vector_core/community/v2/

service.rs

//! Concord v2 service — the stateful orchestration binding the pure v2 modules
//! to storage + transport. Free functions, `std::sync::Arc<crate::db::Session>`-gated at every write
//! (a `swap_session` can land at any await — see CLAUDE.md), mirroring the v1
//! service's discipline.
//!
//! Signing + NIP-44 flow through the active [`VectorSigner`] (`active_signer()`):
//! the live client's signer for a NIP-46 bunker / NIP-55 offline account, else the
//! local vault. Every identity op in v2 is `sign_event` / `nip44_encrypt` /
//! `nip44_decrypt` — a remote signer's whole surface — so create, send, join,
//! invite, moderate, rotate, and refound all work keylessly (CORD-06 D1/D5 made the
//! rekey locator public + its blobs pairwise NIP-44, so unlike v1 there is no
//! raw-ECDH exception).

use nostr_sdk::prelude::{Event, Keys, PublicKey, Timestamp};

use super::super::transport::{Query, Transport};
use super::super::{version, ChannelId, Epoch};
use super::chat::{self, ChatEvent};
use super::community::{ChannelV2, CommunityV2};
use super::control;
use super::derive::{base_rekey_group_key, channel_group_key, channel_rekey_group_key, GroupKey};
use super::invite::{self, CommunityInvite};
use super::rekey::{self, Continuity, RekeyScope};
use super::{guestbook, stream, vsk};
use crate::community::edition::ParsedEdition;

/// The active signer for v2 authority actions: the live client's signer — which
/// covers a NIP-46 bunker / NIP-55 offline signer — falling back to the local
/// vault keys when there is no client or no signer attached (local accounts,
/// headless/CLI paths, and tests). Every v2 seal, rekey blob, and control edition
/// signs / NIP-44-wraps through this, so a keyless account can create AND
/// administer a community. v2's rekey locator is public + its blobs are pairwise
/// NIP-44 (CORD-06 D1/D5), so unlike v1 there is no raw-ECDH exception.
/// The active identity's public key for addressing/tags — authoritative (set at
/// login), no signer round-trip. Used everywhere v2 needs "who am I" so a keyless
/// account (empty vault) still resolves its own identity.
fn me_pk() -> Result<PublicKey, String> {
    crate::state::my_public_key().ok_or_else(|| "no active identity".to_string())
}

fn now_ms() -> u64 {
    web_time::SystemTime::now()
        .duration_since(web_time::UNIX_EPOCH)
        .map(|d| d.as_millis() as u64)
        .unwrap_or(0)
}

/// `now_ms`, but never twice the same value in this process.
///
/// Ordering is by the `ms` tag, and two sends can finish inside one millisecond
/// — so a sender's own back-to-back messages carried IDENTICAL stamps and fell
/// through to the reader's tiebreak, which is content-derived and therefore
/// indifferent to which was typed first. Bumping past the last stamp keeps a
/// single sender's sequence self-consistent; readers still tiebreak across
/// senders. Drifts at most a few ms ahead of the clock under a burst, and only
/// until the clock catches up.
fn next_send_ms() -> u64 {
    use std::sync::atomic::{AtomicU64, Ordering};
    static LAST: AtomicU64 = AtomicU64::new(0);
    let now = now_ms();
    LAST.fetch_update(Ordering::Relaxed, Ordering::Relaxed, |last| Some(now.max(last + 1)))
        .map(|last| now.max(last + 1))
        .unwrap_or(now)
}

/// Create a fresh v2 community owned by the local identity: mint the genesis
/// (self-certifying id + the two owner editions), persist, publish the genesis
/// control editions, and announce the owner's Guestbook Join. Returns the saved
/// community.
pub async fn create_community<T: Transport + ?Sized>(
    transport: &T,
    name: &str,
    relays: Vec<String>,
    description: Option<String>,
) -> Result<CommunityV2, String> {
    crate::db::scoped(async move {
        let signer = crate::signer::active_signer()?;
        let owner_pk = me_pk()?;
        let at_ms = now_ms();

        let meta = control::CommunityMetadata {
            name: name.to_string(),
            description: description.clone(),
            relays: relays.clone(),
            ..Default::default()
        };
        let genesis = control::genesis_signed(owner_pk, &signer, meta, at_ms / 1000).await.map_err(|e| e.to_string())?;
        let community = CommunityV2::from_genesis(&genesis, name, description, relays.clone(), at_ms);

        // Save-before-publish (like v1 create): no peers exist yet so there's no
        // shared view to diverge from, and the fresh-random keys are irrecoverable
        // if a publish hiccup rolled them back. Re-check the session after the genesis
        // signing await (a bunker signs over the network) before the DB write.
        // Seed the genesis edition heads (v1) as the owner's refuse-downgrade floor, so a
        // later edit can't be rolled back by a relay serving only the genesis prefix. The
        // live control sub is replay-free (limit 0), so the owner won't re-fold its own
        // genesis to seed the floor otherwise. Floors land BEFORE the community row
        // (floors-then-state ordering).
        let control = control::ControlPlane::of(&community);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        for wrap in &genesis.wraps {
            if let Ok((ed, _)) = control.open(wrap) {
                let entity_hex = crate::simd::hex::bytes_to_hex_32(&ed.entity_id);
                crate::db::community::set_edition_head_at_epoch(&cid_hex, &entity_hex, ed.version, &ed.self_hash, &ed.inner_id, community.root_epoch.0)?;
            }
        }
        crate::db::community::save_community_v2(&community)?;
        // Archive the genesis root at epoch 0, so a later Refounding leaves this epoch's
        // Public-channel history readable (CORD-03 §3 multi-epoch read).
        let _ = crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, community.root_epoch.0, &community.community_root);

        // Publish the two genesis control editions at the epoch-0 control plane.
        // Durable, not single-shot: over a slow transport (Tor) one attempt is a coin
        // flip, and a lost genesis leaves a community that exists only locally. Durable
        // races every relay, returns on the first ACK, then heals stragglers in the bg.
        for wrap in &genesis.wraps {
            transport.publish_durable(wrap, &community.relays).await?;
        }

        // Announce the owner's Guestbook Join so they appear in the memberlist. Relays are
        // proven-alive by the genesis ACK above, so durable here just guarantees the owner's
        // own join lands (member count) without a real block risk.
        let gb_group = super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let join_rumor = guestbook::build_join_rumor(owner_pk, None, at_ms);
        if let Ok((join_wrap, _)) = guestbook::seal_guestbook_rumor_signed(&signer, owner_pk, &join_rumor, &gb_group, Timestamp::from_secs(at_ms / 1000)).await {
            let _ = transport.publish_durable(&join_wrap, &community.relays).await;
        }

        // Sync the new membership across devices (CORD-02 §8), durably — see the join path.
        match republish_community_list(transport, Some(community.id())).await {
            Ok(true) => {}
            Ok(false) => republish_community_list_durable(Some(*community.id())),
            Err(e) => {
                crate::log_warn!("[CommunityList] failed to record this community across devices ({}) — retrying", e);
                republish_community_list_durable(Some(*community.id()));
            }
        }
        Ok(community)
    })
    .await
}

/// Mint a v2 migration TWIN whose primary channel REUSES the v1 primary channel id (§migration)
/// so chat history stitches through the flip. Same owner identity, fresh salt/root. Additional
/// v1 channels are added by the wizard via `create_*_channel_with_id`. Mirrors
/// [`create_community`]'s persist-before-publish + floor seeding.
pub async fn create_migration_twin<T: Transport + ?Sized>(
    transport: &T,
    name: &str,
    relays: Vec<String>,
    description: Option<String>,
    primary: (ChannelId, String),
) -> Result<CommunityV2, String> {
    crate::db::scoped(async move {
        let signer = crate::signer::active_signer()?;
        let owner_pk = me_pk()?;
        let at_ms = now_ms();

        let meta = control::CommunityMetadata {
            name: name.to_string(),
            description: description.clone(),
            relays: relays.clone(),
            ..Default::default()
        };
        let primary_name = primary.1.clone();
        let genesis = control::genesis_signed_with_primary(owner_pk, &signer, meta, at_ms / 1000, Some(primary))
            .await
            .map_err(|e| e.to_string())?;
        let mut community = CommunityV2::from_genesis(&genesis, name, description, relays.clone(), at_ms);
        // from_genesis hard-names the primary "general"; carry the v1 name (the wire edition
        // already carries it, so this only keeps the owner's immediate local view correct).
        if let Some(ch) = community.channels.first_mut() {
            ch.name = primary_name;
        }
        let control = control::ControlPlane::of(&community);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        for wrap in &genesis.wraps {
            if let Ok((ed, _)) = control.open(wrap) {
                let entity_hex = crate::simd::hex::bytes_to_hex_32(&ed.entity_id);
                crate::db::community::set_edition_head_at_epoch(&cid_hex, &entity_hex, ed.version, &ed.self_hash, &ed.inner_id, community.root_epoch.0)?;
            }
        }
        crate::db::community::save_community_v2(&community)?;
        let _ = crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, community.root_epoch.0, &community.community_root);
        for wrap in &genesis.wraps {
            transport.publish_durable(wrap, &community.relays).await?;
        }
        // Owner Guestbook Join so they appear in the twin's memberlist.
        let gb_group = super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let join_rumor = guestbook::build_join_rumor(owner_pk, None, at_ms);
        if let Ok((join_wrap, _)) = guestbook::seal_guestbook_rumor_signed(&signer, owner_pk, &join_rumor, &gb_group, Timestamp::from_secs(at_ms / 1000)).await {
            let _ = transport.publish_durable(&join_wrap, &community.relays).await;
        }
        Ok(community)
    })
    .await
}

/// Clone a v1 banlist onto the v2 twin (§migration Phase 1.3): the join-time ban gate needs
/// the v2 banlist to name every v1-banned npub, else a banned-but-never-cut member who can
/// open `m` would walk in. Owner-signed on the twin's control plane.
pub async fn clone_banlist_to_twin<T: Transport + ?Sized>(
    transport: &T,
    twin: &CommunityV2,
    banned: &[String],
) -> Result<(), String> {
    if banned.is_empty() {
        return Ok(());
    }
    set_banlist(transport, twin, banned).await
}

/// Clone v1 governance onto the twin (§migration Phase 1.3): every v1 member who was a FULL
/// admin (effective permissions ⊇ ADMIN_ALL) is re-granted @admin on the twin (mapping v1's
/// Admin onto v2's deterministic admin role id, CORD-04 §2). The owner is supreme by
/// identity (never a grant) and banned members are skipped (a banned author's editions fold
/// out anyway, and re-granting would spring them back to admin on a future unban).
///
/// NON-ESCALATION: only a full admin maps to v2 @admin (which holds ADMIN_ALL). A
/// partial-management v1 role holder (e.g. CREATE_INVITE only — never minted by the v1 UI,
/// but reachable via the SDK) degrades to a plain member rather than being ESCALATED to full
/// admin. Bespoke non-admin custom roles are not carried — a documented, non-security gap.
pub async fn clone_governance_to_twin<T: Transport + ?Sized>(
    transport: &T,
    twin: &CommunityV2,
    v1_roles: &crate::community::roles::CommunityRoles,
    banned: &[String],
) -> Result<(), String> {
    use crate::community::roles::Permissions;
    let owner = twin.owner()?;
    for grant in &v1_roles.grants {
        // Founding mask: v1 admin roles predate PIN_MESSAGES, so requiring the
        // widened ADMIN_ALL would silently demote every migrating v1 admin.
        if !v1_roles.effective_permissions(&grant.member).contains(Permissions::ADMIN_FOUNDING_MASK) {
            continue; // not a full admin → plain member on v2 (never escalated)
        }
        if banned.contains(&grant.member) {
            continue; // banned → no authority on v2, don't re-arm a future unban
        }
        let Ok(member) = PublicKey::parse(&grant.member) else { continue };
        if member == owner {
            continue; // supreme by identity — never needs a grant
        }
        grant_admin(transport, twin, &member).await?;
    }
    Ok(())
}

/// The twin's JoinMaterial — the membership subset sealed into the migration `m`.
/// The `m` goes to every migrating MEMBER, so the owner's staff write secret is
/// stripped: members get the address (read), never the key (CORD-02 §2).
pub fn twin_join_material(twin: &CommunityV2) -> super::list::JoinMaterial {
    let mut jm = join_material(twin);
    jm.control_root = None;
    jm
}

/// Send a text message to a channel. Derives the channel's Chat-Plane group key
/// (community_root for a Public channel, the channel key for a Private one),
/// seals it encrypted, and publishes. Returns the message's rumor id (hex).
pub async fn send_message<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    content: &str,
) -> Result<String, String> {
    send_chat_message(transport, community, channel_id, content, None, &[], vec![]).await
}

/// Full chat send: threaded reply (NIP-C7 `q`, the parent's `(rumor_id, author)`
/// hex pair), NIP-30 custom-emoji pairs, and verbatim extra tags (NIP-92 `imeta`
/// attachments). Returns the message's rumor id (hex).
pub async fn send_chat_message<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    content: &str,
    reply_to: Option<(&str, &str)>,
    emoji: &[(&str, &str)],
    extra_tags: Vec<nostr_sdk::prelude::Tag>,
) -> Result<String, String> {
    send_chat_message_at(transport, community, channel_id, content, reply_to, emoji, extra_tags, next_send_ms()).await
}

/// [`send_chat_message`] with an explicit event time. The rumor id is a pure
/// function of its inputs, so a GUI that picks `at_ms` can precompute the id for
/// its optimistic pending row — the in-process echo and the finalize then key
/// the SAME id (the exact v1 pending → sent contract).
#[allow(clippy::too_many_arguments)]
pub async fn send_chat_message_at<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    content: &str,
    reply_to: Option<(&str, &str)>,
    emoji: &[(&str, &str)],
    extra_tags: Vec<nostr_sdk::prelude::Tag>,
    at_ms: u64,
) -> Result<String, String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let rumor = chat::build_message_rumor(author_pk, channel_id, epoch, content, reply_to, emoji, extra_tags, at_ms);
    publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, false).await
}

/// React to a channel message (kind 7, NIP-25 shape). `target_id_hex` /
/// `target_author_hex` name the reacted-to message; `target_kind` is its rumor
/// kind (`kind::MESSAGE`, or `kind::COMMENT` for a threaded reply); `emoji`
/// carries the NIP-30 pair when `emoji_content` is a custom `:shortcode:`.
#[allow(clippy::too_many_arguments)]
pub async fn send_reaction<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    target_id_hex: &str,
    target_author_hex: &str,
    target_kind: u16,
    emoji_content: &str,
    emoji: Option<(&str, &str)>,
) -> Result<String, String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let at_ms = next_send_ms();
    let rumor =
        chat::build_reaction_rumor(author_pk, channel_id, epoch, target_id_hex, target_author_hex, target_kind, emoji_content, emoji, at_ms);
    publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, false).await
}

/// Edit one of your own messages (kind 3302): peers re-render `target_id_hex`
/// with the replacement text. Author-enforced on the read side — only the
/// original author's edit folds.
pub async fn send_edit<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    target_id_hex: &str,
    new_content: &str,
    emoji: &[(&str, &str)],
) -> Result<String, String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let at_ms = next_send_ms();
    let rumor = chat::build_edit_rumor(author_pk, channel_id, epoch, target_id_hex, new_content, emoji, at_ms);
    publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, false).await
}

/// Cooperative in-plane delete (kind 5, NIP-09 semantics): peers stop rendering
/// `target_id_hex`. The wrap ciphertext on relays is scrubbed separately via the
/// retained per-message stream key (see `publish_chat`).
pub async fn send_delete<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    target_id_hex: &str,
    target_kind: u16,
) -> Result<String, String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let at_ms = next_send_ms();
    let rumor = chat::build_delete_rumor(author_pk, channel_id, epoch, target_id_hex, target_kind, at_ms, None);
    let id = publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, false).await?;
    // §7: deleting one's own pinned message obliges the immediate omitting
    // edition. Hooked HERE and not only at ingest — the local delete drops the
    // row before the relay echo returns, so the echo can't re-authorize and
    // the ingest hook never sees an own delete.
    let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
    spawn_pin_duty(&ch_hex, target_id_hex, None);
    Ok(id)
}

/// Moderation-hide: remove SOMEONE ELSE's message under `MANAGE_MESSAGES`
/// (CORD-04 §3/§5). Same kind-5 the author's own delete uses — CORD defines no
/// separate hide, the authority is what differs, and every reader re-derives it
/// from the seal's real npub against the folded Roster.
///
/// Gated locally against the same predicate peers enforce, so the button can't
/// promise what the plane will refuse; a non-owner cites the Grant it acts under.
/// `target_author` comes from the caller's resident copy — you can only moderate
/// a message you can see.
pub async fn moderation_delete<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    target_id_hex: &str,
    target_kind: u16,
    target_author: &PublicKey,
) -> Result<String, String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    if crate::db::community::get_community_dissolved(&cid_hex).unwrap_or(false) {
        return Err("this community is dissolved — it accepts no new moderation actions".to_string());
    }
    let owner_hex = community.owner()?.to_hex();
    let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    if !crate::community::moderation::can_hide(
        Some(&owner_hex),
        &roster,
        &author_pk.to_hex(),
        &target_author.to_hex(),
    ) {
        return Err("you can't hide a message from a member who outranks you (or the owner)".to_string());
    }
    let at_ms = next_send_ms();
    let citation = required_authority_citation(community, &author_pk)?;
    let rumor = chat::build_delete_rumor(author_pk, channel_id, epoch, target_id_hex, target_kind, at_ms, citation.as_ref());
    let id = publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, false).await?;
    // §7: a moderation-hide of a pinned message obliges the omission too, and
    // the moderator here provably holds the bit's neighbourhood (MANAGE_MESSAGES
    // curators usually hold PIN_MESSAGES); the duty itself re-checks.
    let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
    spawn_pin_duty(&ch_hex, target_id_hex, None);
    Ok(id)
}

/// WebXDC realtime peer signal (kind 3310) — the v2 twin of v1's
/// `publish_webxdc_signal`: the same shared content shape, sealed on the
/// channel's chat plane, DURABLE (a reopening peer backfills a recent ad).
/// Signed by the member's real identity — a member can't forge another
/// player's presence. Failure is non-fatal to callers (the next re-advertise
/// covers a missed ad).
pub async fn send_webxdc_signal<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    topic_id: &str,
    node_addr: Option<&str>,
) -> Result<(), String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let at_ms = now_ms();
    let content = crate::webxdc::peer_signal_content(topic_id, node_addr);
    let rumor = chat::build_webxdc_rumor(author_pk, channel_id, epoch, &content, vec![], at_ms);
    publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, false).await.map(|_| ())
}

/// Ephemeral typing indicator (kind 23311 in a 21059 wrap — relays never store it).
pub async fn send_typing<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
) -> Result<(), String> {
    let (author_pk, group, epoch) = chat_send_context(community, channel_id)?;
    let at_ms = now_ms();
    let rumor = chat::build_typing_rumor(author_pk, channel_id, epoch, at_ms);
    publish_chat(transport, community, &group, author_pk, channel_id, epoch, rumor, at_ms, true).await.map(|_| ())
}

/// Everything a chat-plane send needs: local keys, the channel's group key +
/// epoch, and the session snapshot taken BEFORE any await. Refuses a dissolved
/// community (every honest member sealed it read-only) and a keyless Private
/// channel — deriving from the root would post to the public plane; its key
/// arrives over the rekey plane.
fn chat_send_context(community: &CommunityV2, channel_id: &ChannelId) -> Result<(PublicKey, GroupKey, Epoch), String> {
    let author_pk = me_pk()?;
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    if crate::db::community::get_community_dissolved(&cid_hex).unwrap_or(false) {
        return Err("this community has been dissolved".to_string());
    }
    // A self-ban: every honest peer drops our events (CORD-04 §4) and the send
    // echo would silently no-op, so fail loudly instead of a message that seems
    // to send but shows up nowhere.
    if crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default().contains(&author_pk.to_hex()) {
        return Err("you are banned from this community".to_string());
    }
    let ch = community.channel(channel_id).ok_or("no such channel in this community")?;
    if ch.private && ch.key.is_none() {
        return Err("this private channel has no key yet (awaiting rekey delivery)".to_string());
    }
    let (secret, epoch) = community.channel_secret(ch);
    Ok((author_pk, channel_group_key(&secret, channel_id, epoch), epoch))
}

/// Seal one chat rumor, publish, and echo the send into the
/// shared store. Returns the rumor id (hex).
#[allow(clippy::too_many_arguments)]
/// §7: an OWN edit must refresh its pinned target's proof bundle from the SEND
/// side — the relay echo of an own send deduplicates against the local echo, so
/// the ingest hook never sees it (send_delete's omission duty, same reason).
/// Without this the author's pin lags behind their message while everyone
/// else's follows. Returns the duty's arguments when the echo applied an edit.
fn own_echo_pin_duty(
    outcome: &super::inbound::ChatPersist,
    event: &ChatEvent,
) -> Option<(String, super::stream::OpenedStream)> {
    match (outcome, event) {
        (super::inbound::ChatPersist::Updated { .. }, ChatEvent::Edit { opened, target, .. }) => {
            Some((crate::simd::hex::bytes_to_hex_32(target), opened.clone()))
        }
        _ => None,
    }
}

#[allow(clippy::too_many_arguments)]
async fn publish_chat<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    group: &GroupKey,
    author_pk: PublicKey,
    channel_id: &ChannelId,
    epoch: Epoch,
    rumor: nostr_sdk::prelude::UnsignedEvent,
    at_ms: u64,
    ephemeral: bool,
) -> Result<String, String> {
    crate::db::scoped(async move {
        let rumor_id = rumor.id.ok_or("rumor has no id")?.to_hex();
        let signer = crate::signer::active_signer()?;
        let (wrap, _p_tag_keys) = chat::seal_chat_rumor_signed(&signer, author_pk, &rumor, group, Timestamp::from_secs(at_ms / 1000), ephemeral).await
            .map_err(|e| e.to_string())?;
        transport.publish(&wrap, &community.relays).await?;
        // Retain the wrap's signing key (the group stream key) keyed by rumor id so a
        // full delete can NIP-09 this exact wrap off relays (same-author rule, honored
        // everywhere — the discarded p-tag pair only works on recipient-delete relays).
        // Frozen per-message so later rekeys can't strand it. Session-gated: the publish
        // straddled network I/O.
        if !ephemeral {
            crate::db::community::store_message_key(&rumor_id, &wrap.id.to_hex(), group.keys(), &community.relays)?;
        }
        // Local echo (v1 parity): open our OWN wrap through the exact inbound path so
        // send-then-read works with no listen loop, and the relay's re-delivery dedups
        // against this row instead of re-firing callbacks. Best-effort — the publish
        // already succeeded. Ephemeral kinds (typing) apply to nothing and skip out.
        if !ephemeral {
            if let Ok(event) = chat::open_chat_event(&wrap, group, channel_id, epoch) {
                let channel_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
                let outcome = {
                    let mut st = crate::state::STATE.lock().await;
                    super::inbound::apply_chat_to_state(&mut st, &event, &channel_hex, &author_pk)
                };
                if let Some(outcome) = outcome {
                    super::inbound::persist_chat(&channel_hex, &outcome).await;
                    if let Some((target_hex, opened)) = own_echo_pin_duty(&outcome, &event) {
                        spawn_pin_duty(&channel_hex, &target_hex, Some(opened));
                    }
                }
            }
        }
        Ok(rumor_id)
    })
    .await
}

/// A chat event opened from a channel fetch, tagged with the epoch its key
/// decrypted under.
pub struct FetchedEvent {
    pub event: ChatEvent,
    pub epoch: Epoch,
}

/// Self-heal scrub-key retention for an OWN rumor seen during a history open:
/// pre-retention and other-device sends stay fully deletable, because the wrap's
/// signing key is the derivable group stream key — only this rumor→wrap mapping
/// was ever missing locally. No-op for foreign authors, kinds the UI can't
/// delete, and already-retained rows. Best-effort: a store failure never breaks
/// the fetch.
fn heal_own_wrap_key(event: &ChatEvent, group: &GroupKey, relays: &[String]) {
    if !matches!(event, ChatEvent::Message { .. } | ChatEvent::Reaction { .. }) {
        return;
    }
    let opened = event.opened();
    if crate::state::my_public_key() != Some(opened.author) {
        return;
    }
    let rumor_hex = opened.rumor_id.to_hex();
    // Only fill a confirmed gap — never clobber a send-time row, never write
    // when the store can't be read.
    if !matches!(crate::db::community::get_message_key(&rumor_hex), Ok(None)) {
        return;
    }
    if crate::db::community::store_message_key(&rumor_hex, &opened.wrapper_id.to_hex(), group.keys(), relays).is_ok() {
        // The UI caches full-vs-limited delete verdicts per message; tell it this
        // one just flipped so it re-resolves without an app restart.
        crate::traits::emit_event("message_delete_meta_changed", &serde_json::json!({ "id": rumor_hex }));
    }
}

/// How many of the newest held epochs a newest-first catch-up reads. One: a
/// rotation moves the conversation, so the live epoch is where it is. Rotated-past
/// epochs are reached by back-paging, when a reader actually scrolls for them.
const LIVE_COORD_EPOCHS: usize = 1;

/// Fetch a channel's newest messages — one page of [`fetch_channel_history`].
/// `limit` is one relay-side bound across the whole epoch-author OR-set, not
/// per epoch; deeper history pages backwards via the walk.
pub async fn fetch_channel<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    limit: usize,
) -> Result<Vec<FetchedEvent>, String> {
    fetch_channel_history(transport, community, channel_id, limit, 1, None, None, crate::community::transport::Evidence::Quorum, |_| true).await
}

/// Walk a channel's history newest-first (CORD-03 §3 "clients load a Channel
/// newest-first and paginate backwards"), querying every held epoch's Chat-Plane
/// address one `page`-sized query at a time until `max_pages`, a drained relay,
/// or `keep_paging` returns false for a page (the caller's "I already hold
/// these" early stop — consulted only on pages that opened something, so junk
/// at the address can't fake exhaustion). Pages step by INCLUSIVE `until` with
/// wrap-id dedup, so a page boundary landing mid-second can't skip siblings; a
/// full page of only-already-seen wraps is a same-second WALL (relay filters
/// are second-granular) and steps past it accepting that unseen same-second
/// siblings beyond the relay cap are unreachable — logged, and a protocol-level
/// limitation (the `ms` tag can't be filtered server-side).
///
/// Returns everything opened, deduped by rumor id, oldest→newest.
#[allow(clippy::too_many_arguments)]
pub async fn fetch_channel_history<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    page: usize,
    max_pages: usize,
    since: Option<u64>,
    // Unix-seconds upper bound for the FIRST page (inclusive) — the back-paging
    // cursor. `None` starts at the newest.
    start_until: Option<u64>,
    evidence: crate::community::transport::Evidence,
    mut keep_paging: impl FnMut(&[FetchedEvent]) -> bool,
) -> Result<Vec<FetchedEvent>, String> {
    crate::db::scoped(async move {
        // Guards the opportunistic scrub-key heals below — the fetch loop straddles
        // network I/O, and an account swap must not write into the new account's DB.
        let ch = community.channel(channel_id).ok_or("no such channel in this community")?;
        // A Public channel reads across EVERY held base-root epoch, and a Private one
        // across its OWN held epochs (CORD-03 §3), so history spanning a rotation stays
        // continuous either way. A keyless Private channel is unreadable — never derived
        // from the root (that would address the public plane).
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let coords: Vec<([u8; 32], Epoch)> = if ch.private {
            let Some(current) = ch.key else {
                return Ok(Vec::new());
            };
            let ch_hex = crate::simd::hex::bytes_to_hex_32(&ch.id.0);
            let mut held = crate::db::community::held_epoch_keys(&cid_hex, &ch_hex).unwrap_or_default();
            if !held.iter().any(|(ep, _)| *ep == ch.epoch) {
                held.push((ch.epoch, current));
            }
            // Only real grants are archived, but keep the invariant local: a private
            // plane is never read with the root value.
            held.into_iter().filter(|(_, k)| *k != community.community_root).map(|(ep, k)| (k, ep)).collect()
        } else {
            let mut roots = crate::db::community::held_epoch_keys(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX).unwrap_or_default();
            if !roots.iter().any(|(ep, _)| *ep == community.root_epoch) {
                roots.push((community.root_epoch, community.community_root));
            }
            roots.into_iter().map(|(ep, root)| (root, ep)).collect()
        };
        if coords.is_empty() {
            return Ok(Vec::new());
        }
        // Every epoch is its own address on this plane, so the full set costs one
        // fetch per held epoch per page and grows with the community's whole
        // rotation history. A newest-first catch-up wants the live epoch, which is
        // the only one anyone should be speaking on; reaching back through a
        // rotation is what back-paging (`start_until`) is for — the same division
        // the boot volley already draws.
        let mut coords = coords;
        if start_until.is_none() && coords.len() > LIVE_COORD_EPOCHS {
            coords.sort_by_key(|(_, e)| std::cmp::Reverse(e.0));
            coords.truncate(LIVE_COORD_EPOCHS);
        }

        let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
        let mut seen_rumors = std::collections::HashSet::new();
        let mut out: Vec<(u64, FetchedEvent)> = Vec::new();
        let mut until: Option<u64> = start_until;
        let mut oldest: Option<u64> = None;
        for _ in 0..max_pages {
            // Fetch each held epoch's Chat-Plane AUTHED AS that plane key. AUTH-gating
            // relays (Ditto) require the connection authed as the author queried and
            // reject a multi-author REQ ("all authors must be authenticated"), so a
            // single merged fetch returns nothing there — the latest messages under a
            // freshly-adopted epoch never load. Per-plane authed fetches + union.
            let mut wraps: Vec<Event> = Vec::new();
            let mut wrap_ids: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
            for (secret, epoch) in &coords {
                let plane = channel_group_key(secret, channel_id, *epoch);
                let q = Query {
                    kinds: vec![stream::KIND_WRAP],
                    authors: vec![plane.pk_hex()],
                    since,
                    until,
                    limit: Some(page),
                    evidence,
                    ..Default::default()
                };
                if let Ok(evs) = transport.fetch_plane(plane.keys(), &q, &community.relays).await {
                    for e in evs.events {
                        if wrap_ids.insert(e.id) {
                            wraps.push(e);
                        }
                    }
                }
            }
            if wraps.is_empty() {
                break;
            }
            let mut fresh = 0usize;
            let mut page_events: Vec<FetchedEvent> = Vec::new();
            for wrap in &wraps {
                if !seen_wraps.insert(wrap.id) {
                    continue;
                }
                fresh += 1;
                let at = wrap.created_at.as_secs();
                if oldest.is_none_or(|o| at < o) {
                    oldest = Some(at);
                }
                // Select the epoch whose group key authored this wrap (no trial decrypt).
                for (secret, epoch) in &coords {
                    let group = channel_group_key(secret, channel_id, *epoch);
                    if wrap.pubkey != group.pk() {
                        continue;
                    }
                    if let Ok(event) = chat::open_chat_event(wrap, &group, channel_id, *epoch) {
                        let id = event.opened().rumor_id;
                        if seen_rumors.insert(id) {
                            heal_own_wrap_key(&event, &group, &community.relays);
                            page_events.push(FetchedEvent { event, epoch: *epoch });
                        }
                    }
                    break;
                }
            }
            if fresh == 0 {
                if wraps.len() < page {
                    break; // drained — the relay has nothing older.
                }
                // A full page of already-seen wraps: a same-second WALL. Step past it;
                // same-second siblings beyond the relay's cap are unreachable by a
                // second-granular filter.
                let Some(o) = oldest else { break };
                if o == 0 {
                    break;
                }
                crate::log_warn!("v2: same-second history wall at {o} — stepping past it (messages beyond the relay page cap in that second are unreachable)");
                until = Some(o - 1);
                continue;
            }
            let stop = !page_events.is_empty() && !keep_paging(&page_events);
            out.extend(page_events.into_iter().map(|e| (e.event.opened().at_ms, e)));
            if stop {
                break; // the caller holds everything from here back.
            }
            until = oldest; // inclusive — wrap-id dedup absorbs the boundary overlap.
        }
        // Ties break on the content-derived rumor id, so every client orders a
        // same-millisecond pair identically. A bare `ms` sort left ties to whatever
        // order the relay happened to serve across pages, so two readers could show
        // the same two messages in opposite orders.
        out.sort_by(|a, b| {
            a.0.cmp(&b.0)
                .then_with(|| a.1.event.opened().rumor_id.as_bytes().cmp(b.1.event.opened().rumor_id.as_bytes()))
        });
        Ok(out.into_iter().map(|(_, e)| e).collect())
    })
    .await
}

// ── Invites (CORD-05) ────────────────────────────────────────────────────────

/// Who an invite bundle is FOR — which decides the Private-Channel keys it may
/// carry (CORD-05 §1 vs §2).
///
/// A **Link** has no recipient: "anyone the link reaches can join", so its
/// audience holds no Role by construction and is entitled to no Private Channel
/// at all. A **Member** is a specific npub whose entitlement is computable.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum BundleAudience {
    /// A public link (33301 bundle event): public channels only.
    Link,
    /// A direct invite (3313) to this npub: may carry Private-Channel keys.
    Member(PublicKey),
}

/// Build the §1 invite bundle for this community, scoped to `audience`. A
/// Public channel carries the `community_root` as its "key" (the joiner derives
/// the real secret from the root); a Private one its own key — and only for a
/// Member the folded roster shows entitled. The bundle self-certifies the owner,
/// so the inviter's identity is irrelevant to trust.
pub fn bundle_of(
    community: &CommunityV2,
    audience: BundleAudience,
    creator: Option<PublicKey>,
    expires_at_ms: Option<u64>,
    label: Option<String>,
) -> CommunityInvite {
    bundle_of_with_overlay(community, audience, creator, expires_at_ms, label, &[], &[])
}

/// [`bundle_of`] settling entitlement against a Grant this client JUST published
/// (`with`/`without` role ids), since the fold lags its own publish. This is the
/// grant-vend path (CORD-03 "delivered on grant").
pub fn bundle_of_with_overlay(
    community: &CommunityV2,
    audience: BundleAudience,
    creator: Option<PublicKey>,
    expires_at_ms: Option<u64>,
    label: Option<String>,
    with: &[String],
    without: &[String],
) -> CommunityInvite {
    let hex = crate::simd::hex::bytes_to_hex_32;
    let cid_hex = hex(&community.identity.community_id.0);
    let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    let owner_hex = community.owner().ok().map(|o| o.to_hex());
    let recipient_hex = match audience {
        BundleAudience::Link => None,
        BundleAudience::Member(pk) => Some(pk.to_hex()),
    };
    let channels = community
        .vendable_channels(&roster, owner_hex.as_deref(), recipient_hex.as_deref(), with, without)
        .into_iter()
        .map(|c| invite::ChannelGrant {
            id: hex(&c.id.0),
            key: hex(&c.key.unwrap_or(community.community_root)),
            epoch: c.epoch.0,
            name: c.name.clone(),
        })
        .collect();
    CommunityInvite {
        community_id: hex(&community.identity.community_id.0),
        owner: hex(&community.identity.owner_xonly),
        owner_salt: hex(&community.identity.owner_salt),
        community_root: hex(&community.community_root),
        root_epoch: community.root_epoch.0,
        // Read access to the Control Plane, never write (CORD-02 §7); absent
        // on a legacy pre-split epoch.
        control_pk: community.control_pk.map(|p| p.to_hex()),
        channels,
        relays: community.relays.clone(),
        name: community.name.clone(),
        // Mint-time snapshot so a parked invite renders the real logo before any
        // fold; the Control Plane stays the authority after joining.
        icon: community.icon.clone(),
        expires_at: expires_at_ms,
        creator_npub: creator.map(|p| p.to_hex()),
        label,
        extra: Default::default(),
    }
}

/// Gift-wrap a Direct Invite (kind 3313) of this community straight to `recipient`
/// and publish it to the community relays. `expires_at_ms` (unix ms) optionally
/// bounds its shelf life; `label` is echoed in the joiner's Guestbook Join. The
/// bundle hands over the keys; the recipient consents by accepting (nothing joins
/// on receipt). Returns the wrap.
pub async fn send_direct_invite<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    recipient: &PublicKey,
    expires_at_ms: Option<u64>,
    label: Option<String>,
) -> Result<Event, String> {
    crate::db::scoped(async move {
        // A stale bundle is worse than a stale edit: it hands the joiner keys to a
        // buried epoch, and their client later self-evicts on the rekey exclusion.
        assert_current_root(community)?;
        let signer = crate::signer::active_signer()?;
        let inviter_pk = me_pk()?;
        let bundle = bundle_of(community, BundleAudience::Member(*recipient), Some(inviter_pk), expires_at_ms, label);
        let wrap = invite::build_direct_invite_signed(&signer, inviter_pk, recipient, &bundle).await.map_err(|e| e.to_string())?;
        transport.publish(&wrap, &community.relays).await?;
        Ok(wrap)
    })
    .await
}

/// A minted public link: the shareable URL plus the addressable bundle event to
/// publish and the link keypair to retain (in the Invite List) for later refresh
/// or revocation.
pub struct MintedLink {
    pub url: String,
    pub bundle_event: Event,
    pub link_signer: Keys,
    pub token: [u8; super::derive::TOKEN_LEN],
    /// Unix ms, mirrored from the bundle. The Invite List is the creator's only
    /// record of it, and the Registry prunes on it — the coordinate a member
    /// folds carries no expiry, so a lapsed link the creator never pruned reads
    /// as a live door forever (CORD-05 §4/§5).
    pub expires_at_ms: Option<u64>,
    pub label: Option<String>,
}

/// Mint a public invite link for this community: a fresh token + link keypair, the
/// bundle encrypted under the token key and published at `(33301, link_signer,
/// "")`, and the `base/invite/<naddr>#<fragment>` URL. `base` is the deep-link
/// domain (e.g. `https://vectorapp.io`); the fragment carries the token + bootstrap
/// relays and never reaches a server.
pub async fn mint_public_link<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    base: &str,
    expires_at_ms: Option<u64>,
    label: Option<String>,
) -> Result<MintedLink, String> {
    crate::db::scoped(async move {
        // Readers ignore a registry whose author lacks CREATE_INVITE (it can't even
        // flip the community Public) — refuse before minting a link nobody honors.
        ensure_folded_permission(community, &me_pk()?, crate::community::roles::Permissions::CREATE_INVITE, "minting a public invite link")?;
        let mut token = [0u8; super::derive::TOKEN_LEN];
        token.copy_from_slice(&super::super::random_32()[..super::derive::TOKEN_LEN]);
        let link_signer = Keys::generate();
        let bundle = bundle_of(community, BundleAudience::Link, Some(me_pk()?), expires_at_ms, label.clone());
        let bundle_key = super::derive::invite_bundle_key(&token);
        let bundle_event = invite::build_bundle_event(&link_signer, &bundle, &bundle_key).map_err(|e| e.to_string())?;
        let url = invite::build_invite_url(base, &link_signer.public_key(), &token, &community.relays).map_err(|e| e.to_string())?;

        transport.publish_durable(&bundle_event, &community.relays).await?;
        let minted = MintedLink { url, bundle_event, link_signer, token, expires_at_ms, label: label.clone() };
        // Sync the link across the creator's devices (13303) + publish the Registry
        // (vsk-8) so members see the community is Public. Best-effort — the link works
        // without the sync.
        let _ = record_minted_link(transport, community, &minted).await;
        // Local mirror so `list_public_invites` stays a sync local read (v1 parity);
        // the 13303 list remains the cross-device record. Re-check the session: the
        // publishes above straddled awaits, and this write must not land account A's
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let token_hex = crate::simd::hex::bytes_to_hex_16(&minted.token);
        let _ = crate::db::community::save_public_invite(&token_hex, &cid_hex, &minted.url, expires_at_ms.map(|e| e as i64), label.as_deref());
        Ok(minted)
    })
    .await
}

// ── The Invite Registry (vsk 8) + Invite List (13303), CORD-05 §4/§5 ──────────

/// Fetch the creator's own 13303 Invite List from `relays` (newest wins; a
/// decrypt/parse failure is "no news", never a clobber of the local mirror).
/// Transport failure is Err, NOT None: the 13303 is REPLACEABLE, so a caller
/// that mistakes "couldn't reach the relays" for "no list yet" and publishes a
/// fresh one wipes every link minted on other devices. Full evidence for the
/// same reason — this read feeds replaceable-event writes.
async fn fetch_invite_list<T: Transport + ?Sized>(
    transport: &T,
    relays: &[String],
) -> Result<Option<invite::InviteList>, String> {
    let signer = crate::signer::active_signer()?;
    let my_pk = me_pk()?;
    let query = Query {
        kinds: vec![super::kind::INVITE_LIST],
        authors: vec![my_pk.to_hex()],
        limit: Some(4),
        evidence: crate::community::transport::Evidence::Full,
        ..Default::default()
    };
    let events = transport.fetch(&query, relays).await?;
    let mut best: Option<(u64, invite::InviteList)> = None;
    for e in events {
        if let Ok(l) = invite::parse_invite_list_event_signed(&signer, my_pk, &e).await {
            let at = e.created_at.as_secs();
            if best.as_ref().map(|(b, _)| at > *b).unwrap_or(true) {
                best = Some((at, l));
            }
        }
    }
    Ok(best.map(|(_, l)| l))
}

/// The creator's LIVE link-signer pubkeys for one community — the Registry's
/// content (CORD-05 §5), derived from the stored link secrets.
///
/// Live means neither tombstoned nor EXPIRED. An expired link cannot be joined
/// (`InviteBundle::expired`, CORD-05 §1), so leaving it in the Registry states
/// a door that isn't there: the aggregate never empties, the community reads
/// Public forever, and every gate hanging off that reading silently inverts.
fn live_signers_for(list: &invite::InviteList, community_id_hex: &str, now_ms: u64) -> Vec<PublicKey> {
    let dead: std::collections::HashSet<&str> = list.tombstones.iter().map(|t| t.token.as_str()).collect();
    list.entries
        .iter()
        .filter(|e| e.community_id == community_id_hex && !dead.contains(e.token.as_str()))
        .filter(|e| e.expires_at.is_none_or(|exp| now_ms <= exp))
        .filter_map(|e| Keys::parse(&e.signer_sk).ok().map(|k| k.public_key()))
        .collect()
}

/// Publish the creator's Registry (vsk-8) edition — their live link signers for this
/// community — so members fold it into the Public/Private source of truth (a
/// non-empty aggregate = Public).
async fn publish_invite_registry<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, __session: &std::sync::Arc<crate::db::Session>, live_signers: &[PublicKey]) -> Result<(), String> {
    let my_pk = me_pk()?;
    let eid = super::derive::invite_links_locator(community.id(), &my_pk.to_bytes());
    let content = invite::build_registry_content(live_signers);
    publish_control_edition(transport, community, vsk::INVITE_LINKS, &eid, &content).await?;
    // Refresh the cache from the PLANE, not from `live_signers`: the column aggregates
    // every creator, so writing only mine would clobber theirs, and a union could never
    // shrink — retiring the last link would leave the community reading Public forever.
    refresh_invite_registry_cache(transport, community).await;
    Ok(())
}

/// Re-fold the whole invite Registry and cache it, so Public/Private stays a sync
/// LOCAL read. Silent no-op when the plane can't be read whole — a partial fold
/// would under-state Public, leaving a live link open behind a ban.
async fn refresh_invite_registry_cache<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) {
    crate::db::scoped(async move {
        let Ok(owner) = community.owner() else { return };
        let Some(editions) = fetch_control_plane_whole(transport, community).await else { return };
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)
            .unwrap_or_default()
            .into_iter()
            .filter(|(_, f)| f.0 == community.root_epoch.0)
            .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
            .collect();
        let authority = fold_authority(community, &editions, &floors);
        let sets = live_invite_link_sets(community.id(), &owner.to_hex(), &editions, &authority, &floors);
        let _ = crate::db::community::set_community_invite_registry(&cid_hex, &flatten_link_sets(&sets));
        let _ = crate::db::community::replace_invite_link_sets(&cid_hex, &sets);
    })
    .await
}

/// Record a freshly-minted public link across the creator's devices: append it to the
/// 13303 Invite List and refresh the Registry (CORD-05 §4/§5).
async fn record_minted_link<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, minted: &MintedLink) -> Result<(), String> {
    crate::db::scoped(async move {
        let session = crate::db::current_session();
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let token_hex = crate::simd::hex::bytes_to_hex_16(&minted.token);
        // Err aborts the sync half (the link's bundle already published durably;
        // a retry re-records it) — an unreachable relay set must never be mistaken
        // for "no list yet" and clobber the replaceable 13303. Ok(None) IS a fresh
        // creator's honest first list.
        let mut list = fetch_invite_list(transport, &community.relays).await?.unwrap_or_default();
        if !list.entries.iter().any(|e| e.token == token_hex) {
            list.entries.push(invite::InviteEntry {
                token: token_hex,
                signer_sk: minted.link_signer.secret_key().to_secret_hex(),
                community_id: cid_hex.clone(),
                url: minted.url.clone(),
                label: minted.label.clone(),
                created_at: now_ms() / 1000,
                expires_at: minted.expires_at_ms,
                epoch: Some(community.root_epoch.0),
                extra: Default::default(),
            });
        }
        let event = invite::build_invite_list_event_signed(&signer, my_pk, &list).await.map_err(|e| e.to_string())?;
        transport.publish(&event, &community.relays).await?;
        let signers = live_signers_for(&list, &cid_hex, now_ms());
        publish_invite_registry(transport, community, &session, &signers).await
    })
    .await
}

/// Revoke a public link by its token hex (CORD-05 §2/§5): re-post its coordinate as a
/// revocation tombstone (retiring the bundle behind the URL, so a fetcher finds the
/// grave), tombstone the Invite List entry, and refresh the Registry. Retiring the
/// LAST live link empties the Registry → the community reads Private (a Refounding is
/// the owner's separate read-cut).
pub async fn revoke_public_link<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, token_hex: &str) -> Result<(), String> {
    crate::db::scoped(async move {
        let session = crate::db::current_session();
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let mut list = fetch_invite_list(transport, &community.relays).await?.ok_or("no invite list found to revoke from")?;
        let entry = list.entries.iter().find(|e| e.token == token_hex && e.community_id == cid_hex).cloned();
        let Some(entry) = entry else {
            // The list is OURS and was positively fetched; a token it neither vends is a
            // husk — a local row kept past a revocation or privatize performed elsewhere
            // (another device, Armada). The row carries no signer_sk, so no revocation
            // can EVER be built from it: erroring here just leaves an entry the owner can
            // neither use nor remove. Pruning the local record is the only completion.
            // (Ok(None) above still errors — an unreadable list is not proof of absence.)
            let tombstoned = list.tombstones.iter().any(|t| t.token == token_hex && t.community_id == cid_hex);
            crate::log_warn!(
                "[Invites] link {} is not in the fetched invite list ({}) — pruning the local record",
                &token_hex[..token_hex.len().min(8)],
                if tombstoned { "already tombstoned" } else { "retired elsewhere" }
            );
            let _ = crate::db::community::delete_public_invite(token_hex);
            return Ok(());
        };
        // Re-post the bundle coordinate as a revocation tombstone (creator-signed).
        let link_signer = Keys::parse(&entry.signer_sk).map_err(|_| "malformed link signer")?;
        let revocation = invite::build_revocation(&link_signer).map_err(|e| e.to_string())?;
        transport.publish_durable(&revocation, &community.relays).await?;
        // Tombstone the Invite List entry (permanent — a stale device can't resurrect it).
        list.tombstones.push(invite::InviteTombstone { token: token_hex.to_string(), community_id: cid_hex.clone(), extra: Default::default() });
        list.entries.retain(|e| e.token != token_hex);
        let event = invite::build_invite_list_event_signed(&signer, my_pk, &list).await.map_err(|e| e.to_string())?;
        transport.publish(&event, &community.relays).await?;
        let signers = live_signers_for(&list, &cid_hex, now_ms());
        // Does anyone ELSE still vend a live link? Folded BEFORE our own registry
        // republish: a fold taken after it would race relay propagation and read our
        // own stale (pre-revoke) registry, so the privatize decision would flip to
        // "still public" almost every time. Links are per-creator (CORD-05 §5), so
        // only the other creators' sets matter here — ours is `signers`.
        // (v1 parity: `revoke_public_invite`'s B1 fix refreshes the aggregate first
        // for exactly this reason.)
        let others_vend = if signers.is_empty() {
            match fetch_control_plane_whole(transport, community).await {
                Some(editions) => {
                    let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)
                        .unwrap_or_default()
                        .into_iter()
                        .filter(|(_, f)| f.0 == community.root_epoch.0)
                        .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
                        .collect();
                    let owner_hex = community.owner().map(|o| o.to_hex()).unwrap_or_default();
                    let authority = fold_authority(community, &editions, &floors);
                    live_invite_link_sets(community.id(), &owner_hex, &editions, &authority, &floors)
                        .iter()
                        .any(|s| s.creator_hex != my_pk.to_hex())
                }
                // Unreadable plane: assume someone else still vends. Rotating on a
                // guess would burn an epoch (and strand pre-split clients) over a
                // transport blip; the community simply stays public until a read
                // that succeeds says otherwise.
                None => true,
            }
        } else {
            false
        };
        publish_invite_registry(transport, community, &session, &signers).await?;
        let _ = crate::db::community::delete_public_invite(token_hex);
        // CORD-06 §3: converting a Public Community to Private is a Refounding
        // trigger. Revoking only stops NEW acquisitions — everyone who already
        // fetched the bundle keeps the `community_root` until it rolls, so without
        // this the community reads Private while every past link-holder retains
        // read access forever. (v1 does this in `revoke_public_invite`; v2 shipped
        // without it.)
        //
        // Best-effort and retried, NEVER the revocation's verdict: the tombstone has
        // already landed, and reporting failure here would read as "the link is
        // still live" — the opposite of the truth — while a retry would fail anyway
        // (its list entry is gone). A Refounding needs BAN, so a link creator who
        // holds only CREATE_INVITE legitimately can't rotate; that surfaces as a
        // logged warning, not a broken revoke.
        if signers.is_empty() && !others_vend {
            let mut rotated = false;
            for attempt in 0..3u8 {
                match refound_community(transport, community, &[]).await {
                    Ok(_) => {
                        rotated = true;
                        break;
                    }
                    Err(e) if attempt == 2 => {
                        crate::log_warn!(
                            "[v2] privatizing {} could not rotate the base key ({e}); the community reads Private but everyone who took a link keeps read access until it rotates",
                            &cid_hex[..8.min(cid_hex.len())]
                        );
                        crate::emit_event(
                            "community_privatize_rotation_failed",
                            &serde_json::json!({ "community_id": cid_hex, "error": e }),
                        );
                    }
                    Err(_) => continue,
                }
            }
            if rotated {
                crate::log_info!("[v2] {} privatized: base key rotated so link-joined readers are cut off", &cid_hex[..8.min(cid_hex.len())]);
            }
        }
        Ok(())
    })
    .await
}

// ── Severing containment (CORD-06 Severing Refounding) ──────────────────────

/// Persisted sever marks for a community: `root_epoch -> rotation at_secs`.
/// A mark means "epoch E was a containment": link severance retries against it
/// on every follow pass, and a rescue extension of that hop re-stamps the tag.
pub(crate) fn sever_marks(cid_hex: &str) -> std::collections::BTreeMap<u64, u64> {
    crate::db::settings::get_sql_setting(format!("v2_sever:{cid_hex}"))
        .ok()
        .flatten()
        .and_then(|v| serde_json::from_str(&v).ok())
        .unwrap_or_default()
}

/// Who minted each epoch: `root_epoch -> rotator hex`. CORD-02 §5 honors a
/// Guestbook snapshot "only from the npub whose Refounding minted that epoch",
/// so the fold has to remember which npub that was — the owner is only the
/// answer when the owner did the refounding.
pub(crate) fn epoch_minters(cid_hex: &str) -> std::collections::BTreeMap<u64, String> {
    crate::db::settings::get_sql_setting(format!("v2_minter:{cid_hex}"))
        .ok()
        .flatten()
        .and_then(|v| serde_json::from_str(&v).ok())
        .unwrap_or_default()
}

/// Remember the rotator that minted `epoch`. Recorded at ADOPTION (and by the
/// refounder for its own mint), so it is always an npub this device verified as
/// an authorized rotator — never one a snapshot claims for itself.
pub(crate) fn record_epoch_minter(cid_hex: &str, epoch: u64, rotator_hex: &str) {
    let mut m = epoch_minters(cid_hex);
    if m.get(&epoch).is_some_and(|held| held == rotator_hex) {
        return;
    }
    m.insert(epoch, rotator_hex.to_string());
    if let Ok(v) = serde_json::to_string(&m) {
        let _ = crate::db::settings::set_sql_setting(format!("v2_minter:{cid_hex}"), v);
    }
}

/// Record a severed rotation. Idempotent; marks only accumulate — the row is a
/// few bytes and clearing one would let a failed severance read as done (B4).
pub(crate) fn add_sever_mark(cid_hex: &str, epoch: u64, at_secs: u64) {
    let mut marks = sever_marks(cid_hex);
    marks.insert(epoch, at_secs);
    if let Ok(v) = serde_json::to_string(&marks) {
        let _ = crate::db::settings::set_sql_setting(format!("v2_sever:{cid_hex}"), v);
    }
}

/// Sever MY OWN condemned public links: revoke (not refresh) every live link of
/// mine for this community whose minted-at epoch sits below the highest severed
/// epoch. The epoch is the discriminator — deterministic on every device, so a
/// second device adopting the containment late can never eat the fresh link the
/// owner minted to re-open (it carries the post-raid epoch), while a link minted
/// mid-raid by a not-yet-adopted device carries the raid-era epoch and dies.
/// Batched: every tombstone publishes, then ONE 13303 republish and ONE registry
/// edition for the whole set. Deliberately WITHOUT `revoke_public_link`'s
/// last-link refound escalation: every caller here sits inside a rotation
/// (refound or follow), where that escalation self-deadlocks on `follow_lock` —
/// and the severed rotation IS the read-cut the escalation exists to provide.
/// Returns the number revoked; `Ok(0)` when there is nothing of mine to sever.
async fn sever_own_links<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
) -> Result<usize, String> {
    crate::db::scoped(async move {
        let session = crate::db::current_session();
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let Some(condemn_below) = sever_marks(&cid_hex).keys().copied().max() else {
            return Ok(0); // no containment on record — nothing is condemned.
        };
        // Local fast-path: the folded Registry names every creator with a live
        // link, and my own mints also leave local rows. Neither names me → no
        // 13303 fetch; a plain member pays nothing here.
        let maybe_mine = crate::db::community::invite_link_set_creators(&cid_hex)
            .map(|cs| cs.contains(&my_pk.to_hex()))
            .unwrap_or(true)
            || !crate::db::community::list_public_invites(&cid_hex).unwrap_or_default().is_empty();
        if !maybe_mine {
            return Ok(0);
        }
        let Some(mut list) = fetch_invite_list(transport, &community.relays).await? else {
            return Ok(0); // no list ever published — nothing of mine exists.
        };
        let dead: std::collections::HashSet<&str> = list.tombstones.iter().map(|t| t.token.as_str()).collect();
        let victims: Vec<invite::InviteEntry> = list
            .entries
            .iter()
            .filter(|e| e.community_id == cid_hex && !dead.contains(e.token.as_str()) && e.epoch.unwrap_or(0) < condemn_below)
            .cloned()
            .collect();
        if victims.is_empty() {
            return Ok(0);
        }
        let mut revoked_tokens: Vec<String> = Vec::with_capacity(victims.len());
        for entry in &victims {
            // One corrupt entry must not wedge the batch (and with it the
            // community's Public/Private reading) forever: tombstone the husk —
            // no revocation can ever be built from it anyway.
            match Keys::parse(&entry.signer_sk) {
                Ok(link_signer) => {
                    let revocation = invite::build_revocation(&link_signer).map_err(|e| e.to_string())?;
                    transport.publish_durable(&revocation, &community.relays).await?;
                }
                Err(_) => crate::log_warn!("[Sever] link {} carries a malformed signer — tombstoning the husk", &entry.token[..entry.token.len().min(8)]),
            }
            list.tombstones.push(invite::InviteTombstone {
                token: entry.token.clone(),
                community_id: cid_hex.clone(),
                extra: Default::default(),
            });
            revoked_tokens.push(entry.token.clone());
        }
        list.entries.retain(|e| !revoked_tokens.contains(&e.token));
        let event = invite::build_invite_list_event_signed(&signer, my_pk, &list).await.map_err(|e| e.to_string())?;
        transport.publish(&event, &community.relays).await?;
        let signers = live_signers_for(&list, &cid_hex, now_ms());
        publish_invite_registry(transport, community, &session, &signers).await?;
        for token in &revoked_tokens {
            let _ = crate::db::community::delete_public_invite(token);
        }
        crate::log_info!("[Sever] revoked {} own public link(s) (containment)", revoked_tokens.len());
        Ok(revoked_tokens.len())
    })
    .await
}

