[sqnico]

Summary

Add relay-owned scheduled delivery so a message still sends when its author's app is closed. The relay stores the exact signed message and publishes it when due, after checking access again.

• Add a private, owner-scoped queue with revisions, stable create retries, cancel, and send-now operations.
• Claim due work in PostgreSQL and commit the message, mentions, and sent state together. A cancelled or lost claim cannot publish later.
• Add migration 0087, desired-state schema, deletion cleanup, and reservation-aware replica proofs for late delivery.
• Keep the feature off by default. Advertise buzz-scheduled-messages-v1 only with BUZZ_SCHEDULED_MESSAGES=on.

Related issue

Related to #5356. Existing #5380 and #6325 cover local queues for the CLI and legacy desktop app; this PR adds the shared relay backend for the modern app. Companion app: block/buzz-app#3239.

Testing

• PostgreSQL: cargo test -p buzz-db --lib store::scheduled::postgres_tests -- --ignored --test-threads=1 — all 6 passed against a disposable local PostgreSQL server. Each test creates its own ScratchDb. Cases cover ownership, revisions, overdue delivery, replica reservations, retries, lost claims, cancellation, and deletion admission.
• Review fix: exact accepted operations are reconciled before freshness checks. Send-now timestamps come from the signed event. The database regression covers owner/community/revision isolation, delivery, and cancelled rows; the signed HTTPS test covers retries after acceptance.
• Real delivery: the companion app's scheduled-messages.live.test.ts passed against an isolated HTTPS relay. It sends through the real signed/authenticated endpoints and confirms delivery after the scheduling session closes.
• Local review: independent review covered claims, cancellation races, replica completeness, and rollout safety; reported blockers were fixed.
• Mandatory pre-push checks: Rust tests, native desktop Clippy/tests, file-size checks, branch checks, and repository policy checks passed.
• Broad validation remains incomplete: just ci passed Rust/workspace clippy, legacy desktop checks/native clippy, and web checks, then failed in unchanged mobile files during Dart formatting/package resolution. The full just test run was stopped because its runner selects the default development database rather than the isolated test server. Neither command is reported as green.

Rollout and limitations

Read docs/scheduled-messages.md before activation. Deploy the migration and reservation-aware replica probes everywhere with scheduling off, then enable the feature. Mixed-version activation and downgrade with pending work are unsupported.

• Maximum scheduling horizon: 120 days. Access is checked at admission and again at delivery.
• A late delivery retains its selected signed timestamp. Pending overdue work may hold replica proofs back and send reads to the writer.
• The queue guarantees one durable message event; external consumers keep their existing post-commit recovery behavior.
• The manual environment did not include object storage, so new attachment uploads were not tested end to end there.
• This PR does not enable the feature in production. The author confirmed successful testing on November 10, 2026, before the review fixes below. Those fixes need a new human acceptance pass. Human acceptance of the review fixes and current hosted CI remain pending. Current checks and security review should be verified for this upstream branch.

Replaces the fork-based relay PR #9323. The retry-idempotency review is addressed in the included fix; the original discussion remains available there.

Generated with Codex