[matt2e]

DO NOT MERGE. #1821's tree plus one debug-only commit, so the native app can be built and exercised on the complete first-run flow. Nothing in it is meant to land.

Onboarding stack (merge in order, top to bottom):

1. fix(navigation): run the visit deadline only while a presenter is attached #1814 navigation: visit deadline only while a presenter is attached (merged)
2. refactor(communities): extract the join owner and add the pre-join relay lookup #1815 communities: join owner and pre-join relay lookup (merged)
3. feat(identity): observable nsec backup status with pass tickets, explicit lock release, and refused-recovery copy #1816 identity: native nsec backup status (merged)
4. feat(identity): first-run Builderlab account client and dev seed — bundled-grant sign-in, account reads, key link/unlink, backup, saved communities #1818 identity: first-run Builderlab account client and dev seed
5. feat(identity): first-run setup store, step table and pages (composition follows in the next PR) #1819 identity: first-run setup store, step table and pages
6. feat(identity): the first-run Welcome flow replaces the key-setup gate (FOUNDATION: App.tsx) #1820 identity: Welcome flow replaces the key-setup gate
7. feat(settings): read-only Key backup row in Settings → Identity #1821 settings: read-only Key backup row
8. [DO NOT MERGE] chore(identity): DO NOT MERGE — isolated debug Keychain slot (full stack for native testing) #1822 DO NOT MERGE: isolated debug Keychain slot (full stack for native testing) ← this PR

Diff over #1821: production +2/−2; tests +6/−3 — the isolated debug Keychain slot (xyz.block.buzz.desktop.identity.debug.onboarding) so a dev build of this branch does not share an identity with the primary checkout.

Native testing on this tree

Build and run the desktop app from this branch. Because of the debug slot, the first run starts from an empty identity without disturbing the primary checkout's Keychain item. To reset the slot between runs:

security delete-generic-password -s xyz.block.buzz.desktop.identity.debug.onboarding -a human

Native evidence (first-run recordings, hands-on checks) applies only to this tree; the PRs before it are unit/integration-tested only. No native run has been made since the rebase onto main without #1817.

Checks run

• Rebased onto main 9818f778e without feat(builderlab): tenant table — a login origin per hosted relay, granted natively and accepted by the binding signer #1817 (2026-10-30). tsc --noEmit is clean at each of feat(identity): first-run Builderlab account client and dev seed — bundled-grant sign-in, account reads, key link/unlink, backup, saved communities #1818–feat(settings): read-only Key backup row in Settings → Identity #1821. At the stack head 5daa01ffd ([DO NOT MERGE] chore(identity): DO NOT MERGE — isolated debug Keychain slot (full stack for native testing) #1822; same tree that was tested): full vitest run 13,915 passed, 1 failed (codex-sh.test.ts, outside the stack, passes 3/3 alone); biome check on the changed files and the design push check pass.
• Pushed with --no-verify: the pre-push unit check failed only on 5 s timeouts in files the stack doesn't touch while the machine was at load ≈45; all 7 of those files pass when run alone. Rust is unchanged below [DO NOT MERGE] chore(identity): DO NOT MERGE — isolated debug Keychain slot (full stack for native testing) #1822 and was not re-run locally.

🤖 Generated with Claude Code