## Summary
Editing attachment messages through `buzz messages edit` can remove
their files from the effective message. Preserve the latest live imeta
set across successive edits and add `--clear-attachments` for explicit
removal. Add an SDK builder for complete replacement attachment sets
while preserving the existing API.
The relay provides a versioned effective-edit lookup on `/query` for
kinds 9/40002/40008/45001/45003; media reads fold the same set. It uses
the existing normalized-target index, fresh channel authorization, and a
primary snapshot. Generic `#e` matching is unchanged. Mixed-case
historical edits cannot restore removed files, including when another
reference would allow republication.
### Related issue
Fixes#3022. Follows #9077. Related open attempts: #3062 and #3065.
### Testing
Published head: `c630c4ebf0b20a9618f4844629eec1e666699cbe`, through all
mandatory push hooks. The governed-five snapshot passed all four
PostgreSQL/HTTP acceptance tests with `RUST_MIN_STACK` unset and 3,333
affected-package tests. The committed test-only array correction passed
clippy and the preflight rerun.
Independent mutations detected dropped read/lookup kinds, the CLI
two-kind split, and preflight ordering, channel and live-edit errors.
The published follow-up adds forum preview retention/suppression and a
deleted-original preflight fixture; both surviving mutations now fail as
intended. Independent review verified the fixes. All four acceptance
tests pass; the full DB/relay run had two NIP-FI failures that passed in
isolation. The actual standalone MCP workflow passed against this relay
and clean local app `5b583b8c69596353bc37e9f3938eca1aabcd081e`: 15 MCP
edits, 10 direct publications and 60 member GET/HEAD checks across five
isolated blob pairs. Both tested heads are now published. Relay hosted
checks report 80 successful and 31 skipped, with none pending or failed;
app hosted checks and human upload → edit → clear → edit → GET/HEAD
confirmation remain pending. No human acceptance is claimed.
### Rollout
The lookup, CLI preservation/clear and media reads use kinds
9/40002/40008/45001/45003. Deploy the relay before releasing the CLI and
paired [MCP producer](https://github.com/block/buzz-app/pull/2937). New
clients abort without publishing against an unsupported relay. Old CLI
edits emit empty imeta and now revoke diff/forum attachments that
previously remained readable. Other channel-tagged kinds retain the
historical plain-edit path. No additional schema change is needed beyond
migration 0086.
Readiness remains blocked by mobile edits that omit imeta, the app UI
fold that can restore older files, unaudited SDK/direct callers and
unmeasured historical exposure. Run
`docs/sql/private-media-edit-preflight.sql` for each community; producer
updates do not repair signed historical edits. No enforce activation is
authorized. `off` skips policy checks, `shadow` changes policy metrics
while allowing policy failures, and `enforce` denies inaccessible
references.
Observe
`buzz_media_publication_access_total{mode="shadow",reason="denied"}`.
Prefer rolling back the client release while retaining the additive
lookup. A relay rollback makes new CLI/MCP edits fail closed;
already-published imeta remains valid under the older reference rules.
Concurrent edits still use `(created_at,id)` without compare-and-swap.
Generated with Codex
---------
Signed-off-by: Brad Seiler <seiler@squareup.com>
Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