/// The follow-pass severance retry (B4): while a sever mark exists and I still
/// hold live links at-or-below its line, re-attempt. A miss here is load-bearing
/// — a stale registry keeps the community reading Public, which silently skips
/// every future ban's refound — so this runs on every follow until it drains.
pub(crate) async fn retry_pending_severance<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    if sever_marks(&cid_hex).is_empty() {
        return;
    }
    if let Err(e) = sever_own_links(transport, community).await {
        crate::log_warn!("[Sever] pending link severance retry failed (will retry next follow): {e}");
    }
}

/// Refresh every live public link's bundle behind its stable URL (CORD-05 §2) — e.g.
/// after a Rekey/Refounding rolled the keys — by re-posting the bundle at the same
/// coordinate with the CURRENT community state, so a link shared once keeps working
/// across rotations. Best-effort.
pub async fn refresh_public_links<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> Result<(), String> {
    crate::db::scoped(async move {
        let session = crate::db::current_session();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        // Fetch inline (not via fetch_invite_list) so a TRANSPORT FAILURE propagates as
        // Err — the caller (a post-refounding refresh) must be able to retry, or live
        // links keep serving the PRE-refound root and new joiners land on the dead
        // epoch. A genuinely-empty list is Ok (nothing to refresh).
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let query = Query {
            kinds: vec![super::kind::INVITE_LIST],
            authors: vec![my_pk.to_hex()],
            limit: Some(4),
            ..Default::default()
        };
        let events = transport.fetch(&query, &community.relays).await?;
        let mut best: Option<(u64, invite::InviteList)> = None;
        for e in events {
            if let Ok(l) = invite::parse_invite_list_event_signed(&signer, my_pk, &e).await {
                let at = e.created_at.as_secs();
                if best.as_ref().map(|(b, _)| at > *b).unwrap_or(true) {
                    best = Some((at, l));
                }
            }
        }
        let Some((_, list)) = best else {
            return Ok(());
        };
        let creator = my_pk;
        let now = now_ms();
        let dead: std::collections::HashSet<&str> = list.tombstones.iter().map(|t| t.token.as_str()).collect();
        // A containment condemns every link below its epoch. Refreshing one would
        // RE-ARM the exact door the severing rotation closed (with the new root,
        // no less) — and once re-armed, no retry could tell it from a legitimate
        // link. Skip here; the severance retry owns their burial.
        let condemn_below = sever_marks(&cid_hex).keys().copied().max().unwrap_or(0);
        for entry in &list.entries {
            if entry.community_id != cid_hex || dead.contains(entry.token.as_str()) || entry.token.len() != 2 * super::derive::TOKEN_LEN {
                continue;
            }
            if entry.epoch.unwrap_or(0) < condemn_below {
                continue;
            }
            // An expired link can't be joined, so refreshing it just re-states a
            // door that isn't there (CORD-05 §1/§5).
            if entry.expires_at.is_some_and(|exp| now > exp) {
                continue;
            }
            let Ok(link_signer) = Keys::parse(&entry.signer_sk) else { continue };
            let token = crate::simd::hex::hex_to_bytes_16(&entry.token);
            let bundle = bundle_of(community, BundleAudience::Link, Some(creator), entry.expires_at, entry.label.clone());
            let bundle_key = super::derive::invite_bundle_key(&token);
            if let Ok(event) = invite::build_bundle_event(&link_signer, &bundle, &bundle_key) {
                let _ = transport.publish_durable(&event, &community.relays).await;
            }
        }
        // Republish the Registry from the same pruned view. Expiry is the one way a
        // link dies with no user action, so without a heal point here the aggregate
        // never empties and the community reads Public long after its last door
        // shut (CORD-05 §5). Idempotent when nothing lapsed.
        //
        // Only for a creator who actually minted here: one Invite List spans every
        // community, so a member holding links ELSEWHERE would otherwise publish an
        // empty Registry edition into this one on every rotation they adopt — a
        // control-plane write, and a version bump, for a coordinate they never owned.
        let mine_here = list.entries.iter().any(|e| e.community_id == cid_hex);
        if !mine_here {
            return Ok(());
        }
        let signers = live_signers_for(&list, &cid_hex, now);
        let _ = publish_invite_registry(transport, community, &session, &signers).await;
        Ok(())
    })
    .await
}

/// Whether this community is PUBLIC (CORD-05 §5): fold every creator's Registry
/// (vsk-8) that its author is authorized for (`CREATE_INVITE`, bound to their
/// coordinate) into an aggregate live-link set — non-empty ⇒ a live link exists ⇒
/// Public; empty ⇒ Private. Retiring the last link is what flips it back.
pub async fn community_is_public<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> bool {
    let Ok(owner) = community.owner() else { return false };
    // Truncation fails toward Public: over-stating it only makes a caller take the
    // stronger remedy (privatise + re-found + reissue), while under-stating it
    // leaves a live link open behind a ban.
    let Some(editions) = fetch_control_plane_whole(transport, community).await else { return true };
    let cid = community.id();
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
    let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)
        .unwrap_or_default()
        .into_iter()
        .filter(|(_, f)| f.0 == community.root_epoch.0)
        .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
        .collect();
    let authority = fold_authority(community, &editions, &floors);
    !live_invite_link_sets(cid, &owner.to_hex(), &editions, &authority, &floors).is_empty()
}

/// Page the WHOLE control plane, not the newest window: a registry pushed out of a
/// single page reads as retired, and any member can push it out since the plane key
/// comes from the community root they hold. `None` = it could NOT be read whole
/// (transport failure, same-second wall, pager depth), so a caller must not mistake
/// an empty fold for absence.
async fn fetch_control_plane_whole<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> Option<Vec<ParsedEdition>> {
    let control = control::ControlPlane::of(community);
    let mut editions: Vec<ParsedEdition> = Vec::new();
    let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
    let mut oldest: Option<u64> = None;
    let mut until: Option<u64> = None;
    for page in 0..COMPACT_MAX_PAGES {
        // Full, not Quorum: `None` here means "could not be read whole", and a
        // majority that simply lacks another creator's Registry answers as fast as
        // one that has it — so a Quorum read returns Some(empty) and the plane reads
        // link-free. The ban path turns that into a Refounding of a PUBLIC community,
        // which CORD-05 §5 forbids: the link refresh re-posts the bundle behind the
        // same URL, so the rotation severs nothing and buries foreign-link joiners.
        let query = Query {
            kinds: vec![stream::KIND_WRAP],
            authors: vec![control.pk_hex()],
            until,
            limit: Some(FOLLOW_PAGE),
            evidence: crate::community::transport::Evidence::Full,
            ..Default::default()
        };
        let Ok(wraps) = transport.fetch(&query, &community.relays).await else { return None };
        let mut fresh = 0usize;
        for w in &wraps {
            if !seen_wraps.insert(w.id) {
                continue;
            }
            fresh += 1;
            let at = w.created_at.as_secs();
            if oldest.is_none_or(|o| at < o) {
                oldest = Some(at);
            }
            if let Ok((ed, _)) = control.open(w) {
                editions.push(ed);
            }
        }
        if fresh == 0 {
            if wraps.len() >= FOLLOW_PAGE {
                return None; // same-second wall: the plane can't be read whole
            }
            return Some(editions);
        }
        until = oldest;
        if page + 1 == COMPACT_MAX_PAGES {
            return None;
        }
    }
    Some(editions)
}

/// The live link coordinates PER AUTHORISED CREATOR across every Registry (vsk-8);
/// non-empty ⇒ the Community is Public, and the per-creator split is what drives
/// "X has N active invite links". Pure over an already-fetched edition set so the
/// on-demand probe and the control follow fold it identically.
fn live_invite_link_sets(
    cid: &crate::community::CommunityId,
    owner_hex: &str,
    editions: &[ParsedEdition],
    authority: &AuthoritySet,
    floors: &Floors,
) -> Vec<crate::db::community::InviteLinkSetRow> {
    use crate::community::roles::Permissions;
    use std::collections::BTreeMap;
    let mut by_eid: BTreeMap<[u8; 32], Vec<&ParsedEdition>> = BTreeMap::new();
    for e in editions {
        if e.vsk == vsk::INVITE_LINKS {
            by_eid.entry(e.entity_id).or_default().push(e);
        }
    }
    let mut sets: Vec<crate::db::community::InviteLinkSetRow> = Vec::new();
    for (eid, group) in &by_eid {
        // Authority BEFORE the fold, matching `apply_control_fold`. `fold_head`
        // picks an equal-version winner author-blind (lowest inner id, which an
        // author can grind), so folding first would let any member occupy the head
        // slot and have the whole registry dropped by the check below — silently
        // retiring a live invite link, i.e. flipping the community to Private.
        let authed: Vec<&ParsedEdition> = group
            .iter()
            .copied()
            .filter(|p| {
                let author = p.author.to_hex();
                // The creator must hold CREATE_INVITE, not be banned, AND own this coordinate.
                !authority.banned.contains(&author)
                    && authority.roles.is_authorized(&author, Some(owner_hex), Permissions::CREATE_INVITE)
                    && super::derive::invite_links_locator(cid, &p.author.to_bytes()) == *eid
            })
            .collect();
        if authed.is_empty() {
            continue;
        }
        let fold_eds: Vec<version::Edition> = authed.iter().map(|p| p.to_fold_edition()).collect();
        let (Some(hi), _) = fold_head(&fold_eds, floors.get(&crate::simd::hex::bytes_to_hex_32(eid))) else { continue };
        if let Ok(signers) = invite::parse_registry_content(&authed[hi].content) {
            if signers.is_empty() {
                continue; // a creator who retired every link is absent, not a zero row
            }
            sets.push(crate::db::community::InviteLinkSetRow {
                creator_hex: authed[hi].author.to_hex(),
                locators: signers.iter().map(|p| p.to_hex()).collect(),
            });
        }
    }
    sets
}

/// Flatten per-creator sets into the aggregate the `invite_registry` column holds.
fn flatten_link_sets(sets: &[crate::db::community::InviteLinkSetRow]) -> Vec<String> {
    let mut flat: Vec<String> = sets.iter().flat_map(|s| s.locators.iter().cloned()).collect();
    flat.sort();
    flat.dedup();
    flat
}

/// Accept an already-unwrapped bundle: verify the owner commitment AND that the
/// delivered community_root is genuinely the owner's, persist the community, and
/// announce a Guestbook Join (with invite attribution). Shared tail of both accept
/// paths. Takes the caller's `std::sync::Arc<crate::db::Session>` (captured BEFORE any network fetch the
/// caller did) so the whole operation stays with one account across that I/O.
async fn accept_bundle<T: Transport + ?Sized>(
    transport: &T,
    bundle: &CommunityInvite,
    invited_by: Option<PublicKey>,
    announce_join: bool,
) -> Result<CommunityV2, String> {
    crate::db::scoped(async move {
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let at_ms = now_ms();
        // Expiry gate: a past invite still previews but must not join (CORD-05 §1).
        if bundle.expired(at_ms) {
            return Err("this invite has expired".to_string());
        }
        // `from_bundle` re-validates bounds + the owner commitment fail-closed.
        let community = CommunityV2::from_bundle(bundle, at_ms)?;
        // Captured before the save below: a re-accept of a held community must not
        // re-announce a membership this account already declared.
        let already_held = crate::db::community::load_community_v2(community.id()).ok().flatten().is_some();

        // Authenticate the delivered community_root before trusting it. The owner
        // commitment proves WHO the owner is, but community_root (and channel keys) are
        // NOT in that commitment, so a forged invite can pair a real (id, owner, salt)
        // with an attacker-chosen root and silently partition the joiner onto planes
        // only the attacker controls. Requiring the owner's genesis to open under the
        // delivered root closes that eclipse; also reconciles channel classification.
        // A preview verified the SAME (id, root) moments ago → reuse its fold instead
        // of re-walking the plane (the bundle re-fetch above kept the revocation gate).
        let handoff = VERIFIED_PREVIEW.lock().unwrap().take().filter(|v| {
            v.session.is_live()
                && v.at.elapsed() < VERIFIED_PREVIEW_TTL
                && v.community_id == community.id().0
                && v.community_root == community.community_root
        });
        let (community, join_heads, join_banlist, join_pins, join_banlist_content, join_roles, join_authority_heads) =
            match handoff {
                Some(v) => {
                    let mut c = v.folded;
                    // The preview holds no acquisition time — stamp the JOIN's.
                    c.created_at_ms = at_ms;
                    (c, v.heads, v.banned, v.pins, v.banlist_persist, v.roles, v.authority_heads)
                }
                None => {
                    let vj = verify_owner_root_and_reconcile(transport, community).await?;
                    (vj.community, vj.heads, vj.banned, vj.pins, vj.banlist_persist, vj.roles, vj.authority_heads)
                }
            };

        // A dissolved community is a grave (CORD-02 §9): refuse to join it.
        if is_dissolved(transport, &community).await {
            return Err(ERR_DISSOLVED.to_string());
        }

        // Join-time ban gate (CORD-04 §4, Armada parity): an honest client refuses to join a
        // community whose authorized banlist names it — before the Guestbook Join publishes
        // and before any local write. Every door funnels through here (direct invite, parked,
        // public link, migration), so none of them needs its own exclusion.
        if join_banlist.contains(&my_pk.to_hex()) {
            return Err("you are banned from this community".to_string());
        }

        // The account must not have swapped since the guard was captured (which was
        // before any fetch the caller / the verify above performed) — else we'd write
        // A's join into B.
        // Seed the verified heads as the initial refuse-downgrade floor BEFORE the
        // community row lands (floors-then-state, so a mid-seed error can't leave saved
        // state outrunning its floor); the first post-join follow then can't persist a
        // state below what this join already showed.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        for h in join_heads.iter().chain(join_authority_heads.iter()) {
            crate::db::community::set_edition_head_at_epoch(&cid_hex, &h.entity_hex, h.version, &h.self_hash, &h.inner_id, community.root_epoch.0)?;
        }
        crate::db::community::save_community_v2(&community)?;
        // Archive the joined root at its epoch, so this member reads Public-channel
        // history from their join epoch onward across later Refoundings (CORD-03 §3).
        let _ = crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, community.root_epoch.0, &community.community_root);
        // Same for each granted Private-channel key: the archive is what lets its
        // history stay readable after the channel rotates away from this key.
        for ch in &community.channels {
            if let (true, Some(key)) = (ch.private, ch.key) {
                let _ = crate::db::community::store_epoch_key(&cid_hex, &crate::simd::hex::bytes_to_hex_32(&ch.id.0), ch.epoch.0, &key);
            }
        }
        // Persist what the verification walk already folded: the control plane WAS
        // read, so making the fresh member wait for the follow worker's queued
        // re-walk to see pins or enforce bans is pure lag (it read 20-30s on a busy
        // queue). The system "modified the Pins" line still arrives via that first
        // follow — a join backfills state, it doesn't announce edits.
        if let Some((banned_list, version)) = &join_banlist_content {
            let _ = crate::db::community::set_community_banlist(&cid_hex, banned_list, *version as i64);
        }
        // The ROSTER, same rule as the banlist and pins above: the walk already
        // paid for it. Persisted BEFORE the channels register, because the first
        // history ingest reads it to honor moderation hides — an empty roster
        // authorizes nobody, so every admin-hidden message would render to the
        // fresh member until the follow worker's queued re-walk landed.
        if let Some((roles, at)) = &join_roles {
            let _ = crate::db::community::set_community_roles(&cid_hex, roles, *at);
        }
        for (channel_hex, content, version, _author, _at) in &join_pins {
            if matches!(
                crate::db::community::set_community_pins(&cid_hex, channel_hex, content, *version as i64),
                Ok(true)
            ) {
                crate::emit_event(
                    "community_pins_updated",
                    &serde_json::json!({ "community_id": cid_hex, "channel_id": channel_hex }),
                );
            }
        }

        // Announce our Guestbook Join, echoing the invite attribution when present.
        // Only an ACTUAL join speaks: a re-accept of a held community, or a
        // cross-device key sync (announce_join=false), is not a membership event —
        // the account's original Join already stands in the guestbook, and every
        // re-publish renders as "<user> has joined" spam for the whole community.
        if announce_join && !already_held {
            let attribution = invited_by
                .map(|p| p.to_hex())
                .or_else(|| bundle.creator_npub.clone())
                .zip(Some(bundle.label.clone().unwrap_or_default()));
            let attr_ref = attribution.as_ref().map(|(c, l)| (c.as_str(), l.as_str()));
            let gb_group = super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
            let join_rumor = guestbook::build_join_rumor(my_pk, attr_ref, at_ms);
            if let Ok((join_wrap, _)) = guestbook::seal_guestbook_rumor_signed(&signer, my_pk, &join_rumor, &gb_group, Timestamp::from_secs(at_ms / 1000)).await {
                let _ = transport.publish(&join_wrap, &community.relays).await;
            }
        }

        // Record the membership across devices (CORD-02 §8). The inline attempt covers the
        // happy path; anything else hands off to the durable retry, because an unrecorded
        // join is what strands a community behind a stale tombstone.
        //
        // Only for a REAL join. `announce_join == false` is the list-sync adoption path,
        // and those entries were just read FROM this list — republishing it re-records what
        // it already holds. A device adopting N entries would otherwise rebuild and publish
        // the whole document N times, concurrently, every copy identical, on the boot path
        // that is already the slowest thing the app does.
        if announce_join {
            match republish_community_list(transport, Some(community.id())).await {
                Ok(true) => {}
                Ok(false) => republish_community_list_durable(Some(*community.id())),
                Err(e) => {
                    crate::log_warn!("[CommunityList] failed to record this join across devices ({}) — retrying", e);
                    republish_community_list_durable(Some(*community.id()));
                }
            }
        }
        Ok(community)
    })
    .await
}

/// Prove the delivered `community_root` is genuinely the owner's, and reconcile
/// channel classification from the owner's editions. `community_id` commits only
/// to `(owner_xonly, owner_salt)` — both semi-public (they ride every bundle and
/// every synced Community List) — so a forged invite can present a real community's
/// id/owner/salt with an attacker-chosen root; every plane then derives from that
/// root, silently eclipsing the joiner onto attacker-controlled addresses while the
/// owner commitment still "verifies". The defense: the owner's genesis metadata
/// edition (vsk-0, `eid == community_id`) only opens under the AUTHENTIC root — an
/// attacker can't forge the owner's seal — so its presence on the control plane
/// derived from the delivered root proves that root. On a ROTATED plane (epoch > 0)
/// the compaction may have carried an admin-signed metadata head instead (CORD-06
/// re-wraps heads with their original signatures), so the anchor there is the
/// community-bound metadata head plus any owner-signed edition under the same root.
/// Fail-closed: no anchor (forged invite, or relays unreachable) → refuse to join.
/// On success, folds the owner's authoritative editions to heal a bundle that
/// misclassified a channel.
/// Everything the join-time verification walk folded, handed to the accept path so
/// what the join VERIFIED is also what it PERSISTS. The walk already paid for the
/// control plane read; deferring persistence to the first post-join follow re-pays
/// the network cost and leaves the fresh member pins-blind and banlist-blind for
/// the whole follow-queue delay.
struct VerifiedJoin {
    community: CommunityV2,
    heads: Vec<FoldedHead>,
    /// The join-gate banlist (authorized fold over the any-author edition set).
    banned: std::collections::BTreeSet<String>,
    /// Pin List heads folded under the FULL join-time authority (curators included,
    /// same §5 gate as any later follow): `(channel_hex, content, version, author_npub, created_at)`.
    pins: Vec<(String, String, u64, String, u64)>,
    /// The authorized banlist head's content + version, for local persistence.
    banlist_persist: Option<(Vec<String>, u64)>,
    /// The FULL authorized roster (admins included) from the same walk, with the
    /// newest roster edition's `created_at`. `None` when the fold saw a gap.
    ///
    /// This is the one authority artifact the join used to throw away — and a
    /// fresh member whose roster is empty until the follow worker's re-walk
    /// renders every moderator-hidden message in the meantime: the hide gate
    /// reads the stored roster, and an empty roster authorizes nobody.
    roles: Option<(crate::community::roles::CommunityRoles, i64)>,
    /// Role/Grant/Banlist heads folded under the full authority, so an
    /// ADMIN-signed grant seeds the same refuse-downgrade floor an owner-signed
    /// one does.
    authority_heads: Vec<FoldedHead>,
}

async fn verify_owner_root_and_reconcile<T: Transport + ?Sized>(
    transport: &T,
    community: CommunityV2,
) -> Result<VerifiedJoin, String> {
    let owner = community.owner()?;
    let control = control::ControlPlane::of(&community);
    let control_pk = control.pk_hex();

    // AUTH-gating relays (ditto-relay's default gates kind-1059) serve a plane's
    // wraps ONLY to a connection authenticated AS the stream key — Concord's
    // group-addressed wraps aren't p-tagged to the joiner, so the login alone can't
    // satisfy the gate and the control plane reads back empty. Register this
    // community's stream keys + start the challenge responder so the fetch below
    // (whose REQ triggers the relay's AUTH challenge) reads the plane after auth.
    super::streamauth::prime(&community);

    // Authenticity = the owner's GENESIS metadata edition (vsk-0, `eid ==
    // community_id`) at the root-derived control plane. The genesis eid pins it to
    // THIS community, and it lives ONLY under the real root — so a forged root can't
    // produce one: an edition's seal carries no community binding, but another
    // community's genesis has a different eid, and this community's own genesis is
    // unreadable without its real root (which the forger lacks). ("Any owner edition"
    // is NOT sound: an owner sig from any co-owned community, rewrapped onto the fake
    // plane, would pass — reopening the eclipse.) The residual — a T-member replaying
    // T's genesis onto a fake root to MITM another T-joiner — is closed only by
    // binding the root into community_id (protocol, deferred).
    //
    // Seed `until` with a FAR-FUTURE constant (NOT now-based), and request
    // Evidence::Full EXPLICITLY below: this walk draws an ABSENCE verdict (no
    // owner-signed genesis ⇒ reject), which trusts only the completest union —
    // an open partial window misses a genesis on a lagging relay (routine over
    // Tor). A constant beyond any real created_at clips NOTHING — so neither
    // a clock-skewed future-dated genesis nor a >1h-slow-clock joiner is excluded (a
    // now-based bound could clip either). Break on an EMPTY page (a short page is a
    // relay cap). A forged root walks to exhaustion and rejects; a flood/deep plane
    // that buries the genesis past the walk is the deferred protocol residual.
    const PAGE: usize = 500;
    const MAX_PAGES: usize = 4;
    const FAR_FUTURE_SECS: u64 = 4_102_444_800; // ~year 2100 — above any real edition, safe as a relay `until`.
    let mut editions: Vec<ParsedEdition> = Vec::new();
    let mut all_editions: Vec<ParsedEdition> = Vec::new();
    let mut found_genesis = false;
    // Rotated planes (CORD-06): compaction re-wraps each entity's CURRENT head with
    // its ORIGINAL signature, so if an admin last edited the metadata the plane holds
    // no owner-signed vsk-0 at all — the strict genesis anchor is unsatisfiable there.
    // Fallback pair for epoch > 0: the community-bound metadata head (any signer) PLUS
    // at least one owner-signed edition opened under this root. A non-member forger
    // can produce neither; the sibling-community rewrap residual this reopens is the
    // same class the spec defers to root-in-id binding.
    let mut compacted_metadata = false;
    crate::log_debug!(
        "[JoinVerify] control_pk={} root_epoch={:?} relays={:?}",
        &control_pk[..12], community.root_epoch, community.relays
    );
    let anchored = |found_genesis: bool, compacted_metadata: bool, owner_editions: usize, epoch: Epoch| {
        found_genesis || (epoch.0 > 0 && compacted_metadata && owner_editions > 0)
    };
    for attempt in 0..2 {
        editions.clear();
        all_editions.clear();
        compacted_metadata = false;
        let mut until: Option<u64> = Some(FAR_FUTURE_SECS);
        let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
        for page_no in 0..MAX_PAGES {
            let query = Query {
                kinds: vec![stream::KIND_WRAP],
                authors: vec![control_pk.clone()],
                until,
                limit: Some(PAGE),
                evidence: crate::community::transport::Evidence::Full,
                ..Default::default()
            };
            let wraps = transport.fetch(&query, &community.relays).await?;
            crate::log_trace!(
                "[JoinVerify] attempt {} page {}: fetched {} wraps",
                attempt, page_no, wraps.len()
            );
            // INCLUSIVE `until` + wrap-id dedup: a `-1` step can skip same-second
            // siblings at a page boundary (and the genesis with them); re-served
            // boundary events are free, and no-new-events means exhausted.
            let mut oldest = u64::MAX;
            let mut fresh = 0usize;
            for w in &wraps {
                if !seen_wraps.insert(w.id) {
                    continue;
                }
                fresh += 1;
                oldest = oldest.min(w.created_at.as_secs());
                if let Ok((ed, _)) = control.open(w) {
                    crate::log_trace!(
                        "[JoinVerify] edition vsk={} eid={} owner={} at={}",
                        ed.vsk, crate::simd::hex::bytes_to_hex_32(&ed.entity_id)[..12].to_string(),
                        ed.author == owner, w.created_at.as_secs()
                    );
                    if ed.vsk == vsk::COMMUNITY_METADATA && ed.entity_id == community.id().0 {
                        if ed.author == owner {
                            found_genesis = true;
                        } else {
                            compacted_metadata = true;
                        }
                    }
                    if ed.author == owner {
                        editions.push(ed.clone());
                    }
                    // Any-author set for the join-time authority fold below: the banlist head
                    // may be admin-signed, and its authority chains to the owner regardless.
                    all_editions.push(ed);
                }
            }
            crate::log_debug!(
                "[JoinVerify] attempt {} page {}: fresh={} opened_owner={} opened_any={} genesis={} compacted={}",
                attempt, page_no, fresh, editions.len(), all_editions.len(), found_genesis, compacted_metadata
            );
            if anchored(found_genesis, compacted_metadata, editions.len(), community.root_epoch) || fresh == 0 {
                break; // authenticated, or the relay is exhausted.
            }
            until = Some(oldest);
        }
        if anchored(found_genesis, compacted_metadata, editions.len(), community.root_epoch) {
            break;
        }
        if attempt == 0 {
            // AUTH-gating relays: the first walk's REQ triggers the NIP-42 challenge,
            // but nostr-sdk's own retry re-auths as the USER key — which doesn't
            // satisfy a stream-authors gate — and can land before the responder's
            // stream-key auth settles, reading the plane back EMPTY. Replay the
            // remembered challenges for every registered stream key, then walk once
            // more on the settled connection.
            if let Some(client) = crate::state::nostr_client() {
                super::streamauth::prime_auth(&client, &community.relays).await;
            }
        }
    }
    if !anchored(found_genesis, compacted_metadata, editions.len(), community.root_epoch) {
        return Err(
            "could not verify this community from its relays (the invite may be forged, the relays are unreachable, or the control plane is being flooded); not joining"
                .to_string(),
        );
    }
    // Join-time reconcile: the joiner holds no floors yet (empty map → bootstrap per
    // entity). The heads this fold verified are returned for the caller to SEED as
    // the initial floor once the community row is saved — without that, the first
    // post-join follow would bootstrap floor-less and could persist a state BELOW
    // what this join already verified and showed.
    // Join-time reconcile folds only the owner's editions (genesis-authenticated
    // above), and the owner is supreme — so owner-only authority suffices. The full
    // roster (admins) folds on the first post-join follow_control.
    let empty_floors = Floors::new();
    let authority = AuthoritySet::owner_only();
    let fold = apply_control_fold(&community, &editions, &empty_floors, &authority);
    // Join-time banlist: fold authority over the ANY-author edition set (roles/grants
    // chain to the genesis-verified owner; the banlist head is honored only if its signer
    // held BAN). Returned so the accept path can refuse a banned self BEFORE it publishes
    // a Guestbook Join — the gate every join door shares (Armada parity, CORD-04 §4).
    let authority_full = fold_authority(&community, &all_editions, &empty_floors);
    // Pins under the FULL authority: a curator-authored Pin List is as valid at join
    // as on any later follow (same PIN_MESSAGES + citation gate, same owner-chained
    // roster). Only the pins are taken from this pass — the DOCUMENT adoption above
    // stays owner-only, its stricter envelope unchanged.
    let pins = apply_control_fold(&community, &all_editions, &empty_floors, &authority_full).pins_persist;
    // The newest roster edition's stamp, exactly as follow_control computes it, so
    // the follow's own freshness gate composes with a join-seeded roster.
    let newest_roster_at = all_editions
        .iter()
        .filter(|e| e.vsk == vsk::ROLE || e.vsk == vsk::GRANT || e.vsk == vsk::BANLIST)
        .map(|e| e.created_at as i64)
        .max()
        .unwrap_or(0);
    // An anchored walk read the plane back to genesis, so the window is complete
    // by construction; `gapped` still gates the persist for the same reason
    // follow_control's does — a withheld edition must not fold into a baseline.
    let roles = (!authority_full.gapped).then(|| (authority_full.roles.clone(), newest_roster_at));
    Ok(VerifiedJoin {
        community: fold.updated.unwrap_or(community),
        heads: fold.heads,
        banned: authority_full.banned,
        pins,
        banlist_persist: authority_full.banlist_persist,
        roles,
        authority_heads: authority_full.heads,
    })
}

/// Accept a Direct Invite: unwrap the 3313 giftwrap (Schnorr-verifying the seal),
/// then run the shared accept path. The recipient's consent IS this call. No
/// network await precedes the accept, so the guard captured here suffices.
pub async fn accept_direct_invite<T: Transport + ?Sized>(transport: &T, wrap: &Event) -> Result<CommunityV2, String> {
    let signer = crate::signer::active_signer()?;
    let (inviter, bundle) = invite::unwrap_direct_invite_signed(&signer, wrap).await.map_err(|e| e.to_string())?;
    accept_bundle(transport, &bundle, Some(inviter), true).await
}

/// Accept a PARKED Direct Invite from its stored bundle JSON (the wrap was already
/// unwrapped + owner-verified at park time). Re-parses through the same fail-closed
/// bundle validation, then runs the shared accept path (which re-verifies the owner
/// root over the network). `inviter_hex` is the parked seal signer, for Guestbook
/// Join attribution.
pub async fn accept_parked_invite<T: Transport + ?Sized>(
    transport: &T,
    bundle_json: &str,
    inviter_hex: Option<&str>,
) -> Result<CommunityV2, String> {
    let bundle = CommunityInvite::from_bundle_json(bundle_json).map_err(|e| e.to_string())?;
    let invited_by = inviter_hex.and_then(|h| PublicKey::parse(h).ok());
    accept_bundle(transport, &bundle, invited_by, true).await
}

/// Accept v2 JoinMaterial recovered from a v1→v2 migration dissolution payload (`m`). The
/// material IS a bundle's membership subset — rebuild the invite and run the SHARED accept
/// path, which re-verifies the owner root over the network and enforces the join-time ban
/// gate (a banned-never-cut v1 member who can open `m` is refused here, fail-closed). No
/// giftwrap to unwrap: the dissolution already authenticated the owner via its signature.
pub async fn accept_migration_material<T: Transport + ?Sized>(
    transport: &T,
    jm: &super::list::JoinMaterial,
) -> Result<CommunityV2, String> {
    let bundle = material_to_invite(jm);
    accept_bundle(transport, &bundle, None, true).await
}

/// Fetch + decrypt the newest Live bundle at a public link's coordinate
/// (`(33301, link_signer, "")`). **Revocation is authoritative-if-present**: if
/// ANY signer-valid tombstone is among the fetched events, refuse — never trust
/// fetch ordering (a cross-relay union has no global newest-first sort, so a
/// stale Live could otherwise win a partial-propagation race). Otherwise pick
/// the newest valid Live by `created_at`. Read-only.
pub async fn fetch_public_bundle<T: Transport + ?Sized>(transport: &T, url: &str) -> Result<CommunityInvite, String> {
    let parsed = invite::parse_invite_link(url).map_err(|e| e.to_string())?;
    // NO `#d` filter, even though the coordinate's `d` is empty (CORD-05 §2). Relays disagree on
    // indexing an empty tag value: some answer the REQ and then never EOSE, so the fetch burns its
    // whole union grace on every invite. The per-link signer pins the coordinate on its own (it
    // signs nothing else), and `parse_bundle_event` re-checks the empty `d` locally.
    let query = Query {
        kinds: vec![super::kind::INVITE_BUNDLE],
        authors: vec![parsed.link_signer.to_hex()],
        ..Default::default()
    };
    let relays = if parsed.bootstrap_relays.is_empty() {
        invite::stock_relays()
    } else {
        parsed.bootstrap_relays.clone()
    };
    // One bounded retry: a join fired while the pool is still warming (bootstrap
    // relays mid-handshake, routine during boot contention) reads back a transport
    // error, not an absent bundle. The pool add already happened on the first try,
    // so wait for a socket rather than guessing with a fixed sleep.
    let events = match transport.fetch(&query, &relays).await {
        Ok(evs) => evs,
        Err(_) => {
            wait_for_bootstrap_relay(&relays).await;
            transport.fetch(&query, &relays).await?
        }
    };
    let bundle_key = super::derive::invite_bundle_key(&parsed.token);

    // Scan EVERY event: a tombstone beats a Live unconditionally (order-independent).
    let mut newest_live: Option<(u64, CommunityInvite)> = None;
    for event in &events {
        match invite::parse_bundle_event(event, &parsed.link_signer, &bundle_key) {
            Ok(invite::BundleState::Revoked) => return Err("this invite link has been revoked".to_string()),
            Ok(invite::BundleState::Live(bundle)) => {
                let at = event.created_at.as_secs();
                if newest_live.as_ref().is_none_or(|(t, _)| at > *t) {
                    newest_live = Some((at, *bundle));
                }
            }
            Err(_) => {} // a foreign/garbage event at the coordinate — ignore.
        }
    }
    newest_live.map(|(_, b)| b).ok_or_else(|| "invite bundle not found on relays".to_string())
}

/// Wait — bounded — for ANY of the targets to report Connected before a retry:
/// the fetch's own warm path bounds its connect wait tighter than a cold TLS
/// handshake takes under boot contention.
async fn wait_for_bootstrap_relay(relays: &[String]) {
    let Some(client) = crate::state::nostr_client() else { return };
    let deadline = crate::rt::time::Instant::now() + std::time::Duration::from_secs(8);
    loop {
        for url in relays {
            if let Ok(Some(relay)) = client.relay(url).await {
                if relay.status() == nostr_sdk::prelude::RelayStatus::Connected {
                    return;
                }
            }
        }
        if crate::rt::time::Instant::now() >= deadline {
            return;
        }
        crate::rt::time::sleep(std::time::Duration::from_millis(400)).await;
    }
}

/// The most recent owner-root verification a PREVIEW completed, handed to a join
/// so accepting seconds later doesn't re-walk the control plane. Single-slot,
/// short-lived, session-guarded, and keyed on `(community_id, community_root)` —
/// a different delivered root never matches. The join's own bundle re-fetch is
/// untouched, so the revocation gate always runs live.
struct VerifiedPreview {
    session: std::sync::Arc<crate::db::Session>,
    at: web_time::Instant,
    community_id: [u8; 32],
    community_root: [u8; 32],
    folded: CommunityV2,
    heads: Vec<FoldedHead>,
    /// The join-time authorized banlist from the SAME verified walk — carried so the
    /// handoff path keeps the ban gate (a preview-then-join must not skip it).
    banned: std::collections::BTreeSet<String>,
    /// Folded pins + banlist content from the same walk, so a preview-handoff join
    /// persists them exactly like a direct join.
    pins: Vec<(String, String, u64, String, u64)>,
    banlist_persist: Option<(Vec<String>, u64)>,
    roles: Option<(crate::community::roles::CommunityRoles, i64)>,
    authority_heads: Vec<FoldedHead>,
}
static VERIFIED_PREVIEW: std::sync::Mutex<Option<VerifiedPreview>> = std::sync::Mutex::new(None);
const VERIFIED_PREVIEW_TTL: std::time::Duration = std::time::Duration::from_secs(120);

/// Read-only rich preview of a public link: the decrypted bundle plus the LATEST
/// display metadata folded live from the Control Plane (a v2 bundle deliberately
/// carries no icon — the fold is the authority). Owner-root verification rides
/// the fold, so a forged-root link can't render a convincing preview; on a
/// fold/transport failure the bundle snapshot is the fallback. Nothing persists
/// — the caller hasn't joined.
pub async fn preview_public_link<T: Transport + ?Sized>(transport: &T, url: &str) -> Result<CommunityV2, String> {
    let bundle = fetch_public_bundle(transport, url).await?;
    preview_bundle(transport, &bundle).await
}

/// The fold half of [`preview_public_link`], over an already-fetched bundle. Split out so a caller
/// that only needs the community's IDENTITY can read it off the bundle (it is self-certifying) and
/// skip the Control-Plane walk entirely — the walk is the join gate, and `accept_public_link` runs
/// it again regardless.
pub async fn preview_bundle<T: Transport + ?Sized>(transport: &T, bundle: &CommunityInvite) -> Result<CommunityV2, String> {
    let community = CommunityV2::from_bundle(bundle, 0)?;
    match verify_owner_root_and_reconcile(transport, community.clone()).await {
        Ok(vj) => {
            let folded = vj.community;
            *VERIFIED_PREVIEW.lock().unwrap() = Some(VerifiedPreview {
                session: crate::db::current_session(),
                at: web_time::Instant::now(),
                community_id: folded.id().0,
                community_root: folded.community_root,
                folded: folded.clone(),
                heads: vj.heads,
                banned: vj.banned,
                pins: vj.pins,
                banlist_persist: vj.banlist_persist,
                roles: vj.roles,
                authority_heads: vj.authority_heads,
            });
            Ok(folded)
        }
        Err(_) => Ok(community),
    }
}

/// Accept a public invite link: fetch its bundle (revocation-aware) and join.
pub async fn accept_public_link<T: Transport + ?Sized>(transport: &T, url: &str) -> Result<CommunityV2, String> {
    crate::db::scoped(async move {
        // Held across the network fetch so the join stays with one account.
        let bundle = fetch_public_bundle(transport, url).await?;
        accept_bundle(transport, &bundle, None, true).await
    })
    .await
}

/// Leave a community: publish a Guestbook Leave and tear down the local hold.
pub async fn leave_community<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> Result<(), String> {
    crate::db::scoped(async move {
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let at_ms = now_ms();
        let gb_group = super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let leave_rumor = guestbook::build_leave_rumor(my_pk, at_ms);
        if let Ok((wrap, _)) = guestbook::seal_guestbook_rumor_signed(&signer, my_pk, &leave_rumor, &gb_group, Timestamp::from_secs(at_ms / 1000)).await {
            let _ = transport.publish(&wrap, &community.relays).await;
        }
        // Tombstone the membership across devices (CORD-02 §8) BEFORE the local delete.
        // Best-effort, but never silent: an unpublished tombstone is what lets a stale
        // copy of the list rejoin this community on a later boot.
        if let Err(e) = tombstone_community_list(transport, community.id(), &community.relays, at_ms).await {
            crate::log_net_fail!("[CommunityList] leave tombstone failed ({}) — retrying in the background", e);
            tombstone_community_list_durable(*community.id(), community.relays.clone(), at_ms);
        }
        crate::db::community::delete_community(&crate::simd::hex::bytes_to_hex_32(&community.id().0))?;
        Ok(())
    })
    .await
}

/// Cooperative Kick (CORD-04 §6, Guestbook plane): name the target; every reader
/// honors it iff the signer holds KICK and strictly outranks them (the coalesce's
/// `can_kick`), so publishing without authority is inert. A kicked member may
/// rejoin with a fresh invite — cryptographic severance is the ban/refound path.
pub async fn kick_member<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, target: &PublicKey) -> Result<(), String> {
    crate::db::scoped(async move {
        assert_current_root(community)?;
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        // Fast local pre-check; readers re-verify independently.
        let authority = fetch_authority(transport, community).await;
        let owner_hex = community.owner()?.to_hex();
        if !authority.roles.can_act_on_member(
            &my_pk.to_hex(),
            Some(&owner_hex),
            &target.to_hex(),
            crate::community::roles::Permissions::KICK,
        ) {
            return Err("not authorized to kick this member".to_string());
        }
        // CORD-04 §6 composition: a Kick is Role Removal THEN the directive — strip
        // first, so the target's rank is gone before the departure lands. Without it a
        // kicked admin leaves the memberlist still holding every management bit, and
        // every client keeps honoring their control editions.
        //
        // SKIPPED (not refused) when the strip isn't ours to make: a revoke needs
        // MANAGE_ROLES + strict outrank, and a KICK-only moderator still kicks — the
        // target just keeps their rank until an authorized strip lands. Each layer
        // validates on its own rule, so a missing one is a weaker removal, never a
        // broken one. A strip we DO attempt and lose is a hard error: proceeding would
        // publish a directive we know leaves rank behind.
        let target_hex = target.to_hex();
        let holds_roles = authority.roles.grants.iter().any(|g| g.member == target_hex && !g.role_ids.is_empty());
        let may_strip = authority.roles.can_act_on_member(
            &my_pk.to_hex(),
            Some(&owner_hex),
            &target_hex,
            crate::community::roles::Permissions::MANAGE_ROLES,
        );
        if holds_roles && may_strip {
            grant_roles(transport, community, target, Vec::new())
                .await
                .map_err(|e| format!("could not strip this member's roles before kicking: {e}"))?;
        }
        let at_ms = now_ms();
        let gb_group = super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        // A Kick is an authority action, so it cites its Grant like any other
        // (CORD-02 §5 / CORD-04 §5).
        let citation = required_authority_citation(community, &my_pk)?;
        let rumor = guestbook::build_kick_rumor(my_pk, *target, citation.as_ref(), at_ms);
        let (wrap, _) = guestbook::seal_guestbook_rumor_signed(&signer, my_pk, &rumor, &gb_group, Timestamp::from_secs(at_ms / 1000)).await
            .map_err(|e| e.to_string())?;
        transport.publish(&wrap, &community.relays).await?;
        Ok(())
    })
    .await
}

/// What a [`kick_members`] sweep actually managed to do.
#[derive(Debug, Default)]
pub struct KickSweep {
    pub kicked: Vec<PublicKey>,
    /// Targets the caller has no standing over, with the reason. Collected rather than
    /// returned as an error: one unkickable member must not sink the rest of the wave.
    pub refused: Vec<(PublicKey, String)>,
    /// Publishes that failed on the wire — transient, and safe to retry.
    pub failed: Vec<PublicKey>,
}

/// Kick many members in one sweep.
///
/// A Kick is an individual directive, unlike a Banlist edition which names every npub in
/// one document, so the wire cost here is inherently linear and there is nothing to
/// batch. What this saves is everything around it: [`kick_member`] folds the whole
/// control plane per call, so kicking a raid one at a time spends a paged network fetch
/// per target. Authority, citation and the plane key are resolved once and reused.
///
/// `on_progress(done, total)` fires after every target, refusals included, so a caller
/// can drive a counter through a sweep that takes minutes.
pub async fn kick_members<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    targets: &[PublicKey],
    on_progress: &(dyn Fn(usize, usize) + Sync),
) -> Result<KickSweep, String> {
    crate::db::scoped(async move {
        assert_current_root(community)?;
        let mut out = KickSweep::default();
        if targets.is_empty() {
            return Ok(out);
        }
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let my_hex = my_pk.to_hex();
        let owner_hex = community.owner()?.to_hex();
        // ONCE. This is the paged control-plane fetch that makes the per-member path
        // unusable in bulk.
        let authority = fetch_authority(transport, community).await;
        let citation = required_authority_citation(community, &my_pk)?;
        let gb_group =
            super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);

        let total = targets.len();
        for (i, target) in targets.iter().enumerate() {
            let target_hex = target.to_hex();
            let outranks = |perm: u64| {
                authority.roles.can_act_on_member(&my_hex, Some(&owner_hex), &target_hex, perm)
            };
            if !outranks(crate::community::roles::Permissions::KICK) {
                out.refused.push((*target, "you do not outrank this member".to_string()));
                on_progress(i + 1, total);
                continue;
            }
            // CORD-04 §6: a Kick is Role Removal THEN the directive. Only a role-holder
            // pays for the strip, so a wave of plain members never touches the control
            // plane at all. A strip we attempt and lose skips the target rather than
            // publishing a directive we know leaves rank behind.
            let holds_roles =
                authority.roles.grants.iter().any(|g| g.member == target_hex && !g.role_ids.is_empty());
            if holds_roles && outranks(crate::community::roles::Permissions::MANAGE_ROLES) {
                if let Err(e) = grant_roles(transport, community, target, Vec::new()).await {
                    out.refused.push((*target, format!("could not strip roles before kicking: {e}")));
                    on_progress(i + 1, total);
                    continue;
                }
            }
            let at_ms = now_ms();
            let rumor = guestbook::build_kick_rumor(my_pk, *target, citation.as_ref(), at_ms);
            match guestbook::seal_guestbook_rumor_signed(
                &signer,
                my_pk,
                &rumor,
                &gb_group,
                Timestamp::from_secs(at_ms / 1000),
            )
            .await
            {
                Ok((wrap, _)) => match transport.publish(&wrap, &community.relays).await {
                    Ok(_) => out.kicked.push(*target),
                    Err(_) => out.failed.push(*target),
                },
                Err(_) => out.failed.push(*target),
            }
            on_progress(i + 1, total);
        }
        Ok(out)
    })
    .await
}

/// A community's folded, delegation-authorized authority — the on-demand read
/// view (a paged control-plane fetch + fold, nothing persisted). `roles` is the
/// owner-seeded authorized roster (shared algebra with v1); `banned` the
/// enforced banlist. `floored`/`head_entities` let a writer detect a WITHHELD
/// entity (floored locally but no head folded) before replacing it blind.
pub struct AuthorityView {
    pub roles: crate::community::roles::CommunityRoles,
    pub banned: std::collections::BTreeSet<String>,
    /// Any authority entity's fold hit a floor gap (withheld / evicted link).
    pub gapped: bool,
    /// Entity hexes holding a persisted floor at this epoch (all vsk kinds).
    pub floored: std::collections::BTreeSet<String>,
    /// Authority entities (role/grant/banlist) that folded a head this fetch.
    pub head_entities: std::collections::BTreeSet<String>,
    /// Ban history (npub hex → secs), outliving the ban so an un-ban raises no phantom.
    pub banned_at: std::collections::BTreeMap<String, u64>,
}

/// Fetch + fold the community's current authority (CORD-04), paging older like
/// `follow_control` while the fold is gapped so a busy control plane can't push
/// the roster off the newest window. A fetch failure degrades fail-safe:
/// owner-only authority plus the PERSISTED banlist — nobody gains standing from
/// an outage, and a ban never lifts on withheld data.
pub async fn fetch_authority<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> AuthorityView {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)
        .unwrap_or_default()
        .into_iter()
        .filter(|(_, f)| f.0 == community.root_epoch.0)
        .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
        .collect();
    let control = control::ControlPlane::of(community);

    let mut editions: Vec<ParsedEdition> = Vec::new();
    let mut seen: std::collections::HashSet<[u8; 32]> = std::collections::HashSet::new();
    let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
    let mut oldest: Option<u64> = None;
    let mut until: Option<u64> = None;
    // Seed from an EMPTY fold, not owner_only(): a fold over zero editions yields
    // owner-only roles AND retains the PERSISTED banlist. So a first-page transport
    // error returns the stored bans (fail-safe), never an empty banlist that would
    // silently un-ban on withheld data.
    let mut a = fold_authority(community, &[], &floors);
    for _ in 0..FOLLOW_MAX_PAGES {
        // Quorum, DECLARED (the until→Full transport floor is gone): these
        // control reads tolerate a partial union — their fold semantics are
        // fail-safe on gaps (seeded banlists, withheld roster cache).
        let query = Query {
            kinds: vec![stream::KIND_WRAP],
            authors: vec![control.pk_hex()],
            until,
            limit: Some(FOLLOW_PAGE),
            evidence: crate::community::transport::Evidence::Quorum,
            ..Default::default()
        };
        let Ok(wraps) = transport.fetch(&query, &community.relays).await else { break };
        let mut fresh = 0usize;
        for w in &wraps {
            if !seen_wraps.insert(w.id) {
                continue;
            }
            fresh += 1;
            let at = w.created_at.as_secs();
            if oldest.is_none_or(|o| at < o) {
                oldest = Some(at);
            }
            if let Ok((ed, _)) = control.open(w) {
                if seen.insert(ed.inner_id) {
                    editions.push(ed);
                }
            }
        }
        a = fold_authority(community, &editions, &floors);
        if !a.gapped || fresh == 0 {
            break;
        }
        until = oldest;
    }
    AuthorityView {
        roles: a.roles,
        banned: a.banned,
        gapped: a.gapped,
        floored: floors.keys().cloned().collect(),
        head_entities: a.heads.iter().map(|h| h.entity_hex.clone()).collect(),
        banned_at: a.banned_at,
    }
}

/// Page the Guestbook plane newest-to-oldest, stopping once a page's oldest wrap
/// falls below `since_secs` (everything older is already held) or the plane is
/// exhausted. Returns the parsed events at/after the window plus the newest wrap
/// time seen (the caller's next cursor; `since_secs` when nothing newer arrived).
///
/// PAGE bound rationale: a single 500-window silently drops a member whose Join
/// aged out (organic growth, or an insider flooding throwaway Joins), and
/// `refound_community` consumes the fold as its rekey recipient set — a dropped
/// member is SEVERED. Beyond this depth a community needs sharding (documented);
/// the granted-member union in [`fold_members`] is the consensus-complete
/// backstop regardless of Guestbook depth.
async fn fetch_guestbook_events<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    since_secs: u64,
) -> Result<(Vec<guestbook::GuestbookEvent>, u64, bool), String> {
    let gb_group = super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
    const GB_PAGE: usize = 500;
    const GB_MAX_PAGES: usize = 12;
    let mut events = Vec::new();
    let mut newest: u64 = since_secs;
    let mut seen: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
    let mut until: Option<u64> = None;
    let mut oldest: Option<u64> = None;
    // Did the walk run out of PLANE, or out of PAGES? Only the former means the
    // caller holds everything down to `since_secs` — advancing a cursor on the
    // latter skips whatever the walk never reached, permanently.
    let mut reached_end = false;
    for _ in 0..GB_MAX_PAGES {
        // Full: this set becomes the refound's recipient list — a member's
        // Join visible only on a minority relay must not be severed.
        let query = Query { kinds: vec![stream::KIND_WRAP], authors: vec![gb_group.pk_hex()], until, limit: Some(GB_PAGE), evidence: crate::community::transport::Evidence::Full, ..Default::default() };
        let wraps = transport.fetch(&query, &community.relays).await?;
        let mut fresh = 0usize;
        for wrap in &wraps {
            if !seen.insert(wrap.id) {
                continue;
            }
            fresh += 1;
            let at = wrap.created_at.as_secs();
            if oldest.is_none_or(|o| at < o) {
                oldest = Some(at);
            }
            if at > newest {
                newest = at;
            }
            // Older than the cursor window — already held; skip the decrypt.
            if at < since_secs {
                continue;
            }
            if let Ok(opened) = stream::open_wrap(wrap, &gb_group) {
                if let Ok(ev) = guestbook::parse_guestbook_event(&opened) {
                    events.push(ev);
                }
            }
        }
        if fresh == 0 || wraps.len() < GB_PAGE || oldest.is_some_and(|o| o < since_secs) {
            reached_end = true;
            break;
        }
        match oldest {
            Some(o) if o > 0 => until = Some(o),
            // Nothing older to ask for.
            _ => {
                reached_end = true;
                break;
            }
        }
    }
    Ok((events, newest, reached_end))
}

/// The shared membership fold: coalesce Guestbook events under the community's
/// authority (owner-supreme kicks, refounder snapshots), union observed authors
/// plus every roster grantee, subtract the banlist, and pin the proven owner.
/// One implementation, so the live and stored reads can't drift.
/// Whose Guestbook snapshot seeds this community's CURRENT epoch (CORD-02 §5):
/// "honored only from the npub whose Refounding minted that epoch". That is the
/// owner only when the owner did the refounding.
///
/// Vector read it as owner-always, so an admin's — or a moderation bot's —
/// refounding rolled the epoch and vended the keys while its survivor list was
/// discarded. Every client then folded its own accumulated Joins instead: members
/// the containment had cut lingered on the roster, and no two clients agreed on it.
///
/// The minter comes from the rotation this device VERIFIED and adopted, never from
/// the snapshot, so writing a snapshot grants nobody authority over it. An epoch
/// adopted before minters were recorded has no entry and falls back to the owner —
/// the previous behaviour, never a wider one. Genesis (epoch 0) has no refounder and
/// therefore no snapshot power at all.
fn snapshot_authority_for(cid_hex: &str, community: &CommunityV2, owner: &PublicKey) -> Option<PublicKey> {
    if community.root_epoch.0 == 0 {
        return None;
    }
    let minted_by = epoch_minters(cid_hex)
        .get(&community.root_epoch.0)
        .and_then(|h| PublicKey::from_hex(h).ok());
    Some(minted_by.unwrap_or(*owner))
}

fn fold_members(
    community: &CommunityV2,
    events: &[guestbook::GuestbookEvent],
    mut observed: std::collections::BTreeMap<PublicKey, u64>,
    roles: &crate::community::roles::CommunityRoles,
    banlist: &std::collections::BTreeSet<PublicKey>,
    banned_at: &std::collections::BTreeMap<PublicKey, u64>,
) -> Result<Vec<PublicKey>, String> {
    let owner = community.owner()?;
    let owner_hex = owner.to_hex();
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

    // CONSENSUS-COMPLETE backstop: every member the folded roster GRANTS a role to
    // is provably a member (a Grant binds member_xonly, CORD-02 A.6) — count them
    // even if their Join aged out of the Guestbook entirely and they never posted.
    // This is what keeps a Refounding from severing a lurking admin. `observed`
    // carries them at ts 0 (presence, not recency); the banlist subtraction below
    // still removes a banned grantee whose grant wasn't yet stripped.
    for g in &roles.grants {
        if let Some(pk) = PublicKey::from_hex(&g.member).ok().filter(|_| !g.role_ids.is_empty()) {
            observed.entry(pk).or_insert(0);
        }
    }

    // Snapshot authority (CORD-02 §5): a refounding rolls `root_epoch` and re-seeds the
    // new epoch's Guestbook with a 3312 snapshot of the survivors. Only the OWNER's snapshot is
    // honored here, so a silent survivor stays in the memberlist across an owner refound
    // without re-posting. A genesis community (root_epoch 0) has no refounder, hence no
    // snapshot power. KNOWN GAP (do not "fix" unilaterally — CORD-04/06 + Armada): the refound
    // send/receive gates authorize any BAN-holder to refound, but their snapshot is NOT honored
    // here, so a non-owner admin's refound drops silent survivors (incl. migration roster seeds)
    // until they re-post. Binding the minting rotator into snapshot authority is a spec change.
    let snapshot_authority_pk = snapshot_authority_for(&cid_hex, community, &owner);
    let snapshot_authority = snapshot_authority_pk.as_ref();
    // Kick authority (CORD-04 §5/§6): the signer must cite a Grant we've synced AND
    // hold KICK AND strictly outrank the target (the owner is supreme; equal cannot
    // kick equal).
    let can_kick = |actor: &PublicKey, target: &PublicKey, citation: Option<&crate::community::edition::AuthorityCitation>| {
        let actor_hex = actor.to_hex();
        citation_is_synced(&cid_hex, &owner_hex, &actor_hex, citation)
            && roles.can_act_on_member(&actor_hex, Some(&owner_hex), &target.to_hex(), crate::community::roles::Permissions::KICK)
    };
    let now = now_ms();
    let coalesced = guestbook::coalesce(events, now, snapshot_authority, &can_kick);
    // The live refound's guest list also gates the observed-forward path in
    // complete_memberlist, so a raid spammer whose Kick was buried by the rotation
    // isn't silently re-admitted by their old spam.
    let refound = guestbook::live_refound(events, snapshot_authority, now);
    let mut members = guestbook::complete_memberlist(&coalesced, &observed, banlist, banned_at, refound.as_ref());
    // The owner is a member by definition, independent of any fetched Join.
    if !banlist.contains(&owner) {
        members.insert(owner);
    }
    Ok(members.into_iter().collect())
}


