river_core/room_state/

member_info.rs

use crate::room_state::member::MemberId;
use crate::room_state::privacy::SealedBytes;
use crate::room_state::ChatRoomParametersV1;
use crate::room_state::ChatRoomStateV1;
use crate::util::{sign_struct, verify_struct};
use ed25519_dalek::{Signature, SigningKey, VerifyingKey};
use freenet_scaffold::ComposableState;
use serde::{Deserialize, Serialize};
use std::collections::{BTreeMap, HashMap};

/// Maximum number of deputies a single member may list in their `MemberInfo`,
/// to bound state-bloat abuse (deputy ban authority, #410). A `MemberInfo`
/// whose `deputies` list exceeds this is rejected by `MemberInfoV1::verify`.
pub const MAX_DEPUTIES: usize = 64;

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Default)]
pub struct MemberInfoV1 {
    pub member_info: Vec<AuthorizedMemberInfo>,
}

impl MemberInfoV1 {
    /// The CANONICAL `member_info` record for `member_id`: the highest-
    /// `member_info_rank` (higher `version`, else greater signature DIGEST)
    /// among ALL records present for that member, or `None` if there
    /// is none.
    ///
    /// LOAD-BEARING (#411 round 8 item A). `verify` deliberately ACCEPTS a state
    /// carrying more than one record per `member_id` (migration-safety — see its
    /// comment), and a client can hold such a duplicate-containing full-state GET
    /// before any cleanup runs. EVERY by-id reader/writer of `member_info` MUST
    /// go through this selector: a bare first-match `.find()` can read a LOSING
    /// (e.g. revoked) record, and a WRITER that republishes it at `version + 1`
    /// would then resurrect that losing record at a HIGHER rank — reactivating
    /// revoked deputy authority. This returns the SAME record `summarize` /
    /// `apply_delta` converge on, so reads, writes, enforcement, and anti-entropy
    /// all agree. (`post_apply_cleanup` additionally collapses duplicates via
    /// [`Self::dedup_to_canonical`] once cleanup runs, but reads must not depend
    /// on that having happened yet.)
    pub fn canonical(&self, member_id: MemberId) -> Option<&AuthorizedMemberInfo> {
        // The FIRST maximum wins, matching [`Self::dedup_to_canonical`] and
        // `apply_delta` (both replace only on strict `>`). `Iterator::max_by_key`
        // is deliberately NOT used here: it returns the LAST maximum, so with
        // three selectors of "the canonical record" a tie would resolve one way
        // on a freshly-GET'd full state and the other way after the next
        // `apply_delta` ran dedup — a silent flip in `deputies_of`, i.e. in ban
        // authority. A tie needs two records with the same version AND the same
        // 128-bit signature digest, which [`SigDigest`] makes infeasible to mint,
        // so this is closing a latent trap rather than a reachable bug.
        //
        // The rank is computed once per candidate rather than once per
        // comparison, because `member_info_rank` hashes (see [`SigDigest`]).
        let mut best: Option<(&AuthorizedMemberInfo, (u32, SigDigest))> = None;
        for info in self
            .member_info
            .iter()
            .filter(|info| info.member_info.member_id == member_id)
        {
            let rank = member_info_rank(info.member_info.version, &info.signature);
            let better = match &best {
                Some((_, best_rank)) => outranks(rank, *best_rank),
                None => true,
            };
            if better {
                best = Some((info, rank));
            }
        }
        best.map(|(info, _)| info)
    }

    /// The deputies currently listed by `member_id`'s CANONICAL signed
    /// `MemberInfo`, or an empty slice if that member has no info entry or no
    /// deputies. Routes through [`Self::canonical`] so ban authority matches the
    /// converged record even in the presence of duplicates (#410, #411 round 8).
    pub fn deputies_of(&self, member_id: MemberId) -> &[MemberId] {
        self.canonical(member_id)
            .map(|info| info.member_info.deputies.as_slice())
            .unwrap_or(&[])
    }

    /// Collapse any duplicate `member_info` records to the SINGLE canonical
    /// (highest-`member_info_rank`) record per `member_id` (#411 round 8 item C /
    /// security FINDING 2+3). Because `verify` accepts duplicates, a state can
    /// hold several records for one member; without this, two peers holding
    /// different duplicate SETS would diverge byte-for-byte forever (the raw
    /// `member_info` vectors differ even though every canonical read agrees).
    /// Dedup is a pure function of the converged state (max by `member_info_rank`)
    /// so it is deterministic, idempotent, and order-independent; it also bounds
    /// stored `member_info` to at most one record per member. Owner's record is
    /// kept like any other (it is just another `member_id`). Runs in
    /// `post_apply_cleanup`, NEVER in `verify`/`validate_state`, so the
    /// permissionless migration PUT (which only runs `verify`) is unaffected.
    pub fn dedup_to_canonical(&mut self) {
        if self.member_info.len() < 2 {
            return;
        }
        // Carry each incumbent's rank in the map rather than re-deriving it: a
        // rank costs a blake3 hash (see [`SigDigest`]), and recomputing the
        // incumbent's on every collision doubles that cost for no benefit.
        // Ties keep the INCUMBENT (strict `>`), i.e. the first record in vector
        // order, matching [`Self::canonical`] and `apply_delta`.
        let mut best: HashMap<MemberId, ((u32, SigDigest), AuthorizedMemberInfo)> = HashMap::new();
        for info in self.member_info.drain(..) {
            let id = info.member_info.member_id;
            let rank = member_info_rank(info.member_info.version, &info.signature);
            match best.entry(id) {
                std::collections::hash_map::Entry::Occupied(mut e) => {
                    if outranks(rank, e.get().0) {
                        e.insert((rank, info));
                    }
                }
                std::collections::hash_map::Entry::Vacant(e) => {
                    e.insert((rank, info));
                }
            }
        }
        self.member_info = best.into_values().map(|(_, info)| info).collect();
        // Deterministic order (HashMap iteration order is not stable).
        self.member_info
            .sort_by_key(|info| info.member_info.member_id);
    }
}

/// Deterministic ordering used to pick the canonical `MemberInfo` when two
/// signed records for the SAME member collide (#411 round 4 item B).
///
/// Rule: **higher `version` wins; at equal version, the greater SIGNATURE DIGEST
/// wins.** Two records with the same member and version but different content
/// (e.g. different `deputies`) have different signatures — the signature is over
/// the whole `MemberInfo` — so their digests differ and this breaks the tie
/// deterministically. (Before freenet/river#571 the tiebreak compared raw
/// signature bytes; the winner in a tie therefore changed with that PR, which is
/// safe because every peer applies the same rule and the change re-keys the
/// contract. See [`SigDigest`].)
///
/// This is a total ORDER on the returned `(version, digest)` pair, but only a
/// total PREORDER on records: two distinct records rank equal exactly when their
/// signatures collide under [`SigDigest`]. That tie is the dangerous case, not a
/// benign one — see [`SigDigest`] for what a tie does to anti-entropy and for the
/// 128-bit bound that is what actually keeps ties out of reach. "Records never
/// tie" is a cryptographic property here, not a structural guarantee, so the
/// three selectors that consume this order ([`MemberInfoV1::canonical`],
/// [`MemberInfoV1::dedup_to_canonical`], and `apply_delta`) are nevertheless
/// written to break a tie the SAME way (keep the first, i.e. replace only on
/// strict `>`).
///
/// It is applied IDENTICALLY in [`ComposableState::apply_delta`] (conflict
/// resolution), [`ComposableState::delta`], and [`ComposableState::summarize`]
/// — the summary value IS this tuple — so anti-entropy can DETECT a
/// same-version content difference and both peers converge on the same record.
/// Without it, equal-version resolution was order-dependent AND the summary
/// carried only the version, so anti-entropy saw "same version", sent no
/// correction, and peers disagreed on ban authority permanently.
fn member_info_rank(version: u32, signature: &Signature) -> (u32, SigDigest) {
    (version, sig_digest(signature))
}

/// Whether `candidate` beats `incumbent` under [`member_info_rank`]'s order.
///
/// THE SINGLE IMPLEMENTATION OF THE TIE RULE. Five sites choose between two
/// ranked records — [`MemberInfoV1::canonical`],
/// [`MemberInfoV1::dedup_to_canonical`], `summarize`, `delta`, and `apply_delta`
/// — and every one of them must break a tie the SAME way, keeping the incumbent.
/// They previously each spelled `>` inline, which is one edit away from silent
/// disagreement: relaxing any one of them to `>=` flips that site to last-wins
/// while the others stay first-wins, and `deputies_of` then answers differently
/// depending on which code path last touched the record — i.e. ban authority
/// flips. That mutation left the whole suite green, because reaching the tie
/// branch behaviorally needs a genuine [`SigDigest`] collision.
///
/// Routing all five through here means the rule has one definition and one test
/// (`outranks_keeps_the_incumbent_on_a_tie`) rather than five prose assertions.
/// Strict `>` is the rule: **ties keep the incumbent.**
fn outranks(candidate: (u32, SigDigest), incumbent: (u32, SigDigest)) -> bool {
    candidate > incumbent
}

