feat(archive): add agent turn-metric (kind 44200) local archive

[wpfleger96]

Summary

Extends the local-save archive primitive from #1442 to add a "subscribe to all my agents' turn metrics" special case. Kind-44200 (NIP-AM agent turn metrics) is archived via the persistent /query proof path — unlike the observer frames (24200) which use the ephemeral local-validation path, the relay stores and #p-gates 44200 events so relay verification suffices.

Content is decrypted at ingest and stored as plaintext AgentTurnMetricPayload JSON, allowing token-usage calculators to read archive.db directly without the owner key. Fail-closed: decrypt error → drop, never store ciphertext or garbage.

Default off for OSS builds; baked on for internal builds via BUZZ_BUILD_AGENT_METRIC_ARCHIVE_DEFAULT (enabled in buzz-releases#50).

Changes

Rust (src-tauri):

• archive/pipeline.rs: route owner_p+44200 to the persistent bucket; add #p filter arm; change WriteRow to owned String fields to support stored plaintext; decrypt kind-44200 rows at commit time with buzz_core_pkg::agent_turn_metric::decrypt_agent_turn_metric — fail-closed on any error
• archive/store.rs: add merge_owner_p_kinds — reads existing kinds JSON, unions in the new kind, and writes back inside a single unchecked_transaction() so concurrent seeders can't clobber the shared owner_p row
• archive/mod.rs: add KIND_AGENT_TURN_METRIC = 44200 constant; thread owner_keys clone into commit_archive; add merge_save_subscription_kinds Tauri command; 4 pipeline unit tests + run_batch_sync_with_keys helper (routing, decrypt-success-plaintext, decrypt-fail-closed, 24200-still-ephemeral)
• commands/agent_metric_archive.rs (new): agent_metric_archive_default_enabled() Tauri command + OSS-default-false unit test; registered in commands/mod.rs + lib.rs
• build.rs: rerun-if-env-changed + presence remap for BUZZ_BUILD_AGENT_METRIC_ARCHIVE_DEFAULT

TypeScript:

• kinds.ts: add KIND_AGENT_TURN_METRIC = 44200
• agentMetricArchivePreference.ts (new): identity-scoped localStorage gate (key prefix buzz:agent-metric-archive-default-seeded)
• useAgentMetricArchiveSeed.ts (new): seeds owner_p [44200] once/identity on internal builds via the atomic mergeSaveSubscriptionKinds command — the union happens under the DB transaction, so a concurrent observer seed can't clobber it
• useObserverArchiveSeed.ts: switched to the same atomic mergeSaveSubscriptionKinds path (symmetric fix — the shared-row collision was latent here too)
• tauriArchive.ts: add agentMetricArchiveDefaultEnabled() and mergeSaveSubscriptionKinds(kind) bindings
• AppShell.tsx: call useAgentMetricArchiveSeed next to useObserverArchiveSeed
• LocalArchiveSettingsCard.tsx: separate AgentMetricArchiveSection toggle; both toggles merge kinds so observer + metric subscriptions coexist in the single owner_p row (PK is scope_type+scope_value)
• useAgentMetricArchiveSeed.test.mjs (new) + useObserverArchiveSeed.test.mjs: mirrored suites covering seed-once, merge, and concurrent-seed behavior

Stack

Stack: #1442 → this PR

Related: squareup/buzz-releases#50 (bakes BUZZ_BUILD_AGENT_METRIC_ARCHIVE_DEFAULT on for internal builds)

[wesbillman]

LGTM — approve. CI is fully green (all checks pass/skip, incl. both E2E Integration shards). The design is sound and the risky bits are well-tested.

What's good

• Fail-closed decrypt at ingest is the right call — decrypt error → drop, never store ciphertext or garbage. Both the success path (plaintext stored, ciphertext verifiably absent) and the wrong-key path (0 rows written) have direct unit tests.
• Routing split is conservative: 44200 → persistent /query proof path, 24200 stays ephemeral, and unknown kinds under owner_p default to ephemeral rather than silently getting relay-proofed. Tested in both directions.
• merge_owner_p_kinds with BEGIN IMMEDIATE is a genuinely good TOCTOU fix, and the two-connection WAL regression test (tempfile + Barrier + real threads) exercises the actual race instead of a sequential approximation. It also retro-fixes the same latent clobber in the observer seed — nice symmetric cleanup.
• Kind range validation on the Tauri command boundary, rerun-if-env-changed for the new build flag, OSS-default-false test.

Minor notes (follow-up material, not blockers)

1. The settings-card toggles still do the non-atomic TS-side merge the seed hooks just got fixed for. handleObserverToggle/handleMetricToggle read kinds from React subs state, then createSaveSubscription overwrites the full list — and toggle-off can deleteSaveSubscription the whole shared owner_p row if state is stale, taking the other kind with it. Risk is low (user-paced clicks, reload() after each), and there's no atomic remove-kind command yet so it can't fully use the new path — but a remove_save_subscription_kind sibling would close the loop. Worth a queued follow-up.
2. Mixed row shapes in archived_events: 44200 rows now store payload JSON while everything else stores Nostr Event JSON. Any consumer doing Event::from_json(raw_json) on an unfiltered owner_p read will choke. Today's only reader (useObserverEvents) filters kinds: [24200] so it's safe, but this is an invariant future readers must know — a one-liner in the read_archived_events doc comment would cheaply pin it.
3. check-file-sizes overrides keep ratcheting — mod.rs 1465→1700 is its second bump with "split queued" noted both times. The justifications are honest, but the mod_tests.rs split should actually land soon or the override comment block becomes the debt.
4. Plaintext-at-rest is a deliberate tradeoff (stated in the PR body): E2E-encrypted metrics become plaintext in local archive.db so calculators can read without the owner key. Local-only DB, owner's own machine, opt-in for OSS — reasonable, just noting it's a real design decision, not an accident.

Reviewed by Pinky (Buzz agent) on behalf of Wes.