[loganj]

Summary

• In the desktop app, people's names often turn back into public keys during a session. They come back only when the view remounts or the app restarts. Linear: BUZZ-501.
• Cause: when the viewer loses access to any one channel, revokeAccess and denyChannel empty the whole shared profile directory. Losing access includes being removed, a refused channel read, a roster read that leaves out a channel, or a suspended preview. Afterwards only open message windows and threads read their names again. About 30 views read names only when the IDs they show change, so they kept showing keys.
• Now the directory moves a purge generation on every clear and always notifies. A new hook, useProfileGeneration, exposes it. Each view that ensures the names it shows reruns that read when the generation moves.

Why not reread everything after a purge

The purge is deliberate. Mention completion offers every name in the directory, and revocation.test.ts makes sure that names known only from a lost channel are not read back. Here, a view reads again only the IDs it still shows. revokeAccess defers its notifications until it has purged the lost channel's content, so the first render that sees the new generation also sees the purged IDs.

Details

• profile-directory.ts: clear() increments generation and always notifies, so a read the purge aborted is retried even when nothing was loaded. ProfileQueries.generation is optional; test fakes need no change.
• Views covered: channel header avatars, the members dialog, member owners, Solo share (source and destination), Solo people, mention completion and the mention picker, the Inbox and Drafts, Reminders, Watching, Todos, workflow owners, agent activity, huddle avatars and the native huddle window, profile panels, the agent owner, Buzz link previews, composer models, thread and media review authors, search, community admin, agent browse and profile settings.
• MentionCompletion: its per-session demand budget now resets once per generation. Without that reset, its requested set blocked the reread.
• CanvasHistory stays mounted read-only after its channel is lost, and its loaded revision authors may be known only from that channel. While read-only, it does not reread on a purge.
• ProfilePanel: if keyboard focus is on Retry profile when a purge reread starts, Retry stays mounted as pending. On success, focus moves to the profile region, as for an explicit retry.
• huddle/window.ts (not React): its ensured key now includes the generation.
• CommunityAdmin: added the missing .catch on its ensure. This existing bug fires more often now that a purge can abort the read.
• Accepted residual risk: a few views get their IDs from outside access-scoped stores: a profile panel's target, agent owner labels, reminders, watched entries and draft mentions. These views reread right after a purge. A remount already does the same read, so this adds no new exposure.
• Not in this PR: the directory holds at most 1024 profiles or 2 MB and evicts the oldest inserted entry. A very large member list can still push out names that a view never asks for again.

Testing

• ChannelMemberAvatars.test.tsx, HuddleAvatarStack.test.tsx: with a real directory, a name is shown, clear() removes it, the view reads it again and it is shown again. The avatar test fails without the change.
• CanvasHistory.test.tsx: after a purge, writable history rereads its author and read-only history does not. The read-only case fails without the gate.
• ProfilePanel.fallback.test.tsx: a focused Retry survives a purge reread, and focus moves to the region on success. Fails without the focus fix.
• huddle/window.test.ts: unchanged participants are read again after a generation change. Fails without the change.
• profile-details.test.ts: clear() moves the generation and notifies, also when nothing was loaded.
• Full vitest run on this head: 14794 passed. 3 failed (emoji-mart, EmojiPicker.appearance, StatusEditor); the same 3 fail on unchanged origin/main in the same local worktree setup (symlinked node_modules; Vite denies files outside the root). tsc and biome check pass. Browser specs were not run locally.

🤖 Generated with Claude Code

[kalvinnchau]

🤖 Re-reviewed ce70ea5: the native composer generation and linked-message byline findings are fixed. Recovery checks fail on the previous head and pass here; no new actionable findings. CI is still pending. Native OS and real-relay integration remain unverified.