[tellaho]

Category: improvement
User Impact: Fresh installs start with Reminders and Workflows off. Existing installs keep both features available, including when their settings were never changed.

Problem: Changing only the bundled defaults would silently disable these features for existing profiles without overrides. That stops local reminder notifications and removes the controls for workflows that can still run on the relay.

Solution: Change the browser and native defaults to Off, then save each known bundled plugin's resolved state. Existing profiles without a Reminders or Workflows flag retain their former On state. Saved On/Off choices always win; a deliberate reset uses current defaults. If an automatic native snapshot cannot be saved, startup uses the resolved values and later catalog reads retry. Explicit changes and reset still report write failures. Browser reset backs up the original settings and atomically replaces their key, preserving the original if the replacement fails.

The native migration checks whether the plugin-profile directory existed before acquiring the registry lock. Browser storage checks for prior plugin settings or client records before client initialization. New devices or cleared local profiles count as fresh even if the account has older relay data. No relay usage scan, registry schema change, or activation/UI redesign is involved.

The accepted plugin-defaults decision makes future default-off changes apply only to fresh installs. Both storage owners now retain known states across subsequent releases; the decision also requires legacy backfills for users who skip releases that would have saved those states.

File changes

• src/bundled/index.ts and crates/plugin-manager/src/lib.rs: new defaults, native profile detection, initialization under the existing lock, and explicit reset behavior.
• src/plugins/storage.ts: equivalent browser initialization, saved-choice precedence, and recovery behavior.
• Native management tests, frontend storage tests, and app composition tests: cold launch/reopen, untouched upgrade, partial and explicit choices, future default changes, storage failure, and recovery.
• Browser fixture and feature journeys: explicit opt-ins where optional features are required; model fresh plugin choices before seeding community records.
• tests/browser/plugin-defaults.spec.mjs: real app startup without fixture storage, plus migrated activation, working Workflows navigation, deliberate disable, and reload.
• AGENTS.md, docs/plugin-defaults.md, docs/plugin-architecture.md, and docs/buzz-help.md: the durable policy and user-facing behavior.

Reproduction steps

1. Open a fresh disposable profile. Reminders and Workflows should offer Enable under Settings → Plugins → Manage plugins, including after another launch.
2. Upgrade an existing profile that previously opened Buzz but never saved plugin choices. Both should remain on, and the Workflows page should remain usable.
3. Repeat with saved On and Off choices. Those choices should remain effective.
4. Enable or disable either plugin through Settings and reload. The choice should persist.
5. After deliberately recovering/resetting plugin settings, both should be off and remain off after reopening.

Validation

Current head eda7b3f03 fixes native automatic snapshot failures in 46756c962 and browser reset replacement failures in eda7b3f03.

• New regressions failed on the previous implementation: the native catalog returned a snapshot write error, and both browser reset cases lost their original key. With the fixes, all 104 native package tests and 130 frontend plugin-owner/app-composition tests passed.
• At clean eda7b3f03, the complete plugin-defaults.spec.mjs and launch-home.spec.mjs passed 22/22 cases in Chromium and WebKit, including the recovery/reset UI (pnpm test:browser tests/browser/plugin-defaults.spec.mjs tests/browser/launch-home.spec.mjs --project=chromium --project=webkit --no-deps). Two workers, zero retries. No browser cases or fixtures changed in this follow-up.
• Commit and pre-push checks passed. Native first-launch snapshot failure can still leave a directory that a later process classifies as an existing profile; the decision document records this limitation. Restart stability requires a successful snapshot save.

The earlier merge head ff8e6c9ed brings in main 517443522 without rewriting the published branch. The merge applied without conflicts and includes the mainline history geometry / Virtua fix.