/// What a [`rescue_stranded_members`] pass published.
#[derive(Debug, Default, serde::Serialize)]
pub struct RescueReport {
    /// Epoch hops that received catch-up blobs (1..=current, minus any with a missing root).
    pub hops: usize,
    /// Hops skipped because an archived root was missing — those members stay wedged there.
    pub hops_skipped: usize,
    pub chunks_published: usize,
    pub targets: usize,
}

/// Re-vend the epoch chain to members a past rotation forgot.
///
/// DELIBERATELY not surfaced in any client: [`refound_community`]'s recipient union
/// exists so this situation cannot arise from our own rotations. This stays as the
/// operator/SDK primitive for strandings we don't control — another client's rotation
/// folding a narrower memberlist, or a pre-union build. It re-keyed 39 live members
/// once; prevention is the product, this is the fire axe.
///
/// A client follows rekeys hop by hop: from its held root it derives ONE plane —
/// `base_rekey_group(held_root, cid, held_epoch + 1)` — and can never jump. A member
/// excluded from the recipient set at hop N therefore wedges at N−1 forever; no later
/// rotation can reach them because they cannot even derive where to look.
///
/// The rotator holds every archived root, so it can publish what should have existed:
/// for each hop, additional blobs addressed to the stranded set, built with the SAME
/// (rotator, scope, epoch, prev-commitment) as the original rotation. `collect_rotations`
/// correlates on exactly that key, so the catch-up blobs merge into the rotation every
/// client already validated — the stranded client's next follow simply finds its blob
/// and walks the whole chain forward. No action needed on their side; works on any
/// client version.
///
/// Intermediate blobs carry the CURRENT control pair (the historical pairs are not
/// archived). A mid-walk client briefly holds a future control address, and the final
/// hop — which every walk ends on — sets the same, correct pair.
///
/// A Guestbook snapshot addendum at the current epoch re-seeds the rescued members for
/// outside readers (the invite page) and for clients whose fold lost them.
pub async fn rescue_stranded_members<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    targets: &[PublicKey],
) -> Result<RescueReport, String> {
    crate::db::scoped(async move {
        let mut report = RescueReport { targets: targets.len(), ..Default::default() };
        if targets.is_empty() {
            return Ok(report);
        }
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let cid = community.id();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
        let owner = community.owner()?;
        let owner_hex = owner.to_hex();
        // Key-granting is rotation-shaped authority: the receive side only honors blobs
        // inside rotations whose rotator it admits, so an unauthorized caller could only
        // publish noise — but fail loudly here rather than publish it.
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        if my_pk != owner && !roster.is_authorized(&my_pk.to_hex(), Some(&owner_hex), crate::community::roles::Permissions::BAN) {
            return Err("rescuing stranded members requires rotation authority (owner or BAN)".to_string());
        }
        let control_pk = community.control_pk.ok_or("rescue requires a split community (no control pk held)")?;
        let citation = my_authority_citation(community, &my_pk);

        // Every archived root, plus the live head (belt-and-suspenders: the head is
        // archived at rotation time, but the union costs nothing).
        let mut roots: std::collections::BTreeMap<u64, [u8; 32]> =
            crate::db::community::held_epoch_keys(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX)?
                .into_iter()
                .map(|(e, k)| (e.0, k))
                .collect();
        roots.insert(community.root_epoch.0, community.community_root);

        let at_secs = now_ms() / 1000;
        for e in 1..=community.root_epoch.0 {
            let (Some(prev_root), Some(new_root)) = (roots.get(&(e - 1)).copied(), roots.get(&e).copied()) else {
                crate::log_warn!("[Rescue] no archived root for hop {} -> {} — members wedged there stay wedged", e - 1, e);
                report.hops_skipped += 1;
                continue;
            };
            let group = super::derive::base_rekey_group_key(&prev_root, cid, Epoch(e));
            let prev_commit = super::derive::epoch_key_commitment(Epoch(e - 1), &prev_root);
            // The catch-up EXTENDS the original rotation's chunk set: same correlation
            // key, indices past its highest slot. Re-claiming a slot is not an option —
            // collect_rotations keeps the first chunk per index, and if ours won, the
            // original recipients in the losing chunk would fold as removed.
            let existing = fetch_rekey_chunks(transport, &community.relays, &group).await?;
            let start_after = existing
                .iter()
                .filter(|c| {
                    c.rotator == my_pk
                        && c.scope == super::rekey::RekeyScope::Root
                        && c.new_epoch == Epoch(e)
                        && c.prev_commit == prev_commit
                })
                .map(|c| c.chunk.0.max(c.chunk.1))
                .max()
                .unwrap_or(0);
            // The owner rides every catch-up chunk: an extension inherits the original
            // chunks' owner blob, but a plane a relay withheld folds ours standalone,
            // and a rotation without an owner blob is inadmissible by design.
            let mut recipients: Vec<PublicKey> = targets.to_vec();
            if !recipients.contains(&my_pk) {
                recipients.push(my_pk);
            }
            let mut blobs = Vec::with_capacity(recipients.len());
            for r in &recipients {
                // Staff get the control secret exactly as a live rotation would give it.
                let staff = *r == my_pk || roster.is_staff(&r.to_hex(), Some(&owner_hex));
                let ctl_root = if staff { community.control_root.as_ref() } else { None };
                blobs.push(
                    super::rekey::build_base_blob(&signer, &my_pk.to_bytes(), r, Epoch(e), &new_root, &control_pk.to_bytes(), ctl_root)
                        .await
                        .map_err(|e| e.to_string())?,
                );
            }
            // A rescue extension can fold STANDALONE on a withheld plane, so it
            // must re-state the hop's sever itself: from the fetched siblings, or
            // from the persisted mark when the plane withheld even those.
            let severed_hop = existing
                .iter()
                .any(|c| c.scope == super::rekey::RekeyScope::Root && c.new_epoch == Epoch(e) && c.severed)
                || sever_marks(&cid_hex).contains_key(&e);
            let chunks = super::rekey::build_rekey_chunk_extension(
                &signer,
                my_pk,
                &group,
                super::rekey::RekeyScope::Root,
                Epoch(e),
                Epoch(e - 1),
                &prev_commit,
                &blobs,
                at_secs,
                citation.as_ref(),
                severed_hop,
                start_after,
            )
            .await
            .map_err(|e| e.to_string())?;
            for c in &chunks {
                transport.publish_durable(c, &community.relays).await?;
                report.chunks_published += 1;
            }
            report.hops += 1;
        }

        // Re-seed them in the current epoch's Guestbook: snapshot chunks are
        // independently useful (CORD-02 §5), so an addendum under a fresh snap id folds
        // as Joined on every client and every outside reader. Best-effort, like a
        // rotation's own snapshot.
        let gb_group = super::derive::guestbook_group_key(&community.community_root, cid, community.root_epoch);
        let snap_id = crate::community::random_32();
        for rumor in guestbook::build_snapshot_rumors(my_pk, targets, snap_id, at_secs * 1000) {
            if let Ok((wrap, _)) = guestbook::seal_guestbook_rumor_signed(&signer, my_pk, &rumor, &gb_group, Timestamp::from_secs(at_secs)).await {
                let _ = transport.publish(&wrap, &community.relays).await;
            }
        }

        crate::log_info!(
            "[Rescue] {} member(s): {} hop(s) re-vended ({} skipped), {} chunk(s) published, snapshot addendum at epoch {}",
            targets.len(),
            report.hops,
            report.hops_skipped,
            report.chunks_published,
            community.root_epoch.0
        );
        Ok(report)
    })
    .await
}

/// Diagnostic: the memberlist as the WIRE alone tells it — the current epoch's
/// guestbook plane fetched fresh and folded with no local observation and no roster
/// backstop. This is what an outside reader (the invite page) computes, so the diff
/// against [`stored_memberlist`] is exactly the set a rotation left behind: counted
/// locally, absent from the snapshot, holding no current key.
pub async fn wire_guestbook_members<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
) -> Result<Vec<PublicKey>, String> {
    let (events, _newest, _reached_end) = fetch_guestbook_events(transport, community, 0).await?;
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let owner = community.owner()?;
    let owner_hex = owner.to_hex();
    let roles = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    let snapshot_authority_pk = snapshot_authority_for(&cid_hex, community, &owner);
    let snapshot_authority = snapshot_authority_pk.as_ref();
    let can_kick = |actor: &PublicKey, target: &PublicKey, citation: Option<&crate::community::edition::AuthorityCitation>| {
        let actor_hex = actor.to_hex();
        citation_is_synced(&cid_hex, &owner_hex, &actor_hex, citation)
            && roles.can_act_on_member(&actor_hex, Some(&owner_hex), &target.to_hex(), crate::community::roles::Permissions::KICK)
    };
    let coalesced = guestbook::coalesce(&events, now_ms(), snapshot_authority, &can_kick);
    let banlist: std::collections::BTreeSet<PublicKey> = crate::db::community::get_community_banlist(&cid_hex)
        .unwrap_or_default()
        .iter()
        .filter_map(|h| PublicKey::from_hex(h).ok())
        .collect();
    Ok(coalesced
        .iter()
        .filter(|(pk, st)| st.verdict == guestbook::Verdict::Joined && !banlist.contains(pk))
        .map(|(pk, _)| *pk)
        .collect())
}

/// Did the AUTHORIZED Guestbook coalesce rule `member` KICKED, per the stored plane?
///
/// This is the only sound basis for acting on a kick against ourselves. The
/// memberlist is the wrong question: it also folds the banlist, the ban marks and
/// observed authors, so a member whose Guestbook hasn't caught up yet — a REJOIN,
/// where the store starts empty while the control fold has already re-derived their
/// old ban mark — is absent from it while being perfectly joined. Coalescing asks
/// only "what is the latest authorized entry for this npub", so a fresh Join
/// supersedes an old Kick and an empty store yields no verdict at all.
pub fn stored_kick_verdict(community: &CommunityV2, member: &PublicKey) -> bool {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let Ok((events, _cursor)) = crate::db::community::get_guestbook(&cid_hex) else {
        return false;
    };
    let Ok(owner) = community.owner() else { return false };
    let owner_hex = owner.to_hex();
    let roles = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    let snapshot_authority_pk = snapshot_authority_for(&cid_hex, community, &owner);
    let snapshot_authority = snapshot_authority_pk.as_ref();
    let can_kick = |actor: &PublicKey, target: &PublicKey, citation: Option<&crate::community::edition::AuthorityCitation>| {
        let actor_hex = actor.to_hex();
        citation_is_synced(&cid_hex, &owner_hex, &actor_hex, citation)
            && roles.can_act_on_member(&actor_hex, Some(&owner_hex), &target.to_hex(), crate::community::roles::Permissions::KICK)
    };
    matches!(
        guestbook::coalesce(&events, now_ms(), snapshot_authority, &can_kick).get(member),
        Some(st) if st.verdict == guestbook::Verdict::Kicked
    )
}

/// Catch the persisted Guestbook up from its stored cursor (a fresh hold seeds
/// from zero). The fetch straddles the network, so the session re-checks before
/// the store writes. Returns the events that were NEW to the store — the caller
/// surfaces them (presence lines) and refreshes on non-empty.
pub async fn sync_guestbook<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
) -> Result<Vec<guestbook::GuestbookEvent>, String> {
    crate::db::scoped(async move {
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let (mut events, cursor) = crate::db::community::get_guestbook(&cid_hex)?;
        // First sync of the session walks the WHOLE plane; later ones ride the cursor.
        // The cursor alone can only ever move forward, so any history a walk missed —
        // a page cap, an open breaker, stream-auth not yet landed, one relay of several
        // answering — is skipped for good, and two devices settle on different member
        // counts that never converge. Re-walking each session heals that, and it also
        // covers what no persisted flag can: a walk ends on a short page when the relays
        // that ANSWERED had no more, which is not the same as the plane being exhausted.
        let full = !guestbook_walked_this_session(&cid_hex);
        // Overlap one second so a same-second boundary event can't slip the cursor;
        // the rumor-id merge below dedups the re-fetched edge.
        let since = if full { 0 } else { cursor.saturating_sub(1) };
        let (fresh, newest, reached_end) = fetch_guestbook_events(transport, community, since).await?;
        // Every event off this fetch came from the plane we hold the key to. The stamp is
        // what lets the fold tell a Join carried over from a buried epoch apart from a
        // live one; a row stored before stamping existed earns its stamp on re-read.
        let live = Some(community.root_epoch.0);
        let mut by_id: std::collections::HashMap<[u8; 32], usize> = events.iter().enumerate().map(|(i, e)| (e.rumor_id, i)).collect();
        let mut added = Vec::new();
        let mut restamped = false;
        for mut ev in fresh {
            ev.epoch = live;
            match by_id.get(&ev.rumor_id) {
                Some(&i) => {
                    if events[i].epoch.is_none() {
                        events[i].epoch = live;
                        restamped = true;
                    }
                }
                None => {
                    // First sight on THIS client. The author writes `at_ms`; they do
                    // not write this.
                    let mut ev = ev;
                    if ev.observed_at.is_none() {
                        ev.observed_at = Some(
                            web_time::SystemTime::now()
                                .duration_since(web_time::UNIX_EPOCH)
                                .map(|d| d.as_secs())
                                .unwrap_or(0),
                        );
                    }
                    by_id.insert(ev.rumor_id, events.len());
                    events.push(ev.clone());
                    added.push(ev);
                }
            }
        }
        // Advance ONLY on a walk that ran out of plane. `newest` counts every wrap seen,
        // including ones skipped or that failed to open, so moving it after a truncated
        // walk is what buries the events that walk never reached.
        let advanced = if reached_end { newest.max(cursor) } else { cursor };
        if !added.is_empty() || advanced > cursor || restamped {
            crate::db::community::set_guestbook(&cid_hex, &events, advanced)?;
            mark_guestbook_observed_since(&cid_hex);
        }
        if full && reached_end {
            mark_guestbook_walked(&cid_hex);
        }
        Ok(added)
    })
    .await
}

/// Communities whose Guestbook plane has been walked end-to-end this session.
/// Lives on the Session, so an account swap drops it and the next account walks
/// its own rather than inheriting this one's coverage.
struct GuestbookWalked;

fn guestbook_walked_set() -> std::sync::Arc<std::sync::Mutex<std::collections::HashSet<String>>> {
    crate::db::current_session().scoped::<GuestbookWalked, _>()
}

fn guestbook_walked_this_session(community_id: &str) -> bool {
    guestbook_walked_set().lock().is_ok_and(|s| s.contains(community_id))
}

fn mark_guestbook_walked(community_id: &str) {
    if let Ok(mut s) = guestbook_walked_set().lock() {
        s.insert(community_id.to_string());
    }
}

/// Fold ONE live guestbook event into the store (the realtime path — no fetch).
/// Returns whether it was new.
pub fn ingest_guestbook_event(community: &CommunityV2, mut ev: guestbook::GuestbookEvent, wrap_secs: u64) -> Result<bool, String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let (mut events, cursor) = crate::db::community::get_guestbook(&cid_hex)?;
    if events.iter().any(|e| e.rumor_id == ev.rumor_id) {
        return Ok(false);
    }
    ev.epoch = Some(community.root_epoch.0);
    events.push(ev);
    crate::db::community::set_guestbook(&cid_hex, &events, cursor.max(wrap_secs))?;
    Ok(true)
}

/// The memberlist from LOCAL state only: the persisted Guestbook, plus locally
/// observed authors (the synced events DB), plus roster grantees, minus the
/// banlist. Instant and offline-correct; [`sync_guestbook`] (post-join, boot,
/// reconnect, live ingest) keeps the store current. The live [`memberlist`]
/// remains the authoritative walk — a refounding's rekey recipient set must
/// never trust a possibly-stale store.
/// Unix seconds from which this client has been following `cid_hex`'s guestbook.
///
/// Set once, on the first sync that stores anything, and never moved forward. It is
/// what makes `observed_at` usable as evidence: a client that only started watching
/// AFTER a raid began sees every member as new, so its observations prove nothing and
/// must not be allowed to evict anyone.
fn guestbook_observed_since(cid_hex: &str) -> Option<u64> {
    crate::db::settings::get_sql_setting(format!("gb_observed_since:{cid_hex}"))
        .ok()
        .flatten()
        .and_then(|v| v.parse::<u64>().ok())
}

fn mark_guestbook_observed_since(cid_hex: &str) {
    let key = format!("gb_observed_since:{cid_hex}");
    if crate::db::settings::get_sql_setting(key.clone()).ok().flatten().is_some() {
        return; // never moves forward — a later stamp would erase our own coverage
    }
    let now = web_time::SystemTime::now()
        .duration_since(web_time::UNIX_EPOCH)
        .map(|d| d.as_secs())
        .unwrap_or(0);
    let _ = crate::db::settings::set_sql_setting(key, now.to_string());
}

pub fn stored_memberlist(community: &CommunityV2) -> Result<Vec<PublicKey>, String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let (events, _cursor) = crate::db::community::get_guestbook(&cid_hex)?;
    stored_memberlist_from(community, &events)
}

/// [`stored_memberlist`] over a guestbook the caller already holds, so a read that needs
/// the cursor too decrypts and parses the plane once.
pub fn stored_memberlist_from(community: &CommunityV2, events: &[guestbook::GuestbookEvent]) -> Result<Vec<PublicKey>, String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let mut observed: std::collections::BTreeMap<PublicKey, u64> = std::collections::BTreeMap::new();
    for (npub, last_active_secs) in crate::db::community::community_member_activity(&cid_hex).unwrap_or_default() {
        if let Ok(pk) = PublicKey::parse(&npub) {
            observed.insert(pk, last_active_secs.saturating_mul(1000));
        }
    }
    let roles = crate::db::community::get_community_roles(&cid_hex)?;
    let banlist: std::collections::BTreeSet<PublicKey> = crate::db::community::get_community_banlist(&cid_hex)
        .unwrap_or_default()
        .iter()
        .filter_map(|h| PublicKey::from_hex(h).ok())
        .collect();
    // Ban history outlives the banlist itself — see [`fold_members`]. Read from the store,
    // since this path never folds editions.
    let banned_at: std::collections::BTreeMap<PublicKey, u64> = crate::db::community::get_community_ban_marks(&cid_hex)
        .unwrap_or_default()
        .into_iter()
        .filter_map(|(h, at)| PublicKey::from_hex(&h).ok().map(|pk| (pk, at)))
        .collect();
    fold_members(community, events, observed, &roles, &banlist, &banned_at)
}

/// Fold the Complete Memberlist from the Guestbook plane. The proven owner is
/// ALWAYS a member (derived from the self-certifying community_id — no network,
/// so a lost/evicted genesis Join can't drop them). Observed authors — anyone
/// seen publishing on a channel — are folded in FORWARD-only per CORD-02 §5, so a
/// member whose Join was lost still counts.
pub async fn memberlist<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> Result<Vec<PublicKey>, String> {
    let (events, _newest, _reached_end) = fetch_guestbook_events(transport, community, 0).await?;
    // Observed authors: fold each held channel's recent authorship (real author +
    // newest ms), so a member who posted but whose Join was lost is still counted.
    let mut observed: std::collections::BTreeMap<PublicKey, u64> = std::collections::BTreeMap::new();
    for ch in &community.channels {
        if let Ok(page) = fetch_channel(transport, community, &ch.id, 200).await {
            for f in &page {
                let e = observed.entry(f.event.opened().author).or_insert(0);
                *e = (*e).max(f.event.opened().at_ms);
            }
        }
    }

    // Fold the Control Plane roster + banlist (CORD-04) for Kick authority and the
    // ban subtraction. A control fetch failure degrades to owner-only authority + no
    // bans (fail-open on availability is safe here: a Kick still needs a real signer,
    // and a missed ban only fails to HIDE, never to wrongly admit authority).
    let authority = fetch_authority(transport, community).await;
    // The authorized banlist, as pubkeys (a malformed hex entry is simply dropped).
    let banlist: std::collections::BTreeSet<PublicKey> =
        authority.banned.iter().filter_map(|h| PublicKey::from_hex(h).ok()).collect();
    // Union the live fold's ban history with the stored marks: the fetch only reaches the
    // editions still in its window, and a ban that aged out is exactly the one whose
    // pre-ban Join would phantom.
    let mut banned_at: std::collections::BTreeMap<PublicKey, u64> = crate::db::community::get_community_ban_marks(
        &crate::simd::hex::bytes_to_hex_32(&community.id().0),
    )
    .unwrap_or_default()
    .into_iter()
    .filter_map(|(h, at)| PublicKey::from_hex(&h).ok().map(|pk| (pk, at)))
    .collect();
    for (h, at) in &authority.banned_at {
        if let Ok(pk) = PublicKey::from_hex(h) {
            let slot = banned_at.entry(pk).or_insert(0);
            *slot = (*slot).max(*at);
        }
    }
    fold_members(community, &events, observed, &authority.roles, &banlist, &banned_at)
}

// ── Dissolution (CORD-02 §9) ─────────────────────────────────────────────────

/// Owner dissolution / "Delete Community" (CORD-02 §9): publish the terminal
/// tombstone at the dissolved plane (`community_id`-derived, epoch-free, so every
/// past or present member resolves the same grave and a Refounding can never strand
/// it). The tombstone's presence IS the state; only the owner's seal counts.
/// Irreversible — on success the local hold is sealed read-only AND the owner's
/// own membership is tombstoned out of the §8 List: dissolving is also leaving,
/// so the owner's other devices tear the community down on their next list sync
/// instead of keeping a sealed husk they believe is still held.
pub async fn dissolve_community<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> Result<(), String> {
    crate::db::scoped(async move {
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        if community.owner()? != my_pk {
            return Err("only the owner can dissolve a community".to_string());
        }
        let at_ms = now_ms();
        let at = at_ms / 1000;
        let rumor = super::dissolution::dissolved_tombstone_rumor(my_pk, community.id(), at);
        let wrap = super::dissolution::seal_dissolved_signed(&signer, my_pk, &rumor, community.id(), Timestamp::from_secs(at)).await.map_err(|e| e.to_string())?;
        // Durable broadcast: death must propagate (a rekey racing a dissolution loses).
        transport.publish_durable(&wrap, &community.relays).await?;
        crate::db::community::set_community_dissolved(&crate::simd::hex::bytes_to_hex_32(&community.id().0))?;
        // Dissolving IS leaving (same discipline as `leave_community`): retire the
        // membership from the cross-device List in the same breath as the grave.
        // Without this the tombstone never reaches kind 33302 — the teardown above
        // this call only ever spoke the retired v1 mirror — so every sibling device
        // and every §8 client kept the entry LIVE, folded the grave, and showed a
        // dissolved husk that had to be removed by hand. Best-effort with a durable
        // retry, never failing the dissolve: the grave is already published, and an
        // unrecorded leave only costs the husk lingering until the retry lands.
        if let Err(e) = tombstone_community_list(transport, community.id(), &community.relays, at_ms).await {
            crate::log_net_fail!("[CommunityList] dissolve tombstone failed ({}) — retrying in the background", e);
            tombstone_community_list_durable(*community.id(), community.relays.clone(), at_ms);
        }
        Ok(())
    })
    .await
}

/// Whether a valid owner-signed dissolution tombstone exists for this community on
/// its relays (CORD-02 §9). A join refuses a dead community, and a live follow seals
/// on sight. Fail-OPEN on a fetch error (absence of proof is not death), but any
/// owner-verified tombstone found is authoritative.
pub async fn is_dissolved<T: Transport + ?Sized>(transport: &T, community: &CommunityV2) -> bool {
    let group = super::derive::dissolved_group_key(community.id());
    let query = Query {
        kinds: vec![stream::KIND_WRAP],
        authors: vec![group.pk_hex()],
        limit: Some(20),
        ..Default::default()
    };
    let Ok(wraps) = transport.fetch(&query, &community.relays).await else {
        return false;
    };
    wraps.iter().any(|w| super::dissolution::verify_dissolved(w, &community.identity))
}

// ── Refounding (CORD-06 §3) ──────────────────────────────────────────────────

/// Owner/admin Refounding (CORD-06 §3): roll the `community_root` to
/// cryptographically remove `removed` from a Private community (a Ban's read-cut).
/// Compacts the Control Plane under the new root (re-wraps each head VERBATIM — the
/// inner owner/actor signatures survive, so no re-authoring), rekeys the base plus
/// every Private channel (each sealed under the PRIOR root, D2, so a base-fork loser
/// can still open them), and seeds the new epoch's Guestbook snapshot. Requires BAN.
///
/// **Acquire-before-commit:** the compaction is fetched + re-sealed BEFORE any
/// publish, and a head we can't fetch ABORTS with ZERO published state — so a
/// transient miss never strands a published rekey with a half-anchored plane.
pub async fn refound_community<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, removed: &[PublicKey]) -> Result<CommunityV2, String> {
    refound_community_with(transport, community, removed, false, 0, None).await
}

/// A SEVERING Refounding (CORD-06 Severing): the rotation carries the `sever`
/// marker, and every adopter — this client included — revokes its own public
/// invite links instead of refreshing them into the new epoch. The read-cut is
/// real even while the community was Public: the door closes with the rotation,
/// and only a deliberate fresh mint re-opens it.
pub async fn refound_community_severing<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, removed: &[PublicKey], joined_after_cut: u64) -> Result<CommunityV2, String> {
    refound_community_with(transport, community, removed, true, joined_after_cut, None).await
}

/// `joined_after_cut`: seconds. A member whose EARLIEST Join is at or after this is
/// vended no key. 0 disables it. The test is positive evidence only — a member with no
/// Join on the reachable guestbook (buried epoch, aged-out window) is NOT excluded, and
/// an unreadable guestbook excludes nobody. Absence must never evict: five rotations
/// once shed 39 real members that way.
/// Re-found vending keys to `retain` ONLY (plus the owner and this device).
///
/// An operator picked a list; anyone not on it gets nothing, whenever they arrived.
/// The removal-list form cannot express that: it is computed from the memberlist at
/// one instant while the refound fetches its own later, so an account that appears in
/// between is on neither list and is vended a key by default — implicitly RETAINED by
/// the very purge meant to be exhaustive. An allow-list has no such gap, and unlike a
/// join-time cut it is immune to a backdated (author-claimed) Join.
pub async fn refound_community_retaining<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    removed: &[PublicKey],
    retain: &[PublicKey],
) -> Result<CommunityV2, String> {
    refound_community_with(transport, community, removed, false, 0, Some(retain)).await
}

async fn refound_community_with<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, removed: &[PublicKey], sever: bool, joined_after_cut: u64, allow_only: Option<&[PublicKey]>) -> Result<CommunityV2, String> {
    crate::db::scoped(async move {
        let cid = community.id();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
        // Death wins every race: a dissolved community never re-founds (CORD-02 §9).
        if crate::db::community::get_community_dissolved(&cid_hex).unwrap_or(false) {
            return Err("this community has been dissolved; it cannot be re-founded".to_string());
        }
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        // Serialize with the follow worker for the whole rotation: the commit tail
        // whole-row-saves, and an unserialized concurrent follow could otherwise be
        // rolled back (or adopt a half-published sibling of this very rotation).
        let lock = super::realtime::follow_lock(cid);
        let _guard = lock.lock().await;
        // Reload the FRESHEST base state: a stale caller struct would address the rotation
        // under a superseded root (a base fork with no heal). The community_id is
        // self-certifying + stable, so re-loading by it is safe.
        let fresh = crate::db::community::load_community_v2(cid)?.ok_or("community gone before re-founding")?;
        let community = &fresh;
        let owner = community.owner()?;

        // CORD-06 §Authority: a Refounding requires the BAN permission and the rotator
        // must strictly OUTRANK every removed target — the owner is supreme (BAN ⊂
        // owner). Mirrors the receive counterpart (`advance_scope::base_rotator_ok`)
        // and the banlist authority fold: any admin holding BAN may re-found, checked
        // against the folded Roster. Fail-closed — an empty/unauthorized roster leaves
        // only the owner able to re-found.
        {
            let owner_hex = owner.to_hex();
            let me_hex = my_pk.to_hex();
            // Persisted (last-folded) roster — the receive side is authoritative, so
            // this is a belt-and-suspenders gate. Fail-closed: a stale/empty roster
            // collapses to owner-only, which can only OVER-restrict a fresh admin whose
            // grant hasn't folded into their own DB (the caller's ban flow folds control
            // first). It can never grant authority no one has.
            let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
            let banned = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
            let authorized = my_pk == owner
                || (!banned.contains(&me_hex)
                    && roster.is_authorized(&me_hex, Some(&owner_hex), crate::community::roles::Permissions::BAN)
                    && removed.iter().all(|t| {
                        roster.can_act_on_member(&me_hex, Some(&owner_hex), &t.to_hex(), crate::community::roles::Permissions::BAN)
                    }));
            if !authorized {
                return Err("re-founding requires the BAN permission and outranking every removed member".to_string());
            }
        }

        // Fold the current roster: the opened editions are reused for the compaction (their
        // seals re-wrap under the new epoch), and the roster gates which admin-authored
        // heads carry forward.
        let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)?
            .into_iter()
            .filter(|(_, f)| f.0 == community.root_epoch.0)
            .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
            .collect();
        let current_control = control::ControlPlane::of(community);
        // Page the ENTIRE control plane, not just the newest window: the compaction MUST
        // carry EVERY committed (floored) entity to the new epoch, so a head buried under a
        // flood of newer editions (100 roles + 400 grants already exceeds one page) or a
        // head a relay withholds can't silently drop. CORD-06 §3 mandates aborting if the
        // Refounder cannot fold all Control Events — a dropped Banlist would unban a member
        // at the new epoch a fresh joiner bootstraps.
        let mut opened: Vec<(ParsedEdition, super::stream::OpenedStream)> = Vec::new();
        let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
        let mut oldest: Option<u64> = None;
        let mut until: Option<u64> = None;
        // Read to EXHAUSTION, not to coverage: an entity with no floor yet (a
        // first-ever Banlist published while we were away) is invisible to a
        // coverage test, so stopping there could compact it away.
        let mut truncated = false;
        for page in 0..COMPACT_MAX_PAGES {
            // Full: compaction re-wraps the head set it can SEE — a control
            // edition (a ban head) reachable only on a minority relay must not be
            // compacted away by a partial union.
            let query = Query {
                kinds: vec![stream::KIND_WRAP],
                authors: vec![current_control.pk_hex()],
                until,
                limit: Some(FOLLOW_PAGE),
                evidence: crate::community::transport::Evidence::Full,
                ..Default::default()
            };
            let wraps = transport.fetch(&query, &community.relays).await?;
            let mut fresh = 0usize;
            for w in &wraps {
                if !seen_wraps.insert(w.id) {
                    continue;
                }
                fresh += 1;
                let at = w.created_at.as_secs();
                if oldest.is_none_or(|o| at < o) {
                    oldest = Some(at);
                }
                if let Ok(parsed) = current_control.open(w) {
                    opened.push(parsed);
                }
            }
            if fresh == 0 {
                // `until` is inclusive: a FULL page with nothing new is a same-second
                // wall no cursor steps past, so older editions stay unreachable. A
                // short page is simply the end of the plane.
                truncated = wraps.len() >= FOLLOW_PAGE;
                break;
            }
            until = oldest;
            if page + 1 == COMPACT_MAX_PAGES {
                truncated = true;
            }
        }
        if truncated {
            return Err(
                "The community's control plane is too deep to read in full right now; re-founding stopped so no member is left behind.".to_string(),
            );
        }

        let prev_epoch = community.root_epoch;
        let new_epoch = Epoch(prev_epoch.0.checked_add(1).ok_or("root epoch overflow")?);
        let prev_commit = super::derive::epoch_key_commitment(prev_epoch, &community.community_root);
        // Mint-or-REUSE the new root, keyed by (scope, new_epoch) and archived BEFORE any
        // publish: a retried Refounding re-delivers the SAME root at this epoch/address, so
        // it can't double-mint two roots a receiver's correlation dedup would collapse into
        // a permanent fork (CORD-06 §3 idempotency). The compaction fetch above straddled
        let new_root = mint_or_reuse_rotation_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, new_epoch.0)?;
        // Every compliant base rotation mints the split beside the root (CORD-06
        // §3) — a legacy community upgrades as a side effect of this Refounding.
        // Reserved under the same retry-idempotency: both attempts must deliver ONE
        // pair, or staff adopt whichever secret rode the chunk with their locator.
        let new_control_root = mint_or_reuse_rotation_key(&cid_hex, crate::community::CONTROL_ROOT_SCOPE, new_epoch.0)?;
        let new_control_pk = super::derive::control_signer_group_key(&new_control_root, cid, new_epoch).pk();
        // The new epoch's Control plane is SPLIT: wraps sign with the fresh
        // control_root-derived signer and encrypt under the new community_root-
        // derived read key. Editions are never ALSO mirrored to the legacy-derived
        // address — that would re-open exactly the member-writable surface the
        // split closes (CORD-06 §3).
        let new_control = control::split_write_group(&new_control_root, &new_root, cid, new_epoch);
        let at = now_ms();
        let at_secs = at / 1000;

        // ACQUIRE + COVERAGE GATE (CORD-06 §3 MUST): re-wrap the head of EVERY committed
        // (floored) entity under the new epoch — FLOOR-driven, so nothing silently drops,
        // including entities the metadata/roster folds don't touch (the invite Registry
        // vsk-8, whose coordinate survives the rekey per CORD-05 §5). A floor whose head
        // can't be folded (buried past the pager / withheld) ABORTS before any publish.
        use std::collections::BTreeMap;
        let mut by_eid: BTreeMap<String, Vec<usize>> = BTreeMap::new();
        for (i, (e, _)) in opened.iter().enumerate() {
            by_eid.entry(crate::simd::hex::bytes_to_hex_32(&e.entity_id)).or_default().push(i);
        }
        let mut carried: Vec<(FoldedHead, Event)> = Vec::new();
        for (floor_key, floor) in &floors {
            // Re-wrap the AUTHORIZED head — the exact edition the persisted floor commits to
            // (its self_hash). The floor advances ONLY to authorized heads (author-aware fold),
            // so matching it is authority-correct across EVERY entity type. `fold_head`'s
            // version-chain TIP is author-BLIND: a member can seal a forged higher-version
            // edition chaining onto the floor, which the tip would carry and honest folders
            // then DROP as unauthorized — silently suppressing that role/grant/banlist across
            // the refounding. Abort if the committed head isn't served (fail-closed).
            let head_idx = by_eid
                .get(floor_key)
                .and_then(|v| v.iter().copied().find(|&i| opened[i].0.self_hash == floor.1));
            let Some(head_idx) = head_idx else {
                return Err(format!("re-founding aborted: the committed head of control entity {floor_key} (v{}) was not served; no state published", floor.0));
            };
            let (head_ed, head_os) = &opened[head_idx];
            let h = FoldedHead { entity_hex: floor_key.clone(), version: head_ed.version, self_hash: head_ed.self_hash, inner_id: head_ed.inner_id };
            let (rewrapped, _) = super::stream::rewrap_seal(&head_os.seal, &new_control, Timestamp::from_secs(at_secs)).map_err(|e| e.to_string())?;
            carried.push((h, rewrapped));
        }

        // Recipients: the current members minus `removed`, plus me (multi-device).
        //
        // UNION of the network fold and the LOCAL memberlist. The network fold only
        // observes the recent window, so a quiet member whose Join lives on a buried
        // epoch falls out of it — and out of the key set and snapshot — on every
        // rotation. Five rotations in one evening shed 39 real members that way, each
        // left wedged at the hop that first forgot them. Locally-known members are
        // vended keys too; being forgotten is not a removal, only `removed` is.
        let members = memberlist(transport, community).await?;
        let removed_set: std::collections::HashSet<[u8; 32]> = removed.iter().map(|p| p.to_bytes()).collect();
        let net_len = members.len();
        let mut union: std::collections::BTreeSet<PublicKey> = members.into_iter().collect();
        let local = stored_memberlist(community)?;
        let local_len = local.len();
        union.extend(local);
        let mut recipients: Vec<PublicKey> = union.into_iter().filter(|m| !removed_set.contains(&m.to_bytes())).collect();
        if !recipients.contains(&my_pk) {
            recipients.push(my_pk);
        }

        // The freshest roster reachable, for two per-recipient decisions below:
        // channel entitlement AND staff-ness (who receives the 136-byte blob).
        // Entitlement must come from a CURRENT roster, not the last-folded cache:
        // the base recipients above are a fresh network fold, and mixing the two
        // strands anyone granted since this client last folded — they keep a dead
        // key and the new epoch's rekey plane carries no blob for them. Fetched,
        // then merged over the cache so a role we published ourselves survives too.
        let mut roster_for_channels = fetch_authority(transport, community).await.roles;
        {
            let cached = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
            for r in cached.roles {
                if !roster_for_channels.roles.iter().any(|x| x.role_id == r.role_id) {
                    roster_for_channels.roles.push(r);
                }
            }
            for g in cached.grants {
                if !roster_for_channels.grants.iter().any(|x| x.member == g.member) {
                    roster_for_channels.grants.push(g);
                }
            }
        }
        let owner_hex_for_channels = community.owner().ok().map(|o| o.to_hex());

        // Operator purge: vend ONLY to the chosen list.
        //
        // Not a time test — a hard allow-list, so an account that arrived between the
        // operator's selection and this fetch is excluded by NOT BEING ON IT, with no
        // window to slip through and nothing to backdate. Owner and this device are
        // always kept: a purge must not orphan the community or lock out the operator
        // running it.
        if let Some(allow) = allow_only {
            let allowed: std::collections::HashSet<[u8; 32]> = allow.iter().map(|p| p.to_bytes()).collect();
            let before = recipients.len();
            recipients.retain(|r| {
                *r == my_pk
                    || Some(r.to_hex()) == owner_hex_for_channels
                    || allowed.contains(&r.to_bytes())
            });
            let dropped = before.saturating_sub(recipients.len());
            if dropped > 0 {
                crate::log_info!(
                    "[Refound {}] purge: {} member(s) not on the retain list vended no key",
                    &cid_hex[..8.min(cid_hex.len())], dropped
                );
            }
        }

        // Containment: vend no key to anyone who walked in DURING the raid.
        //
        // `removed` is a list computed at one instant; the recipient set above is a
        // LIVE fetch taken later, and re-taken on every retry. A bot joining in that
        // gap lands in the memberlist, misses the list, and is handed a working key
        // for the epoch meant to evict it. Testing the join TIME instead of matching a
        // frozen list is immune to when the fetch happens: a later read only surfaces
        // more late joiners, and each one fails the same test.
        //
        // Positive evidence only. No Join on the reachable guestbook means OLD (or
        // buried), never "new" — and an unreadable guestbook filters nobody, because
        // failing closed here would evict the whole community on one bad read.
        if joined_after_cut > 0 {
            match fetch_guestbook_events(transport, community, 0).await {
                Ok((events, _, _)) => {
                    let mut first_seen: std::collections::BTreeMap<PublicKey, u64> = std::collections::BTreeMap::new();
                    for ev in &events {
                        if let guestbook::GuestbookEntry::Join { member, at_ms, .. } = &ev.entry {
                            let secs = at_ms / 1000;
                            first_seen.entry(*member).and_modify(|e| *e = (*e).min(secs)).or_insert(secs);
                        }
                    }
                    // A Join's `at_ms` is written by its author, so a raider can
                    // backdate under any window computed from it. What this client
                    // WATCHED arrive, they cannot forge — but only if we were already
                    // following before the window opened. A client that started
                    // watching later sees everyone as new, and trusting it would evict
                    // the whole community.
                    if guestbook_observed_since(&cid_hex).is_some_and(|since| since < joined_after_cut) {
                        if let Ok((local, _)) = crate::db::community::get_guestbook(&cid_hex) {
                            for ev in &local {
                                let (guestbook::GuestbookEntry::Join { member, .. }, Some(seen)) = (&ev.entry, ev.observed_at) else {
                                    continue;
                                };
                                // Incriminating only: an observation can move a member
                                // LATER (catching a backdated claim), never earlier.
                                first_seen.entry(*member).and_modify(|e| *e = (*e).max(seen)).or_insert(seen);
                            }
                        }
                    }
                    let before = recipients.len();
                    recipients.retain(|r| {
                        if *r == my_pk || Some(r.to_hex()) == owner_hex_for_channels {
                            return true;
                        }
                        // A moderator who joined moments before a raid is still a moderator.
                        if roster_for_channels.is_staff(&r.to_hex(), owner_hex_for_channels.as_deref()) {
                            return true;
                        }
                        first_seen.get(r).is_none_or(|joined| *joined < joined_after_cut)
                    });
                    let dropped = before.saturating_sub(recipients.len());
                    if dropped > 0 {
                        crate::log_info!(
                            "[Refound {}] containment: {} raid-window joiner(s) vended no key",
                            &cid_hex[..8.min(cid_hex.len())], dropped
                        );
                    }
                }
                Err(e) => crate::log_warn!(
                    "[Refound {}] guestbook unreadable — raid-window joiners NOT filtered, only the named cut is severed ({e})",
                    &cid_hex[..8.min(cid_hex.len())]
                ),
            }
        }

        // STAFF COVERAGE GATE: a granted member who is not a recipient would be
        // stranded at this hop for good — they can only ever derive `held + 1`, so
        // no later rotation reaches them, while every other client still reads them
        // as staff. That is silent and permanent, and it happened: an admin holding
        // a valid grant was vended no key and only surfaced because a human noticed
        // the member list had shrunk.
        //
        // A grant is consensus-complete proof of membership — the same claim
        // `fold_members` makes when it counts granted members "even if their Join
        // aged out of the Guestbook entirely". So the recipients must cover them.
        // Refusing here matches the entity carry-forward directly above, which
        // ABORTS rather than publish a rotation that drops a floored head: better a
        // rotation that did not happen than one that quietly severs the staff.
        //
        // Only the CUT are exempt — removing someone is the one thing a rotation is
        // allowed to do to them.
        {
            // A banned member is not owed a key; every other grant-holder is.
            let banned = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
            let missing: Vec<String> = roster_for_channels
                .grants
                .iter()
                .filter(|g| !g.role_ids.is_empty())
                .filter_map(|g| PublicKey::from_hex(&g.member).ok())
                .filter(|pk| !removed_set.contains(&pk.to_bytes()))
                .filter(|pk| !banned.contains(&pk.to_hex()))
                .filter(|pk| !recipients.contains(pk))
                .map(|pk| pk.to_hex())
                .collect();
            if !missing.is_empty() {
                // The counts ride the message: which of the two folds lost them is
                // the whole diagnosis, and a refusal that does not say leaves the
                // next person guessing exactly as long as this one did.
                return Err(format!(
                    "re-founding aborted: {} granted member(s) would be vended no key and stranded at epoch {} — {}; \
                     recipients={} (network fold {}, local fold {}); no state published",
                    missing.len(),
                    prev_epoch.0,
                    missing.iter().map(|h| h[..8.min(h.len())].to_string()).collect::<Vec<_>>().join(", "),
                    recipients.len(),
                    net_len,
                    local_len
                ));
            }
        }

        // Base rekey blobs, sealed under the PRIOR root: every member's carries the
        // new root + control_pk (104 bytes); a STAFF recipient's (CORD-04 §3)
        // appends the control_root itself (136) — the rotator is staff by
        // construction (a Refounding takes BAN). A stale-roster overshoot hands a
        // just-demoted member only flooding power until the next rotation, the
        // spec's accepted erosion; an undershoot self-heals via the Grant's
        // control_wrap re-delivery.
        let mut base_blobs = Vec::new();
        for r in &recipients {
            let staff = *r == my_pk || roster_for_channels.is_staff(&r.to_hex(), owner_hex_for_channels.as_deref());
            base_blobs.push(
                super::rekey::build_base_blob(&signer, &my_pk.to_bytes(), r, new_epoch, &new_root, &new_control_pk.to_bytes(), staff.then_some(&new_control_root))
                    .await
                    .map_err(|e| e.to_string())?,
            );
        }
        let base_group = super::derive::base_rekey_group_key(&community.community_root, cid, new_epoch);
        let base_chunks =
            super::rekey::build_rekey_chunks(&signer, my_pk, &base_group, super::rekey::RekeyScope::Root, new_epoch, prev_epoch, &prev_commit, &base_blobs, at_secs, my_authority_citation(community, &my_pk).as_ref(), sever)
                .await
                .map_err(|e| e.to_string())?;

        // Private-channel rekeys: each mints a fresh key at its next channel-epoch, sealed
        // under the PRIOR root (D2). Public channels ride the base — no per-channel rekey.
        //
        // Each private channel goes only to ITS entitled set, never the base recipient
        // list: a Refounding that re-broadcast every private key to every member would
        // undo the access lists on every rotation (CORD-03).
        let mut channel_updates: Vec<(ChannelId, [u8; 32], Epoch)> = Vec::new();
        let mut channel_chunk_sets: Vec<Vec<Event>> = Vec::new();
        for ch in &community.channels {
            let (Some(old_key), true) = (ch.key, ch.private) else { continue };
            let ch_hex = crate::simd::hex::bytes_to_hex_32(&ch.id.0);
            let entitled: Vec<PublicKey> = recipients
                .iter()
                .copied()
                .filter(|r| {
                    *r == my_pk
                        || roster_for_channels.is_entitled(owner_hex_for_channels.as_deref(), &r.to_hex(), &ch_hex, &[], &[])
                })
                .collect();
            let ch_new_epoch = Epoch(ch.epoch.0.checked_add(1).ok_or("channel epoch overflow")?);
            // Mint-or-reuse per channel too, keyed by (channel_id, next epoch) — same
            // retry-idempotency as the base root. The base-rekey signing above is a bunker
            // round-trip; re-check before this per-channel DB write straddles it.
            let ch_new_key = mint_or_reuse_rotation_key(&cid_hex, &crate::simd::hex::bytes_to_hex_32(&ch.id.0), ch_new_epoch.0)?;
            let ch_prev_commit = super::derive::epoch_key_commitment(ch.epoch, &old_key);
            let mut ch_blobs = Vec::new();
            for r in &entitled {
                ch_blobs.push(
                    super::rekey::build_blob(&signer, &my_pk.to_bytes(), r, super::rekey::RekeyScope::Channel(ch.id), ch_new_epoch, &ch_new_key)
                        .await
                        .map_err(|e| e.to_string())?,
                );
            }
            let ch_group = super::derive::channel_rekey_group_key(&community.community_root, &ch.id, ch_new_epoch);
            let ch_chunks = super::rekey::build_rekey_chunks(&signer, my_pk, &ch_group, super::rekey::RekeyScope::Channel(ch.id), ch_new_epoch, ch.epoch, &ch_prev_commit, &ch_blobs, at_secs, my_authority_citation(community, &my_pk).as_ref(), false)
                .await
                .map_err(|e| e.to_string())?;
            channel_updates.push((ch.id, ch_new_key, ch_new_epoch));
            channel_chunk_sets.push(ch_chunks);
        }

        // COMMIT (durable publishes only — all fetching is done). Base rekey first
        // (delivers the new root), then channel rekeys, then the compacted control.
        for c in &base_chunks {
            transport.publish_durable(c, &community.relays).await?;
        }
        for set in &channel_chunk_sets {
            for c in set {
                transport.publish_durable(c, &community.relays).await?;
            }
        }
        for (_, wrap) in &carried {
            transport.publish_durable(wrap, &community.relays).await?;
        }
        // Guestbook snapshot at the new epoch — best-effort (a Refounding succeeds without
        // it; an omitted member heals by publishing their own Join).
        let gb_group = super::derive::guestbook_group_key(&new_root, cid, new_epoch);
        let snap_id = crate::community::random_32();
        for rumor in guestbook::build_snapshot_rumors(my_pk, &recipients, snap_id, at) {
            if let Ok((wrap, _)) = guestbook::seal_guestbook_rumor_signed(&signer, my_pk, &rumor, &gb_group, Timestamp::from_secs(at_secs)).await {
                let _ = transport.publish(&wrap, &community.relays).await;
            }
        }

        // COMMIT locally, only now that the new root + compacted plane are on relays.
        if crate::db::community::community_protocol(cid)?.is_none() {
            return Ok(community.clone()); // left/deleted mid-rotation — don't resurrect.
        }
        // Save the new root/epoch + rekeyed channel keys in ONE tx FIRST, so a crash can
        // never leave the base root advanced while the channel keys lag (which would
        // re-derive the channel rekey address under the wrong root and orphan them).
        let mut updated = community.clone();
        updated.community_root = new_root;
        updated.root_epoch = new_epoch;
        updated.control_pk = Some(new_control_pk);
        updated.control_root = Some(new_control_root);
        for (id, key, ep) in &channel_updates {
            if let Some(c) = updated.channels.iter_mut().find(|c| c.id.0 == id.0) {
                c.key = Some(*key);
                c.epoch = *ep;
            }
        }
        crate::db::community::save_community_v2(&updated)?;
        // Archive the new epoch key + confirm the monotonic base head (the root was already
        // archived by mint_or_reuse, so this is idempotent). Record the carried heads at
        // the NEW epoch; if a crash skips this, the epoch-filtered floors bootstrap the
        // compacted control on the next follow, so they self-heal.
        crate::db::community::advance_server_root_epoch(&cid_hex, new_epoch.0, &new_root)?;
        for (h, _) in &carried {
            crate::db::community::set_edition_head_at_epoch(&cid_hex, &h.entity_hex, h.version, &h.self_hash, &h.inner_id, new_epoch.0)?;
        }
        // Re-subscribe NOW: the rotation changed every plane author, and the live sub
        // still carries the OLD epoch's set. Members adopt via the follow worker
        // (which refreshes); the REFOUNDER has no such path — without this, the very
        // client that performed the ban goes deaf to the new epoch (a rejoin lands on
        // the relays and never arrives live).
        if let Some(client) = crate::state::nostr_client() {
            super::realtime::refresh_subscription(&client).await;
        }
        // We minted this epoch, so our own snapshot is what seeds it (CORD-02 §5).
        // Recorded here so the local fold agrees with every follower's without
        // waiting to adopt our own rotation back off the wire.
        record_epoch_minter(&cid_hex, new_epoch.0, &my_pk.to_hex());
        if sever {
            // Severing: the mark persists FIRST (a crash between it and the revoke
            // must retry, not forget — B4), then my own links are tombstoned. Other
            // creators' links die when their clients adopt the marked rotation.
            add_sever_mark(&cid_hex, new_epoch.0, at_secs);
            for attempt in 0..3u8 {
                match sever_own_links(transport, &updated).await {
                    Ok(_) => break,
                    Err(e) if attempt == 2 => {
                        crate::log_warn!("v2: post-severing link revocation failed after retries ({e}); the sever mark retries it on the next follow");
                    }
                    Err(_) => continue,
                }
            }
        } else {
            // Refresh any live public links so their bundles carry the NEW root behind the
            // same URL (a link shared once survives the rotation, CORD-05 §2). Idempotent,
            // so retry a transient failure — a stranded link lands a new joiner on the dead
            // pre-refound epoch, and there's no other trigger to heal it before the next
            // refounding. A persistent failure is logged (refound already succeeded).
            for attempt in 0..3u8 {
                match refresh_public_links(transport, &updated).await {
                    Ok(()) => break,
                    Err(e) if attempt == 2 => {
                        crate::log_warn!("v2: post-refounding public-link refresh failed after retries ({e}); live links may serve the prior root until the next refresh");
                    }
                    Err(_) => continue,
                }
            }
        }
        Ok(updated)
    })
    .await
}

/// BIRTH refound (§migration Phase 1.4): roll a freshly-minted migration twin from epoch 0
/// to epoch 1 so it can carry an owner-signed Guestbook SNAPSHOT of the full v1 memberlist —
/// genesis (epoch 0) has no snapshot authority (`fold_members` gates on `root_epoch > 0`), so
/// this is the ONLY way to seed a roster every honest client folds. UNLIKE [`refound_community`]
/// the two sets are DECOUPLED:
///
/// - **Rekey recipients = {owner} ONLY.** Members do NOT get the epoch-1 root via birth blobs
///   — they get it from the migration carrier's `m` (sealed AFTER this returns). Keeping the
///   set at {owner} also keeps the rotation to a single chunk (blobs shard at 80 per event,
///   so a big memberlist would cost a stack of events delivering roots nobody uses).
/// - **Snapshot members = the EXPLICIT full v1 list** (`snapshot_members`, display/roster only,
///   no keys). Chunked at SNAPSHOT_CHUNK (400)/rumor, no cap — a 10k-member community seeds fine.
///
/// The SAFEST refound possible: the owner authored 100% of the control plane seconds ago and
/// holds every edition locally, so the fold-all-or-abort discipline is trivially met (a flaky
/// relay just fires the abort → the wizard retries). Returns the epoch-1 community.
pub async fn refound_at_birth<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    snapshot_members: &[PublicKey],
) -> Result<CommunityV2, String> {
    crate::db::scoped(async move {
        let cid = community.id();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
        // Death wins every race: a dissolved community never re-founds (CORD-02 §9, parity with
        // refound_community). A migration twin should never be dissolved mid-build, but fail-closed.
        if crate::db::community::get_community_dissolved(&cid_hex).unwrap_or(false) {
            return Err("this community has been dissolved; it cannot be birth-refounded".to_string());
        }
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        if my_pk != community.owner()? {
            return Err("only the owner can birth-refound the migration twin".to_string());
        }
        let lock = super::realtime::follow_lock(cid);
        let _guard = lock.lock().await;
        let community = crate::db::community::load_community_v2(cid)?.ok_or("twin gone before birth refound")?;
        // RESUME IDEMPOTENCE: if the refound already committed locally (epoch 1) but crashed
        // before its ledger write, the wizard re-calls this. The epoch advance + compaction only
        // commit AFTER the snapshot published durably + verified back (below), so an epoch-1 twin
        // means the snapshot already landed and is readable — return it. A twin past epoch 1 is
        // unexpected (nothing else rotates a mid-migration twin).
        if community.root_epoch.0 == 1 {
            return Ok(community);
        }
        if community.root_epoch.0 != 0 {
            return Err("birth refound only rolls a genesis (epoch 0) twin".to_string());
        }
        let community = &community;

        // Compact the epoch-0 control plane onto epoch 1: re-wrap the committed head of every
        // floored entity VERBATIM (inner owner/admin signatures survive). The owner holds every
        // edition locally (authored seconds ago), so this fold-all-or-abort is trivially met.
        let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)?
            .into_iter()
            .filter(|(_, f)| f.0 == community.root_epoch.0)
            .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
            .collect();
        let current_control = control::ControlPlane::of(community);
        let mut opened: Vec<(ParsedEdition, super::stream::OpenedStream)> = Vec::new();
        let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
        let mut oldest: Option<u64> = None;
        let mut until: Option<u64> = None;
        // Exhaustion, not coverage — see the sibling read in `refound_community`.
        let mut truncated = false;
        for page in 0..COMPACT_MAX_PAGES {
            let query = Query { kinds: vec![stream::KIND_WRAP], authors: vec![current_control.pk_hex()], until, limit: Some(FOLLOW_PAGE), evidence: crate::community::transport::Evidence::Full, ..Default::default() };
            let wraps = transport.fetch(&query, &community.relays).await?;
            let mut fresh = 0usize;
            for w in &wraps {
                if !seen_wraps.insert(w.id) { continue; }
                fresh += 1;
                let at = w.created_at.as_secs();
                if oldest.is_none_or(|o| at < o) { oldest = Some(at); }
                if let Ok(parsed) = current_control.open(w) {
                    opened.push(parsed);
                }
            }
            if fresh == 0 {
                truncated = wraps.len() >= FOLLOW_PAGE;
                break;
            }
            until = oldest;
            if page + 1 == COMPACT_MAX_PAGES { truncated = true; }
        }
        if truncated {
            return Err(
                "The community's control plane is too deep to read in full right now; re-founding stopped so no member is left behind.".to_string(),
            );
        }

        let prev_epoch = community.root_epoch; // 0
        let new_epoch = Epoch(1);
        let prev_commit = super::derive::epoch_key_commitment(prev_epoch, &community.community_root);
        let new_root = mint_or_reuse_rotation_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, new_epoch.0)?;
        // The split's pair, minted beside the root exactly as in `refound_community`.
        let new_control_root = mint_or_reuse_rotation_key(&cid_hex, crate::community::CONTROL_ROOT_SCOPE, new_epoch.0)?;
        let new_control_pk = super::derive::control_signer_group_key(&new_control_root, cid, new_epoch).pk();
        let new_control = control::split_write_group(&new_control_root, &new_root, cid, new_epoch);
        let at = now_ms();
        let at_secs = at / 1000;

        use std::collections::BTreeMap;
        let mut by_eid: BTreeMap<String, Vec<usize>> = BTreeMap::new();
        for (i, (e, _)) in opened.iter().enumerate() {
            by_eid.entry(crate::simd::hex::bytes_to_hex_32(&e.entity_id)).or_default().push(i);
        }
        let mut carried: Vec<(FoldedHead, Event)> = Vec::new();
        for (floor_key, floor) in &floors {
            let head_idx = by_eid.get(floor_key).and_then(|v| v.iter().copied().find(|&i| opened[i].0.self_hash == floor.1));
            let Some(head_idx) = head_idx else {
                return Err(format!("birth refound aborted: committed head of entity {floor_key} (v{}) not served; no state published", floor.0));
            };
            let (head_ed, head_os) = &opened[head_idx];
            let h = FoldedHead { entity_hex: floor_key.clone(), version: head_ed.version, self_hash: head_ed.self_hash, inner_id: head_ed.inner_id };
            let (rewrapped, _) = super::stream::rewrap_seal(&head_os.seal, &new_control, Timestamp::from_secs(at_secs)).map_err(|e| e.to_string())?;
            carried.push((h, rewrapped));
        }