/// 16-byte BLAKE3 digest of a signature: the equal-version tiebreak
/// discriminator in [`member_info_rank`], and the value [`MemberInfoV1`]'s
/// summary carries per member.
///
/// WHY A DIGEST AND NOT THE SIGNATURE (freenet/river#571, landed as PR #572;
/// every "#571" elsewhere in this file is that ISSUE, not the PR): the summary carried
/// the raw ed25519 `Signature` per member — ~124 of ~134 CBOR bytes per entry,
/// about 92% of it. That summary is re-sent on every state change to every
/// interested peer, and `interest_sync_summaries` was measured as the largest
/// single consumer of outbound bytes on the Freenet network (49.8%). The
/// signature is never verified here — it is only ever compared for equality and
/// ordering — so a digest serves the identical purpose. Measured through the real
/// `summarize()` on 470 entries with realistic `MemberId`s: **134.08 → 28.01 CBOR
/// bytes per entry, a 4.8x reduction**. A 64-bit digest would be exactly 8 bytes
/// per entry cheaper; the next paragraph is why those 8 bytes are bought
/// deliberately. Both figures are measured, not derived, by
/// `member_info_summary_stays_small_per_entry`, which rebuilds the old shape from
/// the same records.
///
/// WHY 124 AND NOT 66, since 66 is the number the issue and the first draft of
/// this change both used: `ed25519::Signature`'s `Serialize` calls
/// `serialize_tuple(64)`, which ciborium encodes as a CBOR ARRAY of 64 integers,
/// and a uniformly random byte costs 2 bytes there whenever it is >= 24. 66 is
/// the CBOR BYTE STRING encoding — what River's own
/// [`crate::room_state::direct_messages::SignatureBytes`] newtype produces via
/// `serialize_bytes`, and what the deferred `DirectMessagesSummary` follow-up
/// will actually be saving. The member_info summary never used that type. Two
/// different encodings of the same 64 bytes; do not reason about both with one
/// number.
///
/// The 29.1 KB mean `interest_sync_summaries` message that motivated #571 is a
/// FLEET-WIDE mean across all rooms, so it is not this room's own summary size
/// and the two figures must not be multiplied together: at the Official room's
/// ~470 records the member_info term ALONE measures ~63 KB, well above the fleet
/// mean, because that mean also averages in many far smaller rooms. No per-room
/// summary measurement is on record, so no claim is made about what any single
/// room's total summary weighed before this change. (The issue's own arithmetic
/// did not close for the same reason this doc's did not: it used 66 rather than
/// ~124 for the signature.)
///
/// WHY 128 BITS AND NOT 64: a collision here is not cosmetic, and it is not
/// self-correcting. Two same-version records whose discriminators tie are
/// INDISTINGUISHABLE to anti-entropy — `summarize` advertises an identical
/// `(version, digest)` on both peers, `delta` filters on strict `>` so neither
/// peer ever offers its record to the other, `apply_delta` replaces only on
/// strict `>` so each keeps whichever arrived first, and full-state merge does
/// not rescue it either (freenet-scaffold implements `merge` as summarize →
/// delta → apply_delta). The two halves of the network then disagree
/// permanently and SILENTLY on that member's `deputies`, i.e. on who may ban
/// whom (#411 round 4 B is the bug that added this discriminator in the first
/// place). A member SELF-SIGNS their own record and has unlimited grinding
/// entropy for it — `preferred_nickname` is free-form and `deputies` entries
/// are never validated for membership — so the attacker controls BOTH sides of
/// the comparison: at 64 bits that is a ~2^32 birthday search, which is hours on
/// commodity hardware. 128 bits puts it at ~2^64.
///
/// This mirrors [`crate::room_state::direct_messages::PurgeToken`], which
/// derives a 16-byte BLAKE3 value from a signature for the same reason under a
/// strictly WEAKER threat model (there the attacker cannot influence the other
/// side of the comparison, and it still chose 128 bits). The two are
/// deliberately NOT factored into a shared helper: each is an independent
/// wire-format commitment — `PurgeToken`'s bytes live in stored state, these
/// live in the summary — and they must stay free to evolve separately.
///
/// WHY BLAKE3 AND NOT `freenet_scaffold::util::fast_hash`: `fast_hash` is a
/// base-31 polynomial, fine for the accidental collisions `MessageId` and
/// `BanId` care about but trivially collidable by construction, which would
/// price the attack above at roughly nothing regardless of its width.
///
/// WIRE FORMAT, load-bearing in two ways. freenet-core byte-compares
/// `summarize_state` output for staleness, so this must be a fixed function of
/// the signature bytes; and the digest orders the records, so every peer must
/// derive the same bytes and compare them the same way. Both are pinned by
/// `sig_digest_golden_vector`:
///
/// - the digest is the FIRST 16 bytes of `blake3(signature.to_bytes())`, kept in
///   their natural order — there is no integer conversion, hence no endianness
///   decision to get wrong (the 64-bit form needed `from_le_bytes` for this);
/// - ordering is plain lexicographic over those bytes (the derived `Ord`);
/// - it serializes as a CBOR byte string (17 bytes), via the hand-written
///   `Serialize` below rather than the derive, which would emit a 16-element
///   CBOR array — ~32 bytes for random digest content, since each byte >= 24
///   costs two — and undo most of the saving.
///
/// None of the three may change without re-keying the contract. See
/// `.claude/rules/contract-summary-determinism.md` and freenet/freenet-core#4857.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct SigDigest(pub [u8; 16]);

impl Serialize for SigDigest {
    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
        serializer.serialize_bytes(&self.0)
    }
}

impl<'de> Deserialize<'de> for SigDigest {
    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
        let bytes = <Vec<u8>>::deserialize(deserializer)?;
        let arr: [u8; 16] = bytes.as_slice().try_into().map_err(|_| {
            serde::de::Error::custom(format!(
                "expected 16-byte SigDigest, got {} bytes",
                bytes.len()
            ))
        })?;
        Ok(SigDigest(arr))
    }
}

/// The [`SigDigest`] of `signature`. See that type for the threat model, why the
/// width is 128 bits, and the wire-format commitments this function makes.
fn sig_digest(signature: &Signature) -> SigDigest {
    let digest = blake3::hash(signature.to_bytes().as_ref());
    let mut out = [0u8; 16];
    out.copy_from_slice(&digest.as_bytes()[..16]);
    SigDigest(out)
}

impl ComposableState for MemberInfoV1 {
    type ParentState = ChatRoomStateV1;
    /// `(version, signature-digest)` per member — i.e. exactly the value
    /// [`member_info_rank`] returns. The digest is the equal-version tiebreak
    /// discriminator; carrying it lets anti-entropy detect a content difference
    /// at the SAME version (#411 B).
    ///
    /// This was `(u32, Signature)` until freenet/river#571. The raw 64-byte
    /// signature was ~124 of ~134 CBOR bytes per entry (~92%), and this summary
    /// is re-sent to every interested peer on every state change. See [`SigDigest`]
    /// for why a digest is sufficient, why it is 128-bit blake3 rather than 64,
    /// and why it serializes as a CBOR byte string.
    ///
    /// BTreeMap (not HashMap) so the ciborium-serialized summary bytes are
    /// deterministic: freenet-core byte-compares `summarize_state` output for
    /// staleness, and a HashMap iterates in a per-process-random order, making
    /// two identical member_info sets summarize to different bytes → spurious
    /// anti-entropy heals. See `.claude/rules/contract-summary-determinism.md`
    /// and freenet/freenet-core#4857.
    type Summary = BTreeMap<MemberId, (u32, SigDigest)>;
    type Delta = Vec<AuthorizedMemberInfo>;
    type Parameters = ChatRoomParametersV1;

    fn verify(
        &self,
        parent_state: &Self::ParentState,
        parameters: &Self::Parameters,
    ) -> Result<(), String> {
        let members_by_id = parent_state.members.members_by_member_id();
        let owner_id = parameters.owner_id();

        // NOTE (#411 round 7 / Codex P1 #3): `verify` deliberately does NOT reject
        // a state that carries more than one `member_info` record for the same
        // member. Rejecting would be migration-UNSAFE — the real Official-room
        // state is re-PUT to the new contract through `verify`, and if it happens
        // to contain a duplicate, rejection would strand the room EMPTY. Instead,
        // duplicates are made HARMLESS by canonicalizing every by-id READER to the
        // highest-`member_info_rank` record: `deputies_of` (enforcement) and
        // `summarize` (the anti-entropy advertised value) both select the same
        // winner, so two peers holding different duplicate SETS still agree on ban
        // authority AND on the summary, and anti-entropy converges. A reject-in-
        // `verify` guard could be added later as belt-and-suspenders ONLY once the
        // real state is confirmed duplicate-free.

        for member_info in &self.member_info {
            let member_id = member_info.member_info.member_id;

            // Bound the deputy list to prevent state-bloat abuse (#410).
            if member_info.member_info.deputies.len() > MAX_DEPUTIES {
                return Err(format!(
                    "Member {:?} lists {} deputies, exceeding the maximum of {}",
                    member_id,
                    member_info.member_info.deputies.len(),
                    MAX_DEPUTIES
                ));
            }

            if member_id == owner_id {
                // If this is the owner's member info, verify against owner's key
                member_info.verify_signature(parameters)?;
            } else {
                // For non-owner members, verify they exist in members list
                let member = members_by_id.get(&member_id).ok_or_else(|| {
                    format!("MemberInfo exists for non-existent member: {:?}", member_id)
                })?;