• The complete plugin-defaults.spec.mjs and history-loading.spec.mjs passed 48/48 cases in Chromium and WebKit at the clean merge head, in 2.1 minutes (pnpm test:browser tests/browser/plugin-defaults.spec.mjs tests/browser/history-loading.spec.mjs --project=chromium --project=webkit --no-deps). Two workers, zero retries; unrelated measurement projects were excluded.
• Blob comparisons confirm the native manager, browser plugin storage, frontend default declarations, and decision document are identical to e6f8f4a07. The history spec matches main exactly except for the explicit Workflows fixture opt-in; main's assertions remain intact.
• Mandatory pre-push checks passed: TypeScript and related unit tests, design-system checks, workspace Clippy and publication checks. The PR remains ready for review; native UI / human migration acceptance remains pending.

At clean commit 31d97764c:

• pnpm exec vitest run src/plugins src/app/pages.integration.test.mjs: 128 passed, 11 complete files.
• cargo test -p buzzodz-plugins --locked: 103 passed across the complete package suite.
• pnpm test:browser tests/browser/plugin-defaults.spec.mjs tests/browser/notification-settings.spec.mjs tests/browser/settings.spec.mjs --project=chromium --project=webkit --no-deps: 38 passed in 1.3 minutes. Unrelated measurement projects were excluded.
• The new frontend regression suite produced six failures against the previous browser storage implementation at 73a0bd246, then passed with this migration. The comparison used a temporary Vite transform without editing production working-tree files.
• Mandatory commit and pre-push checks passed: formatting, TypeScript and related unit tests, design checks, workspace Clippy, and publication checks. A merge simulation against current origin/main completed without conflicts.

Two browser journeys were added (four cases across the engines), with none removed. They exercise app startup ordering and plugin activation/Settings integration; the state matrix remains in storage tests. Fixture datasets and workers are unchanged. A comparative setup-cost benchmark was not run; no performance claim is made.

The earlier broader run at 15c902232 passed 337/340 cases across 19 complete specs. Its three failures reproduced on unchanged upstream 134248ba7: macOS Alt+ArrowUp scrolling in both engines and sidebar keyboard focus in WebKit. That broader set has not been rerun locally for this migration; current hosted CI supplies the broad check.

Native UI walkthrough and human acceptance of this migration remain pending.

Review follow-up at e6f8f4a07

• Extended the existing native/desktop parity test to guard the legacy-On migration set. No production declarations changed.
• Added an isolated browser page with no fixture init scripts, seeded only with a client record. It checks both plugins stay On across reopening. This adds one journey (two engine cases); none were removed.
• All 103 native package tests and all 10 cases in the complete plugin-defaults browser spec passed at the clean follow-up commit. Mandatory pre-push checks passed.
• Investigated the advisory CI drag-loop failure. On clean pre-fix main b293002a0, using its frozen dependencies and no changes from this PR, the same assertion failed twice in 10 Chromium repetitions: 4 drag steps versus at least 6. Its 10 WebKit repetitions passed locally. The assertion counts drag steps, not message rows.
• Current main 3fabf1be4 passed 20/20 repetitions across both engines. It already contains the shorter viewport / available-distance adjustment from f557d0a5, along with a newer Virtua patch. The comparison does not isolate those two mainline adjustments. This establishes that the failure exists independently of this PR; the unrelated scrolling test remains unchanged here.

Comparison command: pnpm test:browser tests/browser/history-loading.spec.mjs --project=chromium --project=webkit --no-deps --grep 'a held pointer scrolls across the page without being pulled back' --repeat-each=10. Local headless macOS runs used two workers and zero retries. Baseline traces were retained. CI originally reported 3 steps in Chromium and 5 in WebKit.

Screenshots

Fresh-profile controls are visually unchanged by the migration. These captures are from the earlier built-app walkthrough with disposable data; the migration is covered by the current tests above.

Plugin	Fresh profile
Reminders
Workflows

[tellaho]

🤖 Carl: Enabled buzz.reminders explicitly in the notification-settings fixture so its existing eight-switch layout assertion retains full coverage. The production diff remains four lines.

At 73a0bd24606a931d08a9bb0226cd009f1893c51f, the complete spec passed in Chromium and WebKit (2/2): pnpm exec playwright test --config tests/browser/playwright.config.mjs --project chromium --project webkit --no-deps tests/browser/notification-settings.spec.mjs. Mandatory pre-push checks passed. Full CI for the new head remains pending.

