adrienlacombe · adrienlacombe · Aug 13, 2026 · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026
diff --git a/.release/desktop-candidate.json b/.release/desktop-candidate.json
@@ -1,10 +1,10 @@
 {
   "schema": 2,
-  "version": "0.5.10",
-  "base_sha": "f35930104bcbdb1332ff13735214ecb9fce1fc7b",
-  "previous_tag": "desktop-v0.5.9",
-  "previous_base_sha": "f8f2ef0440e7a074223ec04dc3b32d817b8b9d9b",
-  "previous_merge_sha": "538e5e113fc33571f939c87b925567fd4e277109",
-  "tag": "desktop-v0.5.10",
-  "commit_count": 18
+  "version": "0.5.11",
+  "base_sha": "4749bc7be3cdb78c2db4ce4864775ba7ab60b4cc",
+  "previous_tag": "desktop-v0.5.10",
+  "previous_base_sha": "f35930104bcbdb1332ff13735214ecb9fce1fc7b",
+  "previous_merge_sha": "4b3570671eb2786594267758af18784ac6e82972",
+  "tag": "desktop-v0.5.11",
+  "commit_count": 16
 }
diff --git a/AGENTS.md b/AGENTS.md
@@ -172,8 +172,8 @@ place.
 | `.github/workflows/upstream-sync-merge.yml` | new | The deterministic (01:30) sync stage — the one that preserves the merge parent. Plain git, no AI. Optional `SYNC_PUSH_TOKEN` secret: a branch pushed with `GITHUB_TOKEN` does not start new workflow runs, so set a PAT if CI stops firing on sync PRs |
 | `.github/workflows/upstream-sync-ci-status.yml` | new | Labels an open sync PR `sync-ci-green`/`sync-ci-red` once checks settle, and re-requests the Copilot review that gh-aw's `reviewers:` fails to attach. Deliberately does not merge |
 | `migrations/0027_wallet_binding_fts.sql`, `0028_wallet_binding_fts_kind_move.sql` | new, and **kept after the feature was removed** | Search exclusions for the withdrawn NIP-SW wallet binding. They have already run on live databases and sqlx checksums applied migrations, so deleting them breaks startup validation. What they leave behind — a `search_tsv` expression excluding a kind nobody publishes — is inert, and unwinding it would rewrite a generated column across the whole events table for nothing. **Never edit or delete an applied migration**; add a follow-on |
-| `migrations/0029_channels_id_lookup_index.sql`, `0030_long_reaction_payloads.sql` | upstream's `0027_channels_id_lookup_index.sql` and `0028_long_reaction_payloads.sql`, **renumbered**; contents byte-identical | The fork holds 0027 and 0028, so upstream's own new migrations have to arrive above them. Two syncs running, so treat this as the standing cost of the fork's migration block rather than a special case. See [Upstream migrations arrive renumbered](#upstream-migrations-arrive-renumbered) |
-| `crates/buzz-db/src/migration.rs` | `migrations.len()` assertion is 30, not upstream's 28; upstream's channel-index assertion reads `migrations[28].version == 29`, its long-reaction assertion reads `migrations[29].version == 30`, and the highest applied version is `Some(30)` | Counts embedded migrations, so it moves whenever *either* side adds one. `0027` landed without bumping it and left the test failing on `main`; fixed in PR #9. Beyond the count, every upstream assertion that indexes `migrations[…]` past 25 or names a version above 26 has to be shifted by the fork's two — see the section below for why the test suite will *not* catch it if you forget |
+| `migrations/0029_channels_id_lookup_index.sql`, `0030_long_reaction_payloads.sql`, `0031_community_deletion.sql`, `0032_community_deletion_recovery.sql` | upstream's `0027_channels_id_lookup_index.sql`, `0028_long_reaction_payloads.sql`, `0029_community_deletion.sql` and `0030_community_deletion_recovery.sql`, **renumbered**; contents byte-identical | The fork holds 0027 and 0028, so upstream's own new migrations have to arrive above them. Four syncs running, so treat this as the standing cost of the fork's migration block rather than a special case. See [Upstream migrations arrive renumbered](#upstream-migrations-arrive-renumbered) |
+| `crates/buzz-db/src/migration.rs` | `migrations.len()` assertion is 32, not upstream's 30; upstream's channel-index assertion reads `migrations[28].version == 29`, long-reaction `migrations[29].version == 30`, deletion `migrations[30].version == 31`, deletion-recovery `migrations[31].version == 32`; and `deletion_surface_parity_between_migration_0029_and_schema_sql` looks up `version == 31` | Counts embedded migrations, so it moves whenever *either* side adds one. `0027` landed without bumping it and left the test failing on `main`; fixed in PR #9. Beyond the count, every upstream assertion that indexes `migrations[…]` past 25 or names a version above 26 has to be shifted by the fork's two — see the section below for why the test suite will *not* catch it if you forget. **The highest-applied-version assertion is no longer a fork patch**: upstream's 2026-08-13 range replaced the hardcoded `Some(30)` with a `latest_version` derived from `MIGRATOR`, so it now tracks the renumber on its own — take upstream's version if it ever conflicts again |
