BUZZ-271: Bound live-session revalidation

[bradseiler]

Summary

Close admitted root and huddle-audio sockets when durable community bans or membership changes are missed by Redis delivery. Revalidate direct members and verified owner-linked agents against PostgreSQL with bounded batches, concurrency, deadlines, and a fail-closed database-error grace period.

Fence refreshes against current membership and owner state so stale results cannot keep or restore access. Enroll sockets through the real admission paths and start the periodic worker from relay main. Community timeouts retain their existing session policy.

This draft includes the shared mesh receive fix needed for independent validation.

Related issue

BUZZ-271. Companion invitation replacement: #8237. Staging verification runbook: #8235. Regression coverage: #8239.

Testing

Validated 541284c1c67f16e30d7c8d52f57ed2965919797e: full DB/relay packages and doctests passed; the complete discovered PostgreSQL suite passed 941/941; a freshly built relay passed the separate live rehearsal.

Full repository just ci and just test passed on that same head.

The first normal push failed an unchanged composition logging fixture because its expected library warning was absent from captured output. Independent review found no candidate-caused defect; concurrent tracing-filter interference is plausible but unproven. The complete binary suite passed serially (34 passed, 1 ignored), and the full normal hook retry passed with one Rust test worker on the unchanged source head. No hooks or checks were bypassed.

Ordinary repository lanes retain configured infrastructure skips; the separate PostgreSQL suite uses isolated services. Existing ACP pipe-test leak warnings were reported with passing exit status.

Real root/audio admission PostgreSQL regressions pass; removing either production enrollment call makes the corresponding test fail. The separate-relay live rehearsal closed four root/audio member and owner-linked-agent sockets with policy code 1008 within 3.491 seconds of DB-only bans. It closed the two clear root/audio sockets within 9.997 seconds of restriction lookup failure. No Redis notification was published; the clear bystander remained responsive before the failure phase. Its agent fixture exercises owner-derived relay admission on both routes; a clear audio participant keeps the huddle active through the eviction and database-failure phases.

Independent agent review found no remaining blockers. Draft only: human testing and hosted cross-pod evidence remain outstanding.

Hosted CI on this head has an outstanding Desktop Smoke E2E shard 4 failure: the non-empty message-edit test failed all three attempts, causing both desktop summary checks to fail. Independent assessment found this unrelated to the relay/DB change: the desktop tree and smoke workflow match main, and this test edits an in-memory mock store without executing production Rust. Its root cause remains uncategorized. This draft does not claim all hosted required checks are green.

Companion drafts

Webhook owner policy: BUZZ-272.

Generated with Codex.