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Verdict: one recommended blocker, which is a product decision on the upgrade path. The default flip itself is correct and consistent across the browser and native catalogs. Saved On/Off choices survive on both backends, and the test changes keep their real coverage.

What was checked at 73a0bd2: browser and native persistence (a focused storage probe covered the snapshot upgrade, explicit Off on reopen, and a missing flag), other default catalogs and indirect dependants (none found), fixture ordering and retained journey assertions, and the user-facing behavior traced from source. Hosted CI is green, with Windows native skipped. Native UI wasn't exercised.

One thing the PR body should say: browser changePlugin saves the whole resolved map (src/plugins/storage.ts, in changePlugin). So a browser profile that ever toggled any plugin keeps Reminders and Workflows on after upgrading, and only untouched profiles lose them. Native saves only the targeted override. This behavior predates the PR and is fine. It does mean "profiles without a saved override" covers a different set of people on each backend.

Optional follow-up: a deep link, Back entry or reminder notification that targets a disabled Reminders or Workflows page reaches failure = "unavailable" (src/app/navigation.ts:151). It then shows "It may have been removed, or you may need to update Buzz" (src/app/App.tsx:497). That advice is wrong for a plugin that is only turned off. This already happens with Bestie and Todos, but this PR puts it in front of every upgrader. Saying " is turned off" with a Manage plugins action would fix it, and a separate PR is fine.

To merge: resolve the inline thread, either by keeping existing users' plugins on or by explicitly accepting the upgrade behavior and documenting it.

[kalvinnchau]

🤖 Two maintainability and regression-coverage improvements below. No current migration defect was demonstrated; the overall CI run still has unresolved scrolling failures.

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Verdict: no blockers. The legacy-On migration resolves my earlier upgrade-path blocker. Untouched upgraders keep Reminders and Workflows on, fresh installs start with them off, and saved choices still win on both backends.

This was a split review: native, browser, and policy/docs each had an independent reviewer, and I integrated the results. Checked at ff8e6c9:

• Native: all seven read() callers hold registry.lock. Only Manager::lock creates profiles/<p>, and desktop opens the Manager after sign_out::boot.
• Browser: the catalog is pinned before client storage is created. The v1, v2 and v3 shapes, explicit choices and a second viewer behave correctly.
• Compatibility: older builds read the full bundledOverrides map without trouble.
• Docs and fixtures: they match the normal-path behavior, and the fixture edits don't weaken any existing assertion.

Two small checks were run on the failure paths. A disposable scratch test covered native, and a probe of the real storage module covered the browser. They reproduced the two inline findings. Hosted CI is green, with Windows native skipped. Native UI and human migration acceptance are still pending, as the PR body says.

Pinning every bundled default is broader than flipping two flags. It also means a future Off→On default won't reach established profiles. The decision doc says this explicitly, so I'm treating it as accepted policy, not a finding.

Optional, before merge if cheap: the two inline threads. Both are write-failure paths where the new migration breaks the documented contract.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, with independent Rocket, Mantis and Groot coverage.

No new actionable findings. The two write-failure observations from the previous review are addressed: native default-snapshot persistence is best effort while explicit edits/reset and the existing version migration still propagate write errors; browser reset replaces the settings key atomically, preserving saved or corrupt contents if replacement fails. The added regression cases cover preservation and a later successful retry.

Reviewed head eda7b3f0350da6b480cd3b97d1d032c0a251331f, base 517443522133b5c0dc6c29d9b0216ed2636af83b, with follow-up comparison against ff8e6c9ed1b24d560350c8d5eb66bb09a8e7b568. The documented native fresh-profile classification limitation after a failed first snapshot remains; restart stability requires a successful save. Existing recovery-screen presentation is unchanged.

Source-only review: no tests, builds or app execution performed. Public description, commit messages and both attached screenshots inspected. A single hosted-check snapshot showed 71 successful checks and Windows native validation skipped. Native UI, live storage-failure behavior, keyboard/screen-reader recovery, performance and human migration acceptance remain unverified by this review. This is a COMMENT review, not approval or merge authorization.