[RossHartmann]

This fixes a set of desktop and mobile unit test failures. Five are real defects and two are test-only fixes.

Real defects

• Hosted-agent identity sealed an all-zero key (mobile). identityBundle wiped the agent secret before it copied the bundle out of a BytesBuilder(copy: false). The builder still held a reference to the secret, so the sealed envelope carried 32 zero bytes. The bundle is now copied out first and the secret wiped after. Caught by hosted_agent_create_flow_test: the envelope opens with the provisioning key.
• An owner-write retry could reuse the burnt proof (mobile). After a replayed or expired proof, the retry signed a "fresh" proof in the same second. Same tags plus the same created_at gives the same event id, which the API has already burnt. The retry now signs at least one second after the previous attempt. Caught by hosted_agent_management_test: a write re-signs a replayed proof.
• Quadratic bare-link pass (mobile). The new bare-link step found Markdown links with !?\[[^\]\n]*\]\([^)\s]*\). On an unclosed run ([[[[…, [x]([x](…) the regex rereads the rest of the input from every opener. The 256 KB near-limit test took 108 s against its 2 s ceiling. A one-pass scanner with precomputed stop indexes finds the same spans. It was checked against the regex on 200k random strings with no mismatch, and it handles each 256 KB case in a few milliseconds.
• Respond-to picker regression (desktop). The upstream sync (Sync upstream block/buzz main (97e1f6a0) into the Kiingo fork — DO NOT MERGE until main's go #202) dropped the fork's RespondToField change from aac9e12. That change offers a pasted npub or hex key whatever the search returns, and the people search asks for the member picker's page size (25). This restores it on top of upstream's truncateNpub and squircle avatars.
• Two linkify instances (desktop). Since fix(deps): clear Dependabot npm advisories in the workspace lockfile #255 the lockfile resolves linkifyjs 4.3.2 for desktop and 4.3.3 for @tiptap/extension-link. Link's onCreate registered the buzz protocol on 4.3.3, while composerMessageLinkNode and bareLinks read 4.3.2, so pasted buzz:// links were not found there. Desktop now resolves 4.3.3, and the lockfile has a single instance. pnpm install --frozen-lockfile --lockfile-only passes.

Test-only

• Router tests under NODE_ENV=test (desktop). In that mode, TanStack Router's node isServer export is undefined. The router then treats a jsdom process as a client and sets up scroll restoration through bare history, addEventListener and scrollTo, which jsdom only puts on window. The three router-mounting tests (openChannelDirectoryResolver, inboxReopenNavigation, useRetainedProjectGitViews) now expose them.
• requesterLine (desktop). The older-route test matched "request" inside the wrapper's own data-testid. It now checks visible text only.

Not changed here

• A few Flutter widget tests failed only intermittently under load. They need a rerun, not a code change.

Tests were not run locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J3gDfAMsUq8X2NqFTrbJc6