Deleting an auto-archived huddle channel returns 400 "channel is archived" #2954

Describe the bug

Deleting a channel after it has been archived fails with:

relay returned 400 Bad Request: invalid: channel is archived

The user-visible case is an ephemeral huddle channel. When the last participant leaves, the relay automatically archives the huddle channel. Desktop can keep the channel row visible and offers Delete channel; confirming deletion sends NIP-29 DELETE_GROUP (kind 9008), which the relay rejects before reaching the delete handler. The same context menu can show Archive channel even though the relay already considers the channel archived.

The underlying protocol path is broader than huddles: the relay rejects kind 9008 for any archived channel. Both archived-channel guards exempt only an unarchive event (kind 9002 with archived=false), even though the later kind 9008 validator independently enforces owner authorization and the handler performs a soft delete.

Steps to reproduce

1. Create a channel as its owner.
2. Archive it with kind 9002 and archived=true; ending a huddle so its ephemeral channel auto-archives also reproduces this.
3. As the same owner, submit a kind 9008 delete-group event for that channel. In Desktop, right-click the retained huddle channel, select Delete channel, and confirm.
4. Observe the HTTP 400 response: invalid: channel is archived.

Expected behavior

An authorized owner should be able to permanently delete an archived channel. Kind 9008 should pass the archived-channel gates and continue through its existing owner-only validation before the soft-delete handler runs. Other writes to archived channels should remain rejected.

Desktop should also render lifecycle actions from the authoritative archived state, offering Unarchive channel rather than Archive channel when appropriate while still allowing deletion.

Version and platform

• Buzz version: 0.4.26
• OS: macOS 26.5.2
• Relay: commit c0d7b52af8d5f3572790be697dd2c4bf3c6a3b8f; current upstream main at c2a4ee711e481bb427d6cf8cd08b2c7329d1508c has the same guards

Logs / additional context

Relevant code paths:

• validate_admin_event rejects archived channels before its kind 9008 owner check:

  buzz/crates/buzz-relay/src/handlers/side_effects.rs

  Lines 276 to 290 in c0d7b52

  	// Reject mutations on archived channels — except kind:9002 with archived=false
  	// (unarchive), which must be allowed through so the channel can be restored.
  	let channel = state
  	.db
  	.get_channel(tenant.community(), channel_id)
  	.await
  	.map_err(|_| anyhow::anyhow!("channel not found"))?;
  	let is_unarchive_request = kind == 9002
  	&& event.tags.iter().any(|t| {
  	let parts = t.as_slice();
  	parts.len() >= 2 && parts[0] == "archived" && parts[1] == "false"
  	});
  	if channel.archived_at.is_some() && !is_unarchive_request {
  	return Err(anyhow::anyhow!("channel is archived"));
  	}

• The general ingest guard independently rejects every archived-channel event except unarchive:

  buzz/crates/buzz-relay/src/handlers/ingest.rs

  Lines 1953 to 1968 in c0d7b52

  	if channel_id.is_some() {
  	// Allow kind:9002 with archived=false (unarchive operation)
  	let is_unarchive = kind_u32 == KIND_NIP29_EDIT_METADATA
  	&& event.tags.iter().any(|t| {
  	let parts = t.as_slice();
  	parts.len() >= 2 && parts[0] == "archived" && parts[1] == "false"
  	});
  	if !is_unarchive {
  	if let Some(channel) = &channel_row {
  	if channel.archived_at.is_some() {
  	return Err(IngestError::Rejected("invalid: channel is archived".into()));
  	}
  	}
  	}
  	}

• Kind 9008 already has owner-only authorization:

  buzz/crates/buzz-relay/src/handlers/side_effects.rs

  Lines 635 to 654 in c0d7b52

  	9008 => {
  	// DELETE_GROUP: owner only, or the owning human of the channel's agent-owner.
  	let members = state.db.get_members(tenant.community(), channel_id).await?;
  	let actor_member = members.iter().find(|m| m.pubkey == actor_bytes);
  	match actor_member {
  	Some(m) if m.role == "owner" => Ok(()),
  	_ => {
  	// Allow the owning human of any active owner-role agent in the
  	// channel, even when the human is not a channel member —
  	// diverges from kind:9001 intentionally.
  	if actor_owns_any_owner_agent(state, tenant.community(), &members, &actor_bytes)
  	.await?
  	{
  	return Ok(());
  	}
  	Err(anyhow::anyhow!("only owner can delete group"))
  	}
  	}
  	}
  	9022 => {

• Huddle teardown auto-archives the ephemeral channel:

  buzz/crates/buzz-relay/src/audio/handler.rs

  Lines 834 to 842 in c0d7b52

  	info!(channel_id = %channel_id, "audio room empty — auto-ending huddle");
  	match state
  	.db
  	.archive_channel(tenant.community(), channel_id)
  	.await
  	{
  	Err(e) => {
  	warn!(channel_id = %channel_id, "auto-archive failed, huddle stays alive: {e}");

A focused regression should archive a channel, submit a correctly signed kind 9008 as its owner, and assert that the channel is soft-deleted; a non-owner kind 9008 must still be rejected.

Duplicate search: no existing open or closed issue or pull request was found for this archive-then-delete failure.