[sqnico]

Summary

Add relay-owned scheduled delivery so a message still sends when its author's app is closed. The relay stores the exact signed message and publishes it when due, after checking access again.

• Add a private, owner-scoped queue with revisions, stable create retries, cancel, and send-now operations.
• Claim due work in PostgreSQL and commit the message, mentions, and sent state together. A cancelled or lost claim cannot publish later.
• Add migration 0087, desired-state schema, deletion cleanup, and reservation-aware replica proofs for late delivery.
• Keep the feature off by default. Advertise buzz-scheduled-messages-v1 only with BUZZ_SCHEDULED_MESSAGES=on.

Related issue

Related to #5356. Existing #5380 and #6325 cover local queues for the CLI and legacy desktop app; this PR adds the shared relay backend for the modern app. Companion app: block/buzz-app#3207.

Testing

• PostgreSQL: cargo test -p buzz-db --lib store::scheduled::postgres_tests -- --ignored --test-threads=1 — all 5 passed against a disposable local PostgreSQL server. Each test creates its own ScratchDb. Cases cover ownership, revisions, overdue delivery, replica reservations, retries, lost claims, cancellation, and deletion admission.
• Real delivery: the companion app's scheduled-messages.live.test.ts passed against an isolated HTTPS relay. It sends through the real signed/authenticated endpoints and confirms delivery after the scheduling session closes.
• Local review: independent review covered claims, cancellation races, replica completeness, and rollout safety; reported blockers were fixed.
• Mandatory pre-push checks: Rust tests, native desktop Clippy/tests, file-size checks, branch checks, and repository policy checks passed.
• Broad validation remains incomplete: just ci passed Rust/workspace clippy, legacy desktop checks/native clippy, and web checks, then failed in unchanged mobile files during Dart formatting/package resolution. The full just test run was stopped because its runner selects the default development database rather than the isolated test server. Neither command is reported as green.

Rollout and limitations

Read docs/scheduled-messages.md before activation. Deploy the migration and reservation-aware replica probes everywhere with scheduling off, then enable the feature. Mixed-version activation and downgrade with pending work are unsupported.

• Maximum scheduling horizon: 120 days. Access is checked at admission and again at delivery.
• A late delivery retains its selected signed timestamp. Pending overdue work may hold replica proofs back and send reads to the writer.
• The queue guarantees one durable message event; external consumers keep their existing post-commit recovery behavior.
• The manual environment did not include object storage, so new attachment uploads were not tested end to end there.
• This PR does not enable the feature in production. The author confirmed successful testing of the current build on November 10, 2026. Keep it in draft until hosted CI completes; its current run requires maintainer approval: https://github.com/block/buzz/actions/runs/42852711417. The security review for the current commit range also awaits authorization from a user with write access.

Readiness checklist: buzz-review-completed (agent review, agent exercise, and human testing complete; hosted CI remains pending).

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is e2dc54e22fc113f298889d76c3acf674cb46db4b...4b5d43045020e0dddc82b7555d77600c3f00876e.
A new review must complete for this exact range. When manual authorization
is required, a user with write access must comment exactly
@buzz-security-review 4b5d43045020e0dddc82b7555d77600c3f00876e to authorize a new review.
Any previous review applies only to its recorded range.