                // Verify the signature with member's key
                member_info.verify_signature_with_key(&member.member.member_vk)?;
            }
        }
        Ok(())
    }

    fn summarize(
        &self,
        _parent_state: &Self::ParentState,
        _parameters: &Self::Parameters,
    ) -> Self::Summary {
        // Carry the signature DIGEST alongside the version so anti-entropy can
        // detect a SAME-version content difference and correct it (#411 round
        // 4 B).
        //
        // Fold keeping the HIGHEST-`member_info_rank` record per member (#411
        // round 7 / Codex P1 #3), NOT a plain `.collect()` (which keeps whichever
        // duplicate was iterated LAST). If a state holds two records for one
        // member, the advertised `(version, digest)` MUST match the record
        // `deputies_of` enforces on, or a peer with a different duplicate set
        // would advertise a different summary and anti-entropy would never
        // reconcile. Migration-safe: `verify` still accepts duplicates.
        let mut summary: Self::Summary = BTreeMap::new();
        for info in &self.member_info {
            // The summary value IS the rank, so the fold compares tuples
            // directly rather than re-deriving a rank from a stored signature.
            let candidate = member_info_rank(info.member_info.version, &info.signature);
            summary
                .entry(info.member_info.member_id)
                .and_modify(|existing| {
                    if outranks(candidate, *existing) {
                        *existing = candidate;
                    }
                })
                .or_insert(candidate);
        }
        summary
    }

    fn delta(
        &self,
        _parent_state: &Self::ParentState,
        _parameters: &Self::Parameters,
        old_state_summary: &Self::Summary,
    ) -> Option<Self::Delta> {
        let delta: Vec<AuthorizedMemberInfo> = self
            .member_info
            .iter()
            .filter(|info| {
                // Include if the member is absent from the old summary, OR this
                // record OUTRANKS what the old summary has (higher version, or
                // equal version with a greater signature digest). The equal-version arm
                // is what lets a same-version content difference propagate (#411
                // round 4 B) — without it, anti-entropy would never send the
                // correction and peers would disagree on deputies forever.
                match old_state_summary.get(&info.member_info.member_id) {
                    None => true,
                    // The summary value IS the rank (version, signature digest),
                    // so compare against it directly.
                    Some(old_rank) => outranks(
                        member_info_rank(info.member_info.version, &info.signature),
                        *old_rank,
                    ),
                }
            })
            .cloned()
            .collect();

        if delta.is_empty() {
            None
        } else {
            Some(delta)
        }
    }

    fn apply_delta(
        &mut self,
        parent_state: &Self::ParentState,
        parameters: &Self::Parameters,
        delta: &Option<Self::Delta>,
    ) -> Result<(), String> {
        let max_nickname_size = parent_state.configuration.configuration.max_nickname_size;

        if let Some(delta) = delta {
            for member_info in delta {
                let member_id = &member_info.member_info.member_id;

                // Validate nickname declared length
                if member_info.member_info.preferred_nickname.declared_len() > max_nickname_size {
                    return Err(format!(
                        "Nickname declared length {} exceeds max_nickname_size {}",
                        member_info.member_info.preferred_nickname.declared_len(),
                        max_nickname_size
                    ));
                }

                // Enforce the deputy-list cap at the DELTA boundary too — `verify`
                // rejects an over-cap record on stored state, but without this an
                // over-cap self-signed record would enter state via a delta and
                // then block new-joiner / migration full-state validation (#410).
                // SKIP the offending entry (like the removed-member case below)
                // rather than erroring the whole delta: erroring would let one
                // malicious over-cap record deadlock every full-state merge that
                // carries it (the receiver would reject the entire state and never
                // converge). Skipping is deterministic across peers and drops only
                // the bad entry.
                if member_info.member_info.deputies.len() > MAX_DEPUTIES {
                    continue;
                }

                // Check if this is the room owner
                if *member_id == parameters.owner_id() {
                    // If it's the owner, verify against the room owner's key
                    member_info.verify_signature(parameters)?;
                } else {
                    // For non-owners, verify they exist and check their signature.
                    // If the member was removed (e.g. banned or max_members), skip
                    // this entry — retention cleanup below will handle it.
                    let members = parent_state.members.members_by_member_id();
                    let member = match members.get(member_id) {
                        Some(m) => m,
                        None => continue,
                    };
                    member_info.verify_signature_with_key(&member.member.member_vk)?;
                }

                // Update or add the member info. Conflict resolution uses the
                // total, deterministic `member_info_rank` order (higher version,
                // else greater signature digest) so that two DIFFERENT records for the
                // same member at the SAME version resolve identically regardless
                // of delta arrival order (#411 round 4 B). Using only
                // `version >` (as before) left equal-version conflicts
                // order-dependent, so peers could permanently disagree on
                // `deputies` (and therefore on ban authority).
                if let Some(existing_info) = self
                    .member_info
                    .iter_mut()
                    .find(|info| info.member_info.member_id == *member_id)
                {
                    if outranks(
                        member_info_rank(member_info.member_info.version, &member_info.signature),
                        member_info_rank(
                            existing_info.member_info.version,
                            &existing_info.signature,
                        ),
                    ) {
                        *existing_info = member_info.clone();
                    }
                } else {
                    self.member_info.push(member_info.clone());
                }
            }
        }
        // Always remove any member info that is not in parent_state.members
        let member_map = parent_state.members.members_by_member_id();
        self.member_info.retain(|info| {
            parameters.owner_id() == info.member_info.member_id
                || member_map.contains_key(&info.member_info.member_id)
        });

        // Write-side dedup (#411 round 8 Task 2 / item A): the update path above
        // uses first-match to locate the record to update, so if the state
        // already held DUPLICATES for a member (a full-state PUT/GET seeds them,
        // and `verify` accepts them), a delta could update/leave a stale
        // lower-rank one. Collapse to the single canonical (highest-rank) record
        // per member here so the STORED vector is duplicate-free after every
        // apply, not only after `post_apply_cleanup`. Deterministic /
        // order-independent (max by `member_info_rank`); a no-op on the common
        // duplicate-free case. Readers still canonicalize and must not depend on
        // this having run (`MemberInfoV1::canonical`). `dedup_to_canonical` also
        // sorts for deterministic ordering (CRDT convergence requirement); the
        // <2-record case it skips is trivially sorted already.
        self.dedup_to_canonical();

        Ok(())
    }
}

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct AuthorizedMemberInfo {
    pub member_info: MemberInfo,
    pub signature: Signature,
}

impl AuthorizedMemberInfo {
    pub fn new(member_info: MemberInfo, owner_signing_key: &SigningKey) -> Self {
        let signature = sign_struct(&member_info, owner_signing_key);
        Self {
            member_info,
            signature,
        }
    }

    pub fn new_with_member_key(member_info: MemberInfo, member_signing_key: &SigningKey) -> Self {
        let signature = sign_struct(&member_info, member_signing_key);
        Self {
            member_info,
            signature,
        }
    }

    /// Create an AuthorizedMemberInfo with a pre-computed signature.
    /// Use this when signing is done externally (e.g., via delegate).
    pub fn with_signature(member_info: MemberInfo, signature: Signature) -> Self {
        Self {
            member_info,
            signature,
        }
    }

    pub fn verify_signature(&self, parameters: &ChatRoomParametersV1) -> Result<(), String> {
        self.verify_signature_with_key(&parameters.owner)
    }

    pub fn verify_signature_with_key(&self, verifying_key: &VerifyingKey) -> Result<(), String> {
        verify_struct(&self.member_info, &self.signature, verifying_key)
            .map_err(|e| format!("Invalid signature: {}", e))
    }

    // Helper method for tests
    #[cfg(test)]
    pub fn with_invalid_signature(mut self) -> Self {
        self.signature = Signature::from_bytes(&[0; 64]);
        self
    }
}

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
pub struct MemberInfo {
    pub member_id: MemberId,
    pub version: u32,
    pub preferred_nickname: SealedBytes,
    /// Members this member has deputized to ban within this member's invite
    /// subtree (deputy ban authority, #410). Empty for the vast majority of
    /// members.
    ///
    /// LOAD-BEARING: this MUST be the LAST field and MUST keep BOTH
    /// `#[serde(default)]` (so pre-#410 records — which have no `deputies`
    /// key — still deserialize) AND `skip_serializing_if = "Vec::is_empty"`
    /// (so an EMPTY list serializes byte-identically to the old 3-field
    /// record). `MemberInfo` is INDIVIDUALLY signed over its ciborium bytes
    /// (`AuthorizedMemberInfo`), so a plain `#[serde(default)]` alone would
    /// re-serialize every existing member's record with an extra field,
    /// breaking their signature on migration and stranding every existing
    /// room. Never reorder the first three fields. Pinned by
    /// `empty_deputies_serializes_identically_to_legacy_member_info`.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub deputies: Vec<MemberId>,
}

impl MemberInfo {
    /// Create a new member info with a public nickname
    pub fn new_public(member_id: MemberId, version: u32, nickname: String) -> Self {
        Self {
            member_id,
            version,
            preferred_nickname: SealedBytes::public(nickname.into_bytes()),
            deputies: Vec::new(),
        }
    }