        // Base rekey: the epoch-1 root to the OWNER ONLY (members key up via the
        // carrier's `m`). The owner is staff by definition — the 136-byte form.
        let base_blobs = vec![
            super::rekey::build_base_blob(&signer, &my_pk.to_bytes(), &my_pk, new_epoch, &new_root, &new_control_pk.to_bytes(), Some(&new_control_root))
                .await
                .map_err(|e| e.to_string())?,
        ];
        let base_group = super::derive::base_rekey_group_key(&community.community_root, cid, new_epoch);
        let base_chunks =
            super::rekey::build_rekey_chunks(&signer, my_pk, &base_group, super::rekey::RekeyScope::Root, new_epoch, prev_epoch, &prev_commit, &base_blobs, at_secs, my_authority_citation(community, &my_pk).as_ref(), false)
                .await
                .map_err(|e| e.to_string())?;

        // COMMIT to the wire: base rekey (owner's new root), then the compacted control.
        for c in &base_chunks {
            transport.publish_durable(c, &community.relays).await?;
        }
        for (_, wrap) in &carried {
            transport.publish_durable(wrap, &community.relays).await?;
        }
        // The Guestbook SNAPSHOT — the WHOLE POINT of the birth refound, so publish it DURABLY
        // and FAIL the refound if any chunk doesn't land. Unlike `refound_community` (where
        // live members heal via their own Join if a chunk drops), a seeded-never-landed member
        // CANNOT heal — omitted → absent from `memberlist()` → excluded from every future rotation
        // → permanently stranded. So the snapshot is load-bearing, not best-effort. The publishes
        // precede the local commit, so a `?`-abort leaves epoch 0 and a retry re-runs idempotently
        // (mint_or_reuse gives the same epoch-1 root; snapshot chunks coalesce commutatively).
        let gb_group = super::derive::guestbook_group_key(&new_root, cid, new_epoch);
        let snap_id = crate::community::random_32();
        let snapshot_wraps: Vec<Event> = {
            let mut out = Vec::new();
            for rumor in guestbook::build_snapshot_rumors(my_pk, snapshot_members, snap_id, at) {
                let (wrap, _) = guestbook::seal_guestbook_rumor_signed(&signer, my_pk, &rumor, &gb_group, Timestamp::from_secs(at_secs))
                    .await
                    .map_err(|e| format!("seal birth snapshot: {e}"))?;
                out.push(wrap);
            }
            out
        };
        for wrap in &snapshot_wraps {
            transport.publish_durable(wrap, &community.relays).await?;
        }
        // Verify-back (design §4 Phase 1.5): fetch the snapshot at the new epoch and confirm every
        // seeded member folds, before we commit locally. A relay that ACKed a durable publish but
        // won't serve it back (or a partial landing) aborts here with ZERO local state — the retry
        // re-publishes. A seed that is (legitimately) in the folded banlist is EXPECTED to be
        // absent from the memberlist (`memberlist` subtracts the banlist, so requiring a
        // banned seed to "fold" would wedge the retry forever) — so subtract the wire-folded
        // banlist from the expected set. The real caller never seeds a banned member, but the
        // arbitrary-`snapshot_members` API must not be able to wedge on one.
        let verify_view = {
            let mut v = community.clone();
            v.community_root = new_root;
            v.root_epoch = new_epoch;
            v.control_pk = Some(new_control_pk);
            v.control_root = Some(new_control_root);
            v
        };
        let expected: Vec<PublicKey> = {
            let banlist = fetch_authority(transport, &verify_view).await.banned;
            snapshot_members.iter().copied()
                .filter(|m| *m != my_pk && !banlist.contains(&m.to_hex()))
                .collect()
        };
        if !expected.is_empty() {
            let folded = memberlist(transport, &verify_view).await.unwrap_or_default();
            let missing = expected.iter().filter(|m| !folded.contains(m)).count();
            if missing > 0 {
                return Err(format!("birth snapshot verify-back: {missing} seeded member(s) not readable from relays; not committing"));
            }
        }

        // COMMIT locally, only now that the new root + compacted plane + snapshot are on relays.
        if crate::db::community::community_protocol(cid)?.is_none() {
            return Ok(community.clone());
        }
        let mut updated = community.clone();
        updated.community_root = new_root;
        updated.root_epoch = new_epoch;
        updated.control_pk = Some(new_control_pk);
        updated.control_root = Some(new_control_root);
        crate::db::community::save_community_v2(&updated)?;
        crate::db::community::advance_server_root_epoch(&cid_hex, new_epoch.0, &new_root)?;
        for (h, _) in &carried {
            crate::db::community::set_edition_head_at_epoch(&cid_hex, &h.entity_hex, h.version, &h.self_hash, &h.inner_id, new_epoch.0)?;
        }
        Ok(updated)
    })
    .await
}

/// Mint a fresh 32-byte rotation key for `(scope, new_epoch)`, or REUSE the one
/// already archived from a prior (aborted) attempt — so a retried Refounding re-
/// delivers the SAME key at the same epoch/address instead of double-minting two roots
/// a receiver's correlation dedup would collapse into a permanent fork (CORD-06 §3
/// idempotency). Archived BEFORE the first publish; `scope` is the all-zero server-root
/// sentinel for a base rotation, else the channel_id hex.
fn mint_or_reuse_rotation_key(community_id_hex: &str, scope_hex: &str, new_epoch: u64) -> Result<[u8; 32], String> {
    if let Some(existing) = crate::db::community::held_epoch_key(community_id_hex, scope_hex, new_epoch)? {
        return Ok(existing);
    }
    let fresh = crate::community::random_32();
    crate::db::community::store_epoch_key(community_id_hex, scope_hex, new_epoch, &fresh)?;
    Ok(fresh)
}

// ── The Community List (kind 33302, CORD-02 §8) ──────────────────────────────

/// This community's MEMBERSHIP subset for the Community List (CORD-02 §8): never the
/// icon (a rehydrating device folds it from the Control Plane), never the link
/// fields. Only PRIVATE channel keys ride — public channels derive from the root.
fn join_material(community: &CommunityV2) -> super::list::JoinMaterial {
    let hex = crate::simd::hex::bytes_to_hex_32;
    let channels = community
        .channels
        .iter()
        .filter(|c| c.private)
        // Keyed channels ONLY. A keyless entry is readable by this build but is
        // rejected outright by shipped ones (their `key` is a required String),
        // so emitting one would strand every older client on a stale list.
        .filter_map(|c| {
            c.key.map(|k| super::list::ChannelKeyRef { id: hex(&c.id.0), key: Some(hex(&k)), epoch: c.epoch.0, name: c.name.clone(), extra: Default::default() })
        })
        .collect();
    super::list::JoinMaterial {
        community_id: hex(&community.identity.community_id.0),
        owner: hex(&community.identity.owner_xonly),
        owner_salt: hex(&community.identity.owner_salt),
        community_root: hex(&community.community_root),
        root_epoch: community.root_epoch.0,
        control_pk: community.control_pk.map(|p| p.to_hex()),
        // The list carries every private key its holder has (CORD-02 §8) — a
        // staffer's own devices must be able to write. Same trust class as the
        // community_root beside it: NIP-44-encrypted to self.
        control_root: community.control_root.map(|r| hex(&r)),
        channels,
        relays: community.relays.clone(),
        name: community.name.clone(),
        extra: Default::default(),
    }
}

/// Rebuild an invite bundle from list join material, for a cross-device rehydrate
/// (the material IS the membership subset of a bundle). The owner root is still
/// verified over the network before the community is trusted (accept_bundle).
fn material_to_invite(jm: &super::list::JoinMaterial) -> CommunityInvite {
    // A keyless listing records that the channel EXISTS, not a grant — there is
    // nothing to seat, and it keys up when access is granted.
    let channels = jm
        .channels
        .iter()
        .filter_map(|c| {
            c.key.as_ref().map(|k| invite::ChannelGrant { id: c.id.clone(), key: k.clone(), epoch: c.epoch, name: c.name.clone() })
        })
        .collect();
    CommunityInvite {
        community_id: jm.community_id.clone(),
        owner: jm.owner.clone(),
        owner_salt: jm.owner_salt.clone(),
        community_root: jm.community_root.clone(),
        root_epoch: jm.root_epoch,
        control_pk: jm.control_pk.clone(),
        channels,
        relays: jm.relays.clone(),
        name: jm.name.clone(),
        icon: None,
        expires_at: None,
        creator_npub: None,
        label: None,
        extra: Default::default(),
    }
}

/// The account's OWN relays — where an account-level list belongs. Published to a
/// community's relays instead, the list stops being readable the moment that
/// community is left, which is exactly when its tombstone has to be found.
/// Empty without a client (tests), where the caller falls back to the held set.
async fn own_list_relays() -> Vec<String> {
    let Some(client) = crate::state::nostr_client() else { return Vec::new() };
    client
        .relays()
        .await
        .iter()
        .filter(|(_, r)| r.capabilities().load().can_write())
        .map(|(url, _)| url.to_string())
        .collect()
}

/// Read the list from everywhere a copy could be: our own relays, the stock CORD
/// set (where it lands when ours refuse the kind), and the held communities'
/// (where every list published before the move still lives). Missing one of these
/// reads a stale copy and republishes it over a newer tombstone.
async fn list_read_relays(extra: &[String]) -> Vec<String> {
    let mut set = own_list_relays().await;
    set.extend(invite::stock_relays());
    set.extend(held_v2_relays());
    set.extend(extra.iter().cloned());
    set.sort();
    set.dedup();
    set
}

/// What a fragment fetch found: the unioned list, and each index's `created_at`
/// so the next write to that fragment can exceed it.
pub struct FragSet {
    pub list: super::list::CommunityList,
    pub created_at: std::collections::BTreeMap<usize, u64>,
    /// `frags` as declared by the newest fragment seen.
    pub declared: usize,
    /// The winning parsed fragment per index — what the relays currently hold,
    /// so a rewrite can skip publishing byte-identical fragments.
    pub read_frags: std::collections::BTreeMap<usize, super::list_frag::FragList>,
}

impl FragSet {
    /// Coverage, not agreement: we hold every index below `declared`, whatever
    /// their individual ages. A short read is read-only, never a write.
    pub fn is_complete(&self) -> bool {
        (0..self.declared).all(|i| self.created_at.contains_key(&i))
    }
}

/// Fetch the account's 33302 fragments and union them. Newest wins PER INDEX —
/// each fragment is its own addressable coordinate, so they age independently.
async fn fetch_fragments<T: Transport + ?Sized>(transport: &T, relays: &[String]) -> Result<Option<FragSet>, String> {
    let signer = crate::signer::active_signer()?;
    let my_pk = me_pk()?;
    let query = Query {
        kinds: vec![super::kind::COMMUNITY_LIST_FRAG],
        authors: vec![my_pk.to_hex()],
        limit: Some(64),
        ..Default::default()
    };
    let events = transport.fetch(&query, relays).await?;
    if events.is_empty() {
        return Ok(None);
    }
    let mut newest: std::collections::BTreeMap<usize, (u64, [u8; 32], super::list_frag::FragList)> = Default::default();
    let mut undecryptable = 0usize;
    for e in events {
        let at = e.created_at.as_secs();
        let id = *e.id.as_bytes();
        match super::list_frag::parse_fragment_event(&signer, my_pk, &e).await {
            Ok((index, frag)) => {
                // Mirror relay resolution (CORD-02 §8): newest created_at holds the
                // coordinate, an age tie falls to the LOWEST event id.
                let wins = match newest.get(&index) {
                    None => true,
                    Some((prev_at, prev_id, _)) => at > *prev_at || (at == *prev_at && id < *prev_id),
                };
                if wins {
                    newest.insert(index, (at, id, frag));
                }
            }
            Err(_) => undecryptable += 1,
        }
    }
    if newest.is_empty() {
        crate::log_warn!("[CommunityList] {} fragment(s) fetched, none readable — treating as no news", undecryptable);
        return Ok(None);
    }
    // The newest fragment governs `frags`; an age tie resolves to the LARGER count
    // (CORD-02 §8) — too large reads an index that turns out empty, too small sends
    // live fragments out of range and dormant.
    let declared = newest
        .values()
        .max_by_key(|(at, _, f)| (*at, f.frags))
        .map(|(_, _, f)| f.frags)
        .unwrap_or(1)
        .max(1);
    let read_frags: std::collections::BTreeMap<usize, super::list_frag::FragList> =
        newest.iter().map(|(i, (_, _, f))| (*i, f.clone())).collect();
    let frags: Vec<_> = read_frags.values().cloned().collect();
    let set = FragSet {
        list: super::list_frag::defragment(&frags),
        created_at: newest.iter().map(|(i, (at, _, _))| (*i, *at)).collect(),
        declared,
        read_frags,
    };
    if !set.is_complete() {
        crate::log_warn!(
            "[CommunityList] INCOMPLETE: hold {} of {} fragment(s) — reading, refusing to write",
            set.created_at.len(),
            declared
        );
    }
    Ok(Some(set))
}

/// Publish a list as fragments. Each fragment's `created_at` must exceed that
/// fragment's own previous value — relays resolve an addressable event on
/// `created_at` alone and break a tie on the lowest event id, so a same-second
/// rewrite can silently discard the newer content.
async fn publish_fragments<T: Transport + ?Sized>(
    transport: &T,
    list: &super::list::CommunityList,
    prev: &std::collections::BTreeMap<usize, u64>,
    read: &std::collections::BTreeMap<usize, super::list_frag::FragList>,
    own: &[String],
) -> Result<usize, String> {
    let signer = crate::signer::active_signer()?;
    let my_pk = me_pk()?;
    let frags = super::list_frag::fragment(list);
    let now = now_ms() / 1000;
    // A fragment serializing to the bytes we just read is already on the relay:
    // republishing it only churns created_at — and hands a same-second sibling
    // write a lowest-id coin-flip it didn't need to enter.
    let unchanged = |index: usize, frag: &super::list_frag::FragList| -> bool {
        let Some(old) = read.get(&index) else { return false };
        matches!(
            (serde_json::to_string(old), serde_json::to_string(frag)),
            (Ok(a), Ok(b)) if a == b
        )
    };
    // Persisted, not level-gated: a List write that silently never lands is the failure
    // mode this whole format exists to end, and it is only ever diagnosed after the fact.
    crate::log_net_info!(
        "[CommunityList] publishing {} fragment(s): {} live entries ({} retired), {} tombstones",
        frags.len(),
        frags.iter().map(|f| f.entries.len()).sum::<usize>(),
        list.entries.len() - frags.iter().map(|f| f.entries.len()).sum::<usize>(),
        frags.iter().map(|f| f.tombstones.len()).sum::<usize>(),
    );
    let mut skipped = 0usize;
    for (index, frag) in frags.iter().enumerate() {
        if unchanged(index, frag) {
            skipped += 1;
            continue;
        }
        let created_at = now.max(prev.get(&index).copied().unwrap_or(0) + 1);
        let event = super::list_frag::build_fragment_event(&signer, my_pk, frag, index, created_at).await?;
        publish_list_event(transport, &event, own).await?;
    }
    // A shrunk set leaves the fragments above it in place; empty them so a later
    // growth into that index cannot re-read stale memberships.
    for index in frags.len()..prev.len() {
        let empty = super::list_frag::FragList {
            frags: frags.len(),
            entries: vec![],
            tombstones: vec![],
            extra: Default::default(),
        };
        if unchanged(index, &empty) {
            skipped += 1;
            continue;
        }
        let created_at = now.max(prev.get(&index).copied().unwrap_or(0) + 1);
        let event = super::list_frag::build_fragment_event(&signer, my_pk, &empty, index, created_at).await?;
        publish_list_event(transport, &event, own).await?;
    }
    if skipped > 0 {
        crate::log_net_info!("[CommunityList] {} fragment(s) skipped — byte-identical to the relay copy", skipped);
    }
    Ok(frags.len())
}

/// Publish an account-level list, falling back to the stock CORD relays when our
/// own reject it — 33302 is a custom kind, and a relay with a kind whitelist drops
/// it silently. The list is the vault: it has to land somewhere every client reads.
async fn publish_list_event<T: Transport + ?Sized>(transport: &T, event: &Event, own: &[String]) -> Result<(), String> {
    if !own.is_empty() {
        match transport.publish(event, own).await {
            Ok(()) => return Ok(()),
            Err(e) => crate::log_warn!("[CommunityList] own relays refused the list ({}) — falling back to the stock set", e),
        }
    }
    transport.publish(event, &invite::stock_relays()).await
}

/// The union of every held v2 community's relays — a fallback write target, and
/// where every list published before the move to our own relays still lives.
fn held_v2_relays() -> Vec<String> {
    let mut set: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
    if let Ok(ids) = crate::db::community::list_community_ids() {
        for id in ids {
            if matches!(crate::db::community::community_protocol(&id), Ok(Some(crate::community::ConcordProtocol::V2))) {
                if let Ok(Some(c)) = crate::db::community::load_community_v2(&id) {
                    set.extend(c.relays);
                }
            }
        }
    }
    set.into_iter().collect()
}

/// Rebuild this account's Community List from its held v2 communities, MERGE with the remote
/// copy (preserving tombstones, other-device entries, unknown fields), and publish.
/// `just_joined` is the community THIS call is recording a create/join for — the
/// ONLY community whose entry is (re)stamped `now`, so it beats any prior tombstone
/// (a deliberate re-join resurrects). Every OTHER held community that the remote
/// has tombstoned is left tombstoned (a sibling device's leave is NOT undone just
/// because we joined something else — the W1 resurrection hole). Idempotent;
/// best-effort — a list-publish failure never fails the membership change itself.
/// Returns `Ok(true)` when the list was PUBLISHED, `Ok(false)` when the attempt was
/// skipped without failing the caller (a failed remote fetch — see below). Callers that
/// need the membership to actually land use [`republish_community_list_durable`].
pub async fn republish_community_list<T: Transport + ?Sized>(transport: &T, just_joined: Option<&crate::community::CommunityId>) -> Result<bool, String> {
    crate::db::scoped(async move {
        let held = held_v2_relays();
        if held.is_empty() {
            return Ok(false); // nothing held → nothing to sync
        }
        let relays = list_read_relays(&[]).await;
        let own = own_list_relays().await;
        // Written to our own relays, read from both: the copy has to outlive any
        // one membership. Falls back to the held set when we have no relays of
        // our own to write to.
        let write_relays = if own.is_empty() { held.clone() } else { own };
        // A FAILED remote fetch must not drive this replaceable-event write: publishing
        // a list built without the remote seeds would drop older-epoch backfill anchors
        // and re-stamp add-times (the W2 seed-regression + a resurrection window).
        let (remote, prev_created, read_frags) = match fetch_fragments(transport, &relays).await {
            // No fragments yet: this is the first write under §8, and local state
            // is the source. Nothing to merge, nothing to lose.
            Ok(None) => (super::list::CommunityList::default(), Default::default(), Default::default()),
            Ok(Some(set)) if !set.is_complete() => {
                crate::log_net_fail!(
                    "[CommunityList] republish SKIPPED — hold {} of {} fragments; rewriting a set we haven't fully read would drop the memberships in the ones we're missing",
                    set.created_at.len(),
                    set.declared
                );
                return Ok(false);
            }
            Ok(Some(set)) => (set.list, set.created_at, set.read_frags),
            Err(e) => {
                // SILENT-SKIP HAZARD: bailing is correct (publishing a list built without the
                // remote seeds drops backfill anchors), but the membership this call was meant
                // to record is now simply unrecorded. A join that lands here leaves a community
                // held locally with no list entry — and if it also carries an older tombstone,
                // nothing ever out-ranks it again. Say so loudly; `Ok(())` keeps it non-fatal.
                crate::log_warn!(
                    "[CommunityList] republish SKIPPED (remote fetch failed: {}){}",
                    e,
                    just_joined
                        .map(|c| format!(" — the join of {} is NOT recorded across devices", &crate::simd::hex::bytes_to_hex_32(&c.0)[..8]))
                        .unwrap_or_default()
                );
                return Ok(false);
            }
        };
        let just_joined_hex = just_joined.map(|c| crate::simd::hex::bytes_to_hex_32(&c.0));
        let now = now_ms();
        let mut local = super::list::CommunityList::default();
        for id in crate::db::community::list_community_ids()? {
            if !matches!(crate::db::community::community_protocol(&id), Ok(Some(crate::community::ConcordProtocol::V2))) {
                continue;
            }
            let Some(c) = crate::db::community::load_community_v2(&id)? else { continue };
            let cid_hex = crate::simd::hex::bytes_to_hex_32(&c.id().0);
            let is_join = just_joined_hex.as_deref() == Some(cid_hex.as_str());
            // A held community the remote has tombstoned (a sibling device left it) that
            // we are NOT currently (re)joining stays LEFT — don't re-add it, or joining a
            // different community would silently undo the leave everywhere.
            //
            // UNLESS our hold POST-DATES the removal. A rejoin whose membership never
            // reached the list (this publish is best-effort — a failed remote fetch
            // silently skips it) leaves a tombstone with no entry, and nothing can ever
            // out-rank it again: every boot the list sync reads "removed", tears the
            // community down, the rejoin re-adds it, and it loops forever. Our own hold
            // is first-hand evidence of membership, so let it settle the tie by the same
            // add-vs-remove rule the list already uses everywhere else.
            let tombstoned_at = remote
                .tombstones
                .iter()
                .find(|t| t.community_id == cid_hex)
                .map(|t| t.removed_at)
                .unwrap_or(0);
            let held_since = c.created_at_ms;
            if !is_join && !remote.is_live(&cid_hex) && tombstoned_at > 0 && held_since <= tombstoned_at {
                crate::log_warn!(
                    "[CommunityList] holding {} but NOT recording it: a tombstone at {} post-dates our hold ({}) — treated as a leave from another device",
                    &cid_hex[..8], tombstoned_at, held_since
                );
                continue;
            }
            // Keep an already-live entry's add time (no churn); the joined community (or a
            // genuinely-new one) stamps `now` so a re-join beats a stale tombstone. A hold
            // that outlived a tombstone re-asserts itself at its own join time, which is
            // already newer than the removal.
            let added_at = if remote.is_live(&cid_hex) && !is_join {
                remote.entries.iter().find(|e| e.community_id == cid_hex).map(|e| e.added_at).unwrap_or(now)
            } else if !is_join && tombstoned_at > 0 {
                held_since
            } else {
                now
            };
            let jm = join_material(&c);
            local.entries.push(super::list::CommunityListEntry { community_id: cid_hex, seed: jm.clone(), current: jm, added_at, extra: Default::default() });
        }
        let merged = remote.merge(&local);
        // No whole-list cap: fragmentation is what keeps each event publishable,
        // and the count limit is gone (CORD-02 §8).
        match publish_fragments(transport, &merged, &prev_created, &read_frags, &write_relays).await {
            Ok(_) => {}
            Err(e) => {
                crate::log_net_fail!("[CommunityList] publish FAILED ({}) — memberships stay local-only until the next edit", e);
                return Err(e);
            }
        }
        Ok(true)
    })
    .await
}

/// Retry budget for [`republish_community_list_durable`]. An unrecorded membership is
/// invisible to the user and self-heals only on their NEXT join, so ride out a relay
/// blip rather than a single shot. Bounded: a permanently dead relay set gives up
/// instead of spinning.
const LIST_REPUBLISH_BACKOFF_SECS: [u64; 6] = [2, 5, 15, 45, 120, 300];

/// Record a membership across devices DURABLY: retry in the background until the list
/// actually lands.
///
/// [`republish_community_list`] must never fail a join, and it deliberately publishes
/// NOTHING when the remote fetch fails (a list built without the remote seeds would drop
/// other devices' entries). One shot at that means a relay blip during a join leaves the
/// membership unrecorded until the user happens to join something else — and if a stale
/// tombstone out-ranks it, the community is stranded until a manual leave+rejoin.
///
/// Non-blocking. Skipped entirely without a live client (headless/unit tests drive the
/// generic fn directly). Bound to its account, so a swap mid-backoff leaves it
/// publishing A's list from A's client rather than from B's.
pub fn republish_community_list_durable(just_joined: Option<crate::community::CommunityId>) {
    if crate::state::nostr_client().is_none() {
        return;
    }
    crate::db::spawn_bound(async move {
        for (attempt, wait) in LIST_REPUBLISH_BACKOFF_SECS.iter().enumerate() {
            let transport = crate::community::transport::LiveTransport::with_timeout(std::time::Duration::from_secs(12));
            match republish_community_list(&transport, just_joined.as_ref()).await {
                Ok(true) => {
                    if attempt > 0 {
                        crate::log_info!("[CommunityList] membership recorded on retry #{}", attempt);
                    }
                    return;
                }
                Ok(false) => {} // skipped (remote fetch failed) — already logged; retry
                Err(e) => crate::log_warn!("[CommunityList] republish attempt #{} failed: {}", attempt, e),
            }
            crate::rt::time::sleep(std::time::Duration::from_secs(*wait)).await;
        }
        crate::log_warn!(
            "[CommunityList] gave up recording membership after {} attempts — it will re-record on the next join/leave",
            LIST_REPUBLISH_BACKOFF_SECS.len()
        );
    });
}

/// Record a permanent leave tombstone for `community_id` in the List. Written to
/// our OWN relays: the departing community's are about to stop being read at all,
/// so a tombstone left only there is one no later sync can ever fetch — the
/// community then rejoins itself from a stale copy on the next boot.
async fn tombstone_community_list<T: Transport + ?Sized>(
    transport: &T,
    community_id: &crate::community::CommunityId,
    relays: &[String],
    removed_at: u64,
) -> Result<(), String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community_id.0);
    let read_relays = list_read_relays(relays).await;
    let own = own_list_relays().await;
    let write_relays = if own.is_empty() { relays.to_vec() } else { own };
    // A failed fetch here would drop other communities' entries (only the
    // tombstone would survive); preserve them by bailing — the leave re-records
    // on the next attempt, and the local teardown already happened.
    let (mut doc, prev_created, read_frags) = match fetch_fragments(transport, &read_relays).await {
        Ok(Some(set)) if !set.is_complete() => {
            return Err(format!("hold {} of {} fragments — refusing to rewrite a set we haven't fully read", set.created_at.len(), set.declared));
        }
        Ok(Some(set)) => (set.list, set.created_at, set.read_frags),
        Ok(None) => (super::list::CommunityList::default(), Default::default(), Default::default()),
        Err(e) => return Err(e),
    };
    doc.tombstones.retain(|t| t.community_id != cid_hex);
    doc.tombstones.push(super::list::Tombstone { community_id: cid_hex, removed_at, extra: Default::default() });
    // No size gate on the way out: a tombstone strictly shrinks the live set, and
    // a guard that blocks the only operation able to restore compliance is a
    // deadlock, not a guard (CORD-02 §8).
    publish_fragments(transport, &doc, &prev_created, &read_frags, &write_relays).await.map(|_| ())
}

/// Retry a leave tombstone until it lands, on the same budget a join gets. A leave
/// that fails to record is the worse of the two: the local hold is already gone, so
/// this device shows the community left while every other one still holds it, and
/// nothing re-records it until some unrelated edit happens to carry it.
///
/// `removed_at` is the caller's, not `now` — re-stamping it here would let a retry
/// that fires after a genuine rejoin bury that rejoin.
pub fn tombstone_community_list_durable(community_id: crate::community::CommunityId, relays: Vec<String>, removed_at: u64) {
    if crate::state::nostr_client().is_none() {
        return;
    }
    crate::db::spawn_bound(async move {
        for (attempt, wait) in LIST_REPUBLISH_BACKOFF_SECS.iter().enumerate() {
            crate::rt::time::sleep(std::time::Duration::from_secs(*wait)).await;
            let transport = crate::community::transport::LiveTransport::with_timeout(std::time::Duration::from_secs(12));
            match tombstone_community_list(&transport, &community_id, &relays, removed_at).await {
                Ok(()) => {
                    crate::log_net_info!(
                        "[CommunityList] leave tombstone for {} landed on retry #{}",
                        &crate::simd::hex::bytes_to_hex_32(&community_id.0)[..8],
                        attempt + 1
                    );
                    return;
                }
                Err(e) => crate::log_warn!("[CommunityList] leave tombstone retry #{} failed: {}", attempt + 1, e),
            }
        }
        crate::log_net_fail!(
            "[CommunityList] leave tombstone for {} NEVER landed after {} attempts — it will come back on another device",
            &crate::simd::hex::bytes_to_hex_32(&community_id.0)[..8],
            LIST_REPUBLISH_BACKOFF_SECS.len()
        );
    });
}

/// Sync memberships from the Community List across devices: fetch this account's list from
/// `bootstrap_relays` (its held communities' relays plus any caller-supplied set for
/// a fresh device), and JOIN every live entry not already held — reconstructing the
/// community from its join material and re-verifying the owner root. Returns the
/// newly-rehydrated communities (so the caller can subscribe + notify).
/// What one Community-List sync changed locally.
pub struct ListSyncOutcome {
    /// Communities newly adopted from the list (already persisted + chat-registered).
    pub joined: Vec<CommunityV2>,
    /// Communities a sibling device LEFT, as `(community_id_hex, channel_id_hexes)`.
    ///
    /// The rows are already gone here, so the ids are captured BEFORE deletion: the caller
    /// still has to finish the local teardown (chat rows, STATE, the live subscription),
    /// and it can't look them up afterwards. Deleting the community while leaving its chat
    /// row behind is what produces a ghost "0 Members" room pointing at nothing.
    pub removed: Vec<(String, Vec<String>)>,
}

/// Marks that this account has written the fragmented list at least once.
const LIST_SEEDED_KEY: &str = "community_list_frag_seeded";

/// The join refusal for a VERIFIED dissolution — an owner-signed, identity-bound
/// tombstone (§9: no un-dissolve). A sentinel because the accept boundary matches
/// on it: this is the one join failure that is a verdict rather than a maybe, so
/// the parked invite is retired instead of kept for a retry that can never succeed.
pub const ERR_DISSOLVED: &str = "this community has been dissolved";

/// Retire a parked invite whose community is provably dead: drop the local row and
/// tombstone the §8 List so every sibling device purges its copy on the next sync.
/// ONLY for the dissolved verdict — ambiguous could-not-verify failures stay parked.
pub async fn retire_dead_invite<T: Transport + ?Sized>(transport: &T, community_id_hex: &str, relays: &[String]) {
    let _ = crate::db::community::delete_pending_invite(community_id_hex);
    if let Some(cid) = crate::simd::hex::hex_to_bytes_32_checked(community_id_hex) {
        let id = crate::community::CommunityId(cid);
        let at = now_ms();
        if tombstone_community_list(transport, &id, relays, at).await.is_err() {
            // The row is already gone locally; make sure the suppression still
            // reaches sibling devices once the relays cooperate.
            tombstone_community_list_durable(id, relays.to_vec(), at);
        }
    }
    crate::emit_event("community_invites_purged", &serde_json::json!({}));
}

/// Every relay answered EOSE with zero fragments — the only reading of "empty"
/// strong enough to seed over. The aggregate fetch that precedes this cannot
/// distinguish "no fragments" from "the relay holding them never answered";
/// asked one at a time, an error is a FAILED read and a failed read never seeds.
async fn confirmed_no_fragments<T: Transport + ?Sized>(transport: &T, relays: &[String]) -> bool {
    let Ok(my_pk) = me_pk() else { return false };
    if relays.is_empty() {
        return false;
    }
    let query = Query {
        kinds: vec![super::kind::COMMUNITY_LIST_FRAG],
        authors: vec![my_pk.to_hex()],
        limit: Some(1),
        ..Default::default()
    };
    for relay in relays {
        match transport.fetch(&query, std::slice::from_ref(relay)).await {
            Ok(events) if events.is_empty() => {}
            // Found one (the aggregate read raced a sibling's write) or the relay
            // didn't answer — either way this account is not confirmed empty.
            _ => return false,
        }
    }
    true
}

/// First write of the §8 List for an account that has none: an account upgrading
/// from the retired single-event list arrives here with memberships that exist
/// only in local state, and nothing else in the stack publishes without a
/// membership change to record. Latched once it lands, so a boot-load read that
/// comes back empty can never republish local state over a sibling's tombstones.
async fn seed_community_list<T: Transport + ?Sized>(transport: &T) {
    if crate::db::settings::get_sql_setting(LIST_SEEDED_KEY.to_string()).ok().flatten().is_some() {
        return;
    }
    if held_v2_relays().is_empty() {
        return;
    }
    // Seeding over a read that merely FAILED publishes fragment 0 over a sibling
    // device's tombstones at a fresh created_at — confirm the emptiness per relay.
    let own = own_list_relays().await;
    let confirm = if own.is_empty() { held_v2_relays() } else { own };
    if !confirmed_no_fragments(transport, &confirm).await {
        crate::log_warn!("[CommunityList] seed DEFERRED — the empty read is unconfirmed; retrying on a later boot");
        return;
    }
    crate::log_net_info!("[CommunityList] no fragments held anywhere (confirmed per relay) — seeding from local state");
    match republish_community_list(transport, None).await {
        Ok(true) => {
            let _ = crate::db::settings::set_sql_setting(LIST_SEEDED_KEY.to_string(), "1".to_string());
        }
        Ok(false) => {}
        Err(e) => crate::log_net_fail!("[CommunityList] seed failed: {e}"),
    }
}

pub async fn sync_community_list<T: Transport + ?Sized>(transport: &T, bootstrap_relays: &[String]) -> Result<ListSyncOutcome, String> {
    crate::db::scoped(async move {
        let relays = list_read_relays(bootstrap_relays).await;
        if relays.is_empty() {
            return Ok(ListSyncOutcome { joined: vec![], removed: vec![] });
        }
        // A cross-device sync that finds nothing is indistinguishable from one that
        // never ran, so every exit says why — this path is only ever debugged after
        // the fact, from a user's log.
        let list = match fetch_fragments(transport, &relays).await {
            Ok(Some(set)) => {
                crate::log_net_info!(
                    "[CommunityList] fetched: {} of {} fragment(s), {} entries, {} tombstones, across {} relays",
                    set.created_at.len(),
                    set.declared,
                    set.list.entries.len(),
                    set.list.tombstones.len(),
                    relays.len()
                );
                set.list
            }
            Ok(None) => {
                // Transient by nature: boot runs many concurrent passes and a relay that
                // times out under that load returns nothing. Only persistent absence
                // matters, and that shows up as "adopted nothing" anyway.
                crate::log_debug!("[CommunityList] no fragments across {} relays", relays.len());
                seed_community_list(transport).await;
                return Ok(ListSyncOutcome { joined: vec![], removed: vec![] });
            }
            Err(e) => {
                crate::log_net_fail!("[CommunityList] fetch failed across {} relays: {e}", relays.len());
                return Ok(ListSyncOutcome { joined: vec![], removed: vec![] });
            }
        };
        // Receive-side teardown (the counterpart to the republish tombstone guard):
        // a community this device still holds but the synced list shows TOMBSTONED (a
        // sibling device left it) and NOT live gets torn down here, so a leave on one
        // device propagates to the others. A re-join would have re-added it live
        // (beating the tombstone), so is_live short-circuits the honest case.
        let mut removed: Vec<(String, Vec<String>)> = Vec::new();
        for t in &list.tombstones {
            if list.is_live(&t.community_id) {
                continue;
            }
            let Some(cid) = crate::simd::hex::hex_to_bytes_32_checked(&t.community_id) else { continue };
            let id = crate::community::CommunityId(cid);
            let Some(held) = crate::db::community::load_community_v2(&id).ok().flatten() else {
                continue; // not held — nothing to tear down
            };
            // `is_live` above assumes a rejoin re-added an entry, but recording that entry is
            // best-effort: a relay blip at join time leaves the tombstone unopposed forever, and
            // this would then delete the community on every sync. So let the LOCAL hold break the
            // tie too — a hold created after the removal IS the rejoin, whether or not its entry
            // ever reached the list. Same rule the v1 sweep uses.
            if held.created_at_ms > t.removed_at {
                crate::log_warn!(
                    "[CommunityList] {} is tombstoned at {} but our hold ({}) post-dates it — treating as a rejoin, not tearing down",
                    &t.community_id[..8], t.removed_at, held.created_at_ms
                );
                continue;
            }
            let channel_ids: Vec<String> = held.channels.iter().map(|c| crate::simd::hex::bytes_to_hex_32(&c.id.0)).collect();
            let _ = crate::db::community::delete_community(&t.community_id);
            removed.push((t.community_id.clone(), channel_ids));
        }
        // A tombstone also retires any PARKED invite it post-dates — a decline or a
        // dissolution-retire made on another device. Supersession, not a bare id
        // match: only a removal NEWER than the invite's arrival is a verdict on it;
        // an older tombstone is a past leave the re-invite already superseded
        // (received_at is seconds, removed_at is ms).
        let mut invites_purged = 0usize;
        for t in &list.tombstones {
            if list.is_live(&t.community_id) {
                continue;
            }
            let Ok(Some(received_at)) = crate::db::community::pending_invite_received_at(&t.community_id) else { continue };
            if (received_at.max(0) as u64).saturating_mul(1000) <= t.removed_at
                && crate::db::community::delete_pending_invite(&t.community_id).is_ok()
            {
                invites_purged += 1;
            }
        }
        if invites_purged > 0 {
            crate::emit_event("community_invites_purged", &serde_json::json!({}));
        }
        let mut joined = Vec::new();
        for entry in list.live_entries() {
            let Some(cid) = crate::simd::hex::hex_to_bytes_32_checked(&entry.community_id) else { continue };
            // Held under ANY protocol, not just v2. A protocol-scoped check re-adopts an
            // id we already hold as v1: verification correctly fails (there is no v2
            // community at that coordinate), and the entry is retried on EVERY sync pass
            // forever — a permanent warning flood plus a wasted multi-relay walk each time.
            if crate::db::community::community_exists(&crate::community::CommunityId(cid)).unwrap_or(false) {
                continue; // already held
            }
            // The material IS a bundle; accept_bundle re-verifies the owner root, saves,
            // and seeds floors. NO Guestbook Join: this device is receiving keys the
            // account already holds elsewhere — the membership was announced when it
            // actually joined, and a key sync is not a membership event.
            let bundle = material_to_invite(&entry.current);
            match accept_bundle(transport, &bundle, None, false).await {
                Ok(community) => {
                    // The staff write secret never rides a bundle shape — adopt it
                    // from the list entry directly, and only when it derives to the
                    // control_pk held for exactly this epoch (CORD-02 §5/§8). A
                    // stale secret fails closed to read-only; a 136-byte base blob
                    // or the Grant's control_wrap re-delivers on the walk forward.
                    if let (Some(pk), Some(root_hex)) = (community.control_pk, entry.current.control_root.as_deref()) {
                        if let Some(root) = crate::simd::hex::hex_to_bytes_32_checked(root_hex) {
                            if super::derive::control_signer_group_key(&root, community.id(), community.root_epoch).pk() == pk

                            {
                                let mut held = community.clone();
                                held.control_root = Some(root);
                                let _ = crate::db::community::save_community_v2(&held);
                            }
                        }
                    }
                    joined.push(community);
                }
                // A listed-but-unadoptable entry is the failure mode that reads as
                // "cross-device sync is broken": the community never appears and any
                // parked invite for it is never retired.
                Err(e) => crate::log_net_fail!(
                    "[CommunityList] {} is listed but adoption failed: {e}",
                    &entry.community_id[..entry.community_id.len().min(8)]
                ),
            }
        }
        Ok(ListSyncOutcome { joined, removed })
    })
    .await
}

// ── Control edition authoring (CORD-04 roles / CORD-02 §6 / CORD-03 §2) ──────

/// Publish one control edition (a role, grant, banlist, community-metadata, or
/// channel-metadata edit) at the next version for its entity, chaining `prev` from
/// our held head, and advance our local floor. Authority is enforced by every
/// reader's roster fold (CORD-04 §5: authority is rejection, not prevention), so this
/// requires only a valid local signer; a well-behaved client checks its own rank
/// first, but a reader drops an unauthorized edition regardless.
/// This actor's authority citation for a control edition (CORD-04 §5): the head
/// of their OWN Grant entity, pinned by coordinate + version + edition hash.
///
/// A SYNC FLOOR, not a verdict — a verifier refuses to act until it has synced
/// at least this Grant, then resolves rank against its CURRENT roster, so a
/// demoted admin is never grandfathered by an old-but-once-valid citation.
///
/// `None` for the owner (supreme, rank comes from the community id) and `None`
/// when no Grant head is held — an actor who cannot cite has no rank to claim,
/// and the edition is dropped by a conforming reader either way.
/// The verify half of [`my_authority_citation`] (CORD-04 §5): does the actor's
/// cited Grant prove authority we have actually SYNCED? The owner is supreme and
/// cites nothing. A non-owner MUST cite, and we must hold that Grant at ≥ the
/// cited version with the cited hash at the tip — else fail closed, because
/// honoring an action whose authority we can't confirm is exactly how a demoted
/// moderator keeps moderating.
///
/// Completeness only: the permission + outrank is the separate roster check, so a
/// since-demoted actor is refused there (refuse-superseded). An action citing a
/// version we haven't synced parks and is re-judged on the next roster sync — the
/// sync path can't escalate to a blocking fetch.
pub(super) fn citation_is_synced(
    cid_hex: &str,
    owner_hex: &str,
    actor_hex: &str,
    citation: Option<&crate::community::edition::AuthorityCitation>,
) -> bool {
    if owner_hex == actor_hex {
        return true;
    }
    if citation.is_none() {
        return false;
    }
    let cid_bytes = crate::simd::hex::hex_to_bytes_32(cid_hex);
    let actor_bytes = crate::simd::hex::hex_to_bytes_32(actor_hex);
    let grant_hex = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(
        &crate::community::CommunityId(cid_bytes),
        &actor_bytes,
    ));
    let head: Vec<crate::community::roster::EntityHead> =
        crate::db::community::get_edition_head(cid_hex, &grant_hex)
            .ok()
            .flatten()
            .map(|(version, self_hash)| crate::community::roster::EntityHead {
                entity_hex: grant_hex.clone(),
                version,
                self_hash,
                inner_id: [0u8; 32],
                citation: None,
            })
            .into_iter()
            .collect();
    crate::community::roster::authority_citation_satisfied(&head, Some(owner_hex), actor_hex, &grant_hex, citation)
}

/// [`my_authority_citation`], but refusing to emit an action every reader will
/// drop (CORD-04 §5: an uncited non-owner action is not honored).
///
/// The citation is built from PERSISTED heads, which only `follow_control` writes
/// — so an admin who hasn't folded yet (just promoted, or freshly restored) would
/// otherwise publish uncited and have the action silently vanish on every client,
/// with nothing shown locally. Failing here turns that into one retryable error.
fn required_authority_citation(
    community: &CommunityV2,
    actor: &PublicKey,
) -> Result<Option<crate::community::edition::AuthorityCitation>, String> {
    if community.owner().ok().as_ref() == Some(actor) {
        return Ok(None); // supreme, cites nothing
    }
    my_authority_citation(community, actor).map(Some).ok_or_else(|| {
        "your admin rights aren't synced on this device yet — reopen the community and retry".to_string()
    })
}

fn my_authority_citation(
    community: &CommunityV2,
    actor: &PublicKey,
) -> Option<crate::community::edition::AuthorityCitation> {
    if community.owner().ok().as_ref() == Some(actor) {
        return None;
    }
    let entity_id = super::derive::grant_locator(community.id(), &actor.to_bytes());
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let entity_hex = crate::simd::hex::bytes_to_hex_32(&entity_id);
    crate::db::community::get_edition_head(&cid_hex, &entity_hex)
        .ok()
        .flatten()
        .map(|(version, edition_hash)| crate::community::edition::AuthorityCitation { entity_id, version, edition_hash })
}

/// Refuse a root-derived write whose in-hand struct predates a rotation.
///
/// A Ban's refound buries the old root while the caller's `CommunityV2` still
/// points at it; publishing there lands on a plane nobody folds — the action
/// "succeeds" and silently never happened (an unban that doesn't unban, an
/// invite that strands its joiner on a dead epoch). Failing loudly instead lets
/// the caller reload and retry against the living root.
fn assert_current_root(community: &CommunityV2) -> Result<(), String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    match crate::db::community::get_server_root_epoch(&cid_hex)? {
        Some(held) if held != community.root_epoch.0 => Err(format!(
            "the community re-founded mid-action (epoch {} -> {held}); retry",
            community.root_epoch.0
        )),
        _ => Ok(()), // no row = a not-yet-persisted create; nothing newer to defer to
    }
}

async fn publish_control_edition<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    vsk: &str,
    entity_id: &[u8; 32],
    content: &str,
) -> Result<(), String> {
    crate::db::scoped(async move {
        assert_current_root(community)?;
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        // On a split epoch the signing secret is the staff-held control_root
        // (CORD-02 §2) — a member without it fails HERE with a readable error
        // instead of minting a wrap every reader and relay drops.
        let view = control::ControlPlane::of(community);
        let control = view.write_group()?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let entity_hex = crate::simd::hex::bytes_to_hex_32(entity_id);
        let (version, prev) = match crate::db::community::get_edition_head(&cid_hex, &entity_hex)? {
            Some((v, h)) => (v + 1, Some(h)),
            None => (1, None),
        };
        // CORD-04 §5: a non-owner names the exact Grant edition it claims its rank
        // under. Computed here rather than passed in — the citation is a property of
        // WHO IS ACTING, identical for every entity kind, so deciding it per call
        // site is nine chances to forget (and nine were, silently: every site passed
        // None). The owner cites nothing; their rank is the community id itself.
        let citation = required_authority_citation(community, &my_pk)?;
        let at = now_ms() / 1000;
        let rumor = control::build_edition_rumor(my_pk, vsk, entity_id, version, prev.as_ref(), content, at, citation.as_ref());
        let (wrap, _) = control::seal_control_edition_signed(&signer, my_pk, &rumor, &control, Timestamp::from_secs(at)).await.map_err(|e| e.to_string())?;
        transport.publish(&wrap, &community.relays).await?;
        // Advance our own floor so a follow-up edit chains from this head and refuse-
        // downgrade holds; open our own wrap to recover the self_hash + inner_id.
        // Re-check the session AFTER the publish await: a swap mid-publish means the
        // pool now points at another account's DB — skipping is safe (the next own
        // edit rebuilds the same head from the relay's copy).
        if let Ok((ed, _)) = control::open_control_edition(&wrap, &control) {
            crate::db::community::set_edition_head_at_epoch(&cid_hex, &entity_hex, ed.version, &ed.self_hash, &ed.inner_id, community.root_epoch.0)?;
        }
        Ok(())
    })
    .await
}

/// Merge our OWN just-published Role/Grant into the locally stored roster.
///
/// v2 persists the roster only inside `follow_control`, so a role or grant we
/// just published is invisible to every sync local read (entitlement, capability
/// gates, the next grant) until the next fold. This writes what we are already
/// authorized to have written; the next fold recomputes from the plane and
/// converges. Mirrors the fold's own write, so the stored `roles_at` is left
/// alone — a real edition always outranks this optimistic merge.
fn merge_local_roster(cid_hex: &str, role: Option<&crate::community::roles::Role>, grant: Option<&crate::community::roles::MemberGrant>) {
    let mut roster = crate::db::community::get_community_roles(cid_hex).unwrap_or_default();
    if let Some(r) = role {
        match roster.roles.iter_mut().find(|x| x.role_id == r.role_id) {
            Some(slot) => *slot = r.clone(),
            None => roster.roles.push(r.clone()),
        }
    }
    if let Some(g) = grant {
        match roster.grants.iter_mut().find(|x| x.member == g.member) {
            Some(slot) => *slot = g.clone(),
            None => roster.grants.push(g.clone()),
        }
    }
    let at = crate::db::community::get_community_roles_at(cid_hex).unwrap_or(0);
    if let Err(e) = crate::db::community::set_community_roles(cid_hex, &roster, at) {
        crate::log_warn!("v2: local roster merge failed (heals on the next control fold): {e}");
    }
}

/// Create or edit a Role (vsk 1, CORD-04 §2). `role.role_id` is the coordinate; a
/// rename or permission change is a versioned edit of the same id. Gated on the
/// reader side by `MANAGE_ROLES` + outrank.
pub async fn set_role<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, role: &crate::community::roles::Role) -> Result<(), String> {
    super::roles::validate_role(role)?;
    let content = super::roles::role_content_json(role)?;
    let role_id = crate::simd::hex::hex_to_bytes_32_checked(&role.role_id).ok_or("role_id must be 32-byte hex")?;
    publish_control_edition(transport, community, vsk::ROLE, &role_id, &content).await
}

/// Grant or revoke a member's Roles (vsk 3, CORD-04 §2). Empty `role_ids` is a
/// revoke. Gated on the reader side by `MANAGE_ROLES` + outrank of every role + the
/// member. Staff-ness (whether the Grant must deliver the `control_root`,
/// CORD-04 §3) is judged from the persisted roster; internal callers holding a
/// fresher fetched view use [`grant_roles_with_roster`].
pub async fn grant_roles<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, member: &PublicKey, role_ids: Vec<String>) -> Result<(), String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    // A role this device hasn't folded is unjudgeable for staff-ness, and
    // guessing "not staff" publishes a staff-making Grant with NO control_wrap
    // — seating a staffer who cannot write, silently (CORD-04 §3 makes the wrap
    // mandatory on such a Grant). Resolve it from the network first; only the
    // definitions still missing after that fall back to the local view.
    // Internal callers already holding a fetched roster use
    // `grant_roles_with_roster` and skip this round trip.
    let roster = if community.control_pk.is_some() && role_ids.iter().any(|rid| roster.role(rid).is_none()) {
        let mut fetched = fetch_authority(transport, community).await.roles;
        for r in roster.roles {
            if !fetched.roles.iter().any(|x| x.role_id == r.role_id) {
                fetched.roles.push(r);
            }
        }
        fetched
    } else {
        roster
    };
    grant_roles_with_roster(transport, community, member, role_ids, &roster).await
}

/// The `control_wrap` a Grant carries when its role set leaves `member` staff
/// (CORD-04 §3): the current epoch's `control_root`, NIP-44-encrypted under
/// the granter↔member pairwise key, `epoch_be[8] ‖ control_root[32]` inside.
/// `None` when nothing is owed — a legacy pre-split epoch, or a grant that
/// leaves the member non-staff. Attached on EVERY staff-leaving grant, not
/// just the first: a re-issue with a fresh wrap is the spec's own re-delivery
/// path (a lost key, a head superseded before its member fetched it), and the
/// marginal cost is one ECDH.
///
/// Errs when a wrap is owed but this granter cannot mint one: a staff-making
/// edition MUST carry a wrap fresh for the current epoch — publishing without
/// it would seat a staffer who cannot write, silently. (The publish itself
/// would fail on the same missing secret, but the promotion must never outrun
/// the delivery.)
async fn control_wrap_owed(community: &CommunityV2, makes_staff: bool, member: &PublicKey) -> Result<Option<String>, String> {
    if !makes_staff {
        return Ok(None);
    }
    let Some(pk) = community.control_pk else {
        return Ok(None); // legacy epoch — the plane has no write key to deliver
    };
    let Some(cr) = community.control_root else {
        return Err("you don't hold this community's staff write key, so you can't promote to staff yet".to_string());
    };
    // Never deliver a secret that doesn't derive to the held address — the
    // recipient's fail-closed check would drop it anyway (CORD-04 §3).
    if super::derive::control_signer_group_key(&cr, community.id(), community.root_epoch).pk() != pk {
        return Err("this community's held staff write key is corrupt; re-sync before promoting".to_string());
    }
    use nostr_sdk::prelude::AsyncNip44;
    let signer = crate::signer::active_signer()?;
    let wrap = signer
        .nip44_encrypt_async(member, &super::rekey::control_wrap_b64(community.root_epoch, &cr))
        .await
        .map_err(|e| format!("staff key delivery: {e}"))?;
    Ok(Some(wrap))
}

/// [`grant_roles`] judging staff-ness against a caller-supplied roster — the
/// freshest view the caller holds (a fetched authority merge, or one carrying
/// a role minted moments ago that no fold has read back).
async fn grant_roles_with_roster<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    member: &PublicKey,
    role_ids: Vec<String>,
    roster: &crate::community::roles::CommunityRoles,
) -> Result<(), String> {
    // A grant that leaves the member staff carries the staff write key in the
    // edition itself (CORD-04 §3) — promotion and delivery are one signed
    // edition: nothing separate to send, race, or watch an inbox for.
    let control_wrap = control_wrap_owed(community, roster.roles_make_staff(&role_ids), member).await?;
    let grant = crate::community::roles::MemberGrant { member: member.to_hex(), role_ids };
    let content = super::roles::grant_content_json_with_wrap(&grant, control_wrap)?;
    let eid = super::derive::grant_locator(community.id(), &member.to_bytes());
    publish_control_edition(transport, community, vsk::GRANT, &eid, &content).await
}

/// The community's @admin role id: the folded Server-scope ADMIN_ALL role when one
/// exists, else (with `create_if_missing`) a DETERMINISTIC mint — the same id on
/// every device, so concurrent grants converge as editions of ONE entity instead
/// of forking two Admin roles.
pub async fn ensure_admin_role<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    view: &AuthorityView,
    create_if_missing: bool,
) -> Result<Option<String>, String> {
    use crate::community::roles::{Permissions, Role, RoleScope};
    // The finder tests the FROZEN founding mask, never ADMIN_ALL: published
    // Admin roles predate later bits (PIN_MESSAGES...), and requiring a bit
    // they can't have would orphan every one of them and mint a duplicate.
    if let Some(r) = view
        .roles
        .roles
        .iter()
        .find(|r| matches!(r.scope, RoleScope::Server) && r.permissions.contains(Permissions::ADMIN_FOUNDING_MASK))
    {
        return Ok(Some(r.role_id.clone()));
    }
    if !create_if_missing {
        return Ok(None);
    }
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let role_id = crate::crypto::sha256_hex(format!("vector/v2/role/admin/{cid_hex}").as_bytes());
    set_role(transport, community, &Role::admin(role_id.clone())).await?;
    Ok(Some(role_id))
}

/// Grant the @admin role (minting it deterministically when absent), MERGED into
/// the member's existing grant — a grant entity replaces whole (CORD-04 §2), so a
/// blind push would erase their other roles. Owner-only: the position-1 Admin is
/// manageable only by position 0 (an equal never outranks it), and refusing
/// before any publish keeps an unauthorized edition of the DETERMINISTIC admin
/// entity from advancing this device's own floor onto a head readers reject.
pub async fn grant_admin<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, member: &PublicKey) -> Result<(), String> {
    crate::db::scoped(async move {
        // Guard spans the multi-page fetch below: a swap mid-fetch must not let the
        // downstream publish's own (post-swap) guard write account A's floor into B.
        let my_pk = me_pk()?;
        if my_pk != community.owner()? {
            return Err("only the community owner can grant @admin".to_string());
        }
        let view = fetch_authority(transport, community).await;
        let member_hex = member.to_hex();
        require_grant_head(community, &view, &member_hex)?;
        let role_id = ensure_admin_role(transport, community, &view, true)
            .await?
            .expect("create_if_missing yields an id");
        let mut role_ids = view
            .roles
            .grants
            .iter()
            .find(|g| g.member == member_hex)
            .map(|g| g.role_ids.clone())
            .unwrap_or_default();
        if role_ids.contains(&role_id) {
            return Ok(()); // already admin — don't bump the grant edition for nothing.
        }
        role_ids.push(role_id.clone());
        // Judge staff-ness against a roster that HOLDS the admin definition: a
        // just-minted role hasn't folded into the fetched view yet, and missing it
        // would seat an admin without the write key (CORD-04 §3).
        let mut roster = view.roles.clone();
        if roster.role(&role_id).is_none() {
            roster.roles.push(crate::community::roles::Role::admin(role_id));
        }
        grant_roles_with_roster(transport, community, member, role_ids, &roster).await
    })
    .await
}

/// Strip the @admin role from the member's grant, preserving their other roles.
/// A no-op when they don't hold it. Owner-only, like [`grant_admin`].
pub async fn revoke_admin<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, member: &PublicKey) -> Result<(), String> {
    crate::db::scoped(async move {
        let my_pk = me_pk()?;
        if my_pk != community.owner()? {
            return Err("only the community owner can revoke @admin".to_string());
        }
        let view = fetch_authority(transport, community).await;
        let member_hex = member.to_hex();
        require_grant_head(community, &view, &member_hex)?;
        let Some(role_id) = ensure_admin_role(transport, community, &view, false).await? else {
            return Ok(()); // no admin role exists — nothing to revoke.
        };
        let mut role_ids = view
            .roles
            .grants
            .iter()
            .find(|g| g.member == member_hex)
            .map(|g| g.role_ids.clone())
            .unwrap_or_default();
        let before = role_ids.len();
        role_ids.retain(|r| r != &role_id);
        if role_ids.len() == before {
            return Ok(());
        }
        // A demotion can still leave the member staff through a KEPT role — the
        // fetched view holds every kept definition, so judge against it.
        grant_roles_with_roster(transport, community, member, role_ids, &view.roles).await
    })
    .await
}

// ── Role authoring (CORD-04 §2/§3) ──────────────────────────────────────────
//
// Every check below is the rule a READER applies, run before publishing so this
// device never signs an edition the fold drops. That matters beyond wasted work:
// editions are version-chained, and a dropped head still advances the author's own
// floor onto a state nobody honours.

