[matt2e]

Onboarding stack (merge in order, top to bottom):

1. fix(navigation): run the visit deadline only while a presenter is attached #1814 navigation: visit deadline only while a presenter is attached
2. refactor(communities): extract the join owner and add the pre-join relay lookup #1815 communities: join owner and pre-join relay lookup
3. feat(identity): observable nsec backup status with pass tickets, explicit lock release, and refused-recovery copy #1816 identity: native nsec backup status
4. feat(builderlab): tenant table — a login origin per hosted relay, granted natively and accepted by the binding signer #1817 builderlab: tenant table and granted native origins
5. feat(identity): first-run Builderlab account client — sign-in without a plugin session, kgoose reads, link/unlink, backup, saved communities — and its dev seed #1818 identity: first-run Builderlab account client and dev seed
6. feat(identity): first-run setup store, step table and pages (composition follows in the next PR) #1819 identity: first-run setup store, step table and pages
7. feat(identity): the first-run Welcome flow replaces the key-setup gate (FOUNDATION: App.tsx) #1820 identity: Welcome flow replaces the key-setup gate
8. feat(settings): read-only Key backup row in Settings → Identity #1821 settings: read-only Key backup row ← this PR
9. [DO NOT MERGE] chore(identity): DO NOT MERGE — isolated debug Keychain slot (full stack for native testing) #1822 DO NOT MERGE: isolated debug Keychain slot (full stack for native testing)

Depends on: PR 03 (backup.ts types, backup-failure.ts, identity.backup) and PR 05 (backupOfferedFor) only. It is based on 07 to keep the stack linear; it does not use 06/07 and can be reviewed first.

Diff: production +72/−14; tests +141/−3; docs +10/−0

What this layer is

BackupRow reads identity.backup via useSyncExternalStore, one sentence per status (first run's BACKUP_FAILURES copy, with a "Buzz tries again when you next sign in to Builderlab." tail for causes a new sign-in clears), hidden unless backupOfferedFor(backup) holds. No consent or retry control.

Review focus

• One copy table: the failure sentences come from backup-failure.ts, the same entries first run shows; only the Settings tail differs. This layer adds the table's cause field (the sentence without first run's instruction) that BackupRow reads, since it is the first caller.
• Visibility rule shared with first run (backupOfferedFor): Settings passes no origin because its sign-in is always at the build portal; any error hides the row.
• Known UI points, documented and not fixed here: the row appears after the first status read ("Sign out of Buzz" shifts down once), retryable messages end in "Try again." though the row has no button, and the dev seed makes first run offer backup while the row follows the real rule.

Checks run on this branch's tree

• Deferred to CI at the author's request (the build machine was under a deliberate stress load from another session, load avg 58–110, so local vitest/cargo runs were timing out in untouched files). Pushed with --no-verify; the hosted checks on this PR are the verification. The plan's checks for this layer were: vitest run src/app, tsc --noEmit, biome check, pnpm design:check, then the whole-suite vitest run at the top of the stack.
• Tree check ✓: git rev-parse onboarding/08-settings-key-backup-row^{tree} equals the tree of merge --squash 19df106d5 onto 45601246a with the DO-NOT-MERGE commit 8791f32c3 reverted (7ca73468b…).

Native evidence

None on this tree. The native first-run recordings and the hands-on checks on the branch were made on the full tree, which only the DO-NOT-MERGE PR 09 reproduces (it adds the isolated debug Keychain slot). Treat every layer below 09 as unit/integration-tested only.

🤖 Generated with Claude Code

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating Rocket, Mantis and Groot: no production defects found; one low-priority documentation correction is inline. Optional: remove the PR description’s stale claim that retryable Settings messages end in “Try again”; they now describe retrying on the next Builderlab sign-in.

Head b4e66e5944b1b16ba0e1b28baa12eb996a65fa02, base e2f928f8b8d89f9506ba1b1e703d22fd0eba9da2. Source-only: tests, CI, native backup behavior and rendered accessibility were not validated.

[wesbillman]

🤖 [P3] Qualify when a window reload reports idle

NsecBackupHost::document_load in src-tauri/src/nsec_backup.rs:302–312 changes the status to Idle only when it interrupts a Running pass. Settled statuses such as Complete or Failed are retained and returned by the next status read, so reloading Settings does not generally produce the idle sentence described here. Please say that a fresh launch reports idle and a reload does so when it interrupts an active pass, while preserving the explanation that idle does not prove absence of a backup.