanswered at this head. I measured it independently against the real modules, and it is the same cross-client parity split as the previous two rounds, now inverted.

CHANNEL_URL_PATTERN in remarkChannelDeepLinks.ts excludes ASCII quotes but not typographic ones, and TRAILING_PUNCTUATION_PATTERN does not peel them. Driving the actual plugin and parseChannelLink:

Input around a buzz://channel/<uuid>	Mobile at this head	Desktop at this head
"…" ASCII quotes	routes	routes
“…” typographic	routes	inert, fails UUID validation
‘…’ typographic	routes	inert
「…」 CJK	routes	inert

So a message that opens correctly on mobile is a dead link on desktop, which is the parity goal this PR is for. Scope: remarkChannelDeepLinks.ts and its registration in the production plugin list are both new in this PR, so the defect ships with it. I am not charging remarkMessageLinks.ts, whose pattern is byte-identical to base and therefore pre-existing.

Worth noting the desktop suite is fully green over this gap. remarkChannelDeepLinks.test.mjs has two cases and no quote coverage, so a fix wants a regression arm mirroring the mobile matrix.

Non-blocking

A quote that appears mid-URL with no opening quote, as in buzz://channel/<uuid>"tail, is kept inside the destination on mobile and excluded on desktop. Contrived next to the enclosing-quote case, and I am not asking for it here, but it is the same asymmetry if you touch this code again.

Measurements at this exact head

Mobile 1355 passed, 0 failed; flutter analyze clean; focused normalizer suite 14/14. Desktop TypeScript 4777 passed, 0 failed. The CI workflow run was still in progress when I measured, so I am not making a CI claim at this head.

[loganj]

Reviewer bookkeeping: DCO’s app-owned suite remained stuck for 1h41m on 417e7a88, including after the authorized close/reopen webhook nudge. To mint a fresh check suite, I performed one authorized SHA-only amend and force-with-lease push.

New head: 173aa03a8f989db006ffe99d398826098e5b6195
Previous head: 417e7a88d9440e5fc520da6b798150b2970b8736

git diff 417e7a88..173aa03a is empty and both commits have identical tree 0b4fd153e969988d3d66fbabd4af959711088416. Logan authorship, committer identity, sign-off, message, and co-author attribution are preserved. This is zero content change, not a new review delta. @wesbillman your pending request survived and now points at 173aa03a; please review this head as content-identical to the previously requested 417e7a88.

Fresh DCO and CI suites are starting. No further pushes are authorized if DCO fails to emit on this fresh SHA.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 173aa03a8f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Normalize Buzz links inside prose parentheses

When a bare Buzz URL is enclosed in prose parentheses, such as (buzz://channel/580ca78b-9dae-46f3-8854-bd671853ba32), the preceding ( causes this branch to treat it as an existing Markdown destination and return it unchanged. Since it has no [label](destination) wrapper, GptMarkdown renders the custom-scheme URL as plain text rather than routing it through _buildLink, so tapping it cannot open the channel/message/invite; only skip ( when it is actually the destination opener after a Markdown label.

Useful? React with 👍 / 👎.

[brow]

🤖 Re-review at head 173aa03a8f989db006ffe99d398826098e5b6195 (merge base 45f4b91a36145f2ce642548c34f699f1b529bcf5, unchanged).

Disposition: blocker, no approval at this head.

First, confirming the bookkeeping independently: this head is content-identical to 417e7a88d. Both commits share tree 0b4fd153e969988d3d66fbabd4af959711088416 and parent bb9960835, and the only field that moved is the committer timestamp. So no review delta, and the two open findings below carry over unchanged rather than being new regressions.

1. Typographic and CJK closers still break the desktop channel link (carried over)

This is the round-5 blocker, still unfixed, and it is the finding Codex filed in comment 3779112248 at this exact head. remarkChannelDeepLinks.ts is a byte-identical blob (efafec770e) at both heads.

CHANNEL_URL_PATTERN excludes ASCII quotes but not Unicode closers, and TRAILING_PUNCTUATION_PATTERN only peels .,;:!?, so the closer stays in the value and parseChannelLink rejects it. Measured by importing the real plugin plus parseChannelLink, not a transcribed regex:

Input delimiter	Desktop	Mobile
bare, no delimiter (control)	routes	routes
ASCII " and '	routes	routes
typographic “ ” / ‘ ’	invalid-channel-uuid, inert span	routes
CJK 「 」	invalid-channel-uuid, inert span	routes
ideographic 。	invalid-channel-uuid, inert span	routes

Mobile's Unicode peeling is correct here. Desktop is the side that needs to stop at or peel these closers.

2. Buzz links inside prose parentheses stay inert on mobile (new this round)

Credit to Codex, comment 3779695731. I measured the consequence and scope rather than restating it.

In link_normalizer.dart, the preceding-character guard treats any ( as a Markdown destination opener, so a bare Buzz URL in prose parentheses is returned unchanged. Because linkBuilder is the only routing hook into _buildLink, text that never becomes a Markdown link cannot route at all. Measured against normalizeBareLinks:

• See (buzz://channel/<uuid>) stays unchanged, so it renders as plain text and cannot be tapped.
• (buzz://message?...) and (buzz://join?...) behave the same way.
• Controls: a bare buzz://channel/<uuid> linkifies, and a real [label](buzz://channel/<uuid>) destination is correctly left alone.

Desktop routes the parenthesized channel form correctly, so this is the same cross-client parity split as item 1, just in the other direction.

Scope: charged as new in this PR. At the merge base the bare-link pattern was (?<![(\]=])https?://[^\s)>\]]+, which is HTTP only and already excluded (, and there was no bare buzz:// linkification at all. HTTP behavior is unchanged by this PR, so I am not charging it. The narrow fix is the one Codex suggests: only treat ( as an owner when it actually follows a ] label.

Verification at this head

• Mobile: 1355 passed, 0 failed. flutter analyze clean.
• Desktop: 4777 passed, 0 failed.
• Both suites pass over both gaps above, so green is not evidence here. remarkChannelDeepLinks.test.mjs has no quote arms, and there is no prose-parenthesis arm for Buzz URLs. Worth adding arms for both alongside the fixes.
• CI run 31751237408 was still in_progress when I measured, so I am making no CI claim at this head.

[loganj]

Closing per loganj's direction: superseded by movement on main; workstream shut down.