    /// Create a new member info with a private nickname
    pub fn new_private(
        member_id: MemberId,
        version: u32,
        ciphertext: Vec<u8>,
        nonce: [u8; 12],
        secret_version: u32,
        declared_len: u32,
    ) -> Self {
        Self {
            member_id,
            version,
            preferred_nickname: SealedBytes::private(
                ciphertext,
                nonce,
                secret_version,
                declared_len,
            ),
            deputies: Vec::new(),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::room_state::member::{AuthorizedMember, Member};
    use ed25519_dalek::{Signer, SigningKey};
    use rand::rngs::OsRng;

    fn create_test_member_info(member_id: MemberId) -> MemberInfo {
        MemberInfo::new_public(member_id, 1, "TestUser".to_string())
    }

    /// GOLDEN VECTOR for [`SigDigest`] — ONE fixed signature, ONE fixed expected
    /// digest, ONE fixed expected CBOR encoding.
    ///
    /// This pins the four things a peer must agree with every other peer on, and
    /// which cannot change without re-keying the contract: that the hash is
    /// blake3 over `signature.to_bytes()`, that the digest is the FIRST 16 bytes
    /// of it, that those bytes are kept in their natural order, and that the
    /// value serializes as a 17-byte CBOR byte string rather than a 32-byte CBOR
    /// array.
    ///
    /// WHY A FIXED VECTOR AND NOT ONLY THE EXISTING ORACLES: every other check
    /// on the digest — `deputy_ban_test`'s winner oracles and `room_data`'s
    /// key-search fixture — compares digests of RANDOMLY-keyed signatures. A
    /// change to the byte order leaves those comparisons agreeing about half the
    /// time, i.e. an INTERMITTENT detector, which this project treats as a broken
    /// one. Measured twice with the digest bytes reversed: those oracles let the
    /// change through in 11 of 30 runs in one sample and 1 of 12 in an
    /// independent reproduction. The rate depends on the keys a run happens to
    /// draw and is not worth pinning down; what matters is that it is not 0, so
    /// the detector is a coin flip rather than a check. A fixed input makes the
    /// detection deterministic. (Byte order was
    /// a live risk while the digest was a `u64` built with `from_le_bytes`; the
    /// `[u8; 16]` form removes the conversion, but "which 16 bytes, in what
    /// order" still has to be pinned, and the encoding certainly does.)
    ///
    /// The expected bytes were produced with the `b3sum` 1.8.3 CLI, outside this
    /// crate, rather than by running the code under test:
    ///   `printf '%b' "\x00\x01...\x3f" | b3sum` →
    ///   `4eed7141ea4a5cd4b788606bd23f46e212af9cacebacdc7d1f4c6dc7f2511b98`.
    /// That is a separate binary but the same reference BLAKE3 implementation
    /// the `blake3` crate wraps, so this pins OUR choices (which hash, which
    /// bytes, what order, what encoding) — it is not an independent check that
    /// BLAKE3 itself is correct, and is not claimed to be.
    #[test]
    fn sig_digest_golden_vector() {
        // Bytes 0x00..=0x3f. `Signature::from_bytes` is infallible and does not
        // validate the encoded point, and `to_bytes` returns these bytes back
        // unchanged, so the digest input is exactly this fixed array.
        let mut raw = [0u8; 64];
        for (i, b) in raw.iter_mut().enumerate() {
            *b = i as u8;
        }
        let signature = Signature::from_bytes(&raw);
        assert_eq!(
            signature.to_bytes(),
            raw,
            "precondition: the fixture signature must round-trip to the bytes hashed"
        );

        const EXPECTED: [u8; 16] = [
            0x4e, 0xed, 0x71, 0x41, 0xea, 0x4a, 0x5c, 0xd4, 0xb7, 0x88, 0x60, 0x6b, 0xd2, 0x3f,
            0x46, 0xe2,
        ];

        let digest = sig_digest(&signature);
        assert_eq!(
            digest.0, EXPECTED,
            "sig_digest changed. This is a WIRE-FORMAT and ORDERING change: every \
             peer derives the tiebreak discriminator with this exact function, and \
             freenet-core byte-compares summarize_state output for staleness. If \
             the change is intended it re-keys the room contract — follow the \
             migration ritual and update this vector deliberately."
        );

        // Reversing the digest bytes must be observably different, so the vector
        // genuinely constrains ORDER and not merely the multiset of bytes.
        let mut reversed = EXPECTED;
        reversed.reverse();
        assert_ne!(
            digest.0, reversed,
            "the golden vector must distinguish byte order"
        );

        // The encoding is the other half of the commitment: a CBOR byte string
        // (major type 2, length 16 => header 0x50) at 17 bytes total. The derived
        // Serialize would emit a 16-element CBOR array at 32 bytes, undoing most
        // of the saving freenet/river#571 exists for.
        let mut encoded = Vec::new();
        ciborium::ser::into_writer(&digest, &mut encoded).expect("serialize SigDigest");
        let mut want = vec![0x50u8];
        want.extend_from_slice(&EXPECTED);
        assert_eq!(
            encoded, want,
            "SigDigest must serialize as a 17-byte CBOR byte string"
        );

        // And it must survive the round-trip the contract actually performs
        // (summarize_state serializes; get_state_delta deserializes).
        let decoded: SigDigest =
            ciborium::de::from_reader(encoded.as_slice()).expect("deserialize SigDigest");
        assert_eq!(
            decoded, digest,
            "SigDigest must round-trip through ciborium"
        );
    }

    /// The three selectors of "the canonical record" must break a rank TIE the
    /// same way. [`SigDigest`] makes a tie between DISTINCT records infeasible to
    /// mint, but two byte-identical duplicates of the SAME record tie trivially,
    /// and `Iterator::max_by_key` (which `canonical` used before) returns the
    /// LAST maximum while `dedup_to_canonical` and `apply_delta` keep the FIRST.
    /// Left disagreeing, a state holding duplicates would answer `deputies_of`
    /// one way on a freshly-GET'd full state and the other way after the next
    /// `apply_delta` ran dedup.
    /// [`outranks`] is the single definition of the tie rule that all five rank
    /// consumers share, so this is the one place it is pinned.
    ///
    /// Relaxing `>` to `>=` at any individual call site used to leave the entire
    /// suite green: reaching the tie branch behaviorally needs a genuine
    /// [`SigDigest`] collision, since `verify` checks every stored record's
    /// signature. That made the tie direction prose-only, which is exactly the
    /// state that let `canonical` (last-wins) and `dedup_to_canonical`
    /// (first-wins) disagree for as long as they did.
    #[test]
    fn outranks_keeps_the_incumbent_on_a_tie() {
        let lo = SigDigest([0x11; 16]);
        let hi = SigDigest([0x22; 16]);

        // The load-bearing case: equal rank must NOT outrank. `>=` fails here.
        assert!(
            !outranks((1, lo), (1, lo)),
            "a tie must keep the INCUMBENT — all five consumers depend on this"
        );

        // Version dominates the digest in both directions.
        assert!(outranks((2, lo), (1, hi)), "higher version wins");
        assert!(!outranks((1, hi), (2, lo)), "lower version loses");

        // At equal version the digest decides, lexicographically over its bytes.
        assert!(
            outranks((1, hi), (1, lo)),
            "greater digest wins at equal version"
        );
        assert!(
            !outranks((1, lo), (1, hi)),
            "lesser digest loses at equal version"
        );
    }

    /// `canonical` must select on the DIGEST, not merely on the version.
    ///
    /// Without this, a mutation that compares only `version` (keeping the first
    /// on a tie, matching the real tie direction) passes every river-core test;
    /// only a river-ui test catches it. Deterministic by construction: two fixed
    /// signatures whose digests are known to differ, so there is no retry loop
    /// and no randomness.
    #[test]
    fn canonical_selects_by_digest_not_just_version() {
        let mut csprng = OsRng;
        let member_sk = SigningKey::generate(&mut csprng);
        let member_id = MemberId::from(&member_sk.verifying_key());

        // blake3([1; 64]) = 29c04cc4...  blake3([2; 64]) = fe969aba...
        // so the [2; 64] record has the greater digest and MUST win. (Computed
        // with the `b3sum` CLI, not by calling `sig_digest`.)
        let low_sig = Signature::from_bytes(&[1u8; 64]);
        let high_sig = Signature::from_bytes(&[2u8; 64]);
        assert!(
            sig_digest(&high_sig) > sig_digest(&low_sig),
            "fixture precondition: [2; 64] must digest greater than [1; 64]"
        );

        let mut winner_info = MemberInfo::new_public(member_id, 1, "Same".to_string());
        winner_info.deputies = vec![member_id];
        let winner = AuthorizedMemberInfo::with_signature(winner_info, high_sig);
        let loser = AuthorizedMemberInfo::with_signature(
            MemberInfo::new_public(member_id, 1, "Same".to_string()),
            low_sig,
        );