 | `.github/workflows/macos-canary.yml` | new; `push` trigger on `main` with desktop path filters | Unsigned macOS canary; upstream only has a *signed* one, which a fork cannot run. Builds automatically when `desktop/**`, `crates/**` or the root `Cargo.*` change, so the newest artifact always matches `main` — it was dispatch-only, and the sole artifact went 13 commits stale. Free: the repo is public, so GitHub-hosted macOS runners are unbilled. Stages the artifact and the usage notes under the product name read from `tauri.conf.json`, not a hardcoded one, so the brand rename below cannot publish a build under the old name. Sets `signingIdentity: "-"` in its inline config and runs **without** `--no-sign`, which would silently discard it; asserts the bundle signature of the `.app` inside the mounted DMG. Its **sidecar list must track upstream's non-Windows lanes**: `tauri.conf.json`'s `externalBin` is shared, and `scripts/bundle-sidecars.sh` exits 1 on a missing binary, so a sidecar upstream adds breaks this workflow without ever conflicting — `buzz-backend-kubernetes` (#4289) did exactly that in the 2026-08-03 sync |
 | `Dockerfile` | `buzz-paymaster` added to the cargo build, the strip step, and both `COPY` stages | The sponsor ships in the relay's image so there is one publish pipeline and one immutable `:sha-<7>` tag for `deploy-aws.yml` to pin. Four one-line additions, each inside an existing parallel list, so a conflict resolves as *keep ours, take upstream's*. It is **not** the `ENTRYPOINT` — `infra/aws/paymaster.tf` overrides `entryPoint` |
 | `.github/aw/actions-lock.json` | new | gh-aw action SHA pins |
@@ -245,12 +245,16 @@ database**, so the side with *applied history* keeps it — the fork. Same shape
 collision, opposite resolution, because "already deployed" points at different
 parties in the two cases.
 
-It has now happened twice running — `0027_channels_id_lookup_index.sql` (upstream
-#4647) in the 2026-08-05 sync, then `0028_long_reaction_payloads.sql` (upstream #3833)
-in the 2026-08-06 sync, renumbered to `0029` and `0030`. Expect it on any sync that
-touches `migrations/`, and note that the *second* collision is the more dangerous
-shape: upstream's 0028 landed on the fork's 0028, so the two files sorted adjacent and
-the tree looked plausible. **A new file under `migrations/` is the tripwire — check the
+It has now happened on three separate syncs, covering four migrations —
+`0027_channels_id_lookup_index.sql` (upstream #4647) in the 2026-08-05 sync, then
+`0028_long_reaction_payloads.sql` (upstream #3833) in the 2026-08-06 sync, then
+`0029_community_deletion.sql` **and** `0030_community_deletion_recovery.sql`
+(upstream #4425) together in the 2026-08-13 sync; renumbered to `0029`, `0030`,
+`0031` and `0032`. Expect it on any sync that touches `migrations/`, and note that
+the *second* collision is the more dangerous shape: upstream's 0028 landed on the
+fork's 0028, so the two files sorted adjacent and the tree looked plausible. The
+2026-08-13 sync was that shape twice over — both of upstream's new files landed on
+fork-held integers. **A new file under `migrations/` is the tripwire — check the
 version integer before reading anything else in the diff.**
 
 The first one is worth keeping in full because it shows exactly how the failure hides
@@ -297,10 +301,28 @@ merge cleanly into a tree where both are wrong:
 |------|----------|--------------------------------------|
 | 2026-08-05 | 0027 → 0029 | `migrations[26].version == 27` → `migrations[28].version == 29`; `applied_versions(…).last() == Some(27)` → `Some(29)` |
 | 2026-08-06 | 0028 → 0030 | `migrations[27].version == 28` → `migrations[29].version == 30`; `migrations.len()` 28 → 30; `applied_versions(…).last()` → `Some(30)` |
+| 2026-08-13 | 0029 → 0031 **and** 0030 → 0032 | `migrations[28].version == 29` → `migrations[30].version == 31`; `migrations[29].version == 30` → `migrations[31].version == 32`; `migrations.len()` 30 → 32; **and a version-literal lookup**, `find(\|m\| m.version == 29)` → `31`, in `deletion_surface_parity_between_migration_0029_and_schema_sql` |
 
 Only `migrations.len()` arrives as a *conflict*; every indexed assertion arrives as
 clean context, which is why the diff will not point you at them. Grep the test module
-for the old integer instead. A cheap independent check that the rename actually took:
+for the old integer instead.