/// Who is authoring a role change, and from what standing.
struct RoleAuthor {
    me_hex: String,
    owner_hex: String,
    is_owner: bool,
    /// The owner is 0; otherwise the highest (lowest-numbered) role position held.
    rank: u32,
    /// Bits this author may put on a role: everything for the owner, else their own.
    grantable: u64,
}

impl RoleAuthor {
    /// Strictly above `position`: equal never acts on equal (CORD-04 §3).
    fn outranks(&self, position: u32) -> bool {
        self.is_owner || self.rank < position
    }
    /// A role may gain only bits its author holds. Bits it already has may stay:
    /// someone lacking BAN can still rename a role that bans.
    fn may_add(&self, from: u64, to: u64) -> bool {
        self.is_owner || (to & !from) & !self.grantable == 0
    }
}

fn role_author(community: &CommunityV2, view: &AuthorityView) -> Result<RoleAuthor, String> {
    use crate::community::roles::Permissions;
    let me = me_pk()?;
    let owner = community.owner()?;
    let (me_hex, owner_hex) = (me.to_hex(), owner.to_hex());
    let is_owner = me == owner;
    if !is_owner {
        if view.banned.contains(&me_hex) {
            return Err("you are banned from this community".to_string());
        }
        if !view.roles.is_authorized(&me_hex, Some(&owner_hex), Permissions::MANAGE_ROLES) {
            return Err("managing roles needs the Manage Roles permission".to_string());
        }
    }
    let rank = if is_owner { 0 } else { view.roles.highest_position(&me_hex).unwrap_or(u32::MAX) };
    let grantable = if is_owner { u64::MAX } else { view.roles.effective_permissions(&me_hex).0 };
    Ok(RoleAuthor { me_hex, owner_hex, is_owner, rank, grantable })
}

/// A role's current head must be in hand before replacing it, or this edition could
/// chain from a stale version and lose to (or fork from) the one the relays hold.
fn require_role_head(view: &AuthorityView, role_id: &str) -> Result<(), String> {
    let eid = role_id.to_ascii_lowercase();
    if view.floored.contains(&eid) && !view.head_entities.contains(&eid) {
        return Err("this role's current state could not be fetched; try again once relays serve the control plane".to_string());
    }
    Ok(())
}

/// Mint a Role beneath everything that exists, including its author: a new role
/// starts at the bottom, as in Discord, and no role may sit at or above its minter.
/// Returns the new `role_id`.
pub async fn create_role<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    name: &str,
    color: u32,
    permissions: u64,
    scope: crate::community::roles::RoleScope,
) -> Result<String, String> {
    crate::db::scoped(async move {
        use crate::community::roles::{Permissions, Role};
        let view = fetch_authority(transport, community).await;
        let author = role_author(community, &view)?;
        if view.roles.roles.len() >= super::roles::MAX_ROLES_PER_COMMUNITY {
            return Err(format!("a community holds at most {} roles", super::roles::MAX_ROLES_PER_COMMUNITY));
        }
        if !author.may_add(0, permissions) {
            return Err("you can't give a role permissions you don't hold".to_string());
        }
        let name = name.trim();
        if name.is_empty() {
            return Err("a role needs a name".to_string());
        }
        // Channel access roles are parked at the bottom band on purpose (see
        // `channel_access_role`), so a new role lands just above that band rather than
        // in the one slot left beneath it, where the next would saturate into a peer.
        let floor = view
            .roles
            .roles
            .iter()
            .map(|r| r.position)
            .filter(|p| *p < ACCESS_ROLE_POSITION)
            .max()
            .unwrap_or(0)
            .max(author.rank);
        if floor.saturating_add(1) >= ACCESS_ROLE_POSITION {
            return Err("there's no room beneath your role for a new one; reorder the roles first".to_string());
        }
        let role = Role {
            role_id: crate::simd::hex::bytes_to_hex_32(&super::super::random_32()),
            name: name.to_string(),
            position: floor.saturating_add(1),
            permissions: Permissions(permissions),
            scope,
            color,
            extra: Default::default(),
        };
        set_role(transport, community, &role).await?;
        Ok(role.role_id)
    })
    .await
}

/// Edit a Role's name, colour and permissions, keeping its position, its scope and
/// every field another client wrote. Both CORD-04 §3 gates hold: the author outranks the
/// role as it stands, and the edition claims nothing at or above them.
pub async fn edit_role<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    role_id: &str,
    name: &str,
    color: u32,
    permissions: u64,
    scope: crate::community::roles::RoleScope,
) -> Result<(), String> {
    crate::db::scoped(async move {
        use crate::community::roles::Permissions;
        let view = fetch_authority(transport, community).await;
        let author = role_author(community, &view)?;
        let current = view.roles.role(role_id).cloned().ok_or("no such role")?;
        require_role_head(&view, role_id)?;
        if !author.outranks(current.position) {
            return Err("you can only edit roles beneath your own".to_string());
        }
        if !author.may_add(current.permissions.0, permissions) {
            return Err("you can't give a role permissions you don't hold".to_string());
        }
        let name = name.trim();
        if name.is_empty() {
            return Err("a role needs a name".to_string());
        }
        // A scope is a channel's access list: moving it would re-entitle every holder at
        // once, and keys follow grants, not role edits. It is fixed at creation.
        if scope != current.scope {
            return Err("a role's channel can't be changed once it's created".to_string());
        }
        let mut next = current.clone();
        next.name = name.to_string();
        next.color = color;
        next.permissions = Permissions(permissions);
        if next == current {
            return Ok(());
        }
        set_role(transport, community, &next).await
    })
    .await
}

/// Reorder the roles beneath the author, top to bottom as `ordered` lists them.
///
/// Positions are the whole of CORD-04's ordering (no RoleOrder entity), so a reorder
/// republishes each role whose position moves, and nothing else. The author's own
/// rank and everything above it stay put: the moved set is renumbered from just
/// beneath them, which also resolves any ties into one definite order. Returns how
/// many roles were republished.
pub async fn reorder_roles<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    ordered: &[String],
) -> Result<usize, String> {
    crate::db::scoped(async move {
        let view = fetch_authority(transport, community).await;
        let author = role_author(community, &view)?;
        let mut movable: Vec<crate::community::roles::Role> = view
            .roles
            .roles
            .iter()
            .filter(|r| author.outranks(r.position))
            .cloned()
            .collect();
        // The requested order first; anything it omits keeps its current relative place.
        movable.sort_by(|a, b| a.position.cmp(&b.position).then_with(|| a.role_id.cmp(&b.role_id)));
        let rank_of = |id: &str| ordered.iter().position(|o| o.eq_ignore_ascii_case(id));
        let mut keyed: Vec<(usize, usize, crate::community::roles::Role)> = movable
            .into_iter()
            .enumerate()
            .map(|(i, r)| (rank_of(&r.role_id).unwrap_or(usize::MAX), i, r))
            .collect();
        keyed.sort_by(|a, b| a.0.cmp(&b.0).then(a.1.cmp(&b.1)));
        let mut changed = Vec::new();
        for (i, (_, _, role)) in keyed.into_iter().enumerate() {
            let position = author.rank.saturating_add(1).saturating_add(i as u32);
            if role.position != position {
                require_role_head(&view, &role.role_id)?;
                let mut next = role;
                next.position = position;
                changed.push(next);
            }
        }
        for role in &changed {
            set_role(transport, community, role).await?;
        }
        Ok(changed.len())
    })
    .await
}

/// Set exactly which Roles `member` holds. A Grant replaces the member's whole set
/// (CORD-04 §2), so this is the one place a set is written: every change is judged
/// against the author's rank, and ids this device can't resolve ride through
/// untouched rather than being stripped by the device that knows least.
pub async fn set_member_roles<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    member: &PublicKey,
    role_ids: Vec<String>,
) -> Result<(), String> {
    crate::db::scoped(async move {
        use crate::community::roles::Permissions;
        let view = fetch_authority(transport, community).await;
        let author = role_author(community, &view)?;
        let member_hex = member.to_hex();
        if member_hex == author.owner_hex {
            return Err("the owner's standing isn't granted by roles".to_string());
        }
        require_grant_head(community, &view, &member_hex)?;
        if !author.is_owner && !view.roles.can_act_on_member(&author.me_hex, Some(&author.owner_hex), &member_hex, Permissions::MANAGE_ROLES) {
            return Err("you can only change the roles of members beneath you".to_string());
        }
        let current: Vec<String> = view
            .roles
            .grants
            .iter()
            .find(|g| g.member == member_hex)
            .map(|g| g.role_ids.clone())
            .unwrap_or_default();
        let mut next: Vec<String> = Vec::new();
        for id in role_ids.iter().map(|r| r.to_ascii_lowercase()) {
            if !next.contains(&id) {
                next.push(id);
            }
        }
        for id in next.iter().filter(|id| !current.contains(id)) {
            let role = view.roles.role(id).ok_or("no such role")?;
            if !author.outranks(role.position) {
                return Err(format!("you can't grant \"{}\": it isn't beneath your own role", role.name));
            }
        }
        let dropped: Vec<String> = current.iter().filter(|id| !next.contains(id)).cloned().collect();
        for id in dropped {
            // An unresolvable id can't be judged, so it can't be removed either.
            match view.roles.role(&id) {
                Some(role) if !author.outranks(role.position) => {
                    return Err(format!("you can't remove \"{}\": it isn't beneath your own role", role.name));
                }
                Some(_) => {}
                None => next.push(id),
            }
        }
        if next.len() > super::roles::MAX_ROLES_PER_MEMBER {
            return Err(format!("a member holds at most {} roles", super::roles::MAX_ROLES_PER_MEMBER));
        }
        let mut a = current.clone();
        let mut b = next.clone();
        a.sort();
        b.sort();
        if a == b {
            return Ok(());
        }
        grant_roles_with_roster(transport, community, member, next.clone(), &view.roles).await?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        merge_local_roster(&cid_hex, None, Some(&crate::community::roles::MemberGrant { member: member_hex.clone(), role_ids: next.clone() }));
        settle_channel_keys(transport, community, &view, member, &current, &next).await
    })
    .await
}

/// Move Private Channel keys to match a role change (CORD-03: a key is "delivered on
/// grant and rekeyed on removal"). A role scoped to a channel IS its access list, so
/// gaining one owes the member that channel's key, and losing the last one that
/// entitled them rotates the channel without them. Without this a Grant would move
/// entitlement while the keys stayed where they were.
async fn settle_channel_keys<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    view: &AuthorityView,
    member: &PublicKey,
    before: &[String],
    after: &[String],
) -> Result<(), String> {
    use crate::community::roles::RoleScope;
    let added: Vec<String> = after.iter().filter(|id| !before.contains(id)).cloned().collect();
    let removed: Vec<String> = before.iter().filter(|id| !after.contains(id)).cloned().collect();
    let owner_hex = community.owner()?.to_hex();
    let member_hex = member.to_hex();
    let channel_of = |id: &String| match view.roles.role(id).map(|r| &r.scope) {
        Some(RoleScope::Channel(c)) => Some(c.to_ascii_lowercase()),
        _ => None,
    };
    let held = |hex: &str| {
        crate::simd::hex::hex_to_bytes_32_checked(hex)
            .and_then(|b| community.channel(&ChannelId(b)).map(|c| (c.private, c.key.is_some(), ChannelId(b))))
    };

    // One Direct Invite carries every channel the new set entitles them to.
    if added.iter().filter_map(channel_of).any(|c| matches!(held(&c), Some((true, true, _)))) {
        let my_pk = me_pk()?;
        let bundle = bundle_of_with_overlay(community, BundleAudience::Member(*member), Some(my_pk), None, None, &added, &removed);
        let signer = crate::signer::active_signer()?;
        let wrap = invite::build_direct_invite_signed(&signer, my_pk, member, &bundle).await.map_err(|e| e.to_string())?;
        transport.publish(&wrap, &community.relays).await?;
    }

    let mut severed: Vec<String> = Vec::new();
    for chan in removed.iter().filter_map(channel_of) {
        if severed.contains(&chan) {
            continue;
        }
        severed.push(chan.clone());
        let Some((true, true, channel_id)) = held(&chan) else { continue };
        if view.roles.is_entitled(Some(&owner_hex), &member_hex, &chan, &added, &removed) {
            continue; // another role they keep still opens it
        }
        let access_ids = view.roles.channel_role_ids(&chan);
        rekey_channel_excluding(transport, community, &channel_id, &view.roles, &access_ids, std::slice::from_ref(member)).await?;
    }
    Ok(())
}

/// A grant replaces whole — refuse the merge when this member's grant is FLOORED
/// locally but no head folded (withheld / evicted): a blind push at that point
/// would erase their other roles at a higher version.
fn require_grant_head(community: &CommunityV2, view: &AuthorityView, member_hex: &str) -> Result<(), String> {
    let Some(member) = crate::simd::hex::hex_to_bytes_32_checked(member_hex) else {
        return Err("malformed member key".to_string());
    };
    let eid_hex = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(community.id(), &member));
    if view.floored.contains(&eid_hex) && !view.head_entities.contains(&eid_hex) {
        return Err("this member's current grant could not be fetched; try again once relays serve the control plane".to_string());
    }
    Ok(())
}

/// Replace the Banlist (vsk 4, CORD-04 §4) with `banned` (lowercase-hex npubs), the
/// whole list on every edit. Gated on the reader side by `BAN` per head plus strict
/// outrank per entry — mirrored here BEFORE the publish, so an unauthorized caller
/// (an SDK bot without the bit, a demoted moderator) fails loudly instead of
/// publishing an edition every reader silently rejects while its own local echo
/// caches the phantom ban.
pub async fn set_banlist<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, banned: &[String]) -> Result<(), String> {
    crate::db::scoped(async move {
        super::roles::validate_banlist(banned)?;
        {
            let my_pk = me_pk()?;
            let owner = community.owner()?;
            if my_pk != owner {
                let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
                let me_hex = my_pk.to_hex();
                let current = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
                if current.contains(&me_hex) {
                    return Err("you are banned from this community".to_string());
                }
                let roster = crate::db::community::get_community_roles(&cid_hex)?;
                let owner_hex = owner.to_hex();
                if !roster.is_authorized(&me_hex, Some(&owner_hex), crate::community::roles::Permissions::BAN) {
                    return Err("editing the banlist needs the BAN permission".to_string());
                }
                // Only the entries this edit ADDS need the per-target outrank (the fold
                // keeps prior authorized bans alive through its per-candidate history).
                for target in banned.iter().filter(|t| !current.contains(*t)) {
                    if !roster.can_act_on_member(&me_hex, Some(&owner_hex), target, crate::community::roles::Permissions::BAN) {
                        return Err("you do not outrank a member this ban targets".to_string());
                    }
                }
            }
        }
        let content = super::roles::banlist_content_json(banned)?;
        let eid = super::derive::banlist_locator(community.id());
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let entity_hex = crate::simd::hex::bytes_to_hex_32(&eid);
        // The version this publish will chain to — mirrors publish_control_edition.
        let version = match crate::db::community::get_edition_head(&cid_hex, &entity_hex)? {
            Some((v, _)) => v + 1,
            None => 1,
        };
        publish_control_edition(transport, community, vsk::BANLIST, &eid, &content).await?;
        // ECHO the published list into the local cache at once. Without this, the
        // cache only moves on a successful control-plane fold — and a caller
        // composing ban steps (banlist → grant strip → refound) re-reads the STALE
        // list if any later step trips before the fold, so each new banlist
        // edition it builds ERASES every ban since the last fold. Nineteen bans in
        // production each overwrote their predecessor exactly this way.
        let _ = crate::db::community::set_community_banlist(&cid_hex, banned, version as i64);
        Ok(())
    })
    .await
}

/// Per-community moderation-unit locks. Session-scoped: an account swap drops the
/// map with its session, so no cross-account carry-over and nothing to clear.
struct ModerationLocks;
fn moderation_lock(cid: &crate::community::CommunityId) -> std::sync::Arc<tokio::sync::Mutex<()>> {
    let map = crate::db::current_session()
        .scoped::<ModerationLocks, std::sync::Mutex<std::collections::HashMap<[u8; 32], std::sync::Arc<tokio::sync::Mutex<()>>>>>();
    let mut m = map.lock().unwrap_or_else(|e| e.into_inner());
    m.entry(cid.0).or_default().clone()
}

/// Fold control + guestbook so a moderation unit composes over the freshest view
/// another moderator may have advanced. Best-effort: on a dead network the local
/// cache (kept fresh by `set_banlist`'s own echo) is still the best basis.
async fn converge_authority<T: Transport + ?Sized>(transport: &T, id: &crate::community::CommunityId) {
    if let Ok(Some(fresh)) = crate::db::community::load_community_v2(id) {
        let _ = follow_control(transport, &fresh).await;
        // Membership is part of the converged view: a Join that legally raced a ban
        // window may exist only on the relays, and our own just-published edition
        // doesn't echo back to trigger a follow.
        if let Ok(added) = sync_guestbook(transport, &fresh).await {
            if !added.is_empty() {
                crate::traits::emit_event_json(
                    "community_refreshed",
                    serde_json::json!({ "community_id": crate::simd::hex::bytes_to_hex_32(&id.0) }),
                );
            }
        }
    }
}

/// One queued ban/unban intent, answered on `done` when its batch completes.
struct ModIntent {
    id: u64,
    targets: Vec<PublicKey>,
    banned: bool,
    done: tokio::sync::oneshot::Sender<Result<(), String>>,
}

/// Per-community pending moderation intents — the coalescing queue behind
/// [`moderation_lock`]. Session-scoped for the same reason as the lock.
struct PendingModeration;
fn pending_moderation(cid: &crate::community::CommunityId) -> std::sync::Arc<std::sync::Mutex<std::collections::HashMap<[u8; 32], Vec<ModIntent>>>> {
    let _ = cid;
    crate::db::current_session()
        .scoped::<PendingModeration, std::sync::Mutex<std::collections::HashMap<[u8; 32], Vec<ModIntent>>>>()
}

/// Ban or unban members as ONE moderation unit — the CORD-04 §6 three-removal
/// composition, once for the whole wave: one Banlist edition (instant silence),
/// one grant-strip pass (authority removal), and one read cut (a private
/// community re-founds ONCE with every target removed; a public one rotates each
/// reachable private channel ONCE excluding them all).
///
/// Serialized AND coalesced per community. Without the lock, concurrent bans
/// (the SDK spawns a handler task per message, so a spam wave is exactly this)
/// each build their edition from a pre-sibling banlist snapshot, and the fold
/// takes the HEAD's content — so the last racing head silently un-bans the
/// earlier target at every reader, and the refound then compacts that erasure
/// into the new epoch permanently.
///
/// The coalescing half: a unit's read cut holds the lock for a whole multi-
/// publish rotation, so serial single bans arriving meanwhile would each queue
/// up a rotation of their own. Instead every caller deposits an intent; whoever
/// next takes the lock drains ALL of them into one edition + one read cut,
/// applied in arrival order (ban-then-unban of one npub nets to unban). Each
/// intent is judged individually — a target the caller cannot outrank, or an
/// add past the 500-entry ceiling, fails only its own caller, never the batch.
pub async fn set_members_banned<T: Transport + ?Sized>(
    transport: &T,
    community_id: &crate::community::CommunityId,
    members: &[PublicKey],
    banned: bool,
) -> Result<(), String> {
    crate::db::scoped(async move {
        // Dedup — a doubled target must not strip or rotate twice.
        let mut targets: Vec<PublicKey> = Vec::with_capacity(members.len());
        for m in members {
            if !targets.contains(m) {
                targets.push(*m);
            }
        }
        if targets.is_empty() {
            return Ok(());
        }
        // Plain uniqueness source for intent ids — not per-account state.
        static INTENT_IDS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
        let my_id = INTENT_IDS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
        let (tx, rx) = tokio::sync::oneshot::channel();
        {
            let map = pending_moderation(community_id);
            let mut m = map.lock().unwrap_or_else(|e| e.into_inner());
            m.entry(community_id.0).or_default().push(ModIntent { id: my_id, targets, banned, done: tx });
        }
        let unit = moderation_lock(community_id);
        // `biased` so a verdict delivered by another leader wins over a lock we
        // happen to also hold — a drained intent must never run twice.
        tokio::select! {
            biased;
            res = rx => res.unwrap_or_else(|_| Err("moderation unit aborted before completing".to_string())),
            _guard = unit.lock() => {
                // Leader: drain EVERYTHING pending right now. Every ban/unban that
                // stacked while the previous unit's rotation ran coalesces here.
                let batch: Vec<ModIntent> = {
                    let map = pending_moderation(community_id);
                    let mut m = map.lock().unwrap_or_else(|e| e.into_inner());
                    m.remove(&community_id.0).unwrap_or_default()
                };
                run_moderation_batch(transport, community_id, batch, my_id).await
            }
        }
    })
    .await
}

/// Execute one drained batch of moderation intents under the held lock: judge
/// each intent in arrival order against the evolving list, publish the coalesced
/// edition, strip + read-cut the net newly-banned set once, then answer every
/// intent with its own verdict. Returns the LEADER's verdict.
async fn run_moderation_batch<T: Transport + ?Sized>(
    transport: &T,
    community_id: &crate::community::CommunityId,
    batch: Vec<ModIntent>,
    leader_id: u64,
) -> Result<(), String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community_id.0);

    // SYNC BEFORE COMPOSING: a banlist edition replaces the whole list on the
    // wire, so the mutation must start from the freshest view — another
    // moderator's ban this device hasn't folded yet would otherwise be
    // silently erased by ours.
    converge_authority(transport, community_id).await;

    let original = crate::db::community::get_community_banlist(&cid_hex)?;
    let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    let community0 = crate::db::community::load_community_v2(community_id)?
        .ok_or_else(|| "v2 community not found".to_string())?;
    let owner = community0.owner()?;
    let my_pk = me_pk()?;
    let my_hex = my_pk.to_hex();
    let owner_hex = owner.to_hex();

    // Judge intents in arrival order against the EVOLVING list, so the last
    // intent naming an npub wins — exactly serial semantics, minus the churn.
    let mut list = original.clone();
    let mut pk_of: std::collections::HashMap<String, PublicKey> = std::collections::HashMap::new();
    let mut verdicts: std::collections::HashMap<u64, Result<(), String>> = std::collections::HashMap::new();
    for intent in &batch {
        let hexes: Vec<String> = intent.targets.iter().map(|p| p.to_hex()).collect();
        for (pk, hex) in intent.targets.iter().zip(&hexes) {
            pk_of.insert(hex.clone(), *pk);
        }
        let verdict = (|| {
            // Mirror of set_banlist's authority gate, per intent, so one refused
            // intent cannot sink its batch-mates.
            if my_pk != owner {
                if original.contains(&my_hex) {
                    return Err("you are banned from this community".to_string());
                }
                if !roster.is_authorized(&my_hex, Some(&owner_hex), crate::community::roles::Permissions::BAN) {
                    return Err("editing the banlist needs the BAN permission".to_string());
                }
                if intent.banned {
                    for t in hexes.iter().filter(|t| !list.contains(*t)) {
                        if !roster.can_act_on_member(&my_hex, Some(&owner_hex), t, crate::community::roles::Permissions::BAN) {
                            return Err("you do not outrank a member this ban targets".to_string());
                        }
                    }
                }
            }
            let mut next = list.clone();
            next.retain(|h| !hexes.contains(h));
            if intent.banned {
                next.extend(hexes.iter().cloned());
            }
            super::roles::validate_banlist(&next)?;
            list = next;
            Ok(())
        })();
        verdicts.insert(intent.id, verdict);
    }

    let changed = {
        let mut a = original.clone();
        let mut b = list.clone();
        a.sort();
        b.sort();
        a != b
    };
    let newly_banned: Vec<PublicKey> = list
        .iter()
        .filter(|h| !original.contains(*h))
        .filter_map(|h| pk_of.get(h).copied())
        .collect();

    // Publish the coalesced edition + strips, then the single read cut.
    let unit_result: Result<(), String> = async {
        if !changed {
            return Ok(());
        }
        // Rotation barrier: a sibling refound holds this lock for its whole
        // multi-publish rotation while the row still names the OLD root. Dropped
        // before `refound_community`, which re-acquires it (non-reentrant).
        let (community, stripped) = {
            let lock = super::realtime::follow_lock(community_id);
            let _rotation = lock.lock().await;
            let community = crate::db::community::load_community_v2(community_id)?
                .ok_or_else(|| "v2 community not found".to_string())?;
            set_banlist(transport, &community, &list).await?;
            let mut stripped: Vec<(PublicKey, Vec<String>)> = Vec::new();
            // Pre-strip role capture: the read-severance below judges which
            // private channels each member could reach, and after the strip
            // the fold may no longer show it.
            for pk in &newly_banned {
                let hex = pk.to_hex();
                let roles: Vec<String> = roster.roles_of(&hex).map(|r| r.role_id.clone()).collect();
                // Nothing granted = nothing to strip: a bulk ban of roleless
                // spammers must not publish one empty Grant edition apiece.
                let has_grant = roster.grants.iter().any(|g| g.member == hex && !g.role_ids.is_empty());
                if has_grant {
                    // Strip on the kick doctrine (skip, not refuse): readers honor a
                    // grant strip only from MANAGE_ROLES + outrank, and a BAN-only
                    // moderator still bans — the banlist silences regardless, and
                    // publishing a strip readers reject would only poison our own
                    // floor for that grant entity.
                    let can_strip = my_pk == owner
                        || roster.can_act_on_member(&my_hex, Some(&owner_hex), &hex, crate::community::roles::Permissions::MANAGE_ROLES);
                    if can_strip {
                        grant_roles(transport, &community, pk, vec![]).await?;
                    } else {
                        crate::log_warn!("[Ban] grant strip skipped (no MANAGE_ROLES over the target); the banlist still silences");
                    }
                }
                stripped.push((*pk, roles));
            }
            (community, stripped)
        };
        if !newly_banned.is_empty() {
            // CORD-05 §5 gate: a PUBLIC community — any live invite link — must NOT
            // refound on ban. The link refresh re-posts the bundle with the new root
            // behind the same URL, so the banned member re-fetches and reads on: the
            // rotation severs nothing and can strand foreign-link joiners on a buried
            // epoch. The Banlist does all the real work in Public mode.
            if community_is_public(transport, &community).await {
                crate::log_info!("[Ban] public community — banlist + grant strip, no refound (CORD-05 §5)");
                // CORD-06 §1 still applies per channel: only rotation severs the
                // private-channel reads their held keys still allow.
                match sever_banned_private_reads(transport, &community, &stripped).await {
                    Ok(0) => {}
                    Ok(n) => crate::log_info!("[Ban] rotated {n} private channel(s) the banned member(s) could read"),
                    Err(e) => crate::log_warn!("[Ban] private-channel read severance incomplete: {e}"),
                }
            } else if let Err(e) = refound_community(transport, &community, &newly_banned).await {
                // Best-effort escalation, NEVER the ban's verdict. The banlist
                // edition (instant silence at every honest reader) and the grant
                // strip ARE the ban; the refound's §3 coverage gate demands the
                // relay serve back heads published milliseconds ago, so propagation
                // lag makes it fail-closed — and propagating that error out of here
                // once left every ban half-applied AND skipped the converge below,
                // so each next ban rebuilt from a stale list and erased its
                // predecessors.
                crate::log_warn!("[Ban] refound deferred (banlist + grant strip landed): {e}");
            }
        }
        Ok(())
    }
    .await;
    converge_authority(transport, community_id).await;

    // Answer every intent: its own judgment first, then the shared publish fate.
    let mut my_verdict = Err("leader intent missing from its own batch".to_string());
    for intent in batch {
        let final_verdict = verdicts
            .remove(&intent.id)
            .unwrap_or_else(|| Err("intent was never judged".to_string()))
            .and_then(|()| unit_result.clone());
        if intent.id == leader_id {
            my_verdict = final_verdict;
        } else {
            let _ = intent.done.send(final_verdict);
        }
    }
    my_verdict
}

// ── Raid containment (CORD-06 Severing Refounding) ──────────────────────────

/// What a containment actually accomplished. Every field is an honest count —
/// a caller (Sentinel, a moderation console) reports these to a human, so a
/// half-done containment must never read as a closed door.
#[derive(Debug, Clone, Default, serde::Serialize)]
pub struct ContainmentReport {
    /// Raiders added to the Banlist.
    pub banned: usize,
    /// Members cut for joining inside the raid window without being convicted.
    pub window_cut: usize,
    /// Root epoch before and after. Equal = the refound did NOT land.
    pub epoch_before: u64,
    pub epoch_after: u64,
    /// True only if the severing refound published.
    pub refound_ok: bool,
    /// My own public links revoked here. Other creators' links die as their
    /// clients adopt the severed rotation.
    pub own_links_revoked: usize,
    /// Creators whose links are still live pending their client's adoption.
    pub foreign_link_creators: Vec<String>,
    /// Non-fatal problems worth showing a human.
    pub warnings: Vec<String>,
}

/// Contain a raid: ban the raiders, cut everyone who walked in through the door
/// during the raid window, then perform a SEVERING Refounding — the rotation
/// that revokes the invite links instead of carrying them into the new epoch.
///
/// This is the raid lane, not a general ban. An ordinary ban (even in a Public
/// community) keeps its shipped behaviour — [`set_members_banned`] decides
/// internally, and a public one deliberately does NOT roll the root. Here the
/// door itself is the vector, so it closes with the rotation.
///
/// `window_start_secs` is the raid's opening edge: unconvicted members who
/// joined at-or-after it are cut from the new epoch (NOT banned — an innocent
/// caught in the window rejoins through the owner's next link). Members already
/// present before the window are never cut, however quiet.
pub async fn contain_raid<T: Transport + ?Sized>(
    transport: &T,
    community_id: &crate::community::CommunityId,
    raiders: &[PublicKey],
    window_start_secs: u64,
    cut_also: &[PublicKey],
) -> Result<ContainmentReport, String> {
    crate::db::scoped(async move {
        let mut report = ContainmentReport::default();
        let community = crate::db::community::load_community_v2(community_id)?
            .ok_or_else(|| "v2 community not found".to_string())?;
        report.epoch_before = community.root_epoch.0;
        report.epoch_after = community.root_epoch.0;
        let owner = community.owner()?;
        let my_pk = me_pk()?;

        // 1. Ban the convicted. Goes through the coalescer: the banlist edition is
        //    a read-modify-write, and a concurrent single ban would otherwise
        //    rebuild from a stale list and erase this one. A FAILED ban (most
        //    plausibly the 500-entry banlist ceiling under a mega-raid) must not
        //    abort the containment: the refound below cuts the raiders
        //    cryptographically whether or not the list could name them.
        if !raiders.is_empty() {
            match set_members_banned(transport, community_id, raiders, true).await {
                Ok(()) => report.banned = raiders.len(),
                Err(e) => report.warnings.push(format!("banlist did not land ({e}) — the refound still cuts every named raider")),
            }
        }

        // Re-read: the ban published a Banlist edition and stripped grants.
        let community = crate::db::community::load_community_v2(community_id)?
            .ok_or_else(|| "v2 community not found".to_string())?;

        // 2. The window cut. A raid arrives THROUGH the link, so everyone who
        //    walked in during it is part of the wave for containment purposes —
        //    conviction only ever names the ones who spoke. Never the owner, never
        //    staff, never anyone whose earliest trace predates the window.
        //
        //    `cut_also` first: Join timestamps are AUTHOR-claimed, so a quiet
        //    raider who backdated their Join slides under any window this fold
        //    can compute. A caller watching arrivals on its own clock (Sentinel's
        //    receive log) names them here and they are cut regardless.
        let mut cut: Vec<PublicKey> = raiders.to_vec();
        for pk in cut_also {
            if !cut.contains(pk) {
                cut.push(*pk);
                report.window_cut += 1;
            }
        }
        if window_start_secs > 0 {
            let roster = crate::db::community::get_community_roles(
                &crate::simd::hex::bytes_to_hex_32(&community.id().0),
            )
            .unwrap_or_default();
            let owner_hex = owner.to_hex();
            match fetch_guestbook_events(transport, &community, 0).await {
                Ok((events, _, _)) => {
                    // EARLIEST trace per member: a re-announced Join must never make
                    // an established member read as a window joiner.
                    let mut first_seen: std::collections::BTreeMap<PublicKey, u64> = std::collections::BTreeMap::new();
                    for ev in &events {
                        if let guestbook::GuestbookEntry::Join { member, at_ms, .. } = &ev.entry {
                            let secs = at_ms / 1000;
                            first_seen
                                .entry(*member)
                                .and_modify(|e| *e = (*e).min(secs))
                                .or_insert(secs);
                        }
                    }
                    for (pk, joined) in first_seen {
                        if joined < window_start_secs || pk == owner || pk == my_pk || cut.contains(&pk) {
                            continue;
                        }
                        // Staff are never cut by a window: a moderator who joined
                        // moments before a raid is still a moderator.
                        if roster.is_staff(&pk.to_hex(), Some(&owner_hex)) {
                            continue;
                        }
                        cut.push(pk);
                        report.window_cut += 1;
                    }
                }
                Err(e) => report
                    .warnings
                    .push(format!("guestbook unreadable — no window cut applied, only convicted raiders are severed ({e})")),
            }
        }

        // 3. The severing refound. Private channels are deliberately NOT rotated
        //    separately: the root roll re-keys every plane, and link-borne raiders
        //    were never entitled to a private channel in the first place.
        //
        //    Under the MODERATION lock, exactly as `run_moderation_batch` holds it
        //    across ITS refound: an ordinary ban racing this rotation would publish
        //    a banlist edition the compaction fetch below has already read past,
        //    and the new epoch would carry it away — a ban silently erased at the
        //    moment bans matter most. Lock order (moderation → follow) matches the
        //    shipped path. Retried: the refound's coverage gate fails closed under
        //    exactly the relay lag a mid-raid flood produces.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let links_before = crate::db::community::list_public_invites(&cid_hex).map(|l| l.len()).unwrap_or(0);
        let unit = moderation_lock(community_id);
        let _guard = unit.lock().await;
        let mut refound = Err("severing refound never attempted".to_string());
        for attempt in 0..3u8 {
            refound = refound_community_severing(transport, &community, &cut, window_start_secs).await;
            if refound.is_ok() {
                break;
            }
            if attempt < 2 {
                crate::rt::time::sleep(std::time::Duration::from_millis(400 * (attempt as u64 + 1))).await;
            }
        }
        match refound {
            Ok(updated) => {
                report.refound_ok = true;
                report.epoch_after = updated.root_epoch.0;
                let links_after = crate::db::community::list_public_invites(&cid_hex).map(|l| l.len()).unwrap_or(0);
                report.own_links_revoked = links_before.saturating_sub(links_after);
                if links_after > 0 {
                    report.warnings.push(format!(
                        "{links_after} of my own link(s) survived the sever — the mark retries them on the next follow"
                    ));
                }
                report.foreign_link_creators = crate::db::community::invite_link_set_creators(&cid_hex)
                    .unwrap_or_default()
                    .into_iter()
                    .filter(|c| *c != my_pk.to_hex())
                    .collect();
            }
            Err(e) => {
                // The banlist landed and silences the named raiders at every honest
                // reader, but the DOOR IS STILL OPEN. Never dress this as success.
                report.warnings.push(format!("SEVERING REFOUND FAILED — the invite door may still be open: {e}"));
            }
        }
        Ok(report)
    })
    .await
}

/// Edit the community metadata (vsk 0, CORD-02 §6). Gated on the reader side by
/// `MANAGE_METADATA`.
pub async fn edit_community_metadata<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, meta: &control::CommunityMetadata) -> Result<(), String> {
    ensure_folded_permission(community, &me_pk()?, crate::community::roles::Permissions::MANAGE_METADATA, "editing the community metadata")?;
    control::validate_community_metadata(meta).map_err(|e| e.to_string())?;
    let content = serde_json::to_string(meta).map_err(|e| e.to_string())?;
    publish_control_edition(transport, community, vsk::COMMUNITY_METADATA, &community.id().0, &content).await
}

/// Persist a freshly-published icon/banner onto the held row and return the fresh
/// row. Reloads under the community's follow lock: `save_community_v2` is a
/// whole-row save that prunes channels absent from the passed struct, so writing
/// a stale pre-upload copy would drop rows a concurrent fold just landed.
pub async fn persist_community_image(
    id: &crate::community::CommunityId,
    img: control::ImageRef,
    is_banner: bool,
) -> Option<CommunityV2> {
    let lock = super::realtime::follow_lock(id);
    let _guard = lock.lock().await;
    let mut fresh = crate::db::community::load_community_v2(id).ok()??;
    if is_banner {
        fresh.banner = Some(img);
    } else {
        fresh.icon = Some(img);
    }
    crate::db::community::save_community_v2(&fresh).ok()?;
    Some(fresh)
}

/// Add or edit a channel's metadata (vsk 2, CORD-03 §2). `channel_id` is the
/// coordinate. Gated on the reader side by `MANAGE_CHANNELS`.
pub async fn edit_channel_metadata<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, channel_id: &ChannelId, meta: &control::ChannelMetadata) -> Result<(), String> {
    let my_pk = me_pk()?;
    ensure_channel_manager(community, &my_pk)?;
    let old_name = community.channel(channel_id).map(|c| c.name.clone());
    // Public → private CONVERSION is a key rotation (CORD-03 §2) this build doesn't
    // mint yet — refuse the flag flip rather than publish an edition no reader can
    // key (members would keep posting on the root-derived plane, splitting the
    // channel). Private → public works (readers heal to the root derivation).
    if meta.private {
        if let Some(held) = community.channel(channel_id) {
            if !held.private {
                return Err("converting a public channel to private is not supported yet".to_string());
            }
        }
    }
    control::validate_channel_metadata(meta).map_err(|e| e.to_string())?;
    let content = serde_json::to_string(meta).map_err(|e| e.to_string())?;
    publish_control_edition(transport, community, vsk::CHANNEL_METADATA, &channel_id.0, &content).await?;
    // Apply locally too. The fold is the authority but runs later, so without this
    // an edit we just made reads back stale until some future control pass — the
    // rename appears to have silently failed.
    if let Ok(Some(mut held)) = crate::db::community::load_community_v2(community.id()) {
        if let Some(ch) = held.channels.iter_mut().find(|c| c.id.0 == channel_id.0) {
            ch.name = meta.name.clone();
            ch.private = meta.private;
            ch.voice = meta.voice;
            ch.meta_custom = meta.custom.clone();
            ch.meta_extra = meta.extra.clone();
            crate::db::community::save_community_v2(&held)?;
        }
    }
    // Keep the companion access role's label in step with the channel it gates.
    if meta.private {
        if let Some(old) = old_name.filter(|o| *o != meta.name) {
            rename_channel_access_role(transport, community, channel_id, &old, &meta.name).await;
        }
    }
    Ok(())
}

/// Rename a private channel's companion access role to follow the channel (CORD-04 §2).
/// Best-effort and never fatal: the channel rename has already published, and a role's
/// name is cosmetic — entitlement is carried by the scope, not the label.
///
/// Only renames a label still equal to the channel's OLD name, so a deliberately
/// customised role name survives a channel rename untouched.
async fn rename_channel_access_role<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    old_name: &str,
    new_name: &str,
) {
    crate::db::scoped(async move {
        let (Ok(my_pk), Ok(owner)) = (me_pk(), community.owner()) else {
            return;
        };
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
        // Fetched, not cached: `set_role` republishes the WHOLE role body, so a stale
        // cache would clobber a permission edit this client has not folded yet.
        let mut roster = fetch_authority(transport, community).await.roles;
        let cached = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        for r in cached.roles {
            if !roster.roles.iter().any(|x| x.role_id == r.role_id) {
                roster.roles.push(r);
            }
        }
        // MANAGE_CHANNELS got us the rename; the role edition needs MANAGE_ROLES + outrank
        // of its own. Publishing one readers reject would wedge our later, legitimate role
        // edits behind a rejected chain, so verify before publishing rather than after.
        let (me_hex, owner_hex) = (my_pk.to_hex(), owner.to_hex());
        if !roster.is_authorized_in(&me_hex, Some(&owner_hex), &chan_hex, crate::community::roles::Permissions::MANAGE_ROLES) {
            return;
        }
        // Same selector `grant_channel_access` vends: the permission-less scoped role. A
        // per-channel moderator role sharing the scope is NOT the access list.
        let Some(mut role) = roster
            .channel_roles(&chan_hex)
            .into_iter()
            .find(|r| r.permissions == crate::community::roles::Permissions::empty() && r.name == old_name)
            .cloned()
        else {
            return;
        };
        if !roster.can_act_on_position(&me_hex, Some(&owner_hex), role.position, crate::community::roles::Permissions::MANAGE_ROLES) {
            return;
        }
        role.name = new_name.to_string();
        if let Err(e) = set_role(transport, community, &role).await {
            crate::log_warn!("v2: channel renamed but its access role did not follow: {e}");
            return;
        }
        merge_local_roster(&cid_hex, Some(&role), None);
    })
    .await
}

/// The local mirror of a reader-side permission fold gate: the owner, or a
/// roster-authorized holder of `needed` who isn't banned. Refusing BEFORE any
/// publish keeps an unauthorized device from advancing its own edition floor onto
/// a head every reader rejects (wedging its later, legitimately-authorized edits
/// behind a rejected chain). Fail-closed: an empty/unfolded roster collapses to
/// owner-only — it can over-restrict, never grant authority no one has.
fn ensure_folded_permission(
    community: &CommunityV2,
    me: &PublicKey,
    needed: u64,
    verb: &str,
) -> Result<(), String> {
    let owner = community.owner()?;
    if *me == owner {
        return Ok(());
    }
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let me_hex = me.to_hex();
    if crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default().contains(&me_hex) {
        return Err("you are banned from this community".to_string());
    }
    let roster = crate::db::community::get_community_roles(&cid_hex)?;
    if roster.is_authorized(&me_hex, Some(&owner.to_hex()), needed) {
        Ok(())
    } else {
        Err(format!("{verb} needs the {} permission", permission_label(needed)))
    }
}

fn permission_label(bits: u64) -> &'static str {
    use crate::community::roles::Permissions;
    match bits {
        Permissions::MANAGE_ROLES => "MANAGE_ROLES",
        Permissions::MANAGE_CHANNELS => "MANAGE_CHANNELS",
        Permissions::MANAGE_METADATA => "MANAGE_METADATA",
        Permissions::BAN => "BAN",
        Permissions::CREATE_INVITE => "CREATE_INVITE",
        _ => "required",
    }
}

/// [`ensure_folded_permission`] for `MANAGE_CHANNELS` (CORD-03 §2).
fn ensure_channel_manager(community: &CommunityV2, me: &PublicKey) -> Result<(), String> {
    ensure_folded_permission(community, me, crate::community::roles::Permissions::MANAGE_CHANNELS, "managing channels here")
}

/// Create a new PUBLIC channel (CORD-03 §2): mint a fresh id, publish its metadata
/// edition (vsk 2), and add it to the held community. A Public channel derives its Chat
/// Plane from the `community_root` (no per-channel key), so other members fold it in on
/// their next control follow with nothing to distribute. Returns the new channel id.
/// Reader-gated by `MANAGE_CHANNELS`.
pub async fn create_public_channel<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, name: &str) -> Result<ChannelId, String> {
    let channel_id = ChannelId(super::super::random_32());
    create_public_channel_with_id(transport, community, name, channel_id).await?;
    Ok(channel_id)
}

/// [`create_public_channel`] with a CALLER-CHOSEN id — the migration-only entry point
/// (§migration) that reuses a v1 channel's id so chat history stitches through the flip.
/// Asserts the id isn't already live in a DIFFERENT held v2 community before minting.
pub async fn create_public_channel_with_id<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, name: &str, channel_id: ChannelId) -> Result<(), String> {
    crate::db::scoped(async move {
        // Serialize with the follow worker: the save below writes the WHOLE community
        // row from this caller's struct, so an unserialized concurrent follow adopting
        // a rotation would be rolled back to a stale root (a deaf community).
        let lock = super::realtime::follow_lock(community.id());
        let _guard = lock.lock().await;
        let my_pk = me_pk()?;
        ensure_channel_manager(community, &my_pk)?;
        assert_channel_id_free(&channel_id, community.id())?;
        let meta = control::ChannelMetadata { name: name.to_string(), private: false, voice: None, deleted: None, custom: None, extra: Default::default() };
        control::validate_channel_metadata(&meta).map_err(|e| e.to_string())?;
        let content = serde_json::to_string(&meta).map_err(|e| e.to_string())?;
        publish_control_edition(transport, community, vsk::CHANNEL_METADATA, &channel_id.0, &content).await?;
        // Add locally + persist so the creator can post immediately (peers fold it in).
        let mut updated = community.clone();
        updated.channels.push(ChannelV2 { id: channel_id, name: name.to_string(), private: false, key: None, epoch: updated.root_epoch, voice: None, meta_custom: None, meta_extra: Default::default() });
        crate::db::community::save_community_v2(&updated)?;
        Ok(())
    })
    .await
}

/// Refuse a channel id already live in a DIFFERENT held v2 community — the same
/// cross-community hijack the `save_community_v2` guard forecloses, checked up front so a
/// migration twin never adopts an id it doesn't own. A collision with a v1-owned row is
/// fine (that's the whole point — the flip re-parents it); only a foreign v2 owner blocks.
fn assert_channel_id_free(channel_id: &ChannelId, community_id: &crate::community::CommunityId) -> Result<(), String> {
    let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
    if let Ok(Some(existing)) = crate::db::community::community_id_for_channel(&ch_hex) {
        let mine = crate::simd::hex::bytes_to_hex_32(&community_id.0);
        let existing_id = crate::community::CommunityId(crate::simd::hex::hex_to_bytes_32(&existing));
        if existing != mine
            && matches!(crate::db::community::community_protocol(&existing_id), Ok(Some(crate::community::ConcordProtocol::V2)))
        {
            return Err("channel id is already live in another v2 community".to_string());
        }
    }
    Ok(())
}

/// Create a new PRIVATE channel (CORD-03 §2): mint a fresh id + an independent
/// random key at channel-epoch 1, mint a companion channel-scoped Role that is
/// the channel's access list (CORD-04 §2), deliver the key to the entitled over
/// the rekey plane (CORD-06 §1), then announce the channel (vsk 2, `private`).
/// Epoch 0 is the root generation ("the first privatisation is epoch 1"), so the
/// delivery commits its continuity to `(0, community_root)` — verifiable by every
/// member and bound to THIS community's root. The key ships BEFORE the
/// announcement: an aborted attempt leaves only an unannounced crate (invisible),
/// and a retry mints a fresh id, so there is no same-coordinate double-mint to
/// fork on. Live public links are refreshed; they carry no private key, so this
/// only re-states the public set.
pub async fn create_private_channel<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, name: &str) -> Result<ChannelId, String> {
    let channel_id = ChannelId(super::super::random_32());
    create_private_channel_with_id(transport, community, name, channel_id).await?;
    Ok(channel_id)
}

/// The companion Role minted alongside a Private channel — the channel's access
/// list (CORD-04 §2 `scope: {"kind":"channel"}`). Same name as the channel, and
/// **no permission bits**: it confers read access, which is key possession, never
/// authority. Position sits below every management role for the same reason.
/// Where channel access roles sit: the bottom, so anyone who can manage roles outranks
/// them and may hand out read access.
pub const ACCESS_ROLE_POSITION: u32 = u32::MAX - 1;

pub fn channel_access_role(channel_id: &ChannelId, name: &str) -> crate::community::roles::Role {
    use crate::community::roles::{Permissions, Role, RoleScope};
    Role {
        role_id: crate::simd::hex::bytes_to_hex_32(&super::super::random_32()),
        name: name.to_string(),
        position: ACCESS_ROLE_POSITION,
        permissions: Permissions::empty(),
        scope: RoleScope::Channel(crate::simd::hex::bytes_to_hex_32(&channel_id.0)),
        color: 0, extra: Default::default(),
    }
}

/// [`create_private_channel`] with a CALLER-CHOSEN id — the migration-only entry point
/// (§migration) reusing a v1 private channel's id so history stitches through the flip.
pub async fn create_private_channel_with_id<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, name: &str, channel_id: ChannelId) -> Result<(), String> {
    crate::db::scoped(async move {
        // Serialize with the follow worker across the whole fetch→publish→save span
        // (the memberlist fetch is seconds long; an unserialized follow adopting a
        // rotation meanwhile would be rolled back by the whole-row save below).
        let lock = super::realtime::follow_lock(community.id());
        let _guard = lock.lock().await;
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        ensure_channel_manager(community, &my_pk)?;
        assert_channel_id_free(&channel_id, community.id())?;
        let meta = control::ChannelMetadata { name: name.to_string(), private: true, voice: None, deleted: None, custom: None, extra: Default::default() };
        control::validate_channel_metadata(&meta).map_err(|e| e.to_string())?;
        let content = serde_json::to_string(&meta).map_err(|e| e.to_string())?;

        let channel_key = super::super::random_32();
        let epoch = Epoch(1);

        // The channel's access list: a companion channel-scoped Role (CORD-04 §2),
        // granted to me so the creator is entitled from the first edition.
        let access_role = channel_access_role(&channel_id, name);
        let access_role_ids = vec![access_role.role_id.clone()];

        // Recipients are the ENTITLED, not the memberlist: CORD-03's private channel
        // is "readable only by granted role-holders". At create that is me (plus the
        // owner, who is always entitled) — everyone else keys up when granted.
        let owner = community.owner()?;
        let mut recipients = vec![my_pk];
        if owner != my_pk {
            recipients.push(owner);
        }
        let prev_commit = super::derive::epoch_key_commitment(Epoch(0), &community.community_root);
        let mut blobs = Vec::with_capacity(recipients.len());
        for r in &recipients {
            blobs.push(
                rekey::build_blob(&signer, &my_pk.to_bytes(), r, RekeyScope::Channel(channel_id), epoch, &channel_key)
                    .await
                    .map_err(|e| e.to_string())?,
            );
        }
        let group = channel_rekey_group_key(&community.community_root, &channel_id, epoch);
        let at_secs = now_ms() / 1000;
        let chunks = rekey::build_rekey_chunks(&signer, my_pk, &group, RekeyScope::Channel(channel_id), epoch, Epoch(0), &prev_commit, &blobs, at_secs, my_authority_citation(community, &my_pk).as_ref(), false)
            .await
            .map_err(|e| e.to_string())?;
        for c in &chunks {
            transport.publish_durable(c, &community.relays).await?;
        }
        publish_control_edition(transport, community, vsk::CHANNEL_METADATA, &channel_id.0, &content).await?;
        // Publish the access list AFTER the channel exists, so a peer folding the
        // Role always resolves the channel it scopes to. A failure here leaves a
        // channel only its creator can read — recoverable by re-granting, never a
        // leak.
        set_role(transport, community, &access_role).await?;
        // Judge staff-ness against a roster that HOLDS the role just minted above —
        // no fold has read it back yet, and the access role is permission-less, so
        // resolving it locally both skips a round trip and gets the right answer.
        let mut roster_with_access = crate::db::community::get_community_roles(&crate::simd::hex::bytes_to_hex_32(&community.id().0)).unwrap_or_default();
        if roster_with_access.role(&access_role.role_id).is_none() {
            roster_with_access.roles.push(access_role.clone());
        }
        grant_roles_with_roster(transport, community, &my_pk, access_role_ids.clone(), &roster_with_access).await?;
        // The fold is the authority but runs later; without this the creator is not
        // yet entitled to their own channel and the next grant finds no access role.
        merge_local_roster(
            &crate::simd::hex::bytes_to_hex_32(&community.id().0),
            Some(&access_role),
            Some(&crate::community::roles::MemberGrant { member: my_pk.to_hex(), role_ids: access_role_ids }),
        );
        // A leave/delete raced the create: saving would resurrect the community row.
        if crate::db::community::community_protocol(community.id())?.is_none() {
            return Err("community removed during channel create".to_string());
        }
        let mut updated = community.clone();
        updated.channels.push(ChannelV2 { id: channel_id, name: name.to_string(), private: true, key: Some(channel_key), epoch, voice: None, meta_custom: None, meta_extra: Default::default() });
        crate::db::community::save_community_v2(&updated)?;
        // Archive the epoch-1 key so this channel's history stays readable across its
        // future rotations (CORD-03 §3).
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::store_epoch_key(&cid_hex, &crate::simd::hex::bytes_to_hex_32(&channel_id.0), epoch.0, &channel_key)?;
        // Re-state live links. They carry no private key (CORD-05 §2 — a link's
        // audience holds no Role), so this only refreshes the public set.
        let _ = refresh_public_links(transport, &updated).await;
        Ok(())
    })
    .await
}

// ── Receiving a key vend (CORD-03 "delivered on grant") ──────────────────────

/// What a client should do with a vended Private-Channel key right now.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum VendVerdict {
    /// Every rule passed — adopt the key.
    Accept,
    /// Cannot judge YET: our fold lags the grant it delivers. Park quietly and
    /// re-judge after the next control follow. NOT an anomaly — a lagging fold
    /// is the normal case for a vend that races its own Grant.
    Park(&'static str),
    /// Judged invalid against evidence that cannot become true later. Alarm-worthy.
    Refuse(&'static str),
}

/// Judge a vended Private-Channel key against our OWN folded state.
///
/// The Grant is the authority half and rides the owner-rooted control plane, so
/// it cannot be forged; the vend is only delivery. Acceptance therefore rests
/// entirely on what our own fold proves — a bundle can never introduce a channel
/// our control plane doesn't define, which is what closes the hidden-channel
/// injection class.
///
/// `community` must already be the held (self-certified) community: the caller
/// resolves it by `community_id`, so a bundle naming a community we're not in is
/// never judged here at all.
pub fn judge_channel_key_vend(
    community: &CommunityV2,
    roster: &crate::community::roles::CommunityRoles,
    channel_id: &ChannelId,
    epoch: Epoch,
    sender_hex: &str,
) -> VendVerdict {
    let me = match me_pk() {
        Ok(pk) => pk.to_hex(),
        Err(_) => return VendVerdict::Park("no active identity"),
    };
    let owner_hex = match community.owner() {
        Ok(o) => o.to_hex(),
        Err(_) => return VendVerdict::Refuse("community has no resolvable owner"),
    };
    let chan_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);

    // (2) The channel must exist in OUR fold, and be private there. The bundle's
    // own claims are ignored: a vend may deliver a key, never define a channel.
    let Some(ch) = community.channel(channel_id) else {
        return VendVerdict::Park("channel not in our fold yet");
    };
    if !ch.private {
        // Never heals: our owner-rooted fold says this channel is public, so a
        // "private key" for it is a spoof, not a lagging view.
        return VendVerdict::Refuse("vend names a channel our fold says is public");
    }