        // Loser FIRST, so a version-only comparison that keeps the first (the
        // real tie direction) returns the wrong record.
        let state = MemberInfoV1 {
            member_info: vec![loser, winner.clone()],
        };

        assert_eq!(
            state.canonical(member_id),
            Some(&winner),
            "canonical must break the equal-version tie on the digest, not fall \
             back to vector position"
        );
        assert_eq!(
            state.deputies_of(member_id),
            &[member_id],
            "deputies_of must follow canonical's choice — this is the ban-authority path"
        );
    }

    /// The two records are built with `with_signature` so they share a signature
    /// while carrying DIFFERENT `deputies`. That is exactly what a [`SigDigest`]
    /// collision would look like to these two functions, which are pure
    /// orderings and never verify a signature — and it is the only way to reach
    /// the tie branch without actually finding a 128-bit collision. Records built
    /// the normal way cannot be used here: ed25519 signing is deterministic and
    /// covers the whole `MemberInfo`, so two records that tie on rank are
    /// byte-identical, and the assertion would hold under either tie direction.
    #[test]
    fn canonical_and_dedup_break_rank_ties_identically() {
        let mut csprng = OsRng;
        let member_sk = SigningKey::generate(&mut csprng);
        let member_id = MemberId::from(&member_sk.verifying_key());
        let other_id = MemberId::from(&SigningKey::generate(&mut csprng).verifying_key());

        let signed = AuthorizedMemberInfo::new_with_member_key(
            MemberInfo::new_public(member_id, 1, "Tie".to_string()),
            &member_sk,
        );
        let shared_signature = signed.signature;

        let mut with_deputy = MemberInfo::new_public(member_id, 1, "Tie".to_string());
        with_deputy.deputies = vec![other_id];

        let first = AuthorizedMemberInfo::with_signature(
            MemberInfo::new_public(member_id, 1, "Tie".to_string()),
            shared_signature,
        );
        let second = AuthorizedMemberInfo::with_signature(with_deputy, shared_signature);

        assert_ne!(first, second, "precondition: the records must differ");
        assert_eq!(
            member_info_rank(first.member_info.version, &first.signature),
            member_info_rank(second.member_info.version, &second.signature),
            "precondition: the records must nevertheless tie on rank"
        );

        let mut state = MemberInfoV1 {
            member_info: vec![first.clone(), second],
        };
        let picked = state.canonical(member_id).cloned();
        state.dedup_to_canonical();

        assert_eq!(
            state.member_info.len(),
            1,
            "dedup must collapse the tied duplicate"
        );
        assert_eq!(
            picked.as_ref(),
            state.member_info.first(),
            "canonical() and dedup_to_canonical() must keep the SAME record on a tie \
             (`max_by_key` keeps the LAST maximum, dedup keeps the FIRST — using both \
              makes deputies_of flip after an unrelated apply_delta)"
        );
        // Both keep the FIRST record in vector order (replace only on strict `>`).
        assert_eq!(
            picked.as_ref(),
            Some(&first),
            "the tie must keep the first record"
        );
    }

    /// LOAD-BEARING regression test (issue #410).
    ///
    /// `MemberInfo` is individually signed over its ciborium bytes
    /// (`AuthorizedMemberInfo::new*` -> `sign_struct`; `verify_signature`
    /// re-serializes and checks). Adding `deputies` with a PLAIN
    /// `#[serde(default)]` would make the new WASM re-serialize a 4-field
    /// struct, changing the bytes and breaking every existing member's
    /// signature -> `validate_state` rejects the permissionless migration PUT
    /// -> every existing room migrates to empty. The
    /// `skip_serializing_if = "Vec::is_empty"` attribute makes an empty
    /// `deputies` list serialize byte-identically to the old 3-field record,
    /// so old signatures still verify.
    ///
    /// This test constructs the OLD 3-field shape, signs its ciborium bytes,
    /// and asserts the new `MemberInfo` with an empty `deputies` list (a)
    /// serializes to byte-identical bytes and (b) still verifies against that
    /// old signature. It MUST fail if `skip_serializing_if` is dropped.
    #[test]
    fn empty_deputies_serializes_identically_to_legacy_member_info() {
        use crate::util::{sign_struct, verify_struct};

        // Exact mirror of the pre-#410 3-field MemberInfo layout, in order.
        #[derive(Serialize)]
        struct OldMemberInfo {
            member_id: MemberId,
            version: u32,
            preferred_nickname: SealedBytes,
        }

        let signing_key = SigningKey::generate(&mut OsRng);
        let member_id: MemberId = signing_key.verifying_key().into();
        let nickname = SealedBytes::public("LegacyNick".to_string().into_bytes());

        let old = OldMemberInfo {
            member_id,
            version: 7,
            preferred_nickname: nickname.clone(),
        };
        // New struct: same first three fields, EMPTY deputies.
        let new_empty = MemberInfo {
            member_id,
            version: 7,
            preferred_nickname: nickname.clone(),
            deputies: Vec::new(),
        };

        // (a) direct byte-identity of the ciborium serialization.
        let mut old_bytes = Vec::new();
        ciborium::ser::into_writer(&old, &mut old_bytes).unwrap();
        let mut new_bytes = Vec::new();
        ciborium::ser::into_writer(&new_empty, &mut new_bytes).unwrap();
        assert_eq!(
            old_bytes, new_bytes,
            "MemberInfo with empty deputies MUST serialize byte-identically to \
             the legacy 3-field record; dropping skip_serializing_if breaks this \
             and strands every existing room (issue #410)"
        );

        // (b) a signature over the OLD record still verifies against the NEW struct.
        let signature = sign_struct(&old, &signing_key);
        assert!(
            verify_struct(&new_empty, &signature, &signing_key.verifying_key()).is_ok(),
            "signature over legacy MemberInfo bytes must still verify against the \
             new struct with empty deputies (proves byte-identical serialization)"
        );

        // Sanity: a NON-empty deputies list MUST change the bytes (proves the
        // field really is serialized when populated, so it is not a silent no-op).
        let with_deputy = MemberInfo {
            member_id,
            version: 7,
            preferred_nickname: nickname,
            deputies: vec![member_id],
        };
        let mut with_deputy_bytes = Vec::new();
        ciborium::ser::into_writer(&with_deputy, &mut with_deputy_bytes).unwrap();
        assert_ne!(
            old_bytes, with_deputy_bytes,
            "a populated deputies list must change the serialized bytes"
        );
    }

    #[test]
    fn test_member_info_v1_default() {
        let default_member_info = MemberInfoV1::default();
        assert!(default_member_info.member_info.is_empty());
    }

    #[test]
    fn test_member_info_v1_verify() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_verifying_key = member_signing_key.verifying_key();
        let member_id = member_verifying_key.into();

        let member_info = create_test_member_info(member_id);
        let authorized_member_info = AuthorizedMemberInfo::new(member_info, &member_signing_key);

        let mut member_info_v1 = MemberInfoV1::default();
        member_info_v1
            .member_info
            .push(authorized_member_info.clone());

        let mut parent_state = ChatRoomStateV1::default();
        let member = Member {
            owner_member_id: owner_id,
            invited_by: owner_id,
            member_vk: member_verifying_key,
        };
        let authorized_member = AuthorizedMember::new(member, &owner_signing_key);
        parent_state.members.members.push(authorized_member);

        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        let result = member_info_v1.verify(&parent_state, &parameters);
        assert!(
            result.is_ok(),
            "Verification failed: {}",
            result.unwrap_err()
        );

        // Test with non-existent member
        let non_existent_member_id = SigningKey::generate(&mut OsRng).verifying_key().into();
        let non_existent_member_info = create_test_member_info(non_existent_member_id);
        let non_existent_authorized_member_info =
            AuthorizedMemberInfo::new(non_existent_member_info, &owner_signing_key);
        member_info_v1
            .member_info
            .push(non_existent_authorized_member_info);

        let verify_result = member_info_v1.verify(&parent_state, &parameters);
        assert!(
            verify_result.is_err(),
            "Expected verification to fail, but it succeeded"
        );
        if let Err(err) = verify_result {
            assert!(
                err.contains("MemberInfo exists for non-existent member"),
                "Unexpected error message: {}",
                err
            );
        }

        // Test with invalid signature
        let invalid_authorized_member_info = authorized_member_info.with_invalid_signature();
        member_info_v1.member_info.clear();
        member_info_v1
            .member_info
            .push(invalid_authorized_member_info);

        let verify_result = member_info_v1.verify(&parent_state, &parameters);
        assert!(
            verify_result.is_err(),
            "Expected verification to fail, but it succeeded"
        );
        if let Err(err) = verify_result {
            assert!(
                err.contains("Invalid signature"),
                "Unexpected error message: {}",
                err
            );
        }
    }

    #[test]
    fn test_member_info_v1_summarize() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let member_id = SigningKey::generate(&mut OsRng).verifying_key().into();
        let member_info = create_test_member_info(member_id);
        let authorized_member_info = AuthorizedMemberInfo::new(member_info, &owner_signing_key);

        let mut member_info_v1 = MemberInfoV1::default();
        member_info_v1.member_info.push(authorized_member_info);

        let parent_state = ChatRoomStateV1::default();
        let parameters = ChatRoomParametersV1 {
            owner: owner_signing_key.verifying_key(),
        };

        let summary = member_info_v1.summarize(&parent_state, &parameters);
        assert_eq!(summary.len(), 1);
        assert!(summary.contains_key(&member_id));
        assert_eq!(summary.get(&member_id).unwrap().0, 1); // Version should be 1
    }

