fix(relay): push system channel events to a lease that names them (#8517)

🤖
## Summary
Mobile clients can now get push notifications for a system channel, but
only when they ask for that channel by its ID. Before this change, the
relay never sent push for system channels, even when a client asked for
one directly.

System channels are channels the app uses for its own purposes (for
example, agent attention). They are hidden from clients that do not know
about them. #8507 made push use the same visibility rule as normal
reads: a push subscription sees a system channel, or any channel type
added later, only if its filter names that channel ID in `#h`. With that
rule, an older client can never get system channel pushes by accident.
The extra "never push system channels" rule in NIP-CL now only blocks
clients that ask on purpose, such as a future Live Activities
subscription. This PR removes that special case.

### Details
- `push_runtime.rs`: system channels now follow the same rule as other
named-only channel types. The relay still checks membership before it
sends a wake.
- `NamedOnlyChannels::is_system` had no other caller, so it is removed.
- NIP-CL and NOSTR.md now describe the shared rule instead of the ban.
- No behavior change for current clients. They do not name system
channels in their push subscriptions.

### Related issue
Follow-up to #8507 (see
https://github.com/block/buzz/pull/8507#issuecomment-6316180106).

### Testing
- `named_only_channel_pushes_only_to_a_filter_that_names_it` now expects
a wake for a system channel named by `#h`. It also checks that a broad
filter still gets no wake, and that a non-member still gets no wake.
- `cargo test -p buzz-relay --lib push_runtime`, `cargo clippy -p
buzz-relay --all-targets -D warnings`, and `cargo fmt --check` pass.

Signed-off-by: Logan Johnson <loganj@squareup.com>
Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>

crates/buzz-relay/src/handlers/system_channels.rs

@@ -67,11 +67,6 @@ impl NamedOnlyChannels {
         &self.ids
     }
 
-    /// Whether `id` is a system channel.
-    pub(crate) fn is_system(&self, id: &Uuid) -> bool {
-        self.system.contains(id)
-    }
-
     pub(crate) fn is_empty(&self) -> bool {
         self.ids.is_empty()
     }

crates/buzz-relay/src/push_runtime.rs

@@ -360,8 +360,7 @@ fn match_job(
 /// REQ: a legacy-type channel is in every filter's scope (membership is
 /// checked separately), and a named-only channel is in scope only when the
 /// filter names it (see [`crate::handlers::system_channels`]). Lease filters
-/// cannot carry `#t` or `#P`, so for push "names it" means `#h`. The one
-/// exception: NIP-CL forbids push for system channels, even when named.
+/// cannot carry `#t` or `#P`, so for push "names it" means `#h`.
 fn push_filter_reads_channel(
     filter: &Filter,
     channel: Option<uuid::Uuid>,
@@ -373,9 +372,6 @@ fn push_filter_reads_channel(
     if !named_only.ids().contains(&channel) {
         return true;
     }
-    if named_only.is_system(&channel) {
-        return false;
-    }
     filter_channel_scope(filter, &[], named_only).contains(&channel)
 }
 
@@ -853,18 +849,23 @@ mod tests {
         );
         assert_eq!(wakes(&member, broad, Some(future)), 0, "unnamed later type");
 
-        // Naming a later-type channel by #h reads it, as in REQ.
+        // Naming a named-only channel by #h reads it, as in REQ: a system
+        // channel and a later-type channel alike.
         assert_eq!(
             wakes(&member, names(future), Some(future)),
             1,
             "named later type"
         );
-        // NIP-CL: a system channel never pushes, even when named.
         assert_eq!(
             wakes(&member, names(system), Some(system)),
-            0,
+            1,
             "named system"
         );
+        assert_eq!(
+            wakes(&outsider, names(system), Some(system)),
+            0,
+            "non-member system"
+        );
         // Naming one channel does not widen the filter to another.
         let other = uuid::Uuid::new_v4();
         assert_eq!(wakes(&member, names(other), Some(future)), 0, "other #h");