    // (5) Epoch sanity, BOTH directions. Below is superseded by the rotation that
    // produced our copy. Above matters more: the channel head is monotonic, so a
    // wildly-ahead epoch is not merely wrong, it is PERMANENT — every genuine
    // rotation afterwards lands at `head + 1`, is refused as stale, and the
    // channel dies for us with no heal path at all (not a rekey, not a re-grant,
    // not a refound). Rotations advance one epoch at a time, so a lead this large
    // is never a delivery we could place.
    if ch.key.is_some() && epoch.0 <= ch.epoch.0 {
        return VendVerdict::Refuse("superseded: we already hold this epoch or newer");
    }
    if epoch.0 > ch.epoch.0.saturating_add(MAX_VEND_EPOCH_LEAD) {
        return VendVerdict::Refuse("vend epoch is implausibly far ahead of the channel head");
    }

    // (3) OUR fold must show US granted a role scoped to this channel. This is
    // the rule that kills the spoof class: an attacker cannot forge the Grant,
    // so they cannot make us accept a key for a channel we were never granted.
    if !roster.is_entitled(Some(&owner_hex), &me, &chan_hex, &[], &[]) {
        return VendVerdict::Park("our grant for this channel has not folded yet");
    }

    // (4) The vendor must be entitled too — they hold the real key, so a wrong
    // key from them costs isolation, never confidentiality.
    if sender_hex != owner_hex && !roster.is_entitled(Some(&owner_hex), sender_hex, &chan_hex, &[], &[]) {
        return VendVerdict::Park("vendor's entitlement has not folded yet");
    }

    VendVerdict::Accept
}

/// How long an unprovable parked vend is kept. Deliberately long: the fallback
/// heal is the channel's next rotation, which may never come.
const PARKED_VEND_TTL_SECS: u64 = 30 * 24 * 3600;

/// How far above our channel head a vend may claim to be. Generous — a keyless
/// cursor can lag a busy channel by many rotations — but bounded, because the
/// head is monotonic and an over-advance can never be walked back.
const MAX_VEND_EPOCH_LEAD: u64 = 1024;

/// Re-judge every parked key vend for this community and adopt the ones that now
/// pass. Runs after a control follow (the fold moved, so verdicts can change) and
/// on the boot sweep.
///
/// Returns the channels newly keyed up.
pub fn absorb_parked_channel_keys(community: &CommunityV2, session: &std::sync::Arc<crate::db::Session>) -> Vec<ChannelId> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let parked = match crate::db::community::get_pending_channel_keys(&cid_hex) {
        Ok(p) if !p.is_empty() => p,
        _ => return Vec::new(),
    };
    let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    let mut adopted = Vec::new();
    let now = now_ms() / 1000;
    for p in parked {
        // Several candidates may name one channel (parking is open to any sender,
        // so a stranger can never suppress the entitled vendor's key by holding a
        // slot). Once one is seated the rest are moot.
        if adopted.iter().any(|c: &ChannelId| crate::simd::hex::bytes_to_hex_32(&c.0) == p.channel_id) {
            let _ = crate::db::community::drop_pending_channel_key(p.id);
            continue;
        }
        // A vend we were never able to prove is not kept forever: an admin who
        // adds then immediately removes someone leaves a row nothing will ever
        // discharge. Generous by design — the alternative heal (the channel's
        // next rotation) can be arbitrarily far away, so this is hygiene, not a
        // deadline.
        if now.saturating_sub(p.received_at.max(0) as u64) > PARKED_VEND_TTL_SECS {
            let _ = crate::db::community::drop_pending_channel_key(p.id);
            continue;
        }
        let Some(id_bytes) = crate::simd::hex::hex_to_bytes_32_checked(&p.channel_id) else {
            let _ = crate::db::community::drop_pending_channel_key(p.id);
            continue;
        };
        let channel_id = ChannelId(id_bytes);
        match judge_channel_key_vend(community, &roster, &channel_id, Epoch(p.epoch), &p.sender) {
            VendVerdict::Accept => {
                if !session.is_live() {
                    return adopted;
                }
                // First delivery vs rotation. A keyless channel must bypass the
                // monotonic guard: it sits at the epoch-0 cursor, and a peer that
                // mints born-private channels at epoch 0 vends that same epoch, so
                // `new > current` would refuse the only key on offer.
                let keyless = community.channel(&channel_id).is_some_and(|c| c.key.is_none());
                let seated = if keyless {
                    crate::db::community::seat_channel_key(&cid_hex, &p.channel_id, p.epoch, &p.key)
                } else {
                    crate::db::community::advance_channel_epoch(&cid_hex, &p.channel_id, p.epoch, &p.key).map(|_| ())
                };
                if let Err(e) = seated {
                    crate::log_warn!("v2: adopting a vended channel key failed: {e}");
                    continue;
                }
                // The key landed — every other candidate for this channel is moot.
                let _ = crate::db::community::drop_pending_channel_keys_for(&cid_hex, &p.channel_id);
                adopted.push(channel_id);
            }
            VendVerdict::Refuse(why) => {
                crate::log_warn!("v2: refused a vended channel key for {}: {why}", p.channel_id);
                // Only THIS candidate — a sibling may still be the genuine vend.
                let _ = crate::db::community::drop_pending_channel_key(p.id);
            }
            // Quiet by design: the fold simply hasn't caught up.
            VendVerdict::Park(_) => {}
        }
    }
    adopted
}

/// Grant `member` read access to a Private channel (CORD-03 "delivered on
/// grant"): publish a Grant adding the channel's access role, then vend the key
/// as a CORD-05 §6 Direct Invite whose bundle carries exactly the channels they
/// are now entitled to.
///
/// The Grant is the authority half and rides the owner-rooted control plane, so
/// it cannot be forged; the vend is only delivery. A recipient accepts the key
/// solely on the strength of their OWN fold showing this grant — the bundle can
/// never introduce a channel their control plane doesn't define.
pub async fn grant_channel_access<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    member: &PublicKey,
) -> Result<(), String> {
    crate::db::scoped(async move {
        let my_pk = me_pk()?;
        let ch = community.channel(channel_id).ok_or("unknown channel")?;
        if !ch.private {
            return Err("channel is public — every member already reads it".to_string());
        }
        if ch.key.is_none() {
            return Err("we hold no key for this channel, so we cannot vend it".to_string());
        }
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
        let owner_hex = community.owner()?.to_hex();
        // A Grant REPLACES the member's role set, so the union it is built from must
        // be CURRENT: a stale local roster would silently strip every role this
        // client hasn't folded yet. Fetch the authority fresh rather than trusting
        // the cache, and merge the local view on top so a role we just published
        // ourselves (which the plane has but no fold has read back) survives too.
        let view = fetch_authority(transport, community).await;
        let mut roster = view.roles.clone();
        let cached = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        for r in cached.roles {
            if !roster.roles.iter().any(|x| x.role_id == r.role_id) {
                roster.roles.push(r);
            }
        }
        for g in cached.grants {
            if !roster.grants.iter().any(|x| x.member == g.member) {
                roster.grants.push(g);
            }
        }
        let my_hex = my_pk.to_hex();
        let member_hex = member.to_hex();
        // Reader-gated by MANAGE_ROLES, like any Grant; narrowed to this channel so
        // a channel-scoped manager can run its own access list.
        if !roster.is_authorized_in(&my_hex, Some(&owner_hex), &chan_hex, crate::community::roles::Permissions::MANAGE_ROLES) {
            return Err("not authorized to manage this channel's access".to_string());
        }
        // Rank as well as the bit: the fold drops a Grant aimed at a peer or superior
        // (CORD-04 §2), so publishing one vends a key against a role set no reader
        // will honour. The owner is the exception — never a valid rank target, but a
        // legitimate recipient of a channel key an admin minted.
        if member_hex != owner_hex {
            if !roster.can_act_on_member(&my_hex, Some(&owner_hex), &member_hex, crate::community::roles::Permissions::MANAGE_ROLES) {
                return Err("you do not outrank this member".to_string());
            }
            // A Grant replaces whole — a floored-but-unserved head would publish a
            // wipe. The owner holds no Grant (their authority is implicit), so there
            // is no head to insist on and nothing a first edition could erase.
            require_grant_head(community, &view, &member_hex)?;
        }
        // The channel's roles are ordered by AUTHORITY, so `.first()` is the most
        // privileged — granting read access must never hand out a per-channel
        // moderator role that happens to share the scope. Pick the permission-less
        // one: conferring read access is exactly what carries no authority.
        let role_id = roster
            .channel_roles(&chan_hex)
            .into_iter()
            .find(|r| r.permissions == crate::community::roles::Permissions::empty())
            .map(|r| r.role_id.clone())
            .ok_or("channel has no permission-less access role to grant")?;

        let mut role_ids: Vec<String> = roster.roles_of(&member_hex).map(|r| r.role_id.clone()).collect();
        if !role_ids.contains(&role_id) {
            role_ids.push(role_id.clone());
        }
        // The access role is permission-less (never staff-making), but a KEPT role
        // can be — the fetched roster judges (CORD-04 §3).
        grant_roles_with_roster(transport, community, member, role_ids.clone(), &roster).await?;
        merge_local_roster(&cid_hex, None, Some(&crate::community::roles::MemberGrant { member: member.to_hex(), role_ids }));
        // Settle the vend against the Grant we JUST published — the fold lags it.
        let bundle = bundle_of_with_overlay(
            community,
            BundleAudience::Member(*member),
            Some(my_pk),
            None,
            None,
            std::slice::from_ref(&role_id),
            &[],
        );
        let signer = crate::signer::active_signer()?;
        let wrap = invite::build_direct_invite_signed(&signer, my_pk, member, &bundle).await.map_err(|e| e.to_string())?;
        transport.publish(&wrap, &community.relays).await?;
        Ok(())
    })
    .await
}

/// Revoke `member`'s read access to a Private channel (CORD-03 "rekeyed on
/// removal"): drop the channel's access role from their Grant, then rotate the
/// channel to its next epoch delivering the fresh key to everyone still
/// entitled (CORD-06). The revoked member keeps whatever history they already
/// read — a rekey protects the future, never the past.
pub async fn revoke_channel_access<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    member: &PublicKey,
) -> Result<(), String> {
    crate::db::scoped(async move {
        let my_pk = me_pk()?;
        let ch = community.channel(channel_id).ok_or("unknown channel")?;
        if !ch.private {
            return Err("channel is public — there is no access to revoke".to_string());
        }
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
        let owner_hex = community.owner()?.to_hex();
        // Same replace-not-merge hazard as the grant: the retained set must be built
        // from a CURRENT roster or this revoke strips roles we simply hadn't folded.
        let view = fetch_authority(transport, community).await;
        let mut roster = view.roles.clone();
        let cached = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        for r in cached.roles {
            if !roster.roles.iter().any(|x| x.role_id == r.role_id) {
                roster.roles.push(r);
            }
        }
        for g in cached.grants {
            if !roster.grants.iter().any(|x| x.member == g.member) {
                roster.grants.push(g);
            }
        }
        let my_hex = my_pk.to_hex();
        let member_hex = member.to_hex();
        if !roster.is_authorized_in(&my_hex, Some(&owner_hex), &chan_hex, crate::community::roles::Permissions::MANAGE_ROLES) {
            return Err("not authorized to manage this channel's access".to_string());
        }
        if *member == community.owner()? {
            return Err("the owner is supreme and cannot be removed".to_string());
        }
        // Rank as well as the bit, and it matters more here than on the grant side:
        // readers drop the Grant, but the channel rotation below is gated on the
        // citation alone, so an unauthorized revoke still severs its target.
        if !roster.can_act_on_member(&my_hex, Some(&owner_hex), &member_hex, crate::community::roles::Permissions::MANAGE_ROLES) {
            return Err("you do not outrank this member".to_string());
        }
        // A Grant replaces whole — a floored-but-unserved head would publish a wipe.
        require_grant_head(community, &view, &member_hex)?;
        let access_ids = roster.channel_role_ids(&chan_hex);
        // Without the access list this revoke is a no-op that still ROTATES, and the
        // rotation's recipient filter would match nobody — cutting off every
        // legitimately entitled member. Refuse rather than mass-evict.
        if access_ids.is_empty() {
            return Err("this channel's access role has not folded yet — retry once the control plane serves it".to_string());
        }
        let remaining: Vec<String> = roster
            .roles_of(&member_hex)
            .map(|r| r.role_id.clone())
            .filter(|id| !access_ids.contains(id))
            .collect();
        grant_roles_with_roster(transport, community, member, remaining.clone(), &roster).await?;
        merge_local_roster(&cid_hex, None, Some(&crate::community::roles::MemberGrant { member: member.to_hex(), role_ids: remaining }));
        // Rotate so the removal actually severs them (CORD-06 §1). The revoked
        // member is excluded from the recipient set by the overlay, since the fold
        // has not yet caught the Grant we just published.
        rekey_channel_excluding(transport, community, channel_id, &roster, &access_ids, std::slice::from_ref(member)).await
    })
    .await
}

/// Rotate one Private channel to its next epoch, delivering the fresh key to
/// everyone entitled EXCEPT `removed` (CORD-06 §1 single-channel rekey).
///
/// `roster` must be the caller's CURRENT view (fetched, not the local cache):
/// the recipient set is built from it, so a cached roster silently drops every
/// member granted since this client last folded — they keep a dead key with no
/// heal path. `access_ids` is that roster's access-role set for this channel;
/// `removed` is excluded explicitly, since the revoking Grant was published
/// moments ago and no fold has caught it. A batch ban excludes its whole wave
/// in ONE rotation — that is why this takes a slice.
async fn rekey_channel_excluding<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    roster: &crate::community::roles::CommunityRoles,
    access_ids: &[String],
    removed: &[PublicKey],
) -> Result<(), String> {
    crate::db::scoped(async move {
        // Whole-row save below — serialize with the follow worker (see create_*_channel).
        let lock = super::realtime::follow_lock(community.id());
        let _guard = lock.lock().await;
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
        let ch = community.channel(channel_id).ok_or("unknown channel")?.clone();
        let old_key = ch.key.ok_or("we hold no key for this channel, so we cannot rotate it")?;
        let new_epoch = Epoch(ch.epoch.0.checked_add(1).ok_or("channel epoch overflow")?);
        let owner = community.owner()?;
        let owner_hex = owner.to_hex();

        // Everyone still entitled: the owner (always), me (the rotator must be able
        // to read what it rekeys), and every member the roster shows holding an
        // access role — minus the removals.
        let removed_hexes: std::collections::HashSet<String> = removed.iter().map(|p| p.to_hex()).collect();
        let mut recipients: Vec<PublicKey> = vec![my_pk];
        if owner != my_pk {
            recipients.push(owner);
        }
        for g in &roster.grants {
            if removed_hexes.contains(&g.member) || g.member == owner_hex {
                continue;
            }
            if !g.role_ids.iter().any(|id| access_ids.contains(id)) {
                continue;
            }
            if let Ok(pk) = PublicKey::parse(&g.member) {
                if !recipients.contains(&pk) {
                    recipients.push(pk);
                }
            }
        }
        // Mint-or-reuse keyed by (channel, next epoch) so a retry after a partial
        // publish re-uses the same key instead of forking the epoch.
        let new_key = mint_or_reuse_rotation_key(&cid_hex, &chan_hex, new_epoch.0)?;
        let prev_commit = super::derive::epoch_key_commitment(ch.epoch, &old_key);
        let mut blobs = Vec::with_capacity(recipients.len());
        for r in &recipients {
            blobs.push(
                rekey::build_blob(&signer, &my_pk.to_bytes(), r, RekeyScope::Channel(*channel_id), new_epoch, &new_key)
                    .await
                    .map_err(|e| e.to_string())?,
            );
        }
        let group = channel_rekey_group_key(&community.community_root, channel_id, new_epoch);
        let at_secs = now_ms() / 1000;
        let chunks = rekey::build_rekey_chunks(&signer, my_pk, &group, RekeyScope::Channel(*channel_id), new_epoch, ch.epoch, &prev_commit, &blobs, at_secs, my_authority_citation(community, &my_pk).as_ref(), false)
            .await
            .map_err(|e| e.to_string())?;
        for c in &chunks {
            transport.publish_durable(c, &community.relays).await?;
        }
        if crate::db::community::community_protocol(community.id())?.is_none() {
            return Err("community removed during channel rekey".to_string());
        }
        // Adopt locally + archive, so our own history reads across the rotation.
        crate::db::community::advance_channel_epoch(&cid_hex, &chan_hex, new_epoch.0, &new_key)?;
        crate::db::community::store_epoch_key(&cid_hex, &chan_hex, new_epoch.0, &new_key)?;

        // §7 Rotator duty: reseal the Pin List under the NEW key. Without this,
        // members who join at this epoch hold no old key and the channel's pins
        // read as sealed-dark for them forever. The rotator is uniquely placed:
        // it provably reads the old seal (it held the old key) and mints the new
        // one. Best-effort — a failed reseal never fails the rotation, and any
        // curator's next edit heals the same way.
        {
            let mut rotated = community.clone();
            if let Some(c) = rotated.channels.iter_mut().find(|c| c.id == *channel_id) {
                c.key = Some(new_key);
                c.epoch = new_epoch;
            }
            match read_channel_pins(&rotated, channel_id) {
                Ok(read) if !read.sealed && !read.pins.is_empty() => {
                    let entries: Vec<super::pins::PinEntry> =
                        read.pins.iter().map(|p| p.entry.clone()).collect();
                    if let Some(ch2) = rotated.channel(channel_id).cloned() {
                        if let Err(e) = publish_pin_list(transport, &rotated, &ch2, &entries).await {
                            crate::log_warn!("[pins] rotation reseal failed (a curator's next edit heals): {e}");
                        } else {
                            crate::log_info!("[pins] resealed {} pin(s) under epoch {}", entries.len(), new_epoch.0);
                        }
                    }
                }
                Ok(read) if read.sealed => {
                    crate::log_warn!("[pins] rotating a channel whose pin list we cannot read; reseal skipped");
                }
                _ => {}
            }
        }
        Ok(())
    })
    .await
}

/// Rotate every private channel a just-banned member could read (CORD-06 §1 applied
/// per channel). A Public-community Ban skips the Refounding (CORD-05 §5), but the
/// banlist and grant strip alone leave the member holding each private channel's
/// CURRENT epoch key — rotation is the only read severance.
///
/// Takes the whole banned wave: a channel several targets could read rotates ONCE,
/// excluding them all. Per-target rotation would mint N epochs for one ban wave and
/// churn every legitimate reader N times.
///
/// Each target carries its role set as captured before the strip: the fold may or
/// may not have caught the strip yet, and the `with` overlay makes the entitlement
/// judgment independent of that timing.
///
/// Offer-side mirror of the reader's `channel_rotator_ok`: a channel rotation is
/// honored only from `MANAGE_CHANNELS` holders, so a BAN-only moderator must not
/// publish one — locally adopting an epoch every reader rejects forks the channel.
///
/// Best-effort per channel (one failure must not leave the others unrotated);
/// returns how many channels rotated, or the joined failures.
pub async fn sever_banned_private_reads<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    targets: &[(PublicKey, Vec<String>)],
) -> Result<usize, String> {
    crate::db::scoped(async move {
        let my_pk = me_pk()?;
        ensure_folded_permission(community, &my_pk, crate::community::roles::Permissions::MANAGE_CHANNELS, "severing a banned member's channel reads")?;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        // Recipients need the CURRENT entitlement view — fetched, then merged over the
        // cache so entitlements we published ourselves survive a lagging fold (the same
        // two-strand merge as `revoke_channel_access`).
        let mut roster = fetch_authority(transport, community).await.roles;
        let cached = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        for r in cached.roles {
            if !roster.roles.iter().any(|x| x.role_id == r.role_id) {
                roster.roles.push(r);
            }
        }
        for g in cached.grants {
            if !roster.grants.iter().any(|x| x.member == g.member) {
                roster.grants.push(g);
            }
        }
        let owner_hex = community.owner().ok().map(|o| o.to_hex());
        let mut rotated = 0usize;
        let mut failures: Vec<String> = Vec::new();
        for ch in &community.channels {
            if !ch.private || ch.key.is_none() {
                continue;
            }
            let chan_hex = crate::simd::hex::bytes_to_hex_32(&ch.id.0);
            // Everyone in the wave who could read this channel, cut in ONE rotation.
            let excluded: Vec<PublicKey> = targets
                .iter()
                .filter(|(pk, stripped)| roster.is_entitled(owner_hex.as_deref(), &pk.to_hex(), &chan_hex, stripped, &[]))
                .map(|(pk, _)| *pk)
                .collect();
            if excluded.is_empty() {
                continue;
            }
            let access_ids = roster.channel_role_ids(&chan_hex);
            // Entitlement without an access-role set can't happen for a non-owner, and
            // an empty set would make the rotation's recipient filter mass-evict.
            if access_ids.is_empty() {
                continue;
            }
            // Reload per iteration: each rotation advances the held document, and a
            // stale struct would mint a colliding channel epoch on the next pass.
            let held = match crate::db::community::load_community_v2(community.id()) {
                Ok(Some(c)) => c,
                _ => return Err("community gone during ban severance".to_string()),
            };
            match rekey_channel_excluding(transport, &held, &ch.id, &roster, &access_ids, &excluded).await {
                Ok(()) => rotated += 1,
                Err(e) => failures.push(format!("{}: {e}", &chan_hex[..12])),
            }
        }
        if failures.is_empty() {
            Ok(rotated)
        } else {
            Err(format!("{rotated} rotated; failed: {}", failures.join("; ")))
        }
    })
    .await
}

/// Tombstone a channel (CORD-03 §2, `deleted: true`) + drop it locally. Reader-gated by
/// `MANAGE_CHANNELS`; the coordinate stays folded as a grave so peers hide it.
pub async fn delete_channel<T: Transport + ?Sized>(transport: &T, community: &CommunityV2, channel_id: &ChannelId, name: &str) -> Result<(), String> {
    crate::db::scoped(async move {
        // Whole-row save below — serialize with the follow worker (see create_*_channel).
        let lock = super::realtime::follow_lock(community.id());
        let _guard = lock.lock().await;
        let my_pk = me_pk()?;
        ensure_channel_manager(community, &my_pk)?;
        // The tombstone carries the FULL held document (deleted flag set): a strict
        // reader treats an edition as the entity, so even a deletion must not strip
        // fields it didn't touch (CORD-02 §6).
        let mut meta = community.channel(channel_id).map(|c| c.metadata()).unwrap_or_else(|| control::ChannelMetadata {
            name: name.to_string(), private: false, voice: None, deleted: None, custom: None, extra: Default::default(),
        });
        meta.deleted = Some(true);
        let content = serde_json::to_string(&meta).map_err(|e| e.to_string())?;
        publish_control_edition(transport, community, vsk::CHANNEL_METADATA, &channel_id.0, &content).await?;
        let mut updated = community.clone();
        updated.channels.retain(|c| c.id.0 != channel_id.0);
        crate::db::community::save_community_v2(&updated)?;
        Ok(())
    })
    .await
}

// ── Live control-follow (CORD-02 §6 / CORD-03 §2) ────────────────────────────

/// Re-fold this community's Control Plane and apply the current metadata +
/// **public** channel set to the held community, persisting any change. Called
/// when a control-plane wrap arrives in realtime (a rename, a new channel, an
/// edited description) so a long-running bot tracks the community mid-session
/// instead of freezing at its join-time view.
///
/// **Authority (CORD-04 §5):** the roster (roles/grants/banlist) folds first into
/// the owner-seeded authorized set ([`fold_authority`]), then each metadata/channel
/// edition is eligible only if its signer CURRENTLY holds the entity's management
/// bit (`MANAGE_METADATA`/`MANAGE_CHANNELS`) — so an authorized admin's edits fold,
/// a demoted one's drop. The owner is supreme, proven by the self-certifying
/// community_id (no network trust).
///
/// **Private channels are skipped here:** a Private channel's Chat-Plane key is
/// delivered over the rekey plane (or an invite bundle), never derivable from a
/// control edition alone. A new Private channel therefore surfaces only once
/// [`follow_rekeys`] delivers its key. Public channels derive from the
/// community_root, so they fold in directly.
///
/// Returns the updated community iff something changed (so the caller can skip a
/// redundant re-subscribe + refresh notification).
/// What a control fold moved. `updated` is the community DOCUMENT (metadata,
/// channels, adopted control root); `authority_changed` is the roster/banlist/
/// registry — which live in their own columns and so are invisible in `updated`.
///
/// The distinction is load-bearing: the rekey walk's authority gates read exactly
/// the state `authority_changed` covers, so a caller that keys its retry off
/// `updated` alone will refuse a rotation on pass 1, silently fix the roster on
/// pass 2, and never look again. That is a permanent strand — and a strand is a
/// fork to everyone else.
#[derive(Debug, Default)]
pub struct ControlFollow {
    pub updated: Option<CommunityV2>,
    pub authority_changed: bool,
}

impl ControlFollow {
    /// Did anything at all move? Either half warrants another rekey walk.
    pub fn moved(&self) -> bool {
        self.updated.is_some() || self.authority_changed
    }
}

pub async fn follow_control<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
) -> Result<ControlFollow, String> {
    crate::db::scoped(async move {
        community.owner()?; // fail fast if the community is somehow unproven.
        let control = control::ControlPlane::of(community);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        // Per-entity refuse-downgrade floors for the CURRENT epoch only. A head recorded
        // under a prior epoch is excluded, so that entity auto-bootstraps after a
        // Refounding (Armada accepts a compacted head across a dangling prev — matched).
        // A read error FAILS CLOSED: an empty map would silently re-open the rollback
        // window the floor exists to shut.
        let floors: Floors = crate::db::community::get_all_edition_heads_full(&cid_hex)?
            .into_iter()
            .filter(|(_, f)| f.0 == community.root_epoch.0)
            .map(|(entity, f)| (entity, (f.1, f.2, f.3)))
            .collect();

        // Newest window first; page OLDER only while a tracking entity is gapped (its
        // floor link evicted from the window — H1/M8 refetch), bounded like the join
        // verifier. A withholding relay still converges to fail-closed after the cap.
        let mut editions: Vec<ParsedEdition> = Vec::new();
        let mut seen: std::collections::HashSet<[u8; 32]> = std::collections::HashSet::new();
        let mut seen_wraps: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
        let mut fold = ControlFold { updated: None, heads: Vec::new(), gapped: false, pins_persist: Vec::new() };
        let mut authority = AuthoritySet::owner_only();
        // Whether this round gave up with editions still unread. The follow is
        // procedural by design — process what arrives, converge with everyone else —
        // so a short read never blocks reading, writing or epoch adoption. It only
        // withholds the ROSTER cache below: caching a partial authority as this
        // device's baseline is the one step that outlives the round.
        let mut truncated = true;
        let mut pages_read = 0usize;
        // Quorum answers as soon as a majority does, so a fast subset that happens not
        // to hold an older edition is indistinguishable from that edition not existing —
        // and the same subset answers every boot, so the retain never lifts and the
        // roster cache freezes with no way back. This fold draws an ABSENCE verdict
        // (`stored_complete`, `truncated`), and CORD-04 §5 makes a gap fail closed FOR
        // THAT ENTITY and refetch. So escalate: read at Quorum, and if anything we
        // already hold is still unaccounted for, read again at Full before concluding.
        // Healthy folds never pay for the second tier.
        for tier in [
            crate::community::transport::Evidence::Quorum,
            crate::community::transport::Evidence::Full,
        ] {
            let mut until: Option<u64> = None;
            let mut oldest: Option<u64> = None;
            truncated = true;
            for _ in 0..FOLLOW_MAX_PAGES {
                pages_read += 1;
                let query = Query {
                    kinds: vec![stream::KIND_WRAP],
                    authors: vec![control.pk_hex()],
                    until,
                    limit: Some(FOLLOW_PAGE),
                    evidence: tier,
                    ..Default::default()
                };
                let wraps = transport.fetch(&query, &community.relays).await?;
                // The `until` cursor is INCLUSIVE (a `-1` step can skip same-second siblings
                // at a page boundary); the wrap-id dedup makes re-served boundary events
                // free, and a page with nothing new means the relay is exhausted.
                let mut fresh = 0usize;
                for w in &wraps {
                    if !seen_wraps.insert(w.id) {
                        continue;
                    }
                    fresh += 1;
                    let at = w.created_at.as_secs();
                    if oldest.is_none_or(|o| at < o) {
                        oldest = Some(at);
                    }
                    // Open + seal-verify every edition; authority is resolved by the roster
                    // fold (CORD-04 §5), not by a signer filter here — an admin's edits fold.
                    if let Ok((ed, _)) = control.open(w) {
                        if seen.insert(ed.inner_id) {
                            editions.push(ed);
                        }
                    }
                }
                // Roster first (roles/grants/banlist → authorized set), then the authority-
                // gated metadata/channel fold over the same edition set.
                authority = fold_authority(community, &editions, &floors);
                fold = apply_control_fold(community, &editions, &floors, &authority);
                // "Nothing is gapped" is NOT "I have read enough".
                //
                // An entity we track whose editions are entirely absent from the window
                // folds away silently — absence dangles no link, so it raises no gap. The
                // loop therefore declared the very first page coherent and stopped, and a
                // community whose grants sit older than one page could never re-derive its
                // own roster: every fold offered zero grants, and only the completeness
                // guard retaining the cache kept the admin list alive at all. That made the
                // cache the sole surviving copy of the roster rather than a cache.
                //
                // So keep paging while anything we already know about is still unaccounted
                // for. This only ever reads MORE; it cannot lose data, and it terminates on
                // the page cap or an exhausted plane exactly as before.
                let heads_now: std::collections::HashSet<&str> =
                    authority.heads.iter().map(|h| h.entity_hex.as_str()).collect();
                // A FAILED read must not read as "I track nothing" — that makes
                // "everything is accounted for" trivially true and stops the walk at the
                // first page, which is the exact failure this loop exists to prevent.
                // Fail toward reading MORE.
                let all_accounted = match crate::db::community::get_community_roles(&cid_hex) {
                    Ok(known) => {
                        // A roster we have not built yet accounts for nothing, so
                        // "everything I track is present" is vacuously TRUE and stops a
                        // COLD device at the first page — caching whatever the newest
                        // window happened to hold as its whole baseline, and losing every
                        // grant older than one page. The early break is an optimisation
                        // for a client that already knows what it is looking for.
                        (!known.roles.is_empty() || !known.grants.is_empty())
                            && known.roles.iter().all(|r| heads_now.contains(r.role_id.as_str()))
                            && known.grants.iter().all(|g| {
                                crate::simd::hex::hex_to_bytes_32_checked(&g.member).is_none_or(|m| {
                                    let eid = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(community.id(), &m));
                                    heads_now.contains(eid.as_str())
                                })
                            })
                    }
                    Err(e) => {
                        crate::log_warn!("[v2:control {}] roster read failed mid-page ({e}) — paging on rather than assuming nothing is tracked", &cid_hex[..8.min(cid_hex.len())]);
                        false
                    }
                };
                if !(fold.gapped || authority.gapped) && all_accounted {
                    truncated = false; // coherent AND complete for everything we track
                    break;
                }
                if fresh == 0 {
                    // A FULL page with nothing new is a same-second wall no `until` steps
                    // past, so older editions stay unreachable; a short page is the end
                    // of the plane, and a gap in THAT is the relay withholding, not us
                    // giving up early.
                    truncated = wraps.len() >= FOLLOW_PAGE;
                    break;
                }
                until = oldest;
            }

            if tier == crate::community::transport::Evidence::Full {
                break;
            }
            let stored_so_far = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
            let heads_so_far: std::collections::HashSet<&str> =
                authority.heads.iter().map(|h| h.entity_hex.as_str()).collect();
            let accounted = stored_so_far.roles.iter().all(|r| !floors.contains_key(&r.role_id) || heads_so_far.contains(r.role_id.as_str()))
                && stored_so_far.grants.iter().all(|g| {
                    crate::simd::hex::hex_to_bytes_32_checked(&g.member).is_none_or(|m| {
                        let eid = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(community.id(), &m));
                        !floors.contains_key(&eid) || heads_so_far.contains(eid.as_str())
                    })
                });
            if accounted {
                break;
            }
            crate::log_debug!(
                "[v2:control {}] {} stored entit(ies) unaccounted after a Quorum read — re-reading at Full before drawing an absence verdict",
                &cid_hex[..8.min(cid_hex.len())],
                stored_so_far.roles.len() + stored_so_far.grants.len()
            );
        }

        // The fetches straddled awaits; a swap since the guard was captured must not
        // write account A's control state into B.
        // A leave/delete raced this follow: writing now would resurrect the community
        // row and orphan floor rows past delete_community's wipe.
        if crate::db::community::community_protocol(community.id())?.is_none() {
            return Ok(ControlFollow::default());
        }
        // Persist advanced floors BEFORE the state save (a failed floor write must not
        // let saved state outrun its floor), stamping the epoch this fold ran under —
        // not the row's write-time value, which a concurrent re-founding can bump. Both
        // the metadata/channel heads and the roster/banlist heads advance their floors;
        // run the advance (v+1) and same-version convergence (fork tiebreak) paths.
        for h in fold.heads.iter().chain(authority.heads.iter()) {
            crate::db::community::set_edition_head_at_epoch(&cid_hex, &h.entity_hex, h.version, &h.self_hash, &h.inner_id, community.root_epoch.0)?;
            crate::db::community::converge_edition_head_at_epoch(&cid_hex, &h.entity_hex, h.version, &h.self_hash, &h.inner_id, community.root_epoch.0)?;
        }
        // Adopt the staff write key a promotion delivered inside MY OWN Grant
        // (CORD-04 §3): decrypt the control_wrap under the granter↔me pairwise key
        // and record the secret. Verified fail-closed inside — the epoch must be
        // the one I'm on and the secret must derive to exactly the control_pk I
        // hold — so a stale wrap (compaction re-wraps a Grant head verbatim across
        // Refoundings) or a forged one is dropped, never adopted.
        let adopted_control_root = adopt_my_control_wrap(community, &editions).await;
        // The adopt can await a remote signer (bunker NIP-44 round-trip) — re-validate
        // before the per-account writes below.
        // Persist the authorized banlist content (retained/withholding folds carry None,
        // so the stored banlist is left intact — an anti-roster never silently un-bans).
        let mut authority_changed = false;
        // Ban marks MERGE (never replace): they must outlive both the ban and this window,
        // so a later un-ban can't resurrect a pre-ban Join. Persisted even when the banlist
        // itself was retained — the history is what the suppression reads.
        let _ = crate::db::community::merge_community_ban_marks(&cid_hex, &authority.banned_at);
        if let Some((banned, version)) = &authority.banlist_persist {
            let mut before = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
            crate::db::community::set_community_banlist(&cid_hex, banned, *version as i64)?;
            let mut after = banned.clone();
            before.sort();
            after.sort();
            authority_changed |= before != after;
        }
        // Persist the authorized roster so capabilities/roles stay sync LOCAL reads
        // (v1 parity: the passive follow folds, reads never fetch). Guarded like v1's
        // fetch path: only an aggregate built from roster editions at least as new as
        // the stored one may replace it — a withholding relay serving NO roster
        // editions folds an empty-but-ungapped aggregate (absence raises no gap flag),
        // and that must RETAIN the stored roster, never wipe standing.
        let newest_roster_at: i64 = editions
            .iter()
            .filter(|e| e.vsk == vsk::ROLE || e.vsk == vsk::GRANT || e.vsk == vsk::BANLIST)
            .map(|e| e.created_at as i64)
            .max()
            .unwrap_or(0);
        // Completeness gate: the `gapped` flag only covers entities present in the window.
        // A role/grant floored on this device but with ZERO editions fetched (aged out of
        // the paging reach) folds absent yet raises no gap — persisting would silently drop
        // it. So if any CURRENTLY-STORED entity is floored but folded no head this round,
        // RETAIN. A real revoke still folds a head (see select_authorized), so it persists.
        let stored = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        let head_ents: std::collections::HashSet<&str> = authority.heads.iter().map(|h| h.entity_hex.as_str()).collect();
        let stored_complete = stored.roles.iter().all(|r| !floors.contains_key(&r.role_id) || head_ents.contains(r.role_id.as_str()))
            && stored.grants.iter().all(|g| {
                crate::simd::hex::hex_to_bytes_32_checked(&g.member).is_none_or(|m| {
                    let eid = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(community.id(), &m));
                    !floors.contains_key(&eid) || head_ents.contains(eid.as_str())
                })
            });
        // `truncated` covers the case the other three can't: a COLD device (no floors,
        // no stored roster) folding under a plane a member has inflated past the pager.
        // `stored_complete` is trivially true with nothing stored, so without this the
        // first sync would cache a partial authority as its own baseline.
        let stored_at = crate::db::community::get_community_roles_at(&cid_hex)?;
        // `stored_at == 0` is a roster with NO plane provenance: the optimistic local
        // merge every creator writes (`merge_local_roster`) so a just-made role works
        // before its edition folds. It is a guess about the plane, not evidence about
        // it, so it must never out-vote a coherent fold — and it was: the seed names
        // entities the plane no longer heads, `stored_complete` goes false forever, and
        // the roster can never be replaced. A community's OWNER is the likeliest holder
        // of such a seed, so the wedge lands on exactly the account whose rotations
        // everyone else is waiting to adopt.
        let seed_only = stored_at == 0;
        // A floor that can NEVER be satisfied must not veto the roster forever.
        //
        // `stored_complete` retains the cache when a stored entity is floored but
        // folded no head, because a withholding relay looks exactly like that. The
        // trouble is that an entity can legitimately stop producing a head for good:
        // its author was demoted, so `select_authorized` drops their editions; or the
        // entity was compacted away. The veto then holds forever, the roster can never
        // be replaced, and a client with a stale roster refuses every rotation from an
        // admin promoted since — which is a fork, arrived at silently.
        //
        // So when the read was COHERENT — the whole plane paged, nothing gapped, and
        // the fetch itself is quorum-backed — an entity that produced no head is
        // genuinely not there as far as the reachable relay set can tell. Forget its
        // floor and let the roster move. A read that was truncated or gapped proves
        // nothing and still retains, which is the withholding case the guard exists
        // for. My OWN grant is never pruned: losing my own standing on a bad read is
        // the one mistake with no path back.
        // NO FLOOR PRUNING. An attempt at it evicted thirteen real admins from a live
        // community: their grant editions were merely outside the fetched window, and
        // "the plane is serving newer editions than mine" is not evidence that a
        // specific entity is gone. A frozen roster is a fork risk; a WRONG roster is a
        // fork plus silent loss of everyone's standing, which is strictly worse. Until
        // there is per-entity proof of absence, absence stays unproven.
        // NOT gated on `authority.gapped`. That flag is a global OR across every
        // entity — its own declaration calls it the per-entity flag that "drives
        // older-paging" — so one unresolvable entity anywhere vetoed the whole roster
        // cache, permanently once the plane is exhausted and more paging cannot help.
        // CORD-04 §5 says a gap fails closed FOR THAT ENTITY, suspending and refetching
        // it, and that already happens: a gapped entity produces no head and so is
        // simply absent from the fold. Freezing every other entity behind it is the
        // over-reach, and it is what left live communities unable to re-derive rosters
        // they could otherwise read perfectly.
        //
        // The downgrade defence is `stored_complete`, which is untouched: nothing we
        // already know can silently vanish. An entity we have never held cannot be
        // stripped from us by its absence.
        if !truncated && (stored_complete || seed_only) && newest_roster_at >= stored_at {
            authority_changed |= stored != authority.roles;
            crate::db::community::set_community_roles(&cid_hex, &authority.roles, newest_roster_at)?;
        } else {
            // Loud, because the failure mode is silent and total: the roster is what
            // authorizes every rotation, so a client that can never re-cache it is
            // permanently deaf to that admin's re-foundings — and the only symptom is
            // an epoch that never advances.
            // Name the BLOCKERS and what the fold actually found. Without these the
            // warning says a decision was made but not on what evidence, which is how
            // a wrong roster stays indistinguishable from a cautious one.
            let mut blockers: Vec<String> = Vec::new();
            for r in &stored.roles {
                if floors.contains_key(&r.role_id) && !head_ents.contains(r.role_id.as_str()) {
                    blockers.push(format!("role:{}", &r.role_id[..8.min(r.role_id.len())]));
                }
            }
            for g in &stored.grants {
                if let Some(m) = crate::simd::hex::hex_to_bytes_32_checked(&g.member) {
                    let eid = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(community.id(), &m));
                    if floors.contains_key(&eid) && !head_ents.contains(eid.as_str()) {
                        blockers.push(format!("grant:{}", &g.member[..8.min(g.member.len())]));
                    }
                }
            }
            // Per-entity fate of every roster edition in the window. "Blocked" only
            // says which stored entity produced no head; this says WHY — whether its
            // editions were absent, or present and dropped, and by whom they were
            // authored. Guessing between those three cost a day.
            {
                use std::collections::BTreeMap;
                let mut fate: BTreeMap<String, (u64, u64, String, &str)> = BTreeMap::new();
                for e in &editions {
                    if e.vsk != vsk::ROLE && e.vsk != vsk::GRANT {
                        continue;
                    }
                    let kind = if e.vsk == vsk::ROLE { "role" } else { "grant" };
                    let eid = crate::simd::hex::bytes_to_hex_32(&e.entity_id);
                    let slot = fate.entry(eid).or_insert((0, 0, String::new(), kind));
                    slot.0 += 1;
                    if e.version > slot.1 {
                        slot.1 = e.version;
                        slot.2 = e.author.to_hex()[..8].to_string();
                        slot.3 = kind;
                    }
                }
                let head_now: std::collections::HashSet<&str> =
                    authority.heads.iter().map(|h| h.entity_hex.as_str()).collect();
                let rows: Vec<String> = fate
                    .iter()
                    .map(|(eid, (n, v, author, kind))| {
                        format!(
                            "{}[{kind}]:{}ed/v{}/by{}{}{}",
                            &eid[..8], n, v, author,
                            if head_now.contains(eid.as_str()) {
                                "/HEAD".to_string()
                            } else {
                                AUTHORITY_REFUSALS
                                    .with(|c| c.borrow().get(eid.as_str()).copied())
                                    .map(|r| {
                                        let extra = MISSING_ROLE_REFS
                                            .with(|m| m.borrow().get(eid.as_str()).cloned())
                                            .map(|ids| format!(" wants:{ids}"))
                                            .unwrap_or_default();
                                        format!("/DROPPED({r}{extra})")
                                    })
                                    .unwrap_or_else(|| "/dropped(no candidate survived the fold)".into())
                            },
                            floors.get(eid).map(|f| format!("/floor@v{}", f.0)).unwrap_or_default(),
                        )
                    })
                    .collect();
                // The OWNER is the root of all authority: every other author needs a
                // grant that traces back to them. If no edition here is owner-authored
                // the chain cannot bootstrap at all, and that is a different bug from
                // any individual entity being rejected.
                crate::log_warn!(
                    "[v2:control {}] fold accepted roles: [{}]",
                    &cid_hex[..8.min(cid_hex.len())],
                    authority.roles.roles.iter().map(|r| format!("{}@pos{}", &r.role_id[..8.min(r.role_id.len())], r.position)).collect::<Vec<_>>().join(" ")
                );
                crate::log_warn!(
                    "[v2:control {}] owner={} — roster editions in window: [{}]",
                    &cid_hex[..8.min(cid_hex.len())],
                    community.owner().map(|o| o.to_hex()[..8].to_string()).unwrap_or_else(|_| "UNPROVEN".into()),
                    rows.join(" ")
                );
            }
            crate::log_warn!(
                "[v2:control {}] roster NOT cached (truncated={} authority_gapped={} doc_gapped={} stored_complete={} newest_roster_at={} stored_at={}) — stored {}r/{}g, fold offers {}r/{}g from {} edition(s) over {} page(s), blocked by [{}]",
                &cid_hex[..8.min(cid_hex.len())], truncated, authority.gapped, fold.gapped, stored_complete, newest_roster_at, stored_at,
                stored.roles.len(), stored.grants.len(), authority.roles.roles.len(), authority.roles.grants.len(),
                editions.len(), pages_read,
                blockers.join(", ")
            );
        }
        // Cache the folded invite Registry so Public/Private stays a sync LOCAL read
        // (v1 parity — `invite_registry` is the column every caller reads). Gated like
        // the roster: a truncated or gapped window folds an empty registry out of mere
        // absence, and persisting that under-states Public — the unsafe direction, since
        // it leaves a live link open behind a ban.
        if !truncated && !authority.gapped && !fold.gapped {
            if let Ok(owner) = community.owner() {
                let sets = live_invite_link_sets(community.id(), &owner.to_hex(), &editions, &authority, &floors);
                let live = flatten_link_sets(&sets);
                let mut before = crate::db::community::get_community_invite_registry(&cid_hex).unwrap_or_default();
                before.sort();
                if before != live {
                    crate::db::community::set_community_invite_registry(&cid_hex, &live)?;
                    authority_changed = true;
                }
                // The per-creator split drives "X has N active invite links" and the
                // first-link-flips-Public confirm; it lives in its own table.
                crate::db::community::replace_invite_link_sets(&cid_hex, &sets)?;
            }
        }
        // Folded Pin List heads (CORD-04 §7): raw content per channel. The write
        // itself is monotonic on version (atomic in the statement), so a stale
        // window racing a publish echo can never regress a newer held head.
        for (channel_hex, content, version, author_npub, created_at) in &fold.pins_persist {
            match crate::db::community::set_community_pins(&cid_hex, channel_hex, content, *version as i64) {
                Ok(true) => {
                    crate::log_info!("[pins] fold adopted v{} for channel {}", version, &channel_hex[..12]);
                    crate::emit_event(
                        "community_pins_updated",
                        &serde_json::json!({ "community_id": cid_hex, "channel_id": channel_hex }),
                    );
                    note_pins_modified(channel_hex, *version, author_npub, *created_at).await;
                }
                Ok(false) => {}
                Err(e) => crate::log_warn!("[pins] fold persist failed: {e}"),
            }
        }
        // Roster/banlist moves are invisible in the returned community (they live in
        // their own columns), so callers that key a refresh off `updated` would never
        // repaint a promote/demote/ban. Announce from the single fold point — it covers
        // realtime, boot catch-up and manual sync alike.
        if authority_changed {
            crate::emit_event("community_refreshed", &serde_json::json!({ "community_id": cid_hex }));
        }
        // Owner-side silent Admin widening (PIN_MESSAGES): after the roster has
        // folded, so the check reads the settled roles. Once per community per
        // process — the fold runs constantly and the upgrade is a one-shot.
        {
            static UPGRADED: std::sync::Mutex<Option<std::collections::HashSet<String>>> = std::sync::Mutex::new(None);
            let first = UPGRADED
                .lock()
                .map(|mut set| set.get_or_insert_with(Default::default).insert(cid_hex.clone()))
                .unwrap_or(false);
            if first {
                let _ = upgrade_admin_role_pin_bit(transport, community).await;
            }
        }
        // The pins/upgrade tail awaited network I/O — re-validate before the vault save.
        // An adopted staff key rides whatever gets saved (the fold's update, or the
        // otherwise-unchanged community) — the vault write that makes it durable.
        let mut updated = fold.updated;
        if let Some(cr) = adopted_control_root {
            let mut u = updated.take().unwrap_or_else(|| community.clone());
            u.control_root = Some(cr);
            updated = Some(u);
        }
        match updated {
            Some(u) => {
                crate::db::community::save_community_v2(&u)?;
                Ok(ControlFollow { updated: Some(u), authority_changed })
            }
            None => Ok(ControlFollow { updated: None, authority_changed }),
        }
    })
    .await
}

/// Adopt the `control_root` a staff-making Grant delivered to ME (CORD-04 §3).
///
/// Nothing to adopt on a legacy epoch (no write key exists) or when the secret
/// is already held. Candidate editions are MY grant coordinate's, newest
/// version first; authority-gating them is unnecessary for adoption — the
/// derive check IS the gate (only the true secret derives to the held
/// `control_pk`, so the worst a forged edition can do is fail it). The epoch
/// rides inside the ciphertext because staleness is structural: compaction
/// re-wraps a Grant head verbatim across Refoundings, and staff crossing a
/// rotation get the new secret in their 136-byte base blob instead.
async fn adopt_my_control_wrap(community: &CommunityV2, editions: &[ParsedEdition]) -> Option<[u8; 32]> {
    use nostr_sdk::prelude::AsyncNip44;
    let held_pk = community.control_pk?;
    if community.control_root.is_some() {
        return None;
    }
    let my_pk = me_pk().ok()?;
    let signer = crate::signer::active_signer().ok()?;
    let my_eid = super::derive::grant_locator(community.id(), &my_pk.to_bytes());
    let mut candidates: Vec<&ParsedEdition> = editions
        .iter()
        .filter(|e| e.vsk == vsk::GRANT && e.entity_id == my_eid)
        .collect();
    candidates.sort_by_key(|e| std::cmp::Reverse(e.version));
    for ed in candidates {
        let Some(wrap_b64) = super::roles::parse_grant_control_wrap(&ed.content) else { continue };
        // The granter is the edition's sealed author — the pairwise key's other
        // half (one ECDH either side can compute; bunker accounts included).
        let Ok(plain_b64) = signer.nip44_decrypt_async(&ed.author, &wrap_b64).await else { continue };
        let Ok(plain) = base64_simd::STANDARD.decode_to_vec(plain_b64.as_bytes()) else { continue };
        let Ok((epoch, root)) = super::rekey::parse_control_wrap(&plain) else { continue };
        if epoch != community.root_epoch {
            continue;
        }
        if super::derive::control_signer_group_key(&root, community.id(), epoch).pk() != held_pk {
            continue;
        }
        crate::log_info!("[v2] adopted the staff write key from my Grant (epoch {})", epoch.0);
        return Some(root);
    }
    None
}

/// Control-follow paging bounds: enough depth to re-anchor a long-offline floor
/// (H1/M8 refetch) without letting a flooding relay stall the follow queue.
///
/// Nearly free to raise: both follow loops exit the moment the fold stops being
/// gapped, so the cap only binds when something is genuinely missing — exactly
/// when paging further is what's wanted. The old ceiling of 4 (~2k editions) sat
/// under a plane that 100 roles + 400 grants already outgrows before counting
/// superseded versions, which accumulate until a compaction retires them.
/// One walk's hop bound. A backlog deeper than this converges across passes,
/// because every adopted hop is checkpointed before the next is attempted.
const MAX_WALK_STEPS: usize = 128;
const FOLLOW_MAX_PAGES: usize = 32;
const FOLLOW_PAGE: usize = 500;
/// Page ceiling for a COMPACTION read (CORD-06 §3: a Refounder that cannot fold
/// every Control Event must abort). Far above any real plane, but plane depth is
/// attacker-controlled — any member holds the key that mints wraps — so the read
/// is bounded and reports coming up short rather than compacting a partial view.
const COMPACT_MAX_PAGES: usize = 512;

/// A folded control head to persist as the per-entity refuse-downgrade floor.
#[derive(Clone)]
struct FoldedHead {
    entity_hex: String,
    version: u64,
    self_hash: [u8; 32],
    inner_id: [u8; 32],
}

/// The outcome of a floor-aware control fold: the updated community (if content
/// changed), the heads to persist as the new floor (returned even when content is
/// unchanged, so the floor still seeds/advances), and whether any TRACKING entity
/// hit an unresolvable gap — the caller's signal to page older history and re-fold
/// (CORD-04 H1/M8's refetch).
struct ControlFold {
    updated: Option<CommunityV2>,
    heads: Vec<FoldedHead>,
    gapped: bool,
    /// Folded Pin List heads to persist:
    /// `(channel_hex, raw content, version, author_npub, created_at)`.
    /// Raw carried bytes on purpose — republishing must not re-serialize.
    pins_persist: Vec<(String, String, u64, String, u64)>,
}

/// Per-entity floor: `(version, self_hash, inner_id)` of the committed head.
type Floor = (u64, [u8; 32], Option<[u8; 32]>);
type Floors = std::collections::HashMap<String, Floor>;

/// Fold owner-authored control editions into an updated community using the
/// PERSISTED per-entity version floor (refuse-downgrade). Per entity, fold with
/// [`version::fold`]`(floor, floor_hash)`:
///   - ANCHORED: adopt the chain-verified head. A `gap` ABOVE it (withheld middles)
///     doesn't block the verified prefix — refuse-downgrade holds for everything
///     applied — but flags `gapped` so the caller pages for the rest.
///   - UNANCHORED under a held floor: one legitimate cause is a same-version owner
///     fork AT the floor whose deterministic winner (lower inner id; a NULL held id
///     is always replaceable, mirroring v1's `decide()`) isn't our held edition —
///     the floor CONVERGES to the winner and the chain re-anchors on it, so every
///     client lands on the same head where a hash-strict floor would wedge forever.
///     Anything else is withholding → fail closed + `gapped`.
///   - BOOTSTRAPPING (`floor == 0` — a fresh joiner, or a fresh epoch after a
///     Refounding, since the caller epoch-filters the floor) takes the highest
///     signed head (author already owner-filtered).
///
/// This matches CORD-04 §1 and mirrors v1's `fold_roster`. Epoch-filtering makes a
/// compaction at a new epoch auto-bootstrap, converging with Armada's acceptance of
/// a compacted head across a dangling `prev` (Armada doesn't persist a floor, so a
/// Vector floor only makes Vector STRICTER locally — no wire change, honest-case
/// convergence preserved).
fn apply_control_fold(community: &CommunityV2, editions: &[ParsedEdition], floors: &Floors, authority: &AuthoritySet) -> ControlFold {
    use crate::community::roles::Permissions;
    use std::collections::BTreeMap;

    let owner_hex = community.owner().ok().map(|o| o.to_hex());

    let mut groups: BTreeMap<(String, [u8; 32]), Vec<&ParsedEdition>> = BTreeMap::new();
    for e in editions {
        groups.entry((e.vsk.clone(), e.entity_id)).or_default().push(e);
    }

    let mut out = community.clone();
    let mut changed = false;
    let mut heads = Vec::new();
    let mut gapped = false;
    let mut pins_persist = Vec::new();
    // Pin List eids are one-way HKDF locators, so attribution runs the other
    // direction: precompute every known channel's locator. An eid matching no
    // channel folds nothing this round — once the channel's metadata lands, the
    // next fold attributes it (editions re-fold from the window each sync).
    let pins_by_eid: std::collections::HashMap<[u8; 32], String> = community
        .channels
        .iter()
        .map(|ch| (super::derive::pins_locator(community.id(), &ch.id), crate::simd::hex::bytes_to_hex_32(&ch.id.0)))
        .collect();
    for ((vsk_code, eid), group) in &groups {
        // This fold applies three entities: community metadata (eid ==
        // community_id), channel metadata, and per-channel Pin Lists. A vsk-2
        // whose eid equals the community id is excluded — the floor row keys on
        // the entity alone, so it would share (and corrupt) the metadata
        // chain's floor.
        let is_meta = vsk_code == vsk::COMMUNITY_METADATA && *eid == community.id().0;
        let is_channel = vsk_code == vsk::CHANNEL_METADATA && *eid != community.id().0;
        let pins_channel = (vsk_code == vsk::PINS).then(|| pins_by_eid.get(eid)).flatten();
        if !is_meta && !is_channel && pins_channel.is_none() {
            continue;
        }
        // Authority gate (CORD-04 §5): only editions whose author CURRENTLY holds the
        // entity's management bit are eligible. Pre-filtering before the fold means a
        // demoted admin's (possibly higher-version) edition can't be the head; the
        // highest AUTHORIZED head wins. The owner is supreme.
        let required = if is_meta {
            Permissions::MANAGE_METADATA
        } else if is_channel {
            Permissions::MANAGE_CHANNELS
        } else {
            Permissions::PIN_MESSAGES
        };
        let authed: Vec<&ParsedEdition> = group
            .iter()
            .copied()
            .filter(|e| {
                let author = e.author.to_hex();
                // A banned npub's edits are dropped (CORD-04 §4), even if they still
                // held a bit via a not-yet-stripped grant.
                !authority.banned.contains(&author)
                    && authority.roles.is_authorized(&author, owner_hex.as_deref(), required)
                    // …and the CORD-04 §5 sync floor. Resolved against the Grant heads
                    // this same fold settled, so it works on a bootstrap where no
                    // persisted head exists yet.
                    && citation_ok_in_fold(community.id(), &authority.heads, owner_hex.as_deref(), &e.author, e.authority.as_ref())
            })
            .collect();
        if authed.is_empty() {
            continue;
        }
        let entity_hex = crate::simd::hex::bytes_to_hex_32(eid);
        let fold_eds: Vec<version::Edition> = authed.iter().map(|p| p.to_fold_edition()).collect();
        let (hi, entity_gapped) = fold_head(&fold_eds, floors.get(&entity_hex));
        gapped |= entity_gapped;
        let Some(hi) = hi else { continue };

        let head = authed[hi];
        heads.push(FoldedHead { entity_hex, version: head.version, self_hash: head.self_hash, inner_id: head.inner_id });
        if is_meta {
            if let Ok(meta) = serde_json::from_str::<control::CommunityMetadata>(&head.content) {
                changed |= apply_community_metadata(&mut out, meta);
            }
        } else if is_channel {
            if let Ok(meta) = serde_json::from_str::<control::ChannelMetadata>(&head.content) {
                // vsk-2 carries no community binding (shared v1 grammar); a same-owner
                // cross-community replay can inject a phantom PUBLIC channel (bounded:
                // root-scoped key, eids don't collide). Binding is a deferred wire change.
                changed |= apply_channel_metadata(&mut out, ChannelId(*eid), meta);
            }
        } else if let Some(channel_hex) = pins_channel {
            // The RAW carried content, cap-violations included: readers judge
            // those (read as empty), and a re-serialization here would break the
            // byte cap's meaning and every republish's fidelity.
            use nostr_sdk::prelude::ToBech32;
            let author_npub = head
                .author
                .to_bech32()
                .unwrap_or_else(|_| head.author.to_hex());
            pins_persist.push((channel_hex.clone(), head.content.clone(), head.version, author_npub, head.created_at));
        }
    }
    ControlFold { updated: changed.then_some(out), heads, gapped, pins_persist }
}