    #[test]
    fn test_member_info_v1_delta() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let member_id1 = SigningKey::generate(&mut OsRng).verifying_key().into();
        let member_id2 = SigningKey::generate(&mut OsRng).verifying_key().into();

        let member_info1 = create_test_member_info(member_id1);
        let member_info2 = create_test_member_info(member_id2);

        let authorized_member_info1 = AuthorizedMemberInfo::new(member_info1, &owner_signing_key);
        let authorized_member_info2 = AuthorizedMemberInfo::new(member_info2, &owner_signing_key);
        // Capture member1's signature for the summary tiebreak (#411 round 4 B).
        let sig1 = authorized_member_info1.signature;

        let mut member_info_v1 = MemberInfoV1::default();
        member_info_v1.member_info.push(authorized_member_info1);
        member_info_v1.member_info.push(authorized_member_info2);

        let parent_state = ChatRoomStateV1::default();
        let parameters = ChatRoomParametersV1 {
            owner: owner_signing_key.verifying_key(),
        };

        // Summary says the peer already holds member1 at (version 1, sig1), so
        // member1 does not outrank it and only member2 appears in the delta.
        let mut old_summary = BTreeMap::new();
        old_summary.insert(member_id1, member_info_rank(1, &sig1));

        let delta = member_info_v1.delta(&parent_state, &parameters, &old_summary);

        assert!(delta.is_some());
        let delta = delta.unwrap();
        assert_eq!(delta.len(), 1);
        assert_eq!(delta[0].member_info.member_id, member_id2);
    }

    #[test]
    fn test_member_info_v1_apply_delta() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_verifying_key = member_signing_key.verifying_key();
        let member_id = member_verifying_key.into();

        let member_info = create_test_member_info(member_id);
        let authorized_member_info =
            AuthorizedMemberInfo::new_with_member_key(member_info, &member_signing_key);

        let mut member_info_v1 = MemberInfoV1::default();
        let delta = vec![authorized_member_info.clone()];

        let mut parent_state = ChatRoomStateV1::default();
        parent_state.members.members.push(AuthorizedMember {
            member: Member {
                owner_member_id: owner_id,
                invited_by: owner_id,
                member_vk: member_verifying_key,
            },
            signature: owner_signing_key
                .sign("TestUser".as_bytes())
                .to_bytes()
                .into(),
        });

        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        // Test applying delta with a new member
        println!("Applying delta with a new member");
        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(delta));
        println!("Result: {:?}", result);
        assert!(result.is_ok(), "Failed to apply delta: {:?}", result.err());
        assert_eq!(member_info_v1.member_info.len(), 1);
        assert_eq!(member_info_v1.member_info[0], authorized_member_info);

        // Test applying delta with an existing member (update)
        println!("Applying delta with an existing member (update)");
        let updated_member_info =
            MemberInfo::new_public(member_id, 2, "UpdatedNickname".to_string());
        let updated_authorized_member_info =
            AuthorizedMemberInfo::new_with_member_key(updated_member_info, &member_signing_key);
        let update_delta = vec![updated_authorized_member_info.clone()];

        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(update_delta));
        println!("Result: {:?}", result);
        assert!(
            result.is_ok(),
            "Failed to apply update delta: {:?}",
            result.err()
        );
        assert_eq!(member_info_v1.member_info.len(), 1);
        assert_eq!(
            member_info_v1.member_info[0],
            updated_authorized_member_info
        );

        // Test applying delta with a non-existent member (should succeed, entry silently dropped)
        println!("Applying delta with a non-existent member");
        let non_existent_member_id = SigningKey::generate(&mut OsRng).verifying_key().into();
        let non_existent_member_info = create_test_member_info(non_existent_member_id);
        let non_existent_authorized_member_info = AuthorizedMemberInfo::new_with_member_key(
            non_existent_member_info,
            &SigningKey::generate(&mut OsRng),
        );
        let non_existent_delta = vec![non_existent_authorized_member_info];

        let prev_len = member_info_v1.member_info.len();
        let result =
            member_info_v1.apply_delta(&parent_state, &parameters, &Some(non_existent_delta));
        println!("Result: {:?}", result);
        assert!(
            result.is_ok(),
            "Non-existent member should be silently skipped"
        );
        assert_eq!(
            member_info_v1.member_info.len(),
            prev_len,
            "Entry should not be added"
        );

        // Test applying delta with an older version (should not update)
        println!("Applying delta with an older version");
        let older_member_info = MemberInfo::new_public(member_id, 1, "TestUser".to_string());
        let older_authorized_member_info =
            AuthorizedMemberInfo::new_with_member_key(older_member_info, &member_signing_key);
        let older_delta = vec![older_authorized_member_info];

        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(older_delta));
        println!("Result: {:?}", result);
        assert!(
            result.is_ok(),
            "Failed to apply older version delta: {:?}",
            result.err()
        );
        assert_eq!(member_info_v1.member_info.len(), 1);
        assert_eq!(member_info_v1.member_info[0].member_info.version, 2);

        // Test applying delta with multiple members
        println!("Applying delta with multiple members");
        let new_member_signing_key = SigningKey::generate(&mut OsRng);
        let new_member_verifying_key = new_member_signing_key.verifying_key();
        let new_member_id = new_member_verifying_key.into();
        let new_member_info = create_test_member_info(new_member_id);
        let new_authorized_member_info =
            AuthorizedMemberInfo::new_with_member_key(new_member_info, &new_member_signing_key);

        parent_state.members.members.push(AuthorizedMember {
            member: Member {
                owner_member_id: owner_id,
                invited_by: owner_id,
                member_vk: new_member_verifying_key,
            },
            signature: owner_signing_key
                .sign("NewTestUser".as_bytes())
                .to_bytes()
                .into(),
        });

        let multi_delta = vec![
            updated_authorized_member_info.clone(),
            new_authorized_member_info.clone(),
        ];

        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(multi_delta));
        println!("Result: {:?}", result);
        assert!(
            result.is_ok(),
            "Failed to apply multi-member delta: {:?}",
            result.err()
        );
        assert_eq!(member_info_v1.member_info.len(), 2);
        assert!(member_info_v1
            .member_info
            .contains(&updated_authorized_member_info));
        assert!(member_info_v1
            .member_info
            .contains(&new_authorized_member_info));
    }

    #[test]
    fn test_authorized_member_info_new_and_verify() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let member_id = SigningKey::generate(&mut OsRng).verifying_key().into();
        let member_info = create_test_member_info(member_id);

        let authorized_member_info =
            AuthorizedMemberInfo::new(member_info.clone(), &owner_signing_key);

        let parameters = ChatRoomParametersV1 {
            owner: owner_signing_key.verifying_key(),
        };

        assert!(authorized_member_info.verify_signature(&parameters).is_ok());

        // Test with wrong key
        let wrong_key = SigningKey::generate(&mut OsRng).verifying_key();
        let wrong_parameters = ChatRoomParametersV1 { owner: wrong_key };
        assert!(authorized_member_info
            .verify_signature(&wrong_parameters)
            .is_err());
    }

    #[test]
    fn test_member_info_v1_delta_scenarios() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();

        let mut member_info_v1 = MemberInfoV1::default();
        let parent_state = ChatRoomStateV1::default();
        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        // Generate 5 member infos
        let member_infos: Vec<AuthorizedMemberInfo> = (0..5)
            .map(|_| {
                let member_id = SigningKey::generate(&mut OsRng).verifying_key().into();
                let member_info = create_test_member_info(member_id);
                AuthorizedMemberInfo::new(member_info, &owner_signing_key)
            })
            .collect();

        // Test when all members are new
        member_info_v1.member_info = member_infos.clone();
        let delta = member_info_v1.delta(&parent_state, &parameters, &BTreeMap::new());
        assert_eq!(delta.unwrap().len(), 5);

        // Test when all members are old with the same (version, digest) —
        // nothing outranks the summary, so the delta is empty (#411 round 4 B).
        let old_summary: BTreeMap<MemberId, (u32, SigDigest)> = member_infos
            .iter()
            .map(|info| {
                (
                    info.member_info.member_id,
                    member_info_rank(info.member_info.version, &info.signature),
                )
            })
            .collect();
        let delta = member_info_v1.delta(&parent_state, &parameters, &old_summary);
        assert!(delta.is_none());

        // Test with a mix of new and old members
        let mut old_summary = BTreeMap::new();
        old_summary.insert(
            member_infos[0].member_info.member_id,
            member_info_rank(1, &member_infos[0].signature),
        );
        old_summary.insert(
            member_infos[1].member_info.member_id,
            member_info_rank(1, &member_infos[1].signature),
        );
        let delta = member_info_v1.delta(&parent_state, &parameters, &old_summary);
        assert_eq!(delta.unwrap().len(), 3);

