feat(desktop): persist sidebar observed-unread across webview reload

[wpfleger96]

Problem

Command+R (webview reload) wipes the two in-memory refs driving sidebar channel unread badges: observedUnreadEventsByChannelRef and latestByChannelRef. The boot catch-up REQ can only fetch events newer than each channel's NIP-RS frontier, so thread replies that arrived before the frontier was passively advanced (the common case) are never re-discovered.

Inbox is unaffected because it rebuilds candidates from a relay feed query and checks fine-grained thread:/msg: markers. The sidebar badge path lacks an equivalent recovery mechanism.

Solution

Persist the sidebar's per-event candidate set to localStorage as a disposable, versioned projection cache (buzz-observed-unread.v1:<relay>:<pubkey>) and hydrate it on boot before the catch-up REQ runs.

New files

observedUnreadStorage.ts — storage module for the cache:

• Keyed buzz-observed-unread.v1:<normalizedRelayUrl>:<normalizedPubkey> (relay-scoped to prevent cross-community leakage, matching threadActivityStorage)
• Stores validated per-event ObservedUnreadEvent rows; latestByChannel is derived at hydration — no divergent dual aggregate
• Age pruning (7d = READ_STATE_HORIZON_SECONDS), per-channel cap (1000), global cap (5000) across all channels in a scope bucket
• Payload updatedAt for LRU ordering; registered in PURE_CACHE_KEY_PREFIXES for 2 MiB eviction budget
• Field-level validation on decode; write failure is non-fatal (session-only degradation)
• Snapshot-owning timers: scheduleObservedUnreadWrite deep-clones the events map at schedule time — a late A-scope timer can never read B's mutable refs or write under B's key

useObservedUnreadPersistence.ts — hook that owns all persistence lifecycle:

• Scope fence: normalized pubkey + normalized relay identity; isScopeLoaded() callback guards both projection (rawUnread) and every mutation (recordUnreadEvent, removeChannel, clearAll) before touching refs or storage
• Synchronous pagehide flush closes the Cmd+R timing gap (useReloadShortcut.ts reloads within 500ms of teardown, before the 1-second debounce fires)
• Identity-reset effect: flushes old scope, resets refs, hydrates from storage, stamps loaded scope — all atomic; cleanup flushes on unmount
• clearAll and removeChannel cancel pending timer before clearing storage, preventing a pending snapshot from resurrecting cleared state
• Marker-prune effect on readStateVersion: evaluates each retained event with observedUnreadEventReadAt() (the same evaluator used by the projection memo) and removes covered events, rederiving per-channel latest — never clears a whole channel for a single thread/msg marker
• Returns a stable useMemo-wrapped API object keyed on actual deps so unrelated re-renders do not restart the catch-up REQ
• isScopeLoaded is a useCallback (not a memoized boolean) — always reads the ref at call time, never stale

Modified files

useUnreadChannels.ts — hook integration:

• Calls useObservedUnreadPersistence with all persistence wired through the returned API
• rawUnread: isScopeLoaded() guard suppresses A-scope refs from projecting under B
• recordUnreadEvent: isScopeLoaded() fence before touching refs; schedules a debounced write on each successful record
• markChannelRead clearObserved path: calls removeChannel so the cleared state survives reload
• markAllChannelsRead: clears both observed refs wholesale (= new Map()), then calls clearAll — prevents a pending snapshot from carrying non-projected events back to storage

localStorageQuota.ts — registers buzz-observed-unread.v1: in PURE_CACHE_KEY_PREFIXES

Design constraints

The cache is a disposable projection: versioned key, read-through only, safe to delete wholesale. It does not touch ReadStateManager, marker semantics, or forcedUnreadStore. Zero overlap with the NIP-RS manual mark-read/unread protocol work in progress in another channel; migration path when that lands is "stop reading the key."

Test coverage

observedUnreadStorage.test.mjs covers storage primitives:

• Key normalization, relay-scoped isolation, round-trip correctness
• Age-prune and per-channel cap on read and write; global cap across channels
• deriveLatestByChannel correctness
• pruneObservedUnreadByMarkers with channel, thread, and msg markers — one opened thread leaves another unread thread persisted and lit; local/synced advances produce identical stored result
• flushObservedUnreadWrite and scheduleObservedUnreadWrite scope safety (late A-scope timer while in B scope does nothing)
• record → pending-debounce → pagehide-flush → hydrate proves the headline repro is not timing-dependent
• Malformed structures/fields, relay/pubkey isolation, normalized-equivalent URLs, quota failure degradation

useObservedUnreadPersistence.test.mjs exercises the real hook via createRoot + act:

• pagehide flush: event recorded within debounce window survives reload (headline regression)
• Unmount with pending write flushes before teardown
• API object identity is stable across re-renders with unchanged props (catch-up REQ not restarted)
• A→B scope switch: late A-scope scheduled write does not corrupt B's bucket
• clearAll cancels pending debounce so no resurrection after reload
• removeChannel cancels pending debounce so cleared channel is not resurrected
• Marker prune: thread marker removes only covered events, leaves other threads intact, calls onPruned
• isScopeLoaded returns false before identity-reset effect commits, true after