/// Fold one entity's editions against its persisted floor into a head index (into the
/// input slice) plus whether a TRACKING gap was hit (the caller pages older history).
/// Encapsulates the W2 refuse-downgrade policy: bootstrap at floor 0 (highest signed
/// head, what Armada shows across a compaction's dangling prev); adopt the chain-
/// anchored head, paging on an upper gap; converge a same-version fork at the floor to
/// the lower-inner-id winner; and fail closed otherwise.
fn fold_head(fold_eds: &[version::Edition], floor: Option<&Floor>) -> (Option<usize>, bool) {
    let floor_v = floor.map(|f| f.0).unwrap_or(0);
    if floor_v == 0 {
        return (version::bootstrap_head(fold_eds, 0), false);
    }
    let floor_hash = floor.map(|f| &f.1);
    let held_inner = floor.and_then(|f| f.2);
    let result = version::fold(fold_eds, floor_v, floor_hash);
    if result.anchored {
        return (result.head, result.gap); // verified prefix; page any upper gap.
    }
    if result.head.is_none() && !result.gap {
        return (None, false); // everything below floor — a stale relay, no paging.
    }
    // Unanchored under a held floor: converge a same-version fork at the floor to its
    // deterministic winner (lower inner id; a NULL held id is always replaceable),
    // else fail closed.
    let fork = fold_eds.iter().enumerate().filter(|(_, e)| e.version == floor_v).min_by_key(|(_, e)| e.tiebreak_id);
    let win_hash = match fork {
        Some((_, w)) if floor_hash != Some(&w.self_hash) && held_inner.is_none_or(|h| w.tiebreak_id < h) => w.self_hash,
        _ => return (None, true), // detached from our committed head → withholding.
    };
    let re = version::fold(fold_eds, floor_v, Some(&win_hash));
    if !re.anchored {
        return (None, true);
    }
    (re.head, re.gap)
}

/// The folded, delegation-AUTHORIZED control-plane authority (CORD-04): the roster
/// (roles + grants, owner-seeded fixpoint), the enforced banlist, and the
/// role/grant/banlist heads to persist as refuse-downgrade floors. The owner is
/// recomputed from the self-certifying community_id at each use.
struct AuthoritySet {
    roles: crate::community::roles::CommunityRoles,
    banned: std::collections::BTreeSet<String>,
    heads: Vec<FoldedHead>,
    gapped: bool,
    /// The authorized banlist `(content, version)` to persist when an authorized head
    /// advanced the floor. `None` when the banlist was retained (no new authorized
    /// head) or is empty — the caller then leaves the stored banlist untouched.
    banlist_persist: Option<(Vec<String>, u64)>,
    /// Ban HISTORY: npub hex → `created_at` (secs) of the newest authorized edition that
    /// named them, across every edition in the window rather than just the head. Outlives
    /// the ban itself so an un-ban can't resurrect a phantom (see [`fold_members`]).
    banned_at: std::collections::BTreeMap<String, u64>,
}

impl AuthoritySet {
    /// Bootstrap authority for a community with no roster editions folded yet: only
    /// the owner is authorized (supreme), nobody banned.
    fn owner_only() -> Self {
        AuthoritySet {
            roles: Default::default(),
            banned: Default::default(),
            heads: vec![],
            gapped: false,
            banlist_persist: None,
            banned_at: Default::default(),
        }
    }
}

/// Fold the roster/banlist entities (vsk 1/3/4) from the control editions into the
/// delegation-AUTHORIZED roster + enforced banlist (CORD-04 §2-§5). Each entity binds
/// to its coordinate (role at role_id, grant at grant_locator(cid, member), banlist at
/// banlist_locator(cid)); a content whose coordinate doesn't match is dropped. Roles
/// cap at the 100 lowest role_ids, a member at 64 roles, the banlist at 500. The
/// banlist is enforced only if its head's signer held BAN in the authorized roster.
fn fold_authority(community: &CommunityV2, editions: &[ParsedEdition], floors: &Floors) -> AuthoritySet {
    use crate::community::roles::Permissions;
    use std::collections::BTreeMap;

    let cid = community.id();
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
    let owner = community.owner().ok();
    let owner_hex = owner.map(|o| o.to_hex());
    let banlist_eid = super::derive::banlist_locator(cid);
    let banlist_hex = crate::simd::hex::bytes_to_hex_32(&banlist_eid);

    let mut groups: BTreeMap<[u8; 32], Vec<&ParsedEdition>> = BTreeMap::new();
    for e in editions {
        if e.vsk == vsk::ROLE || e.vsk == vsk::GRANT || e.vsk == vsk::BANLIST {
            groups.entry(e.entity_id).or_default().push(e);
        }
    }

    // Per-entity CANDIDATE lists — every ≥floor edition of a role/grant, highest
    // version first (lowest inner-id as the deterministic tiebreak). CORD-04 §1: an
    // edition whose signer isn't authorized is SIMPLY DROPPED and the fold continues
    // to the next candidate, so a forged higher-version edition can't suppress the
    // authorized head beneath it (the author-blind collapse-to-one-head it replaces
    // let any member vanish a role or a member's grant). `gapped` (drives older-
    // paging) stays fold_head's per-entity flag.
    let mut role_cands: BTreeMap<String, Vec<AuthorityCand>> = BTreeMap::new();
    let mut grant_cands: BTreeMap<String, Vec<AuthorityCand>> = BTreeMap::new();
    let mut gapped = false;

    for (eid, group) in &groups {
        // The banlist is folded author-aware AFTER the roster is known (below).
        if *eid == banlist_eid {
            continue;
        }
        let entity_hex = crate::simd::hex::bytes_to_hex_32(eid);
        let fold_eds: Vec<version::Edition> = group.iter().map(|p| p.to_fold_edition()).collect();
        let (_hi, entity_gapped) = fold_head(&fold_eds, floors.get(&entity_hex));
        gapped |= entity_gapped;
        let floor_v = floors.get(&entity_hex).map(|f| f.0).unwrap_or(0);

        for p in group {
            // Refuse-downgrade: never consider an edition below the persisted floor.
            if p.version < floor_v {
                continue;
            }
            let head = FoldedHead { entity_hex: entity_hex.clone(), version: p.version, self_hash: p.self_hash, inner_id: p.inner_id };
            match p.vsk.as_str() {
                vsk::ROLE => {
                    // Bind: the content's role_id IS the coordinate; position 0 is the owner's.
                    if let Some(role) = super::roles::parse_role_content(&p.content) {
                        if role.role_id == entity_hex && role.position != 0 {
                            role_cands.entry(entity_hex.clone()).or_default().push(AuthorityCand { role: Some(role), grant: None, author: p.author, head, citation: p.authority.clone() });
                        }
                    }
                }
                vsk::GRANT => {
                    if let Some(mut grant) = super::roles::parse_grant_content(&p.content) {
                        if let Some(member) = crate::simd::hex::hex_to_bytes_32_checked(&grant.member) {
                            if super::derive::grant_locator(cid, &member) == *eid {
                                grant.role_ids.truncate(super::roles::MAX_ROLES_PER_MEMBER);
                                grant_cands.entry(entity_hex.clone()).or_default().push(AuthorityCand { role: None, grant: Some(grant), author: p.author, head, citation: p.authority.clone() });
                            }
                        }
                    }
                }
                _ => {}
            }
        }
    }
    for cands in role_cands.values_mut().chain(grant_cands.values_mut()) {
        cands.sort_by(|a, b| b.head.version.cmp(&a.head.version).then(a.head.inner_id.cmp(&b.head.inner_id)));
    }

    let empty: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
    // Preliminary roster (bans not yet applied) — the authority view the banlist head
    // is judged against.
    let (prelim, prelim_heads) = select_authorized(cid, &role_cands, &grant_cands, owner_hex.as_deref(), &empty, None);

    // Banlist (CORD-04 §4), folded AUTHORITY-aware so its two anti-roster hazards are
    // both closed:
    //   - head selection: the head is the highest version whose author CURRENTLY holds
    //     BAN — an unauthorized higher-version edition can't erase existing bans
    //     (fail-open), and the floor never advances to one;
    //   - per-target: each entry is kept only if the author STRICTLY OUTRANKS that
    //     target (`can_act_on_member` — an admin can't ban a peer/superior, and the
    //     owner is unbannable);
    //   - withholding: when no authorized head is served, the persisted banlist is
    //     RETAINED (an anti-roster must not un-ban on a relay withholding the ban).
    let persisted_banned: Vec<String> = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
    // An ALREADY-banned npub can't author the banlist (a banned member vanishes, §4), or
    // a BAN-holder whose grant-strip hasn't yet folded could publish a list omitting their
    // OWN ban to un-ban themselves (removals aren't outrank-checked). Exclude them from
    // head eligibility, not just from the roster.
    let banned_authors: std::collections::HashSet<&str> = persisted_banned.iter().map(String::as_str).collect();
    let banlist_authored: Vec<&ParsedEdition> = groups
        .get(&banlist_eid)
        .map(|g| {
            g.iter()
                .copied()
                .filter(|e| {
                    let ah = e.author.to_hex();
                    !banned_authors.contains(ah.as_str())
                        && prelim.is_authorized(&ah, owner_hex.as_deref(), Permissions::BAN)
                        && citation_ok_in_fold(cid, &prelim_heads, owner_hex.as_deref(), &e.author, e.authority.as_ref())
                })
                .collect()
        })
        .unwrap_or_default();
    // Ban history for phantom suppression: the newest AUTHORIZED edition naming each npub,
    // over EVERY candidate rather than only the head — an un-ban replaces the head, so the
    // head alone forgets the ban that the suppression exists to remember. The owner is
    // skipped: they are never bannable, and a moderator listing them must not durably
    // suppress them past the un-ban.
    let mut banned_at: std::collections::BTreeMap<String, u64> = std::collections::BTreeMap::new();
    for p in &banlist_authored {
        for t in super::roles::parse_banlist_content(&p.content).unwrap_or_default() {
            if owner_hex.as_deref() == Some(t.as_str()) {
                continue;
            }
            let slot = banned_at.entry(t).or_insert(0);
            *slot = (*slot).max(p.created_at);
        }
    }
    let mut banlist_persist: Option<(Vec<String>, u64)> = None;
    let mut banlist_head: Option<FoldedHead> = None;
    let banned: std::collections::BTreeSet<String> = if banlist_authored.is_empty() {
        persisted_banned.into_iter().collect()
    } else {
        let fold_eds: Vec<version::Edition> = banlist_authored.iter().map(|p| p.to_fold_edition()).collect();
        let (hi, g) = fold_head(&fold_eds, floors.get(&banlist_hex));
        gapped |= g;
        match hi {
            Some(hi) => {
                let head = banlist_authored[hi];
                let ah = head.author.to_hex();
                let list: Vec<String> = super::roles::parse_banlist_content(&head.content)
                    .unwrap_or_default()
                    .into_iter()
                    .filter(|t| prelim.can_act_on_member(&ah, owner_hex.as_deref(), t, Permissions::BAN))
                    .take(super::roles::MAX_BANLIST)
                    .collect();
                banlist_head = Some(FoldedHead { entity_hex: banlist_hex.clone(), version: head.version, self_hash: head.self_hash, inner_id: head.inner_id });
                banlist_persist = Some((list.clone(), head.version));
                list.into_iter().collect()
            }
            None => persisted_banned.into_iter().collect(),
        }
    };

    // Final roster (CORD-04 §4: a banned npub vanishes — every edition it authored is
    // dropped, and a grant TO a banned member carries no rank). Re-run selection with
    // the banned set excluded so a banned admin loses authority.
    UNCITED_ACCEPTED.with(|n| *n.borrow_mut() = 0);
    let mut refusals: std::collections::BTreeMap<String, &'static str> = Default::default();
    let (mut authorized, mut heads) = select_authorized(cid, &role_cands, &grant_cands, owner_hex.as_deref(), &banned, Some(&mut refusals));
    AUTHORITY_REFUSALS.with(|c| *c.borrow_mut() = refusals);
    if let Some(bh) = banlist_head {
        heads.push(bh);
    }

    // Cap the AUTHORIZED community at the 100 lowest role_ids — applied AFTER
    // authorization, so an attacker's unauthorized roles can't consume cap slots and
    // evict a legitimate one (the pre-authorize cap they replace let 100 forged low-id
    // roles empty the roster).
    if authorized.roles.len() > super::roles::MAX_ROLES_PER_COMMUNITY {
        authorized.roles.sort_by(|a, b| a.role_id.cmp(&b.role_id));
        authorized.roles.truncate(super::roles::MAX_ROLES_PER_COMMUNITY);
        let kept: std::collections::HashSet<&str> = authorized.roles.iter().map(|r| r.role_id.as_str()).collect();
        authorized.grants.iter_mut().for_each(|g| g.role_ids.retain(|rid| kept.contains(rid.as_str())));
        authorized.grants.retain(|g| !g.role_ids.is_empty());
    }

    AuthoritySet { roles: authorized, banned, heads, gapped, banlist_persist, banned_at }
}

/// One candidate edition of a role/grant entity — the pool [`select_authorized`]
/// draws the highest AUTHORIZED head from (exactly one of `role`/`grant` is set).
struct AuthorityCand {
    role: Option<crate::community::roles::Role>,
    grant: Option<crate::community::roles::MemberGrant>,
    author: PublicKey,
    head: FoldedHead,
    /// The `vac` this edition carried (CORD-04 §5). `None` for an owner edition
    /// (supreme, cites nothing) or an uncited one — the latter is refused.
    citation: Option<crate::community::edition::AuthorityCitation>,
}

/// CORD-04 §5 sync floor, resolved against the heads THIS fold pass has accepted.
///
/// Deliberately not the persisted-head helper the kick/hide paths use: this IS the
/// pass that establishes those heads, so an external floor would refuse every
/// non-owner edition on a bootstrap and the roster could never fold. Same rule the
/// spec gives for a dangling `prev` across a Refounding — a fresh joiner takes the
/// authority-verified head as its baseline, a tracking client fails closed per
/// entity — applied to the citation instead of the chain link.
fn citation_ok_in_fold(
    cid: &crate::community::CommunityId,
    heads: &[FoldedHead],
    owner_hex: Option<&str>,
    author: &PublicKey,
    citation: Option<&crate::community::edition::AuthorityCitation>,
) -> bool {
    let actor_hex = author.to_hex();
    if owner_hex == Some(actor_hex.as_str()) {
        return true;
    }
    let grant_hex = crate::simd::hex::bytes_to_hex_32(&super::derive::grant_locator(cid, &author.to_bytes()));
    let as_entity: Vec<crate::community::roster::EntityHead> = heads
        .iter()
        .map(|h| crate::community::roster::EntityHead {
            entity_hex: h.entity_hex.clone(),
            version: h.version,
            self_hash: h.self_hash,
            inner_id: h.inner_id,
            citation: None,
        })
        .collect();
    crate::community::roster::authority_citation_satisfied(&as_entity, owner_hex, &actor_hex, &grant_hex, citation)
}

thread_local! {
    /// How many uncited editions the last fold admitted on rank alone — pre-citation
    /// clients' output. Visibility only; the rank gates decide.
    static UNCITED_ACCEPTED: std::cell::RefCell<u32> = const { std::cell::RefCell::new(0) };
    /// For a grant refused on a missing role reference: which role ids were absent.
    static MISSING_ROLE_REFS: std::cell::RefCell<std::collections::BTreeMap<String, String>> =
        const { std::cell::RefCell::new(std::collections::BTreeMap::new()) };
    /// Refusal reasons from the most recent authority fold on this thread — read by
    /// the roster diagnostic. Diagnostic only; nothing branches on it.
    static AUTHORITY_REFUSALS: std::cell::RefCell<std::collections::BTreeMap<String, &'static str>> =
        const { std::cell::RefCell::new(std::collections::BTreeMap::new()) };
}

/// The owner-seeded delegation fixpoint (CORD-04 §1/§2), author-AWARE: per entity it
/// takes the highest-version candidate whose author is authorized to author it under
/// the roster resolved SO FAR, dropping unauthorized higher versions rather than
/// vanishing the entity. Authority resolves outward from the owner (proven by
/// `community_id`, never a Role), and the strict-outrank rule (no edition at/above its
/// signer's own position) keeps the fixpoint monotone, so it converges. Returns the
/// authorized roster plus the per-entity heads of the SELECTED editions (the floor
/// advances only to authorized heads — an unauthorized forgery never poisons it).
fn select_authorized(
    cid: &crate::community::CommunityId,
    role_cands: &std::collections::BTreeMap<String, Vec<AuthorityCand>>,
    grant_cands: &std::collections::BTreeMap<String, Vec<AuthorityCand>>,
    owner_hex: Option<&str>,
    excluded: &std::collections::BTreeSet<String>,
    // Why each entity was refused, for diagnosis. A rejection here is invisible by
    // construction — every gate is a bare `continue` — so a roster that silently
    // collapses gives a reader nothing to go on.
    mut why: Option<&mut std::collections::BTreeMap<String, &'static str>>,
) -> (crate::community::roles::CommunityRoles, Vec<FoldedHead>) {
    use crate::community::roles::{CommunityRoles, Permissions};
    let mut accepted = CommunityRoles::default();
    let mut heads: Vec<FoldedHead> = Vec::new();
    // Jacobi iteration: authority propagates one delegation level per round, so a
    // generous multiple of the entity count is an ample bound. Non-convergence (never
    // seen for an owner-rooted chain) falls through fail-safe: only authorized editions
    // are ever selected.
    let bound = 2 * (role_cands.len() + grant_cands.len()) + 8;
    for _ in 0..bound {
        let mut next = CommunityRoles::default();
        let mut next_heads: Vec<FoldedHead> = Vec::new();

        for cands in role_cands.values() {
            // Two gates, not one (CORD-04 §2). Minting at a position you outrank
            // is necessary but not sufficient: an edition REPLACES the entity, so
            // the author must also outrank the position standing before it.
            // Without that, an admin at position 5 rewrites the position-1 role
            // to position 9 — every check passes, since 9 is beneath them — and
            // a role that outranked them is now beneath them, along with everyone
            // holding it. Rank inversion by republish.
            //
            // The chain is replayed ASCENDING so each version is judged against
            // the position its own predecessor established, then the highest
            // admissible version wins (candidates arrive version-DESC, forks
            // broken by lowest inner_id — preserved by walking version groups).
            let mut admissible: std::collections::HashSet<[u8; 32]> = std::collections::HashSet::new();
            let mut standing: Option<u32> = None;
            let mut i = cands.len();
            while i > 0 {
                let hi = i;
                let ver = cands[i - 1].head.version;
                while i > 0 && cands[i - 1].head.version == ver {
                    i -= 1;
                }
                // One winner per version: fork siblings can't sidestep the gate.
                for c in cands[i..hi].iter().rev() {
                    let Some(role) = &c.role else { continue };
                    let ah = c.author.to_hex();
                    let note = |w: &mut Option<&mut std::collections::BTreeMap<String, &'static str>>, r: &'static str| {
                        if let Some(m) = w.as_mut() {
                            m.insert(c.head.entity_hex.clone(), r);
                        }
                    };
                    if excluded.contains(&ah) || role.position == 0 {
                        note(&mut why, "role: author banned or position 0");
                        continue;
                    }
                    if !accepted.can_act_on_position(&ah, owner_hex, role.position, Permissions::MANAGE_ROLES) {
                        note(&mut why, "role: author lacks MANAGE_ROLES over this position");
                        continue;
                    }
                    if let Some(prev) = standing {
                        if !accepted.can_act_on_position(&ah, owner_hex, prev, Permissions::MANAGE_ROLES) {
                            note(&mut why, "role: author cannot outrank the position it replaces");
                            continue;
                        }
                    }
                    // A `vac` is a SYNC FLOOR, not the verdict (CORD-04 §5): a verifier
                    // waits until it has synced the cited Grant, then resolves rank
                    // against its CURRENT roster. So a citation we cannot resolve still
                    // parks — that is a real sync gap. But an edition carrying NO
                    // citation declared no floor to wait for, and refusing it converts a
                    // sync aid into an authority requirement the spec says it is not.
                    //
                    // This cannot escalate: every rank gate above has already passed —
                    // the author is authorized under the roster resolved so far and
                    // strictly outranks both this position and the one it replaces. The
                    // citation never granted authority; it only decided when to look.
                    if !citation_ok_in_fold(cid, &heads, owner_hex, &c.author, c.citation.as_ref()) {
                        if c.citation.is_some() {
                            note(&mut why, "role: cited a grant we cannot resolve");
                            continue;
                        }
                        UNCITED_ACCEPTED.with(|n| *n.borrow_mut() += 1);
                    }
                    admissible.insert(c.head.self_hash);
                    standing = Some(role.position);
                    break;
                }
            }
            for c in cands {
                let Some(role) = &c.role else { continue };
                if !admissible.contains(&c.head.self_hash) {
                    continue;
                }
                next.roles.push(role.clone());
                next_heads.push(c.head.clone());
                break; // highest admissible candidate for this entity
            }
        }
        for cands in grant_cands.values() {
            for c in cands {
                let c2 = c;
                let Some(grant) = &c.grant else { continue };
                let ah = c.author.to_hex();
                let note = |w: &mut Option<&mut std::collections::BTreeMap<String, &'static str>>, r: &'static str| {
                    if let Some(m) = w.as_mut() {
                        m.insert(c.head.entity_hex.clone(), r);
                    }
                };
                if excluded.contains(&ah) || excluded.contains(&grant.member) {
                    note(&mut why, "grant: author or member banned");
                    continue;
                }
                // The granter must outrank every granted role (resolved against the
                // accepted roster) AND the member — the escalation defense (CORD-04 §2).
                //
                // Resolve the roles that CAN be resolved rather than discarding the
                // grant whole. All-or-nothing deadlocks a community that grew the
                // ordinary way: an admin creates a role, the owner grants that role to
                // them, and now the grant needs the role accepted while the role needs
                // the grant. Neither can go first, the fixpoint lands empty, and the
                // entire roster — the owner's own grants included — collapses. Seen on
                // two live communities; the cached roster was all that hid it.
                //
                // Partial resolution is strictly fail-closed: it can only ever grant
                // FEWER roles than the edition names, every retained role is still
                // rank-checked below, and the unresolved ones fold in on a later
                // iteration once their own authority settles. Nothing is granted that
                // the author did not write.
                let resolved: Vec<(String, u32)> = grant
                    .role_ids
                    .iter()
                    .filter_map(|rid| accepted.role(rid).map(|r| (rid.clone(), r.position)))
                    .collect();
                let positions: Vec<u32> = resolved.iter().map(|(_, p)| *p).collect();
                if resolved.is_empty() && !grant.role_ids.is_empty() {
                    // Record WHICH role is missing — a grant refused for pointing at
                    // an unaccepted role is the head of a dependency chain, and the
                    // chain is unreadable without naming its next link.
                    if let Some(m) = why.as_mut() {
                        let missing: Vec<String> = grant
                            .role_ids
                            .iter()
                            .filter(|rid| accepted.role(rid).is_none())
                            .map(|rid| rid[..8.min(rid.len())].to_string())
                            .collect();
                        MISSING_ROLE_REFS.with(|c| {
                            c.borrow_mut().insert(c2.head.entity_hex.clone(), missing.join("+"));
                        });
                        m.insert(c2.head.entity_hex.clone(), "grant: references a role not in the accepted roster");
                    }
                    continue;
                }
                // An unresolvable citation parks; an absent one is tolerated ONLY when
                // the edition grants something. The rank gate below is what stops
                // escalation, and it needs a position to check: a REVOCATION carries no
                // role ids, so `positions.iter().all(..)` is vacuously true and the
                // citation is the only thing standing there. Without this an
                // unauthorized stranger strips any member's roles with a forged empty
                // grant — proven by `a_non_owner_cannot_strip_a_members_grant_by_forging_a_higher_version`.
                //
                // So: an uncited edition may ADD authority (fully rank-checked) but
                // never REMOVE it.
                if !citation_ok_in_fold(cid, &heads, owner_hex, &c.author, c.citation.as_ref()) {
                    if c.citation.is_some() {
                        note(&mut why, "grant: cited a grant we cannot resolve");
                        continue;
                    }
                    if resolved.is_empty() {
                        note(&mut why, "grant: UNCITED revocation — a strip must cite its authority");
                        continue;
                    }
                    UNCITED_ACCEPTED.with(|n| *n.borrow_mut() += 1);
                }
                if positions.iter().all(|p| accepted.can_act_on_position(&ah, owner_hex, *p, Permissions::MANAGE_ROLES))
                    && accepted.can_act_on_member(&ah, owner_hex, &grant.member, Permissions::MANAGE_ROLES)
                {
                    // Record the head even for an EMPTY grant (a revoke is a real chain
                    // advance a completeness check must see), but don't carry the husk
                    // into the roster.
                    next_heads.push(c.head.clone());
                    if !resolved.is_empty() {
                        // Carry only the resolved subset; the rest arrive on a later
                        // iteration, or never, if they were never legitimate.
                        let mut g = grant.clone();
                        g.role_ids = resolved.iter().map(|(rid, _)| rid.clone()).collect();
                        next.grants.push(g);
                    }
                    break;
                }
            }
        }

        let converged = next.roles == accepted.roles && next.grants == accepted.grants;
        accepted = next;
        heads = next_heads;
        if converged {
            break;
        }
    }
    (accepted, heads)
}

/// Apply a folded community-metadata head. Relays only overwrite when the edition
/// carries a non-empty list (a metadata edition that omits relays must not blank
/// the working set). Returns whether anything changed.
fn apply_community_metadata(out: &mut CommunityV2, meta: control::CommunityMetadata) -> bool {
    let mut changed = false;
    if out.name != meta.name {
        out.name = meta.name;
        changed = true;
    }
    if out.description != meta.description {
        out.description = meta.description;
        changed = true;
    }
    // Icon/banner apply verbatim, None included — an edition is the full
    // document, so an absent image IS a removal (editors preserve via
    // `CommunityV2::metadata()`).
    if out.icon != meta.icon {
        out.icon = meta.icon;
        changed = true;
    }
    if out.banner != meta.banner {
        out.banner = meta.banner;
        changed = true;
    }
    // Client-extensible + unknown fields ride the fold verbatim so our own
    // editions can carry them forward (CORD-02 §6).
    if out.meta_custom != meta.custom {
        out.meta_custom = meta.custom;
        changed = true;
    }
    if out.meta_extra != meta.extra {
        out.meta_extra = meta.extra;
        changed = true;
    }
    // CAP on the way in. `cap_relays` is the truncate-on-read invariant for every
    // other construction boundary, and the fold is a boundary like any other: an
    // authorized editor is not a trusted one, and an oversize list costs every
    // member a fan-out on each publish and the slowest of N on each fetch
    // (CORD-02 §6 makes trimming explicitly a client's call). Compare against the
    // CAPPED list too — against the raw one, an oversize edition never compares
    // equal, so every fold would report a change and re-save forever.
    let relays = crate::community::cap_relays(meta.relays);
    if !relays.is_empty() && out.relays != relays {
        out.relays = relays;
        changed = true;
    }
    changed
}

/// Apply a folded channel-metadata head: delete removes the channel, a rename
/// updates an existing one, a brand-new PUBLIC channel is added, and a brand-new
/// PRIVATE one is recorded KEYLESS (unreadable until its key arrives over the
/// rekey plane or a fresh bundle). Returns whether anything changed.
fn apply_channel_metadata(out: &mut CommunityV2, id: ChannelId, meta: control::ChannelMetadata) -> bool {
    let deleted = meta.deleted.unwrap_or(false);
    if deleted {
        let before = out.channels.len();
        out.channels.retain(|c| c.id.0 != id.0);
        return out.channels.len() != before;
    }
    match out.channels.iter_mut().find(|c| c.id.0 == id.0) {
        Some(existing) => {
            let mut changed = false;
            if existing.name != meta.name {
                existing.name = meta.name;
                changed = true;
            }
            // vsk-2 fields Vector doesn't drive still fold + persist, so a later
            // local edit republishes them instead of wiping (CORD-02 §6).
            if existing.voice != meta.voice {
                existing.voice = meta.voice;
                changed = true;
            }
            if existing.meta_custom != meta.custom {
                existing.meta_custom = meta.custom;
                changed = true;
            }
            if existing.meta_extra != meta.extra {
                existing.meta_extra = meta.extra;
                changed = true;
            }
            // The owner's edition authoritatively declares visibility. A channel the
            // owner marks PUBLIC must derive from the root (key = None) — this heals a
            // bundle-time misclassification where an attacker set a public channel's
            // grant key to their own, silently addressing it at a plane only they read.
            // Public → private CONVERSION is DEFERRED: the flip is IGNORED here (the
            // record stays public) until the convert flow (key mint + cursor rebase
            // to the conversion's channel epoch) lands — the send side refuses to
            // publish one, and a foreign client's conversion won't move us.
            if !meta.private && (existing.private || existing.key.is_some()) {
                existing.private = false;
                existing.key = None;
                changed = true;
            }
            changed
        }
        None if !meta.private => {
            // A public channel derives its Chat Plane from the community_root at the
            // current root epoch (key = None); its stored epoch mirrors the root.
            out.channels.push(ChannelV2 {
                id,
                name: meta.name,
                private: false,
                key: None,
                epoch: out.root_epoch,
                voice: meta.voice,
                meta_custom: meta.custom,
                meta_extra: meta.extra,
            });
            true
        }
        None => {
            // A brand-new PRIVATE channel: record it KEYLESS at epoch 0 (the root
            // generation — CORD-03 §2 numbers the first private key epoch 1). The
            // epoch then doubles as [`follow_rekeys`]' scan cursor. Until a rotation
            // delivers a key, every read/send/subscribe path skips the channel; the
            // root-fallback in `channel_secret` is never taken for it.
            out.channels.push(ChannelV2 {
                id,
                name: meta.name,
                private: true,
                key: None,
                epoch: Epoch(0),
                voice: meta.voice,
                meta_custom: meta.custom,
                meta_extra: meta.extra,
            });
            true
        }
    }
}

// ── Live rekey-follow (CORD-06 §2/§3) ────────────────────────────────────────

/// The outcome of a rekey-follow pass.
pub struct RekeyFollow {
    /// The community after adopting every rotation it could catch up on, or `None`
    /// if nothing advanced.
    pub updated: Option<CommunityV2>,
    /// A base rotation removed us — the caller tears the local hold down (the
    /// updated community is not persisted in that case).
    pub self_removed: bool,
    /// An owner tombstone sits on the dissolved plane (CORD-02 §9) — the local
    /// flag is already set; the caller surfaces the death and stops following.
    pub dissolved: bool,
    /// A complete authorized rotation carried a blob AT OUR LOCATOR that would
    /// not open (a width this build predates, a rotator bug, or a deliberately
    /// undecryptable blob planted to pass an admissibility check while severing
    /// us). Never a removal (CORD-06 §2: removal is the ABSENCE of a blob), so
    /// the walk parks — but the park is otherwise indistinguishable from "no
    /// rotation happened", which is exactly what makes it abusable. Surfaced so
    /// the user learns their key delivery is broken while the prior root still
    /// reaches everyone.
    pub wedged: bool,
}

/// The most archived base roots a channel-rekey lookup fans across per step. A
/// standalone rekey rides the minter's then-current root and a removal's rides the
/// PRIOR root (CORD-06 §3), so a follower whose base already advanced must look
/// back. A channel stranded DEEPER than this (its next-epoch crate addressed under
/// an older root than the fan reaches) only heals via a fresh invite bundle — the
/// walk is strictly sequential, so a later rotation can't be reached either.
const MAX_ADDRESSING_ROOTS: usize = 8;

/// The base roots a channel rekey may be addressed under, freshest first: the
/// current root plus the archived priors, capped at [`MAX_ADDRESSING_ROOTS`].
/// CORD-06 D2: a removal-forced channel rekey rides the PRIOR root — so the
/// follower's fetch fan ([`follow_rekeys`]) and the stream-auth registration
/// (`streamauth::register_community`) MUST cover the SAME set. A plane the
/// fetch addresses but auth never registered is invisible on an AUTH-gating
/// relay: the REQ is CLOSED, the rotation crate never arrives, and the channel
/// wedges at its old epoch while the base advances.
pub(crate) fn channel_rekey_addressing_roots(cur_root: [u8; 32], cid_hex: &str) -> Vec<[u8; 32]> {
    let mut roots: Vec<[u8; 32]> = vec![cur_root];
    let mut archived = crate::db::community::held_epoch_keys(cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX)
        .unwrap_or_default();
    archived.sort_by_key(|a| std::cmp::Reverse(a.0 .0));
    for (_, r) in archived {
        if !roots.contains(&r) {
            roots.push(r);
        }
    }
    roots.truncate(MAX_ADDRESSING_ROOTS);
    roots
}

/// Follow rekeys for a held community: advance the base (root) epoch and each
/// Private channel's epoch as far as authorized rotations allow, adopting the
/// fresh key we're still a recipient of at each step and dropping a scope we've
/// been removed from. Persists the result. Called when a rekey wrap arrives in
/// realtime so a long-running bot keeps decrypting after a rotation instead of
/// going silent.
///
/// **Authority (CORD-06 §Authority):** a BASE rotation is honored from the owner
/// or any `BAN` holder, and a CHANNEL rotation from the owner or a
/// `MANAGE_CHANNELS` holder — both under the PERSISTED roster (folded by
/// `follow_control`), minus the banlist, so an admin-created private channel
/// keys up on every member. Concluding OUR OWN removal takes more than the bit:
/// the rotator must strictly outrank us (`*_outranks_me`), so an equal-rank
/// admin can never evict a peer by minting a rotation that skips their blob.
///
/// **Addressing fans across held base roots:** each channel step queries its
/// next-epoch rekey address under the current root AND the archived prior roots,
/// so a base adopt landing before a Refounding's prior-root-addressed channel
/// rekeys (or before a creation delivery minted under an older root) can't
/// strand the channel.
///
/// **Continuity + fork resolution are spec-strict:** a rotation must extend the
/// exact `(epoch, key)` I hold, one epoch at a time; a same-epoch fork resolves
/// by the lexicographically lowest new key ([`rekey::lowest_key_winner`]), so
/// every follower converges. An incomplete rotation (a missing chunk) never
/// concludes removal — it just waits. A KEYLESS channel (announced by vsk-2, key
/// not yet delivered) holds no chain, so continuity is vacuous for it (CORD-06
/// §2: "a convergence check, not a secrecy mechanism") — authority is its
/// boundary; its epoch is the scan cursor, advancing past complete rotations
/// that exclude us so the walk converges on the channel's current epoch.
/// Explain this client's epoch state: what we hold, what the next-epoch base plane
/// offers, and — per rotation found there — exactly which `advance_scope` gate
/// decided we did or did not adopt it.
///
/// **Ships in release builds deliberately.** A strand is silent by construction: a
/// client parked on a dead epoch is subscribed at its own addresses and simply sees
/// nothing, which is indistinguishable from a quiet community. Answering "why is
/// this client stuck" without this meant reading sqlite by hand. It is also the
/// instrument for comparing two clients' views of one community — the local half
/// (`held`) is what diverges first.
///
/// Read-only, and safe to surface: every rotator/owner is a PUBLIC key, and no key
/// material, blob plaintext or roster secret is returned.
pub async fn explain_epoch_state<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
) -> Result<serde_json::Value, String> {
    let my_xonly = me_pk()?.to_bytes();
    let owner = community.owner()?;
    let owner_hex = owner.to_hex();
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
    let banned = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
    let held_epoch = community.root_epoch;
    let held_key = community.community_root;
    let next = Epoch(held_epoch.0.saturating_add(1));
    let group = base_rekey_group_key(&held_key, community.id(), next);
    let chunks = fetch_rekey_chunks(transport, &community.relays, &group).await?;
    let rotations = rekey::collect_rotations(&chunks);

    let reports: Vec<serde_json::Value> = rotations
        .iter()
        .map(|r| {
            let rotator_is_owner = r.rotator == owner;
            // CORD-06 §Authority: a Refounding is authorized by BAN in the folded
            // Roster, not owner-identity — report that gate, not just owner-equality.
            let rotator_authorized = rotator_is_owner
                || (!banned.contains(&r.rotator.to_hex())
                    && roster.is_authorized(&r.rotator.to_hex(), Some(&owner_hex), crate::community::roles::Permissions::BAN));
            let scope_ok = r.scope.id32() == rekey::RekeyScope::Root.id32();
            let epoch_ok = r.new_epoch.0 == next.0;
            let complete = r.is_complete();
            let continuity = format!("{:?}", r.continuity(held_epoch, &held_key));
            let has_my_blob = rekey::find_my_blob(&r.blobs, &r.rotator.to_bytes(), &my_xonly, r.scope, r.new_epoch).is_some();
            // Is the OWNER a recipient? A non-owner Refounding that drops the owner
            // is a takeover attempt — this tells whether an "owner must be kept"
            // adopt-block would be safe here (it would falsely reject a legitimate
            // rotation that happened to exclude the owner).
            let owner_kept = r.rotator == owner
                || rekey::find_my_blob(&r.blobs, &r.rotator.to_bytes(), &owner.to_bytes(), r.scope, r.new_epoch).is_some();
            // The exact reason follow_rekeys skipped/rejected this rotation, in gate order.
            let verdict = if !rotator_authorized {
                "REJECTED: rotator holds no BAN authority in the folded roster"
            } else if !scope_ok {
                "REJECTED: scope is not Root"
            } else if !epoch_ok {
                "REJECTED: new_epoch != held+1"
            } else if !complete {
                "WAIT: rotation incomplete (missing chunk) — never concludes removal"
            } else if continuity != "Extends" {
                "REJECTED: continuity does not extend my held root (FORK/GAP)"
            } else if has_my_blob {
                "ADOPT: authorized + complete + continuous + my blob present"
            } else {
                "REMOVED: complete authorized rotation with no blob for me"
            };
            serde_json::json!({
                "rotator": r.rotator.to_hex(),
                "rotator_is_recorded_owner": rotator_is_owner,
                "rotator_authorized_ban": rotator_authorized,
                "scope_is_root": scope_ok,
                "new_epoch": r.new_epoch.0,
                "prev_epoch": r.prev_epoch.0,
                "declared_chunks": r.declared_chunks,
                "held_chunks": r.held_chunks.iter().copied().collect::<Vec<_>>(),
                "is_complete": complete,
                "continuity_vs_held_root": continuity,
                "my_blob_present": has_my_blob,
                "owner_kept": owner_kept,
                "blob_count": r.blobs.len(),
                "severing": r.severed,
                "verdict": verdict,
            })
        })
        .collect();

    // The LOCAL half. Two clients on one community diverge here first, and every
    // field is a thing that has silently frozen a client in the field: the roster
    // is what authorizes a rotator, its provenance is what the freeze-guard reads,
    // and the invite registry is what Public/Private hangs off.
    let roster_at = crate::db::community::get_community_roles_at(&cid_hex).unwrap_or(0);
    let admin_count = roster.grants.iter().filter(|g| roster.is_admin(&g.member)).count();
    let held = serde_json::json!({
        "root_epoch": held_epoch.0,
        "roster_roles": roster.roles.len(),
        "roster_grants": roster.grants.len(),
        "roster_admins": admin_count,
        // 0 = a locally-seeded roster that never folded from the plane. A client
        // whose roster never gains provenance can never authorize a non-owner
        // admin, so it refuses their rotations forever.
        "roster_provenance_at": roster_at,
        "banlist_entries": banned.len(),
        "sever_marks": sever_marks(&cid_hex).keys().copied().collect::<Vec<_>>(),
        "control_plane_split": community.control_pk.is_some(),
        "private_channels": community.channels.iter().filter(|c| c.private).count(),
        "channels_awaiting_key": community.channels.iter().filter(|c| c.private && c.key.is_none()).count(),
    });

    // The one-line answer. `probing_next_epoch` existing at all proves the community
    // moved without us; what we did about it is the `rotations` verdicts.
    let summary = if rotations.is_empty() {
        "UP TO DATE (or the plane is unreachable): no rotation offered at held+1"
    } else if reports.iter().any(|r| r["verdict"].as_str().is_some_and(|v| v.starts_with("ADOPT"))) {
        "BEHIND: an adoptable rotation is waiting — run a sync"
    } else {
        "WEDGED: a rotation exists at held+1 and every one was refused (see verdicts)"
    };

    Ok(serde_json::json!({
        "summary": summary,
        "recorded_owner": owner.to_hex(),
        "held": held,
        "held_root_epoch": held_epoch.0,
        "probing_next_epoch": next.0,
        "base_plane_pk": group.pk_hex(),
        "raw_chunks_parsed": chunks.len(),
        "rotations_found": rotations.len(),
        "rotations": reports,
    }))
}

pub async fn follow_rekeys<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    session: &std::sync::Arc<crate::db::Session>,
) -> Result<RekeyFollow, String> {
    crate::db::scoped(async move {
        // Death wins every race (CORD-02 §9): a dissolved community honors no epoch advance
        // past its tombstone — don't adopt a rotation into a grave.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        if crate::db::community::get_community_dissolved(&cid_hex).unwrap_or(false) {
            return Ok(RekeyFollow { updated: None, self_removed: false, dissolved: true, wedged: false });
        }
        // An offline member must also LEARN of a death: the tombstone rides its own
        // public plane, which the live sub watches but no catch-up fetch touched —
        // without this, a member who slept through a dissolution follows (and posts
        // into) a grave forever. Fail-open on transport failure: availability is
        // never death.
        if is_dissolved(transport, community).await {
            if session.is_live() {
                let _ = crate::db::community::set_community_dissolved(&cid_hex);
            }
            return Ok(RekeyFollow { updated: None, self_removed: false, dissolved: true, wedged: false });
        }
        let signer = crate::signer::active_signer()?;
        let my_pk = me_pk()?;
        let my_xonly = my_pk.to_bytes();
        let owner = community.owner()?;
        let owner_hex = owner.to_hex();
        let mut cur = community.clone();
        let mut changed = false;
        // A rotation delivered us a blob we could not open (see RekeyFollow::wedged).
        let mut wedged = false;

        // The rotator/admissibility gates read the PERSISTED roster (folded by a prior
        // follow_control; the worker folds control right after this rekey pass). This
        // is "one pass late" for the rotator-AUTHORIZATION direction (a newly-granted
        // admin's rotation adopts a pass late, never early — safe). It is fail-OPEN for
        // the base-admissibility protected-set: a superior whose grant this receiver
        // has not yet folded is not in `roster.grants`, so a non-owner Refounding
        // excluding them can be adopted within that propagation window. Bounded — the
        // owner is ALWAYS hard-protected below (independent of the roster) and can
        // counter-refound; and it is inherent to eventual consistency (one cannot gate
        // on a grant never seen). Tightening this (fold control before the first rekey,
        // or gate non-owner adoption on roster freshness) is a follow-on.
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap_or_default();
        let banned = crate::db::community::get_community_banlist(&cid_hex).unwrap_or_default();
        let me_hex = my_pk.to_hex();
        // CORD-06 §Authority: "a rotation cites the Grant it acts under like any
        // authority action (CORD-04's `vac`), so a just-demoted admin's rotation is
        // never honored by a lagging client." Persisted heads ARE the right floor
        // here (unlike the roster fold, which must resolve in-pass): a rotation is
        // judged against a roster we already folded, and `follow_control` — v2's only
        // roster writer — persists the heads in the same pass it writes the roster.
        // A joiner who sees a rotation before folding control simply parks it and
        // heals on the next follow, which runs control first.
        let cited_ok = |rot: &rekey::Rotation| -> bool {
            citation_is_synced(&cid_hex, &owner_hex, &rot.rotator.to_hex(), rot.citation.as_ref())
        };
        let channel_rotator_ok = |rotator: &PublicKey| -> bool {
            if *rotator == owner {
                return true;
            }
            let rh = rotator.to_hex();
            !banned.contains(&rh) && roster.is_authorized(&rh, Some(&owner_hex), crate::community::roles::Permissions::MANAGE_CHANNELS)
        };
        // Concluding MY removal takes more than the bit: the rotator must strictly
        // outrank ME (CORD-06 §Authority — "the Rotator must strictly outrank every
        // removed target"), so an equal-rank admin can never silently evict a peer
        // (or the owner) by minting a complete rotation that skips their blob.
        let channel_rotator_outranks_me = |rotator: &PublicKey| -> bool {
            if *rotator == owner {
                return true;
            }
            let rh = rotator.to_hex();
            !banned.contains(&rh) && roster.can_act_on_member(&rh, Some(&owner_hex), &me_hex, crate::community::roles::Permissions::MANAGE_CHANNELS)
        };
        // CORD-06 §Authority: a Refounding requires the BAN permission in the folded
        // Roster (NOT owner-identity) — any admin holding BAN may perform it, checked
        // against the Roster exactly like a channel rekey checks MANAGE_CHANNELS. The
        // owner is always authorized. (Owner-only here silently wedged every member
        // whose community was refounded by a non-owner admin.)
        let base_rotator_ok = |rotator: &PublicKey| -> bool {
            if *rotator == owner {
                return true;
            }
            let rh = rotator.to_hex();
            !banned.contains(&rh) && roster.is_authorized(&rh, Some(&owner_hex), crate::community::roles::Permissions::BAN)
        };
        // Concluding MY removal via a base rotation takes more than the bit: the
        // rotator must strictly outrank ME with BAN (CORD-06 §Authority — "the
        // Rotator must strictly outrank every removed target"), so an equal-rank
        // admin can never evict a peer (or the owner) by minting a rotation that
        // skips their blob. Adoption (I hold a blob) only needs `base_rotator_ok`.
        let base_rotator_outranks_me = |rotator: &PublicKey| -> bool {
            if *rotator == owner {
                return true;
            }
            let rh = rotator.to_hex();
            !banned.contains(&rh) && roster.can_act_on_member(&rh, Some(&owner_hex), &me_hex, crate::community::roles::Permissions::BAN)
        };

                // A non-owner Refounding may only remove members the rotator strictly
        // OUTRANKS. The protected set is the owner plus every grant-holder the
        // rotator can't act on with BAN (a peer or superior) — excluding one is
        // an authority-escalation takeover, so its rotation is inadmissible.
        // Plain members hold no grant and are always outranked by a BAN-holder,
        // so removing them is legitimate and needs no memberlist.
        let base_admissible = |r: &rekey::Rotation| -> bool {
            if r.rotator == owner {
                return true; // the owner is supreme.
            }
            // Uncited (or citing a Grant we haven't synced) → skip entirely:
            // neither adopt nor conclude a removal, exactly like an
            // unauthorized rotation. It parks and heals on the next follow.
            if !cited_ok(r) {
                return false;
            }
            let rotator_hex = r.rotator.to_hex();
            let has_blob = |xonly: &[u8; 32]| {
                rekey::find_my_blob(&r.blobs, &r.rotator.to_bytes(), xonly, r.scope, r.new_epoch).is_some()
            };
            // The owner is never a valid removed target.
            if !has_blob(&owner.to_bytes()) {
                return false;
            }
            for g in &roster.grants {
                if g.member == rotator_hex || g.member == owner_hex || banned.contains(&g.member) {
                    continue; // self, owner (checked), or an already-authorized removal.
                }
                // A grant-holder the rotator can't act on is a peer/superior.
                if !roster.can_act_on_member(&rotator_hex, Some(&owner_hex), &g.member, crate::community::roles::Permissions::BAN) {
                    if let Ok(pk) = PublicKey::from_hex(&g.member) {
                        if !has_blob(&pk.to_bytes()) {
                            return false; // a peer/superior was excluded.
                        }
                    }
                }
            }
            true
        };

        // ── Same-epoch convergence, BEFORE walking forward (CORD-06 §3) ─────────
        //
        // Two authorized rotators can mint the same epoch concurrently. The spec's
        // tiebreak is deterministic — the lexicographically lowest new base key wins
        // — but it was only ever applied among rotations seen in ONE fetch. A client
        // that saw only the higher sibling adopted it and then looked exclusively
        // for its successor, so the lower sibling became permanently unreachable:
        // two halves of a community, both at the same epoch number, different keys,
        // unable to read each other, forever. Nobody was misbehaving.
        //
        // So re-check the epoch we ALREADY hold on every follow, and step sideways
        // onto a strictly lower sibling. Down-only, exactly as the spec requires: a
        // held epoch converges only downward, so a flaky fetch that returns just the
        // higher sibling can never re-fork a settled epoch, and the walk terminates
        // because each convergence strictly decreases the held key.
        //
        // The losing branch's key is simply dropped. Messages already ingested from
        // it stay readable — they are stored decrypted under the account vault, not
        // re-derived from the epoch key — so converging costs only the fork-window
        // messages this client never fetched, which live on a branch nobody reads.
        if cur.root_epoch.0 > 0 {
            let prior = crate::db::community::held_epoch_key(
                &cid_hex,
                crate::community::SERVER_ROOT_SCOPE_HEX,
                cur.root_epoch.0 - 1,
            )
            .ok()
            .flatten();
            if let Some(prior_root) = prior {
                let group = base_rekey_group_key(&prior_root, cur.id(), cur.root_epoch);
                match fetch_rekey_chunks(transport, &cur.relays, &group).await {
                    Ok(siblings) if !siblings.is_empty() => {
                        let held_before = cur.community_root;
                        match advance_scope(
                            &[(siblings, Some((Epoch(cur.root_epoch.0 - 1), prior_root)))],
                            RekeyScope::Root,
                            cur.id(),
                            &base_rotator_ok,
                            &base_rotator_outranks_me,
                            &base_admissible,
                            &signer,
                            &my_xonly,
                            cur.root_epoch,
                        )
                        .await
                        {
                            // Strictly lower only. Equal = the branch we already hold.
                            Advance::Adopt { new_key, control_pk, control_root, .. } if new_key < held_before => {
                                crate::log_warn!(
                                    "[v2:follow {}] same-epoch fork at epoch {} — converging DOWN onto the canonical sibling",
                                    &cid_hex[..8.min(cid_hex.len())], cur.root_epoch.0
                                );
                                cur.community_root = new_key;
                                cur.control_pk = control_pk.and_then(|pk| PublicKey::from_slice(&pk).ok());
                                cur.control_root = control_root;
                                if let Err(e) = crate::db::community::store_epoch_key(
                                    &cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, cur.root_epoch.0, &new_key,
                                ) {
                                    crate::log_warn!("v2: converged epoch-key archive failed: {e}");
                                }
                                if matches!(crate::db::community::community_protocol(community.id()), Ok(Some(_))) {
                                    let _ = crate::db::community::save_community_v2(&cur);
                                }
                                changed = true;
                            }
                            // A sibling we cannot open is NOT a removal: refusing to
                            // converge parks us on a branch that still works, where
                            // concluding removal here would delete the community over
                            // a fork we merely could not read.
                            _ => {}
                        }
                    }
                    Ok(_) => {}
                    Err(e) => crate::log_warn!(
                        "[v2:follow {}] same-epoch fork check failed (will retry): {}",
                        &cid_hex[..8.min(cid_hex.len())], e
                    ),
                }
            }
        }

        // Bound the catch-up: each real step consumes a valid authorized rotation, so a
        // finite chain terminates naturally; the cap defends against a relay feeding a
        // pathological set.
        const MAX_STEPS: usize = MAX_WALK_STEPS;
        // Wide enough to collapse a large community's channel fan into one wave,
        // narrow enough that a catch-up does not present as a burst to every relay.
        const CHANNEL_FAN_CONCURRENCY: usize = 8;
        // Containment hops adopted in this walk (B2: any one of them condemns —
        // a later ordinary hop in the same walk must not relaunder links open).
        let mut severed_hops: Vec<u64> = Vec::new();
        for _ in 0..MAX_STEPS {
            let mut advanced = false;

            // The roots a channel rekey may be addressed under (re-read each pass —
            // a base adopt below changes the head, and its predecessor is already
            // archived). Shared with streamauth so the auth registration covers
            // exactly this fan.
            let addressing_roots = channel_rekey_addressing_roots(cur.community_root, &cid_hex);

            // Private channels first: a removal-forced channel rekey rides the PRIOR
            // root (CORD-06 D2), so read channels before a base adopt moves it.
            let channel_ids: Vec<ChannelId> = cur.channels.iter().filter(|c| c.private).map(|c| c.id).collect();
            // One concurrent wave per hop, not one round-trip per (channel, root).
            // Serially this was `private channels x addressing roots` fetches before a
            // single hop could be decided — around a hundred for a large community, and
            // a week's absence walks dozens of hops. The decisions below still run
            // serially and in the same order; only the reads overlap.
            let fan: Vec<(ChannelId, Option<[u8; 32]>, Epoch, Epoch)> = channel_ids
                .iter()
                .filter_map(|cid| {
                    cur.channel(cid).map(|ch| {
                        (*cid, ch.key, ch.epoch, Epoch(ch.epoch.0.saturating_add(1)))
                    })
                })
                .collect();
            let mut prefetched: std::collections::HashMap<([u8; 32], usize), Vec<rekey::RekeyChunk>> =
                std::collections::HashMap::new();
            {
                use futures_util::stream::StreamExt;
                // root #0 = current, #1.. = archived priors (indices only — root
                // bytes are key material and must never reach a log).
                let jobs: Vec<(ChannelId, usize, GroupKey, Epoch)> = fan
                    .iter()
                    .flat_map(|(cid, _, _, next)| {
                        addressing_roots.iter().enumerate().map(move |(ri, root)| {
                            (*cid, ri, channel_rekey_group_key(root, cid, *next), *next)
                        })
                    })
                    .collect();
                let relays = &cur.relays;
                let mut results = futures_util::stream::iter(jobs)
                    .map(|(cid, ri, group, next)| async move {
                        (cid, ri, next, fetch_rekey_chunks(transport, relays, &group).await)
                    })
                    .buffer_unordered(CHANNEL_FAN_CONCURRENCY);
                while let Some((cid, ri, next, out)) = results.next().await {
                    let ch_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
                    match out {
                        Ok(chunks) => {
                            if chunks.is_empty() {
                                continue;
                            }
                            crate::log_debug!(
                                "[v2:follow {}] ch {} next e{} root#{}/{}: {} rekey chunk(s)",
                                &cid_hex[..8], &ch_hex[..8], next.0, ri, addressing_roots.len(), chunks.len()
                            );
                            prefetched.insert((cid.0, ri), chunks);
                        }
                        Err(e) => {
                            crate::log_warn!(
                                "[v2:follow {}] ch {} next e{} root#{}/{}: rekey plane fetch failed: {}",
                                &cid_hex[..8], &ch_hex[..8], next.0, ri, addressing_roots.len(), e
                            );
                            return Err(e);
                        }
                    }
                }
            }

            for (cid, held_key, held_epoch, next) in fan {
                let ch_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);
                let mut batches: Vec<RekeyBatch> = Vec::new();
                for ri in 0..addressing_roots.len() {
                    if let Some(chunks) = prefetched.remove(&(cid.0, ri)) {
                        batches.push((chunks, held_key.map(|k| (held_epoch, k))));
                    }
                }
                // Keyless-adopt residual (documented, deferred hardening): a malicious
                // AUTHORIZED admin can fork a keyless member onto an orphan low-key
                // rotation nothing extends (keyed members' continuity filters it out).
                // Recoverable via a fresh bundle; an insider with MANAGE_CHANNELS can
                // exclude the member outright anyway, so the marginal harm is the wedge
                // outliving their demotion.
                match advance_scope(&batches, RekeyScope::Channel(cid), cur.id(), &channel_rotator_ok, &channel_rotator_outranks_me, &cited_ok, &signer, &my_xonly, next).await {
                    Advance::Adopt { new_key, .. } => {
                        if let Some(ch) = cur.channels.iter_mut().find(|c| c.id.0 == cid.0) {
                            ch.key = Some(new_key);
                            ch.epoch = next;
                        }
                        crate::log_debug!("[v2:follow {}] ch {} ADOPTED e{}", &cid_hex[..8], &ch_hex[..8], next.0);
                        // The adopter's own multi-epoch archive (the minter archived at
                        // mint) — this channel's history stays readable across rotations.
                        // fetch_channel compensates for the CURRENT epoch, so a failed
                        // archive only bites after the NEXT rotation — surface it.
                        if let Err(e) = crate::db::community::store_epoch_key(&cid_hex, &crate::simd::hex::bytes_to_hex_32(&cid.0), next.0, &new_key) {
                            crate::log_warn!("v2: channel epoch-key archive failed (history across this rotation may not read back): {e}");
                        }
                        advanced = true;
                        changed = true;
                    }
                    Advance::Removed => {
                        match held_key {
                            // A complete rotation dropped my blob — cut from the channel.
                            Some(_) => {
                                cur.channels.retain(|c| c.id.0 != cid.0);
                            }
                            // Keyless scan: this epoch's rotation completed without me.
                            // Advance the cursor so the walk converges on the channel's
                            // CURRENT epoch — my entry point is its next rotation (whose
                            // recipients are the members at that time) or a fresh bundle.
                            None => {
                                if let Some(ch) = cur.channels.iter_mut().find(|c| c.id.0 == cid.0) {
                                    ch.epoch = next;
                                }
                            }
                        }
                        advanced = true;
                        changed = true;
                    }
                    Advance::Stay => {}
                    Advance::StayWedged => {
                        // A blob at our locator that will not open: park, never
                        // remove, and make the park legible (a silent park is
                        // indistinguishable from "no rotation happened").
                        wedged = true;
                    }
                }
            }