        // Test with updated version
        let mut updated_member_info = member_infos[0].clone();
        updated_member_info.member_info.version = 2;
        member_info_v1.member_info[0] = updated_member_info;

        let delta = member_info_v1.delta(&parent_state, &parameters, &old_summary);
        assert_eq!(delta.unwrap().len(), 4); // 3 new members + 1 updated member
    }

    #[test]
    fn test_member_info_version_handling() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        // Create a member
        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_verifying_key = member_signing_key.verifying_key();
        let member_id = member_verifying_key.into();

        // Create initial member info with version 1
        let member_info_v1 = create_test_member_info(member_id);
        let authorized_member_info_v1 =
            AuthorizedMemberInfo::new_with_member_key(member_info_v1, &member_signing_key);

        // Create updated member info with version 2
        let member_info_v2 = MemberInfo::new_public(member_id, 2, "UpdatedNickname".to_string());
        let authorized_member_info_v2 =
            AuthorizedMemberInfo::new_with_member_key(member_info_v2, &member_signing_key);

        // Set up state with version 1
        let mut member_info_state = MemberInfoV1::default();
        member_info_state
            .member_info
            .push(authorized_member_info_v1.clone());

        // Create parent state with the member
        let mut parent_state = ChatRoomStateV1::default();
        let member = Member {
            owner_member_id: owner_id,
            invited_by: owner_id,
            member_vk: member_verifying_key,
        };
        let authorized_member = AuthorizedMember::new(member, &owner_signing_key);
        parent_state.members.members.push(authorized_member);

        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        // Create summary with version 1
        let summary = member_info_state.summarize(&parent_state, &parameters);
        assert_eq!(summary.get(&member_id).unwrap().0, 1);

        // Create delta with version 2
        let mut updated_state = MemberInfoV1::default();
        updated_state
            .member_info
            .push(authorized_member_info_v2.clone());

        let delta = updated_state.delta(&parent_state, &parameters, &summary);
        assert!(delta.is_some());
        assert_eq!(delta.as_ref().unwrap().len(), 1);
        assert_eq!(delta.as_ref().unwrap()[0].member_info.version, 2);

        // Apply delta and verify version is updated
        member_info_state
            .apply_delta(&parent_state, &parameters, &delta)
            .unwrap();
        assert_eq!(member_info_state.member_info.len(), 1);
        assert_eq!(member_info_state.member_info[0].member_info.version, 2);
        assert_eq!(
            member_info_state.member_info[0]
                .member_info
                .preferred_nickname,
            SealedBytes::public("UpdatedNickname".to_string().into_bytes())
        );
    }

    #[test]
    fn test_room_owner_member_info() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        let owner_member_info = create_test_member_info(owner_id);
        let authorized_owner_info =
            AuthorizedMemberInfo::new(owner_member_info, &owner_signing_key);

        let mut member_info_v1 = MemberInfoV1::default();
        member_info_v1.member_info.push(authorized_owner_info);

        let mut parent_state = ChatRoomStateV1::default();
        parent_state.members.members.push(AuthorizedMember {
            member: Member {
                owner_member_id: owner_id,
                invited_by: owner_id,
                member_vk: owner_verifying_key,
            },
            signature: owner_signing_key
                .sign("TestOwner".as_bytes())
                .to_bytes()
                .into(),
        });

        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        let result = member_info_v1.verify(&parent_state, &parameters);
        assert!(
            result.is_ok(),
            "Room owner should be allowed to have member info: {:?}",
            result
        );
    }

    #[test]
    fn test_member_info_retention() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        // Create owner's member info
        let owner_member_info = create_test_member_info(owner_id);
        let authorized_owner_info =
            AuthorizedMemberInfo::new(owner_member_info, &owner_signing_key);

        // Create regular member's info
        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_verifying_key = member_signing_key.verifying_key();
        let member_id = member_verifying_key.into();
        let member_info = create_test_member_info(member_id);
        let authorized_member_info =
            AuthorizedMemberInfo::new_with_member_key(member_info, &member_signing_key);

        // Set up MemberInfoV1 with both owner and member info
        let mut member_info_v1 = MemberInfoV1::default();
        member_info_v1
            .member_info
            .push(authorized_owner_info.clone());
        member_info_v1
            .member_info
            .push(authorized_member_info.clone());

        // Set up parent state with only the regular member
        let mut parent_state = ChatRoomStateV1::default();
        parent_state.members.members.push(AuthorizedMember {
            member: Member {
                owner_member_id: owner_id,
                invited_by: owner_id,
                member_vk: member_verifying_key,
            },
            signature: owner_signing_key
                .sign("TestMember".as_bytes())
                .to_bytes()
                .into(),
        });

        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        // Apply an empty delta to trigger retention logic
        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(vec![]));
        assert!(result.is_ok(), "Failed to apply delta: {:?}", result.err());

        // Verify that owner's info is retained even though not in members list
        assert!(
            member_info_v1
                .member_info
                .iter()
                .any(|info| info.member_info.member_id == owner_id),
            "Owner's member info should be retained"
        );

        // Remove the regular member from parent state
        parent_state.members.members.clear();

        // Apply another empty delta
        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(vec![]));
        assert!(
            result.is_ok(),
            "Failed to apply second delta: {:?}",
            result.err()
        );

        // Verify that only owner's info remains
        assert_eq!(
            member_info_v1.member_info.len(),
            1,
            "Should only contain owner's info"
        );
        assert_eq!(
            member_info_v1.member_info[0].member_info.member_id, owner_id,
            "Remaining info should be owner's"
        );
    }

    /// Regression test: apply_delta should succeed when the delta contains
    /// member_info for a member that was simultaneously removed from
    /// parent_state.members (e.g. ban or max_members eviction).
    #[test]
    fn test_apply_delta_with_removed_member_info() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_verifying_key = member_signing_key.verifying_key();
        let member_id = member_verifying_key.into();

        // Start with the member present in both member_info and members list
        let member_info = create_test_member_info(member_id);
        let authorized_member_info =
            AuthorizedMemberInfo::new_with_member_key(member_info, &member_signing_key);

        let mut member_info_v1 = MemberInfoV1 {
            member_info: vec![authorized_member_info.clone()],
        };

        // Parent state with member REMOVED (simulates ban/max_members)
        let parent_state = ChatRoomStateV1::default();
        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        // Delta includes member_info for the now-removed member
        let updated_info = MemberInfo::new_public(member_id, 2, "NewNick".to_string());
        let updated_authorized =
            AuthorizedMemberInfo::new_with_member_key(updated_info, &member_signing_key);
        let delta = vec![updated_authorized];

        // Previously this would error; now it should succeed
        let result = member_info_v1.apply_delta(&parent_state, &parameters, &Some(delta));
        assert!(
            result.is_ok(),
            "apply_delta should skip removed member's info, got: {:?}",
            result.err()
        );

        // The removed member's info should be cleaned up by retention
        assert!(
            !member_info_v1
                .member_info
                .iter()
                .any(|info| info.member_info.member_id == member_id),
            "Removed member's info should be pruned"
        );

        // Owner info (if any) should be unaffected
        let owner_info = create_test_member_info(owner_id);
        let authorized_owner = AuthorizedMemberInfo::new(owner_info, &owner_signing_key);
        member_info_v1.member_info.push(authorized_owner.clone());

        let result = member_info_v1.apply_delta(&parent_state, &parameters, &None);
        assert!(result.is_ok());
        assert_eq!(member_info_v1.member_info.len(), 1);
        assert_eq!(
            member_info_v1.member_info[0].member_info.member_id,
            owner_id
        );
    }

    /// #411 round 7 / Codex P1 #3: a state carrying TWO validly-signed
    /// `member_info` records for the same member (a `grant` at v1 and a `revoke`
    /// at v2) must READ consistently. `verify` MUST still accept it
    /// (migration-safety), and BOTH `deputies_of` (enforcement) and `summarize`
    /// (the anti-entropy advertised value) must select the highest-rank (v2 =
    /// revoke) record, regardless of vector order — so peers with different
    /// duplicate sets converge on both enforcement and the summary.
    #[test]
    fn duplicate_member_info_reads_canonicalize_to_highest_rank() {
        let owner_signing_key = SigningKey::generate(&mut OsRng);
        let owner_verifying_key = owner_signing_key.verifying_key();
        let owner_id = owner_verifying_key.into();

        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_verifying_key = member_signing_key.verifying_key();
        let member_id = member_verifying_key.into();

        let deputy = SigningKey::generate(&mut OsRng).verifying_key().into();

        // grant @ v1: member deputizes `deputy`.
        let mut grant_mi = MemberInfo::new_public(member_id, 1, "nick".to_string());
        grant_mi.deputies = vec![deputy];
        let grant = AuthorizedMemberInfo::new_with_member_key(grant_mi, &member_signing_key);

        // revoke @ v2 (higher rank): member clears their deputies.
        let mut revoke_mi = MemberInfo::new_public(member_id, 2, "nick".to_string());
        revoke_mi.deputies = vec![];
        let revoke = AuthorizedMemberInfo::new_with_member_key(revoke_mi, &member_signing_key);
        let revoke_summary_value = member_info_rank(2u32, &revoke.signature);

        let mut parent_state = ChatRoomStateV1::default();
        parent_state.members.members.push(AuthorizedMember::new(
            Member {
                owner_member_id: owner_id,
                invited_by: owner_id,
                member_vk: member_verifying_key,
            },
            &owner_signing_key,
        ));
        let parameters = ChatRoomParametersV1 {
            owner: owner_verifying_key,
        };

        for (label, entries) in [
            ("grant-then-revoke", vec![grant.clone(), revoke.clone()]),
            ("revoke-then-grant", vec![revoke.clone(), grant.clone()]),
        ] {
            let state = MemberInfoV1 {
                member_info: entries,
            };