+
+**Grepping for the index is not enough — there is a third shape.** The 2026-08-13
+sync added `deletion_surface_parity_between_migration_0029_and_schema_sql`, which
+resolves its migration with `MIGRATOR.iter().find(|m| m.version == 29)` rather than
+by index. Fixing the count and both indexed assertions left it silently reading the
+*fork's* 0029 (the channels index), where it found zero deletion tables and failed.
+So sweep for all three: `migrations.len()`, `migrations[N]`, and `version == N`.
+Unlike the indexed assertions this one does fail loudly, which is the only reason it
+was caught — do not rely on that holding for the next one.
+
+That sync also renumbered **two** migrations at once, and upstream's second file
+(`0030_community_deletion_recovery.sql`) landed exactly on the fork's own `0030`.
+Renumber the whole upstream block in one pass and keep its internal order; the
+recovery migration alters tables the deletion migration creates, so a reordering
+that happens to dodge the collision would still fail at runtime.
+
+A cheap independent check that the rename actually took:
 
 ```bash
 ls migrations/*.sql | sed 's|.*/||' | cut -d_ -f1 | sort | uniq -d

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,31 @@
 # Changelog
 
+## v0.5.11
+
+### Desktop and shared changes
+
+- perf(desktop): persist channel snapshot hash ([#5684](https://github.com/block/buzz/pull/5684)) ([`c86443c5997c96c42829ce200e73e6e6efe52d96`](https://github.com/block/buzz/commit/c86443c5997c96c42829ce200e73e6e6efe52d96))
+- fix(agent): raise output limit and allow 3 recoveries ([#5475](https://github.com/block/buzz/pull/5475)) ([`72d56e7bd3a94fa3ee20b5a50bd1b868a9329d9c`](https://github.com/block/buzz/commit/72d56e7bd3a94fa3ee20b5a50bd1b868a9329d9c))
+- fix(desktop): defer foreground resume work ([#5696](https://github.com/block/buzz/pull/5696)) ([`59f613c404958d8ac99525b4aaaf26843257de31`](https://github.com/block/buzz/commit/59f613c404958d8ac99525b4aaaf26843257de31))
+- perf(desktop): coalesce thread-activity localStorage writes ([#5693](https://github.com/block/buzz/pull/5693)) ([`c6c6e7eca70d6b526c43af925e596e8616b19fb8`](https://github.com/block/buzz/commit/c6c6e7eca70d6b526c43af925e596e8616b19fb8))
+- Batch observer-store publications per relay envelope ([#5680](https://github.com/block/buzz/pull/5680)) ([`c3b0ccf383fe4ee936abbe6b9c9134b5728cc2b5`](https://github.com/block/buzz/commit/c3b0ccf383fe4ee936abbe6b9c9134b5728cc2b5))
+- feat(buzz-acp): idle re-sleep for woken lazy pools ([#5682](https://github.com/block/buzz/pull/5682)) ([`dc2dbfe0f570abb818d3f3da8a71ea235555ed27`](https://github.com/block/buzz/commit/dc2dbfe0f570abb818d3f3da8a71ea235555ed27))
+- fix(desktop): preserve agent mention separator after send ([#5623](https://github.com/block/buzz/pull/5623)) ([`a8e5c89e23b85ee93306f2c3c11d8fe6300cd360`](https://github.com/block/buzz/commit/a8e5c89e23b85ee93306f2c3c11d8fe6300cd360))