            // Migration-safety: `verify` accepts the duplicate state.
            assert!(
                state.verify(&parent_state, &parameters).is_ok(),
                "verify must ACCEPT a duplicate-member_info state ({label})"
            );

            // Enforcement reads the highest-rank (revoke @ v2 → no deputies).
            assert_eq!(
                state.deputies_of(member_id),
                &[] as &[MemberId],
                "deputies_of must return the v2 (revoke) result ({label})"
            );

            // Anti-entropy advertises the highest-rank (version, digest).
            let summary = state.summarize(&parent_state, &parameters);
            assert_eq!(
                summary.get(&member_id).copied(),
                Some(revoke_summary_value),
                "summarize must advertise the v2 (revoke) (version, digest) ({label})"
            );
        }
    }

    /// #411 round 7 / Codex P1 #3: when two records for one member are present,
    /// `deputies_of` must return the HIGHEST-rank record's deputies (higher
    /// version, else greater signature digest) — the same winner `apply_delta` /
    /// `summarize` converge on — regardless of vector order. A bare `.find()`
    /// (first) could disagree with the converged state.
    #[test]
    fn deputies_of_picks_highest_rank_record() {
        let member_signing_key = SigningKey::generate(&mut OsRng);
        let member_id = member_signing_key.verifying_key().into();

        let deputy_x = SigningKey::generate(&mut OsRng).verifying_key().into();
        let deputy_y = SigningKey::generate(&mut OsRng).verifying_key().into();

        // Lower-version record lists deputy_x; higher-version lists deputy_y.
        let mut mi_v1 = MemberInfo::new_public(member_id, 1, "nick".to_string());
        mi_v1.deputies = vec![deputy_x];
        let low = AuthorizedMemberInfo::new_with_member_key(mi_v1, &member_signing_key);

        let mut mi_v2 = MemberInfo::new_public(member_id, 2, "nick".to_string());
        mi_v2.deputies = vec![deputy_y];
        let high = AuthorizedMemberInfo::new_with_member_key(mi_v2, &member_signing_key);

        // Put the LOWER-rank record FIRST so a naive `.find()` would pick it.
        let member_info_v1 = MemberInfoV1 {
            member_info: vec![low, high],
        };

        assert_eq!(
            member_info_v1.deputies_of(member_id),
            &[deputy_y],
            "deputies_of must return the highest-version record's deputies"
        );

        // Also robust to the reverse vector order.
        let mut mi_v1b = MemberInfo::new_public(member_id, 1, "nick".to_string());
        mi_v1b.deputies = vec![deputy_x];
        let low_b = AuthorizedMemberInfo::new_with_member_key(mi_v1b, &member_signing_key);
        let mut mi_v2b = MemberInfo::new_public(member_id, 2, "nick".to_string());
        mi_v2b.deputies = vec![deputy_y];
        let high_b = AuthorizedMemberInfo::new_with_member_key(mi_v2b, &member_signing_key);
        let reversed = MemberInfoV1 {
            member_info: vec![high_b, low_b],
        };
        assert_eq!(
            reversed.deputies_of(member_id),
            &[deputy_y],
            "deputies_of result must be independent of vector order"
        );
    }

    /// #411 round 8 item A/C: `canonical` selects the highest-rank record and
    /// `dedup_to_canonical` collapses duplicates to it (owner kept), independent
    /// of vector order. This is the shared selector EVERY by-id reader/writer
    /// routes through, plus the post_apply_cleanup dedup.
    #[test]
    fn canonical_and_dedup_to_canonical_pick_highest_rank() {
        let owner_sk = SigningKey::generate(&mut OsRng);
        let owner_id: MemberId = owner_sk.verifying_key().into();

        let m_sk = SigningKey::generate(&mut OsRng);
        let m_id: MemberId = m_sk.verifying_key().into();
        let n_sk = SigningKey::generate(&mut OsRng);
        let n_id: MemberId = n_sk.verifying_key().into();

        let dep = SigningKey::generate(&mut OsRng).verifying_key().into();
        // M: grant @ v1 (deputies=[dep]) and revoke @ v2 (deputies=[]).
        let mut g = MemberInfo::new_public(m_id, 1, "nick".to_string());
        g.deputies = vec![dep];
        let grant = AuthorizedMemberInfo::new_with_member_key(g, &m_sk);
        let mut r = MemberInfo::new_public(m_id, 2, "nick".to_string());
        r.deputies = vec![];
        let revoke = AuthorizedMemberInfo::new_with_member_key(r, &m_sk);
        // N: single record. Owner: single record.
        let n_info = AuthorizedMemberInfo::new_with_member_key(
            MemberInfo::new_public(n_id, 3, "n".to_string()),
            &n_sk,
        );
        let owner_info = AuthorizedMemberInfo::new(
            MemberInfo::new_public(owner_id, 1, "o".to_string()),
            &owner_sk,
        );

        for order in [
            vec![
                grant.clone(),
                revoke.clone(),
                n_info.clone(),
                owner_info.clone(),
            ],
            vec![
                owner_info.clone(),
                n_info.clone(),
                revoke.clone(),
                grant.clone(),
            ],
        ] {
            let mut mi = MemberInfoV1 { member_info: order };

            // canonical picks the v2 revoke for M.
            assert_eq!(
                mi.canonical(m_id).map(|c| c.member_info.version),
                Some(2),
                "canonical(M) must be the v2 revoke"
            );
            assert_eq!(mi.canonical(n_id).map(|c| c.member_info.version), Some(3));
            assert_eq!(
                mi.canonical(owner_id).map(|c| c.member_info.version),
                Some(1)
            );
            assert!(mi
                .canonical(SigningKey::generate(&mut OsRng).verifying_key().into())
                .is_none());

            // dedup collapses M's duplicate, keeps owner + N, one record each.
            mi.dedup_to_canonical();
            assert_eq!(mi.member_info.len(), 3, "exactly one record per member_id");
            let m_rec = mi
                .member_info
                .iter()
                .find(|i| i.member_info.member_id == m_id)
                .unwrap();
            assert_eq!(
                m_rec.member_info.version, 2,
                "M's kept record is the revoke"
            );
            assert!(
                m_rec.member_info.deputies.is_empty(),
                "revoke has no deputies"
            );
            assert!(mi
                .member_info
                .iter()
                .any(|i| i.member_info.member_id == owner_id));
            // Idempotent.
            let before = mi.clone();
            mi.dedup_to_canonical();
            assert_eq!(before, mi, "dedup_to_canonical is idempotent");
        }
    }

    /// #411 round 8 Task 2: `apply_delta` collapses a PRE-EXISTING duplicate
    /// state (seeded by a full-state PUT/GET, which `verify` accepts) to the
    /// single canonical record per member on the WRITE path — not only later in
    /// `post_apply_cleanup`. Even an empty delta triggers it.
    #[test]
    fn apply_delta_dedups_preexisting_duplicates_to_canonical() {
        let owner_sk = SigningKey::generate(&mut OsRng);
        let owner_vk = owner_sk.verifying_key();
        let owner_id = owner_vk.into();

        let m_sk = SigningKey::generate(&mut OsRng);
        let m_vk = m_sk.verifying_key();
        let m_id: MemberId = m_vk.into();

        let dep = SigningKey::generate(&mut OsRng).verifying_key().into();
        let mut g = MemberInfo::new_public(m_id, 1, "n".to_string());
        g.deputies = vec![dep];
        let grant = AuthorizedMemberInfo::new_with_member_key(g, &m_sk);
        let mut r = MemberInfo::new_public(m_id, 2, "n".to_string());
        r.deputies = vec![];
        let revoke = AuthorizedMemberInfo::new_with_member_key(r, &m_sk);

        // Pre-existing duplicate (grant FIRST so a naive first-match would keep it).
        let mut mi = MemberInfoV1 {
            member_info: vec![grant, revoke],
        };

        let mut parent_state = ChatRoomStateV1::default();
        parent_state.members.members.push(AuthorizedMember::new(
            Member {
                owner_member_id: owner_id,
                invited_by: owner_id,
                member_vk: m_vk,
            },
            &owner_sk,
        ));
        let params = ChatRoomParametersV1 { owner: owner_vk };

        // Applying even an empty delta collapses the duplicate on the write path.
        mi.apply_delta(&parent_state, &params, &None).unwrap();

        let recs: Vec<_> = mi
            .member_info
            .iter()
            .filter(|i| i.member_info.member_id == m_id)
            .collect();
        assert_eq!(
            recs.len(),
            1,
            "apply_delta must collapse the pre-existing duplicate on the write path"
        );
        assert_eq!(recs[0].member_info.version, 2, "canonical (revoke) kept");
        assert!(recs[0].member_info.deputies.is_empty());
    }
}