+- fix(link-previews): proxy sent preview media ([#5627](https://github.com/block/buzz/pull/5627)) ([`884ed8a5d35dfba3892fc40437f39e08856dec7d`](https://github.com/block/buzz/commit/884ed8a5d35dfba3892fc40437f39e08856dec7d))
+- feat(deletion): add durable whole-community deletion ([#4425](https://github.com/block/buzz/pull/4425)) ([`8a2c9af2dbe0cf315e77f43a4560d3572da5e554`](https://github.com/block/buzz/commit/8a2c9af2dbe0cf315e77f43a4560d3572da5e554))
+- fix(desktop): preserve live channel timelines ([#5662](https://github.com/block/buzz/pull/5662)) ([`63d14a0e95c8d5ae19f3f80123027729ec209bb2`](https://github.com/block/buzz/commit/63d14a0e95c8d5ae19f3f80123027729ec209bb2))
+- Refine channel settings and profile panels ([#5574](https://github.com/block/buzz/pull/5574)) ([`63f961c7e4818a1d29f1185002c123e486bd4a19`](https://github.com/block/buzz/commit/63f961c7e4818a1d29f1185002c123e486bd4a19))
+- fix(deps): bump webbrowser to 1.2.4 for RUSTSEC-2026-0257 ([#5659](https://github.com/block/buzz/pull/5659)) ([`c966b862fe8b9018c68c384b1680ca0173d0128c`](https://github.com/block/buzz/commit/c966b862fe8b9018c68c384b1680ca0173d0128c))
+- fix(desktop): launch Databricks OAuth from passive model discovery ([#5607](https://github.com/block/buzz/pull/5607)) ([`1ff98fa685fdb7133dbc18437d23dcdeeb42ce6e`](https://github.com/block/buzz/commit/1ff98fa685fdb7133dbc18437d23dcdeeb42ce6e))
+
+### Other repository changes
+
+- feat(acp): report standard adapter usage ([#4950](https://github.com/block/buzz/pull/4950)) ([`4749bc7be3cdb78c2db4ce4864775ba7ab60b4cc`](https://github.com/block/buzz/commit/4749bc7be3cdb78c2db4ce4864775ba7ab60b4cc))
+- fix(mobile): settle hydrated threads on latest reply ([#4702](https://github.com/block/buzz/pull/4702)) ([`7634fe74563ea7f3c86fb6017a0ad647a9934477`](https://github.com/block/buzz/commit/7634fe74563ea7f3c86fb6017a0ad647a9934477))
+- feat(acp): deliver channel description in prompt [Context] ([#4552](https://github.com/block/buzz/pull/4552)) ([`6e0631f6b5d2139e4e080bf94e27ecee8a3d4d74`](https://github.com/block/buzz/commit/6e0631f6b5d2139e4e080bf94e27ecee8a3d4d74))
+
+[Compare desktop-v0.5.10...desktop-v0.5.11](https://github.com/block/buzz/compare/desktop-v0.5.10...desktop-v0.5.11)
+
 ## v0.5.10
 
 ### Desktop and shared changes

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -15,6 +15,7 @@ members = [
     "crates/buzz-test-client",
     "crates/buzz-ws-client",
     "crates/buzz-admin",
+    "crates/buzz-deletion",
     "crates/buzz-workflow",
     "crates/buzz-media",
     "crates/buzz-paymaster",
@@ -136,6 +137,7 @@ schemars = { version = "1", default-features = false }
 buzz-core = { path = "crates/buzz-core" }
 buzz-conformance = { path = "crates/buzz-conformance" }
 buzz-db = { path = "crates/buzz-db" }
+buzz-deletion = { path = "crates/buzz-deletion" }
 buzz-auth = { path = "crates/buzz-auth" }
 buzz-pubsub = { path = "crates/buzz-pubsub" }
 buzz-search = { path = "crates/buzz-search" }