            // Base rotation (Refounding): advances the root + root_epoch, re-addressing
            // every public channel, the guestbook, and the control plane by derivation
            // (refresh_subscription recomputes the author-set from the new root).
            {
                let held_epoch = cur.root_epoch;
                let held_key = cur.community_root;
                let next = Epoch(held_epoch.0.saturating_add(1));
                let group = base_rekey_group_key(&cur.community_root, cur.id(), next);
                let chunks = fetch_rekey_chunks(transport, &cur.relays, &group).await?;
                let batches = vec![(chunks, Some((held_epoch, held_key)))];
                match advance_scope(&batches, RekeyScope::Root, cur.id(), &base_rotator_ok, &base_rotator_outranks_me, &base_admissible, &signer, &my_xonly, next).await {
                    Advance::Adopt { new_key, control_pk, control_root, severed, rotator } => {
                        // CORD-02 §5: this npub's snapshot — and only this npub's —
                        // seeds the new epoch's Guestbook. Recorded from the rotation
                        // this device just VERIFIED and adopted, so a snapshot can
                        // never nominate its own author.
                        record_epoch_minter(&cid_hex, next.0, &rotator.to_hex());
                        // Record the HOP that was severed, not the walk's final head:
                        // the mark drives both the link condemnation line and the
                        // rescue re-stamp, and a multi-step walk would otherwise
                        // present the containment at the wrong epoch.
                        if severed {
                            severed_hops.push(next.0);
                        }
                        cur.community_root = new_key;
                        cur.root_epoch = next;
                        // The control pair is the blob's, never inherited: the
                        // secret rolls with the root at every Refounding
                        // (CORD-02 §2), so a stale pair carried forward would sign
                        // (or subscribe) at a dead address.
                        //
                        // A legacy 72-byte blob therefore DOWNGRADES a split
                        // community back to the member-writable plane — the exact
                        // flooding surface the split closes. The width stays
                        // accepted (transition compat, CORD-06 §3), but once a
                        // community has been split this is either an outdated
                        // rotator or an attack, so it is never silent.
                        if cur.control_pk.is_some() && control_pk.is_none() {
                            crate::log_warn!(
                                "[v2:follow {}] rotation to epoch {} carried a LEGACY base blob — this community's control plane reverts to the member-writable address",
                                &cid_hex[..8.min(cid_hex.len())], next.0
                            );
                        }
                        cur.control_pk = control_pk.and_then(|pk| PublicKey::from_slice(&pk).ok());
                        cur.control_root = control_root;
                        // Archive on adopt: without this, a member who lived through TWO
                        // Refoundings loses the middle epoch's public history (only the
                        // minter archived it).
                        if let Err(e) = crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, next.0, &new_key) {
                            crate::log_warn!("v2: base epoch-key archive failed (this epoch's history may not read back after the next rotation): {e}");
                        }
                        // CHECKPOINT THE HOP. A client back from a long absence walks
                        // many epochs in one pass, and the row used to be written only
                        // after the whole loop — so a fetch failure on the last hop
                        // discarded every hop already taken. The next attempt started
                        // from scratch, cost the same again, and on a flaky link could
                        // never converge at all. Banking here makes the walk resumable:
                        // progress is monotonic, and an interrupted catch-up picks up
                        // where it stopped.
                        //
                        // The FULL row, never just root+epoch: `control_pk`/
                        // `control_root` roll with the root, so a narrow write would
                        // leave the control pair an epoch behind and fold the control
                        // plane at a dead address. Archive first, then the head — a
                        // stray archive is harmless, a missing one is permanent.
                        //
                        // A leave/delete racing the walk must not be resurrected by an
                        // upsert, so re-check the row still exists before each write.
                        match crate::db::community::community_protocol(community.id()) {
                            Ok(Some(_)) => {
                                if let Err(e) = crate::db::community::save_community_v2(&cur) {
                                    crate::log_warn!("v2: hop checkpoint failed at epoch {} (the walk will redo it): {e}", next.0);
                                }
                            }
                            // Gone mid-walk: stop rather than resurrect it.
                            Ok(None) => return Ok(RekeyFollow { updated: None, self_removed: false, dissolved: false, wedged }),
                            Err(e) => crate::log_warn!("v2: hop checkpoint skipped at epoch {}: {e}", next.0),
                        }
                        advanced = true;
                        changed = true;
                    }
                    Advance::Removed => {
                        return Ok(RekeyFollow { updated: None, self_removed: true, dissolved: false, wedged: false });
                    }
                    Advance::Stay => {}
                    Advance::StayWedged => {
                        // A blob at our locator that will not open: park, never
                        // remove, and make the park legible (a silent park is
                        // indistinguishable from "no rotation happened").
                        wedged = true;
                    }
                }
            }

            if !advanced {
                break;
            }
        }

        if wedged {
            // Legible, and actionable: the prior root still reaches every member,
            // so an owner/admin seeing this can counter-rotate before the honest
            // chain moves on.
            crate::log_warn!(
                "[v2:follow {}] a complete rotation delivered a key blob this client cannot open — parked at epoch {} (never treated as a removal)",
                &cid_hex[..8.min(cid_hex.len())], cur.root_epoch.0
            );
            crate::emit_event(
                "community_rekey_wedged",
                &serde_json::json!({ "community_id": cid_hex, "held_epoch": cur.root_epoch.0 }),
            );
        }
        if !changed {
            // A pending severance whose revoke was interrupted must heal on QUIET
            // passes too — waiting for the next rotation means a one-shot transport
            // blip leaves the community reading Public (and every future ban
            // refound-less) until someone happens to rotate again.
            retry_pending_severance(transport, &cur).await;
            return Ok(RekeyFollow { updated: None, self_removed: false, dissolved: false, wedged });
        }
        // A leave/delete raced this follow: saving would resurrect the community row
        // (the save is an upsert) with no floor rows behind it.
        if crate::db::community::community_protocol(community.id())?.is_none() {
            return Ok(RekeyFollow { updated: None, self_removed: false, dissolved: false, wedged });
        }
        crate::db::community::save_community_v2(&cur)?;
        // Mark every containment hop FIRST: the marks are what condemn links, and
        // both the severance below and the refresh consult them — so the order of
        // those two stops mattering (a condemned link is skipped by the refresh
        // and buried by the severance, in either order, on any pass).
        for hop in &severed_hops {
            add_sever_mark(&cid_hex, *hop, now_ms() / 1000);
        }
        if !severed_hops.is_empty() {
            // Someone ELSE ran a Severing Refounding: my links minted below the
            // severed epoch are the raid's door — bury them instead of carrying
            // them forward. A fresh link minted at-or-after it survives every
            // device's adopt, however late (the epoch is the same on all of them).
            if let Err(e) = sever_own_links(transport, &cur).await {
                crate::log_warn!("[Sever] own-link revocation on adopt failed (retries next follow): {e}");
            }
        }
        // Carry my SURVIVING links across the rotation someone ELSE performed
        // (CORD-05 §2). The refounder refreshes only the bundles they can reach —
        // their own — so without this every other creator's links keep vending the
        // superseded root and drop new joiners onto a dead epoch, which is exactly
        // the stranding the stable-URL refresh exists to prevent. Condemned links
        // are skipped inside (see the guard there). Best-effort and idempotent.
        let _ = refresh_public_links(transport, &cur).await;
        // A pending sever mark (mine or adopted) whose revoke never completed
        // keeps retrying while condemned links remain (B4).
        retry_pending_severance(transport, &cur).await;
        Ok(RekeyFollow { updated: Some(cur), self_removed: false, dissolved: false, wedged })
    })
    .await
}

/// One scope's catch-up decision from the rekey chunks fetched at its next-epoch
/// address.
enum Advance {
    /// Adopt this fresh key for `next_epoch`. A BASE adoption also carries the
    /// next epoch's Control Plane pair from the blob (CORD-06 §1) — the pk in
    /// every 104/136-byte blob, the secret only in a staff recipient's 136. The
    /// pair is the BLOB's, never inherited: a legacy 72-byte blob carries
    /// neither (that epoch's Control folds at the legacy address), and channel
    /// rotations never carry any.
    Adopt { new_key: [u8; 32], control_pk: Option<[u8; 32]>, control_root: Option<[u8; 32]>, severed: bool, rotator: PublicKey },
    /// A complete owner rotation at `next_epoch` dropped my blob — I'm removed.
    Removed,
    /// No owner rotation extends my held epoch (yet) — keep the current key.
    Stay,
    /// A complete authorized rotation carried a blob at MY locator that would
    /// not open. Never a removal (CORD-06 §2), but never silent either — the
    /// caller surfaces it (see [`RekeyFollow::wedged`]).
    StayWedged,
}

/// Fetch + parse every seal-verified 3303 chunk at a rekey plane address.
async fn fetch_rekey_chunks<T: Transport + ?Sized>(
    transport: &T,
    relays: &[String],
    group: &GroupKey,
) -> Result<Vec<rekey::RekeyChunk>, String> {
    // A rekey plane address is community_root-derived, so ANY member can seal junk
    // 3303s there — a flood (or, organically, a large community's own multi-chunk
    // rotation past the newest window) could bury the genuine owner/admin rotation
    // in a single fixed page. PAGE backwards (inclusive until + wrap-id dedup, the
    // control pager's discipline) so a buried authorized chunk is still recovered;
    // the seal + authority filter downstream drops the junk. Bounded — a sustained
    // flood past this depth degrades to "adopt one pass late", never a false state.
    const REKEY_PAGE: usize = 200;
    const REKEY_MAX_PAGES: usize = 6;
    let mut out = Vec::new();
    let mut seen: std::collections::HashSet<nostr_sdk::prelude::EventId> = std::collections::HashSet::new();
    let mut until: Option<u64> = None;
    let mut oldest: Option<u64> = None;
    for _ in 0..REKEY_MAX_PAGES {
        let query = Query {
            kinds: vec![stream::KIND_WRAP],
            authors: vec![group.pk_hex()],
            until,
            limit: Some(REKEY_PAGE),
            ..Default::default()
        };
        // Authenticate AS the rekey plane key: on AUTH-gating relays (Ditto) the
        // shared user-authed client's REQ for a plane's events is CLOSED, so an
        // offline rotation catch-up would return nothing and wedge at the old
        // epoch. `fetch_plane` rides a connection authed as the plane itself.
        let page = transport.fetch_plane(group.keys(), &query, relays).await?;
        // A page nobody fully answered must not read as "the plane ends here": the
        // short-page break below is a completeness verdict, and drawing it from a
        // degraded read is how a client concludes a rotation is absent when it is
        // merely unreachable.
        let page_complete = page.is_complete();
        let wraps = page.events;
        let mut fresh = 0usize;
        for w in &wraps {
            if !seen.insert(w.id) {
                continue;
            }
            fresh += 1;
            let at = w.created_at.as_secs();
            if oldest.is_none_or(|o| at < o) {
                oldest = Some(at);
            }
            if let Ok(opened) = stream::open_wrap(w, group) {
                if let Ok(chunk) = rekey::parse_rekey_chunk(&opened) {
                    out.push(chunk);
                }
            }
        }
        // Drained, or a same-second wall the pager can't step past (second-granular
        // until) — either way stop; the accumulated set is what advance_scope folds.
        if fresh == 0 || (wraps.len() < REKEY_PAGE && page_complete) {
            break;
        }
        match oldest {
            Some(o) if o > 0 => until = Some(o),
            _ => break,
        }
    }
    Ok(out)
}

/// One addressing root's chunks, with the key held at that scope as `(epoch, key)`.
type RekeyBatch = (Vec<rekey::RekeyChunk>, Option<(Epoch, [u8; 32])>);

/// Decide how a scope advances from per-addressing-root chunk batches (pure). Each
/// batch pairs the chunks fetched under one root with the continuity to demand of
/// them: a rotation qualifies when it's rotator-authorized (`rotator_ok`),
/// complete, targets the immediate `next_epoch`, and — when I hold a chain —
/// extends my exact `(epoch, key)`. A KEYLESS batch (`held` = None) has no chain
/// to extend, so it qualifies on authority + completeness alone (CORD-06 §2:
/// continuity is "a convergence check, not a secrecy mechanism"; the rotator's
/// seal authority is the boundary). Among qualifying rotations carrying my blob
/// the lexicographically lowest new key wins (convergent). All complete
/// candidates without my blob conclude Removed for a KEYED holder only when one
/// came from a rotator who may remove ME (`rotator_may_remove_me`, the CORD-06
/// strict-outrank rule) — else Stay; for a keyless holder they merely advance the
/// scan cursor (any bit-holder's real rotation is scan progress, never a loss).
#[allow(clippy::too_many_arguments)]
async fn advance_scope<S: crate::signer::VectorSigner + ?Sized>(
    batches: &[RekeyBatch],
    scope: RekeyScope,
    community_id: &crate::community::CommunityId,
    rotator_ok: &(dyn Fn(&PublicKey) -> bool + Sync),
    rotator_may_remove_me: &(dyn Fn(&PublicKey) -> bool + Sync),
    admissible: &(dyn Fn(&rekey::Rotation) -> bool + Sync),
    signer: &S,
    my_xonly: &[u8; 32],
    next_epoch: Epoch,
) -> Advance {
    let mut winners: Vec<rekey::BaseKeyDelivery> = Vec::new();
    // Parallel to `winners`: whether each delivery's rotation is a containment
    // (Root scope only). Selected by the same lowest-key index, so a same-epoch
    // fork adopts the winner's flag and never a loser's.
    let mut winner_severed: Vec<bool> = Vec::new();
    // Parallel to `winner_severed`: whose Refounding this delivery came from. The
    // snapshot authority for the adopted epoch (CORD-02 §5) is exactly this npub.
    let mut winner_rotator: Vec<PublicKey> = Vec::new();
    let mut saw_complete_candidate = false;
    // Did any qualifying rotation actually carry recipients? See the removal gate.
    let mut saw_nonempty_candidate = false;
    let mut saw_outranking_candidate = false;
    let mut my_blob_unopenable = false;
    let keyed = batches.iter().any(|(_, held)| held.is_some());
    for (chunks, held) in batches {
        let rotations = rekey::collect_rotations(chunks);
        for r in &rotations {
            if !rotator_ok(&r.rotator) || r.scope.id32() != scope.id32() || r.new_epoch.0 != next_epoch.0 {
                continue;
            }
            if let Some((held_epoch, held_key)) = held {
                if r.continuity(*held_epoch, held_key) != Continuity::Extends {
                    continue;
                }
            }
            // CORD-06 §Authority: a rotator must strictly OUTRANK every removed
            // target. An authorized-but-inadmissible rotation (one that excludes
            // the owner or a peer/superior the rotator can't act on) is a takeover
            // attempt — skip it entirely, so it neither adopts nor concludes a
            // removal (it forks; the honest chain wins).
            if !admissible(r) {
                continue;
            }
            // Completeness gates the DESTRUCTIVE direction only. Concluding removal
            // means "no blob for me anywhere in this rotation", which is only
            // knowable with every chunk in hand — so `saw_complete_candidate`, and
            // everything downstream of it, still demands the whole set.
            //
            // ADOPTION does not need it. The blob binds its own (scope, epoch)
            // inside the ciphertext, so a key that opens is this rotation's key
            // whatever else is unreachable; and admissibility is monotonic in the
            // blob set — chunks we have not seen can only ADD recipients, so a
            // rotation that looks admissible on the blobs we hold cannot become a
            // takeover once the rest arrive. Requiring the full set to adopt made a
            // large community's rotation as fragile as its least reachable chunk,
            // and the walk is sequential, so that strand blocked every epoch above
            // it too. (A rotation that fails admissibility on partial data is still
            // skipped, never adopted — the unsafe direction stays closed.)
            if r.is_complete() {
                saw_complete_candidate = true;
                saw_nonempty_candidate |= !r.blobs.is_empty();
                saw_outranking_candidate |= rotator_may_remove_me(&r.rotator);
            }
            // EVERY blob at my locator, not just the first. A locator is a public
            // index that proves nothing, so anyone may publish a blob at mine;
            // taking only the first would let a junk one shadow the real key and
            // park a client that actually holds it. First that opens wins.
            let mut mine = rekey::find_my_blobs(&r.blobs, &r.rotator.to_bytes(), my_xonly, r.scope, r.new_epoch).peekable();
            let had_candidate = mine.peek().is_some();
            let mut opened_one = false;
            for blob in mine {
                let opened = match scope {
                    // Base blobs are width-declared forms (CORD-06 §1).
                    RekeyScope::Root => rekey::open_base_blob(signer, &r.rotator, community_id, r.new_epoch, blob).await,
                    RekeyScope::Channel(_) => rekey::open_blob(signer, &r.rotator, r.scope, r.new_epoch, blob)
                        .await
                        .map(|k| rekey::BaseKeyDelivery { new_root: k, control_pk: None, control_root: None }),
                };
                if let Ok(d) = opened {
                    winners.push(d);
                    winner_severed.push(scope.id32() == RekeyScope::Root.id32() && r.severed);
                    winner_rotator.push(r.rotator);
                    opened_one = true;
                    break;
                }
            }
            // A blob AT my locator that won't open is not an exclusion (CORD-06 §2:
            // removal = NO blob across all chunks). It must never conclude Removed
            // below — that is exactly how a pre-split client turned an unreadable
            // width into a false self-removal. Stay and keep recovering instead.
            if had_candidate && !opened_one {
                my_blob_unopenable = true;
            }
        }
    }
    if !winners.is_empty() {
        // `collect_rotations` correlates on `(rotator, scope, new_epoch, prev_commit)`,
        // so a single rotator's blobs merge into ONE rotation (and a retried Refounding
        // MINT-OR-REUSES its root, so it never emits two distinct roots to fork on).
        // The lowest-key tiebreak engages only for CONCURRENT DISTINCT rotators racing
        // the same epoch (separate rotations): every follower converges on the same
        // lowest new BASE key — the control pair rides the winner's blobs, never
        // compared (CORD-06 §3). A wrap served under two addressing roots can't
        // double-count: each rekey wrap opens under exactly one root's group key.
        let keys: Vec<[u8; 32]> = winners.iter().map(|d| d.new_root).collect();
        let idx = rekey::lowest_key_winner(&keys).expect("winners is non-empty");
        let w = &winners[idx];
        return Advance::Adopt {
            new_key: w.new_root,
            control_pk: w.control_pk,
            control_root: w.control_root,
            severed: winner_severed[idx],
            rotator: winner_rotator[idx],
        };
    }
    // A rotation that delivered NO blob to anyone removed nobody. Read literally it
    // is "complete, authorized, and contains no blob for me" — which is the removal
    // shape — but removal DELETES the community locally, so one empty rotation from
    // an authorized rotator would evict the entire membership at once, irreversibly.
    // An empty recipient set is a malformed or aborted rotation, never a verdict
    // about any individual. Nobody is removed by a rotation that removed everybody.
    if saw_complete_candidate && !saw_nonempty_candidate {
        return Advance::Stay;
    }
    if saw_complete_candidate && !my_blob_unopenable && (!keyed || saw_outranking_candidate) {
        Advance::Removed
    } else if my_blob_unopenable {
        Advance::StayWedged
    } else {
        Advance::Stay
    }
}

// ── Pins (CORD-04 §7) ────────────────────────────────────────────────────────

/// A channel's pin list, read from the locally folded head.
#[derive(Debug, serde::Serialize)]
pub struct ChannelPins {
    /// Entries that passed the full §7 verification, wire order (curator's).
    pub pins: Vec<super::pins::VerifiedPin>,
    /// The head is sealed under a key epoch this client does not hold: the
    /// pins exist but are unreadable. Render as unavailable, NEVER as empty —
    /// and a writer seeing this MUST NOT publish (it would drop every entry).
    pub sealed: bool,
    /// Folded head version (0 = no edition has ever folded).
    pub version: u64,
}

/// The channel's stream conversation key at `epoch`, if this client holds the
/// deriving secret: a private channel's held per-epoch key, a public channel's
/// held base root at that epoch.
fn channel_conv_key_at(community: &CommunityV2, ch: &ChannelV2, epoch: u64) -> Option<[u8; 32]> {
    let ikm = channel_conv_ikm(community, ch, epoch).ok()?;
    // A private plane is never derived from the root value (that would address
    // the public plane) — mirrors fetch_channel_history's invariant.
    if ch.private && ikm == community.community_root {
        return None;
    }
    let group = channel_group_key(&ikm, &ch.id, Epoch(epoch));
    group.conv_key().as_bytes().try_into().ok()
}

/// Read a channel's pins from the locally folded head: unseal (private form),
/// verify every entry, keep wire order. Local-only — the control follow is what
/// moves the head.
pub fn read_channel_pins(community: &CommunityV2, channel_id: &ChannelId) -> Result<ChannelPins, String> {
    let ch = community.channel(channel_id).ok_or("no such channel in this community")?;
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
    let Some((content, version)) = crate::db::community::get_community_pins(&cid_hex, &ch_hex)? else {
        return Ok(ChannelPins { pins: Vec::new(), sealed: false, version: 0 });
    };
    let read = super::pins::read_pin_list(&content, |epoch| channel_conv_key_at(community, ch, epoch));
    let pins = read
        .entries
        .iter()
        .filter_map(|e| super::pins::verify_pin_entry(e, &ch_hex))
        .collect();
    Ok(ChannelPins { pins, sealed: read.sealed, version: version.max(0) as u64 })
}

/// Publish `entries` as the channel's next Pin List edition, in the form the
/// channel's folded type mandates, and echo it locally so a follow-up edit
/// builds on this write rather than the pre-write fold.
async fn publish_pin_list<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    ch: &ChannelV2,
    entries: &[super::pins::PinEntry],
) -> Result<(), String> {
    crate::db::scoped(async move {
        let content = if ch.private {
            let key = ch.key.ok_or("this private channel's key has not arrived yet")?;
            let group = channel_group_key(&key, &ch.id, ch.epoch);
            super::pins::serialize_sealed_pin_list(entries, group.conv_key(), ch.epoch.0)?
        } else {
            super::pins::serialize_public_pin_list(entries)?
        };
        let eid = super::derive::pins_locator(community.id(), &ch.id);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&ch.id.0);
        let entity_hex = crate::simd::hex::bytes_to_hex_32(&eid);
        // The version this publish will chain to — mirrors publish_control_edition.
        let version = match crate::db::community::get_edition_head(&cid_hex, &entity_hex)? {
            Some((v, _)) => v + 1,
            None => 1,
        };
        crate::log_info!("[pins] publishing v{} with {} entries for channel {}", version, entries.len(), &ch_hex[..12]);
        publish_control_edition(transport, community, vsk::PINS, &eid, &content).await?;
        let _ = crate::db::community::set_community_pins(&cid_hex, &ch_hex, &content, version as i64);
        crate::emit_event(
            "community_pins_updated",
            &serde_json::json!({ "community_id": cid_hex, "channel_id": ch_hex }),
        );
        if let Ok(me) = me_pk() {
            use nostr_sdk::prelude::ToBech32;
            let me_npub = me.to_bech32().unwrap_or_else(|_| me.to_hex());
            note_pins_modified(&ch_hex, version, &me_npub, now_ms() / 1000).await;
        }
        Ok(())
    })
    .await
}

/// One centered system row per adopted Pin List edition — "X modified the
/// Pins". The id is deterministic on (channel, version), so the publisher's
/// echo and every fold that adopts the same edition collapse into one row,
/// and a catch-up fold stamps the edition's own time so history sorts true.
async fn note_pins_modified(channel_hex: &str, version: u64, actor_npub: &str, at_secs: u64) {
    let event_id = format!("pins-mod-{}-v{}", &channel_hex[..16], version);
    let inserted = crate::db::events::save_system_event_at(
        &event_id,
        channel_hex,
        crate::stored_event::SystemEventType::PinsModified,
        actor_npub,
        None,
        at_secs,
        None,
        None,
    )
    .await
    .unwrap_or(false);
    if inserted {
        crate::emit_event(
            "system_event",
            &serde_json::json!({
                "conversation_id": channel_hex,
                "event_id": event_id,
                "event_type": crate::stored_event::SystemEventType::PinsModified.as_u8(),
                "member_pubkey": actor_npub,
            }),
        );
    }
}

/// The current entries this writer may build on. Replace-entire cuts sharply
/// (§7): an empty view has two innocent causes indistinguishable from an empty
/// list, so a writer MUST refuse to build from a list it could not read.
fn writable_pin_entries(community: &CommunityV2, channel_id: &ChannelId) -> Result<Vec<super::pins::PinEntry>, String> {
    let current = read_channel_pins(community, channel_id)?;
    if current.sealed {
        return Err("this channel's pins are sealed under a key you don't hold; pinning would erase them".to_string());
    }
    Ok(current.pins.into_iter().map(|p| p.entry).collect())
}

/// Pin a message: recover its wrap, rebuild its proof, append, republish.
///
/// The seal is re-fetched from the community relays by the stored wrapper id —
/// the DB retains rumors, not seals, and a proof needs the seal verbatim.
pub async fn pin_message<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    rumor_id_hex: &str,
) -> Result<(), String> {
    crate::db::scoped(async move {
        let ch = community.channel(channel_id).ok_or("no such channel in this community")?.clone();
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);

        let mut entries = writable_pin_entries(community, channel_id)?;
        if entries.len() >= super::pins::PIN_MAX_ENTRIES {
            return Err(format!("this channel already holds {} pins; unpin one first", super::pins::PIN_MAX_ENTRIES));
        }
        // Idempotent: re-pinning an already-pinned message is a no-op, not an error.
        if entries
            .iter()
            .filter_map(|e| super::pins::verify_pin_entry(e, &ch_hex))
            .any(|v| v.rumor_id == rumor_id_hex)
        {
            return Ok(());
        }

        let (wrap_id, _tags) = crate::db::events::get_event_wrap_context(rumor_id_hex)?
            .ok_or("message not found in this device's history")?;
        let wrap_id = wrap_id.ok_or("this message's original wrap id was not recorded")?;

        // Recover the wrap verbatim — Full evidence: a pin is a permanent artifact,
        // so don't build it from the first relay to answer.
        let wraps = transport
            .fetch(
                &Query {
                    ids: vec![wrap_id.clone()],
                    kinds: vec![super::stream::KIND_WRAP],
                    limit: Some(1),
                    evidence: crate::community::transport::Evidence::Full,
                    ..Default::default()
                },
                &community.relays,
            )
            .await?;
        let wrap = wraps
            .iter()
            .find(|w| w.id.to_hex() == wrap_id)
            .ok_or("the message's wrap is no longer served by this community's relays")?;

        // The stored row does not retain the rumor's epoch binding, so re-derive it
        // the way history reads do: try the channel's every held plane coordinate,
        // current epoch first, until the wrap opens AND carries this rumor. The
        // open itself verifies the channel + epoch binding, so a false coordinate
        // fails closed rather than mis-attributing.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let mut coords: Vec<(u64, [u8; 32])> = Vec::new();
        if ch.private {
            if let Some(k) = ch.key {
                coords.push((ch.epoch.0, k));
            }
            let held = crate::db::community::held_epoch_keys(&cid_hex, &ch_hex).unwrap_or_default();
            coords.extend(held.into_iter().filter(|(_, k)| *k != community.community_root).map(|(ep, k)| (ep.0, k)));
        } else {
            coords.push((community.root_epoch.0, community.community_root));
            let held = crate::db::community::held_epoch_keys(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX).unwrap_or_default();
            coords.extend(held.into_iter().map(|(ep, k)| (ep.0, k)));
        }
        coords.dedup();

        let mut found: Option<(super::stream::OpenedStream, [u8; 32])> = None;
        for (epoch, ikm) in coords {
            let group = channel_group_key(&ikm, &ch.id, Epoch(epoch));
            if let Ok(super::chat::ChatEvent::Message { opened, .. }) =
                super::chat::open_chat_event(wrap, &group, channel_id, Epoch(epoch))
            {
                if opened.rumor_id.to_hex() == rumor_id_hex {
                    let conv: [u8; 32] = group
                        .conv_key()
                        .as_bytes()
                        .try_into()
                        .map_err(|_| "conversation key size".to_string())?;
                    found = Some((opened, conv));
                    break;
                }
            }
        }
        let Some((opened, conv_key)) = found else {
            return Err("that message is from a key epoch this device no longer holds".to_string());
        };

        let entry = super::pins::build_pin_entry(&opened, &conv_key, &ch_hex).map_err(|e| match e {
            super::pins::PinBuildFailure::NotEncrypted => "this message's seal form cannot be pinned".to_string(),
            super::pins::PinBuildFailure::BadPayload => "that message is from a key epoch this device no longer holds".to_string(),
            super::pins::PinBuildFailure::Unverifiable => "this message's proof did not verify".to_string(),
        })?;
        entries.push(entry);

        publish_pin_list(transport, community, &ch, &entries).await
    })
    .await
}

/// The deriving secret (ikm) for a channel plane at `epoch` — the same lookup
/// `channel_conv_key_at` performs, surfaced for the open path.
fn channel_conv_ikm(community: &CommunityV2, ch: &ChannelV2, epoch: u64) -> Result<[u8; 32], String> {
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    if ch.private {
        if ch.epoch.0 == epoch {
            return ch.key.ok_or("this private channel's key has not arrived yet".to_string());
        }
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&ch.id.0);
        crate::db::community::held_epoch_keys(&cid_hex, &ch_hex)
            .unwrap_or_default()
            .into_iter()
            .find(|(ep, _)| ep.0 == epoch)
            .map(|(_, k)| k)
            .ok_or("that message is from a key epoch this device no longer holds".to_string())
    } else if community.root_epoch.0 == epoch {
        Ok(community.community_root)
    } else {
        crate::db::community::held_epoch_keys(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX)
            .unwrap_or_default()
            .into_iter()
            .find(|(ep, _)| ep.0 == epoch)
            .map(|(_, k)| k)
            .ok_or("that message is from a root epoch this device no longer holds".to_string())
    }
}

/// Unpin a message: the next edition without the entry (§7 — no deletion event).
pub async fn unpin_message<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
    channel_id: &ChannelId,
    rumor_id_hex: &str,
) -> Result<(), String> {
    let ch = community.channel(channel_id).ok_or("no such channel in this community")?.clone();
    let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
    let entries = writable_pin_entries(community, channel_id)?;
    let kept: Vec<super::pins::PinEntry> = entries
        .into_iter()
        .filter(|e| {
            super::pins::verify_pin_entry(e, &ch_hex)
                .map(|v| v.rumor_id != rumor_id_hex)
                // An entry we can't verify is kept: unpin removes exactly the
                // named message, never collateral.
                .unwrap_or(true)
        })
        .collect();
    publish_pin_list(transport, community, &ch, &kept).await
}

/// §7 curator duties: converge the Pin List when a pinned message is deleted
/// or edited. Spawned fire-and-forget from ingest — a non-curator, a sealed
/// list, or an unpinned target all no-op silently; the duty is voluntary.
pub(crate) fn spawn_pin_duty(channel_hex: &str, target_rumor_hex: &str, edit: Option<super::stream::OpenedStream>) {
    let channel_hex = channel_hex.to_string();
    let target = target_rumor_hex.to_string();
    crate::db::spawn_bound(async move {
        let transport = crate::community::transport::LiveTransport::with_timeout(std::time::Duration::from_secs(12));
        let _ = run_pin_duty(&transport, &channel_hex, &target, edit).await;
    });
}

/// The duty body, transport-injected so tests can drive it end to end.
///
/// The affected author acts at once; every other PIN_MESSAGES holder waits a
/// deterministic 5-25s stagger (hashed from (me, target) — no thundering herd
/// of racing editions) and re-reads before publishing, so a duty another
/// curator already performed dissolves into a no-op.
async fn run_pin_duty<T: Transport + ?Sized>(
    transport: &T,
    channel_hex: &str,
    target: &str,
    edit: Option<super::stream::OpenedStream>,
) -> Result<(), String> {
    use crate::community::roles::Permissions;
    let Some(cid_hex) = crate::db::community::community_id_for_channel(channel_hex)? else {
        return Ok(());
    };
    let cid = crate::community::CommunityId(crate::simd::hex::hex_to_bytes_32(&cid_hex));
    let Some(community) = crate::db::community::load_community_v2(&cid)? else {
        return Ok(());
    };
    let channel_id = ChannelId(crate::simd::hex::hex_to_bytes_32(channel_hex));

    // Cheap pre-checks before any waiting: pinned target, readable list, held bit.
    let read = read_channel_pins(&community, &channel_id)?;
    if read.sealed {
        return Ok(());
    }
    let Some(hit) = read.pins.iter().find(|p| p.rumor_id == target) else {
        return Ok(());
    };
    if let Some(ed) = &edit {
        // Monotonic: a bundle at or past this revision needs no refresh.
        if hit.edited.as_ref().is_some_and(|held| held.ms >= ed.at_ms) {
            return Ok(());
        }
    }
    let me = me_pk()?;
    let me_hex = me.to_hex();
    let owner_hex = community.owner()?.to_hex();
    let roster = crate::db::community::get_community_roles(&cid_hex)?;
    if !roster.is_authorized(&me_hex, Some(&owner_hex), Permissions::PIN_MESSAGES) {
        return Ok(());
    }

    if hit.author != me_hex {
        let mut h: u32 = 0;
        for b in me_hex.bytes().chain(target.bytes()) {
            h = h.wrapping_mul(31).wrapping_add(u32::from(b));
        }
        crate::rt::time::sleep(std::time::Duration::from_secs(5 + u64::from(h % 21))).await;
    }

    // Re-read after the stagger: another curator's edition may have landed.
    let read = read_channel_pins(&community, &channel_id)?;
    if read.sealed {
        return Ok(());
    }
    let Some(hit) = read.pins.iter().find(|p| p.rumor_id == target) else {
        return Ok(());
    };
    let ch = community.channel(&channel_id).ok_or("no such channel")?.clone();

    let entries: Vec<super::pins::PinEntry> = match &edit {
        // Deletion: the next edition simply omits the entry (§7 — replace-entire).
        None => read
            .pins
            .iter()
            .filter(|p| p.rumor_id != target)
            .map(|p| p.entry.clone())
            .collect(),
        // Edit: the same entry, its bundle refreshed to the newest revision.
        Some(ed) => {
            if hit.edited.as_ref().is_some_and(|held| held.ms >= ed.at_ms) {
                return Ok(());
            }
            let ch_hex = crate::simd::hex::bytes_to_hex_32(&channel_id.0);
            // The edit sealed under the channel's current plane in the common
            // (realtime) case; older epochs are tried like every other read.
            let mut bundle = None;
            let mut epochs: Vec<u64> = vec![if ch.private { ch.epoch.0 } else { community.root_epoch.0 }];
            let scope = if ch.private { ch_hex.clone() } else { crate::community::SERVER_ROOT_SCOPE_HEX.to_string() };
            epochs.extend(
                crate::db::community::held_epoch_keys(&cid_hex, &scope)
                    .unwrap_or_default()
                    .into_iter()
                    .map(|(ep, _)| ep.0),
            );
            epochs.dedup();
            for epoch in epochs {
                let Some(conv) = channel_conv_key_at(&community, &ch, epoch) else { continue };
                if let Ok(b) = super::pins::build_pin_edit_bundle(ed, &conv, &hit.author, target, &ch_hex) {
                    bundle = Some(b);
                    break;
                }
            }
            let Some(bundle) = bundle else { return Ok(()) };
            read.pins
                .iter()
                .map(|p| {
                    let mut entry = p.entry.clone();
                    if p.rumor_id == target {
                        entry.edit = Some(bundle.clone());
                    }
                    entry
                })
                .collect()
        }
    };

    crate::log_info!(
        "[pins] duty {} for target {} in channel {}",
        if edit.is_some() { "edit-refresh" } else { "omission" },
        &target[..12],
        &channel_hex[..12]
    );
    publish_pin_list(transport, &community, &ch, &entries).await
}

/// Silent owner-side widening: an Admin role published before PIN_MESSAGES
/// existed gains the bit, so delegated admins can curate pins in communities
/// founded before this build. One edition, idempotent, converges across owner
/// devices (both publish the same widened mask as editions of one entity).
pub async fn upgrade_admin_role_pin_bit<T: Transport + ?Sized>(
    transport: &T,
    community: &CommunityV2,
) -> Result<bool, String> {
    use crate::community::roles::{Permissions, RoleScope};
    let my_pk = me_pk()?;
    if community.owner()? != my_pk {
        return Ok(false);
    }
    let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
    let roles = crate::db::community::get_community_roles(&cid_hex)?;
    let Some(role) = roles.roles.iter().find(|r| {
        matches!(r.scope, RoleScope::Server)
            && r.permissions.contains(Permissions::ADMIN_FOUNDING_MASK)
            && !r.permissions.contains(Permissions::PIN_MESSAGES)
    }) else {
        return Ok(false);
    };
    let mut widened = role.clone();
    widened.permissions.0 |= Permissions::PIN_MESSAGES;
    set_role(transport, community, &widened).await?;
    Ok(true)
}

#[cfg(test)]
mod tests {
    // The legacy (pre-split) Control derivation, still reachable for the
    // migration-compat paths under test.
    use super::super::derive::control_group_key;
    use crate::ClientRelayExt;
    use nostr_sdk::prelude::FinalizeEvent;
    use super::super::super::transport::memory::MemoryRelay;
    use super::*;
    use crate::community::roles::{MemberGrant, Permissions, Role, RoleScope};

    /// A distinct npub-shaped account-dir name (bech32 charset) per counter.
    fn account_name(n: u32) -> String {
        const B: &[u8] = b"qpzry9x8gf2tvdw0s3jn54khce6mua7l";
        let mut acct = String::from("npub1");
        let mut v = n as usize;
        for _ in 0..58 {
            acct.push(B[v % 32] as char);
            v = v / 32 + 7;
        }
        acct
    }

    /// One test participant: its identity keys and its isolated account DB dir.
    struct Actor {
        keys: Keys,
        account: String,
    }

    /// Two participants sharing one relay but isolated per-account DBs — the
    /// cross-account harness a real invite/join loop needs. `swap_to` mirrors a
    /// live `swap_session`: re-point the DB pool + rebind the identity + clear
    /// the per-account id caches, so account A's community is invisible to B
    /// until B legitimately joins.
    struct TestBed {
        _tmp: tempfile::TempDir,
        _guard: std::sync::MutexGuard<'static, ()>,
        relay: MemoryRelay,
        relays: Vec<String>,
    }

    impl TestBed {
        fn new() -> (TestBed, Actor, Actor) {
            static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(70_000);
            let guard = crate::db::DB_TEST_GUARD.lock().unwrap_or_else(|e| e.into_inner());
            crate::db::close_database();
            crate::db::clear_id_caches();
            let tmp = tempfile::tempdir().unwrap();
            crate::db::set_app_data_dir(crate::db::shared_test_data_dir().to_path_buf());

            let mk = || {
                let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                let account = account_name(n);
                std::fs::create_dir_all(tmp.path().join(&account)).unwrap();
                crate::db::set_current_account(account.clone()).unwrap();
                crate::db::init_database(&account).unwrap();
                Actor { keys: Keys::generate(), account }
            };
            let owner = mk();
            let member = mk();
            let _ = crate::state::take_nostr_client();
            let bed = TestBed {
                _tmp: tmp,
                _guard: guard,
                relay: MemoryRelay::new(),
                relays: vec!["wss://r".to_string()],
            };
            (bed, owner, member)
        }

        /// Become `actor`: swap the account DB + identity, as a real session swap.
        /// Bumps the session generation like production `swap_session` does — so any task a
        /// prior actor spawned (e.g. the migration finalize) dies at its std::sync::Arc<crate::db::Session> check
        /// instead of racing this actor's DB (a cross-test flake that can't happen in prod).
        fn swap_to(&self, actor: &Actor) {
            crate::db::close_database();
            crate::db::set_current_account(actor.account.clone()).unwrap();
            crate::db::init_database(&actor.account).unwrap();
            crate::db::clear_id_caches();
            crate::state::MY_SECRET_KEY.store_from_keys(&actor.keys, &[]);
            crate::state::set_my_public_key(actor.keys.public_key());
        }
    }

    /// Legacy single-actor helper (the create/send tests below).
    fn init_test_db() -> (tempfile::TempDir, std::sync::MutexGuard<'static, ()>, Keys) {
        let guard = crate::db::DB_TEST_GUARD.lock().unwrap_or_else(|e| e.into_inner());
        crate::db::close_database();
        crate::db::clear_id_caches();
        let tmp = tempfile::tempdir().unwrap();
        static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(50_000);
        let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
        let acct = account_name(n);
        std::fs::create_dir_all(tmp.path().join(&acct)).unwrap();
        crate::db::set_app_data_dir(crate::db::shared_test_data_dir().to_path_buf());
        crate::db::set_current_account(acct.clone()).unwrap();
        crate::db::init_database(&acct).unwrap();
        let _ = crate::state::take_nostr_client();
        let owner = Keys::generate();
        crate::state::MY_SECRET_KEY.store_from_keys(&owner, &[]);
        crate::state::set_my_public_key(owner.public_key());
        (tmp, guard, owner)
    }

    /// A transport that simulates a session swap landing DURING a fetch await —
    /// so a join straddling the fetch sees an invalid session and aborts.
    /// Switches to a real second account on the first fetch, then stays out of
    /// the way. It BORROWS the relay that built the community — a fresh one
    /// would fail verification for want of a control plane, which is not the
    /// thing being tested.
    struct SwapMidFetch<'a> {
        inner: &'a MemoryRelay,
        to: String,
        armed: std::sync::atomic::AtomicBool,
    }

    impl<'a> SwapMidFetch<'a> {
        fn arm(inner: &'a MemoryRelay) -> Self {
            static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(88_000);
            let to = account_name(N.fetch_add(1, std::sync::atomic::Ordering::Relaxed));
            std::fs::create_dir_all(crate::db::shared_test_data_dir().join(&to)).unwrap();
            Self { inner, to, armed: std::sync::atomic::AtomicBool::new(true) }
        }
    }

    #[async_trait::async_trait]
    impl Transport for SwapMidFetch<'_> {
        async fn fetch_plane(&self, _plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> { Ok(crate::community::transport::PlaneFetch::whole(self.fetch(query, relays).await?)) }
        async fn publish(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.inner.publish(e, r).await
        }
        async fn publish_durable(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.inner.publish_durable(e, r).await
        }
        async fn fetch(&self, q: &Query, r: &[String]) -> Result<Vec<Event>, String> {
            let out = self.inner.fetch(q, r).await;
            if self.armed.swap(false, std::sync::atomic::Ordering::SeqCst) {
                crate::db::set_current_account(self.to.clone()).unwrap();
                crate::db::init_database(&self.to).unwrap();
            }
            out
        }
    }

    /// Bumps the session generation on the first `publish_durable` — the rekey
    /// crate a private-channel create ships before it writes anything locally.
    struct SwapMidPublish {
        inner: MemoryRelay,
    }
    #[async_trait::async_trait]
    impl Transport for SwapMidPublish {
        async fn fetch_plane(&self, _plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> { Ok(crate::community::transport::PlaneFetch::whole(self.fetch(query, relays).await?)) }
        async fn publish(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.inner.publish(e, r).await
        }
        async fn publish_durable(&self, e: &Event, r: &[String]) -> Result<(), String> {
            let out = self.inner.publish_durable(e, r).await;
            crate::db::close_database();
            out
        }
        async fn fetch(&self, q: &Query, r: &[String]) -> Result<Vec<Event>, String> {
            self.inner.fetch(q, r).await
        }
    }

    /// A transport whose `fetch` returns a FIXED, UNSORTED event list — modelling
    /// the production `LiveTransport` union (first-responding relay's batch, no
    /// global newest-first sort), which `MemoryRelay` hides by sorting. This is
    /// the only harness that can exercise the revocation-race ordering.
    struct FixedFetch {
        events: Vec<Event>,
    }
    #[async_trait::async_trait]
    impl Transport for FixedFetch {
        async fn fetch_plane(&self, _plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> { Ok(crate::community::transport::PlaneFetch::whole(self.fetch(query, relays).await?)) }
        async fn publish(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
            Ok(())
        }
        async fn publish_durable(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
            Ok(())
        }
        async fn fetch(&self, _q: &Query, _r: &[String]) -> Result<Vec<Event>, String> {
            Ok(self.events.clone())
        }
    }

    /// Fetch a pending Direct Invite (kind 3313 giftwrap) addressed to `me` — the
    /// indexed inbox query CORD-05 §6 defines: `{1059, #p:[me], #k:["3313"]}`.
    async fn fetch_direct_invite(relay: &MemoryRelay, relays: &[String], me: &PublicKey) -> Event {
        let q = Query {
            kinds: vec![stream::KIND_WRAP],
            p_tags: vec![me.to_hex()],
            k_tags: vec!["3313".to_string()],
            ..Default::default()
        };
        relay.fetch(&q, relays).await.unwrap().into_iter().next().expect("a direct invite is waiting")
    }

    #[tokio::test]
    async fn create_persists_and_reloads_a_v2_community() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];

        let created = create_community(&relay, "Vectorville", relays.clone(), Some("hi".into())).await.unwrap();
        assert!(created.identity.verify());
        assert_eq!(created.owner().unwrap(), owner.public_key());
        assert_eq!(created.channels.len(), 1);

        // Protocol dispatch sees it as v2, and it reloads byte-faithfully.
        assert_eq!(
            crate::db::community::community_protocol(created.id()).unwrap(),
            Some(crate::community::ConcordProtocol::V2)
        );
        let loaded = crate::db::community::load_community_v2(created.id()).unwrap().expect("reloads");
        assert_eq!(loaded.name, "Vectorville");
        assert_eq!(loaded.community_root, created.community_root);
        assert_eq!(loaded.identity, created.identity);
        assert_eq!(loaded.channels[0].id.0, created.channels[0].id.0);
        assert!(!loaded.channels[0].private);

        // The genesis control editions + the owner Join landed on the relay.
        assert!(relay.count_on("wss://r") >= 3, "2 genesis editions + 1 guestbook join");
    }

    #[tokio::test]
    async fn owner_sends_and_reads_back_a_message() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Chat", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;

        let id1 = send_message(&relay, &community, &general, "hello world").await.unwrap();
        let id2 = send_message(&relay, &community, &general, "second message").await.unwrap();
        assert_ne!(id1, id2);

        let page = fetch_channel(&relay, &community, &general, 100).await.unwrap();
        let texts: Vec<String> = page
            .iter()
            .filter_map(|f| match &f.event {
                ChatEvent::Message { .. } => Some(f.event.opened().rumor.content.clone()),
                _ => None,
            })
            .collect();
        assert_eq!(texts, vec!["hello world", "second message"], "messages round-trip in ms order");
    }

    #[test]
    fn send_stamps_never_repeat_within_a_process() {
        // Ordering is by the `ms` tag, and an optimized build seals several sends
        // per millisecond. Identical stamps fell through to the reader's
        // content-derived tiebreak, which knows nothing about which was typed
        // first, so a fast sender could watch its own messages come back
        // shuffled — the flake in `owner_sends_and_reads_back_a_message` once the
        // suite began compiling optimized. Distinctness must not depend on how
        // slow the build happens to be.
        let stamps: Vec<u64> = (0..5_000).map(|_| next_send_ms()).collect();
        for pair in stamps.windows(2) {
            assert!(pair[1] > pair[0], "stamps must strictly increase: {} then {}", pair[0], pair[1]);
        }
    }

    #[tokio::test]
    async fn same_millisecond_messages_order_by_rumor_id_not_relay_order() {
        // Cross-client half: when stamps DO collide (two senders, clock skew),
        // every reader must still agree. A bare `ms` sort left ties in whatever
        // order the relay served them across pages, so two readers could show the
        // same pair in opposite orders. The rumor id is content-derived, so
        // pinning ties to it is something every client computes identically.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Ties", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;

        let at = now_ms();
        for i in 0..6 {
            send_chat_message_at(&relay, &community, &general, &format!("tied {i}"), None, &[], vec![], at)
                .await
                .unwrap();
        }
        let page = fetch_channel(&relay, &community, &general, 100).await.unwrap();
        let msgs: Vec<(Vec<u8>, String)> = page
            .iter()
            .filter_map(|f| match &f.event {
                ChatEvent::Message { .. } => {
                    let o = f.event.opened();
                    Some((o.rumor_id.as_bytes().to_vec(), o.rumor.content.clone()))
                }
                _ => None,
            })
            .collect();
        assert_eq!(msgs.len(), 6, "all six tied messages read back");
        let got: Vec<String> = msgs.iter().map(|(_, c)| c.clone()).collect();
        let mut by_id = msgs.clone();
        by_id.sort_by(|a, b| a.0.cmp(&b.0));
        let expected: Vec<String> = by_id.into_iter().map(|(_, c)| c).collect();
        assert_eq!(got, expected, "ties resolve by rumor id, never by the relay's serving order");
    }

    #[tokio::test]
    async fn a_rapid_burst_carries_strictly_increasing_stamps() {
        // The call-site half: sends must draw from the monotonic stamp, not the
        // raw clock. An optimized build seals several per millisecond, and equal
        // stamps hand a sender's own ordering to the content tiebreak, which
        // knows nothing about typing order.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Burst", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        for i in 0..8 {
            send_message(&relay, &community, &general, &format!("msg {i}")).await.unwrap();
        }
        let page = fetch_channel(&relay, &community, &general, 100).await.unwrap();
        let stamps: Vec<u64> = page
            .iter()
            .filter_map(|f| match &f.event {
                ChatEvent::Message { .. } => Some(f.event.opened().at_ms),
                _ => None,
            })
            .collect();
        assert_eq!(stamps.len(), 8);
        for pair in stamps.windows(2) {
            assert!(pair[1] > pair[0], "a sender's own stamps must strictly increase, got {pair:?}");
        }
    }

    #[tokio::test]
    async fn a_second_member_reads_the_public_channel_from_the_root() {
        // A member who holds the community_root (via an invite bundle, modeled
        // here by cloning the community) reads the owner's public-channel message
        // — public channels need no key delivery, they derive from the root.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Public", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&relay, &community, &general, "everyone can read this").await.unwrap();

        // The "member" reconstructs the same read coordinates from the root.
        let member_view = community.clone();
        let page = fetch_channel(&relay, &member_view, &general, 100).await.unwrap();
        assert_eq!(page.len(), 1);
        assert!(matches!(&page[0].event, ChatEvent::Message { .. }));
        assert_eq!(page[0].event.opened().rumor.content, "everyone can read this");
    }

    // ── Two-actor end-to-end (the create → invite → join → message loop) ──────

    async fn texts_in<T: crate::community::transport::Transport + ?Sized>(relay: &T, community: &CommunityV2, channel: &ChannelId) -> Vec<String> {
        fetch_channel(relay, community, channel, 100)
            .await
            .unwrap()
            .iter()
            .filter_map(|f| match &f.event {
                ChatEvent::Message { .. } => Some(f.event.opened().rumor.content.clone()),
                _ => None,
            })
            .collect()
    }

    /// History as the BACK-PAGING cursor reads it: every held epoch. Opening a
    /// channel deliberately reads only the live planes, so pre-rotation history is
    /// reached by paging, which is what a user scrolling up actually does.
    async fn all_texts_in<T: crate::community::transport::Transport + ?Sized>(
        relay: &T,
        community: &CommunityV2,
        channel: &ChannelId,
    ) -> Vec<String> {
        let from_now = now_ms() / 1000 + 3600;
        fetch_channel_history(
            relay,
            community,
            channel,
            100,
            8,
            None,
            Some(from_now),
            crate::community::transport::Evidence::Quorum,
            |_| true,
        )
        .await
        .unwrap()
        .iter()
        .filter_map(|f| match &f.event {
            ChatEvent::Message { .. } => Some(f.event.opened().rumor.content.clone()),
            _ => None,
        })
        .collect()
    }

    #[tokio::test]
    async fn direct_invite_full_loop_owner_and_member_converse() {
        let (bed, owner, member) = TestBed::new();

        // Owner creates a community, posts, and Direct-Invites the member's npub.
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Guild", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&bed.relay, &community, &general, "owner: welcome!").await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();

        // Member (a DIFFERENT account, no prior knowledge) finds + accepts the invite.
        bed.swap_to(&member);
        assert!(
            crate::db::community::load_community_v2(community.id()).unwrap().is_none(),
            "the member does not hold the community before joining"
        );
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap();
        assert_eq!(joined.id().0, community.id().0, "joined the same community");
        assert!(joined.identity.verify(), "the joiner independently verifies the owner commitment");
        assert_eq!(joined.owner().unwrap(), owner.keys.public_key());

        // The member reads the owner's public-channel history and replies.
        assert_eq!(texts_in(&bed.relay, &joined, &general).await, vec!["owner: welcome!"]);
        send_message(&bed.relay, &joined, &general, "member: thanks for the invite").await.unwrap();

        // The owner reads the member's reply.
        bed.swap_to(&owner);
        assert_eq!(
            texts_in(&bed.relay, &community, &general).await,
            vec!["owner: welcome!", "member: thanks for the invite"],
            "both actors' messages interleave in ms order on the shared channel"
        );

        // The Guestbook memberlist now folds both participants.
        let members = memberlist(&bed.relay, &community).await.unwrap();
        assert!(members.contains(&owner.keys.public_key()), "owner is a member (genesis Join)");
        assert!(members.contains(&member.keys.public_key()), "member is a member (invite Join)");
        assert_eq!(members.len(), 2);
    }

    /// Join-time ban gate: an honest client whose npub is on the authorized banlist
    /// refuses to join — no Guestbook Join publish, no local write — through the shared
    /// accept path every door (direct invite, parked, public link, migration) funnels into.
    #[tokio::test]
    async fn a_banned_member_is_refused_at_join_time() {
        let (bed, owner, member) = TestBed::new();

        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoEntry", bed.relays.clone(), None).await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();
        set_banlist(&bed.relay, &community, &[member.keys.public_key().to_hex()]).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let err = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap_err();
        assert!(err.contains("banned"), "refusal names the reason: {err}");
        assert!(
            crate::db::community::load_community_v2(community.id()).unwrap().is_none(),
            "a refused join persists nothing"
        );

        // The gate is the LAST word only for banned members: an unbanned bystander with
        // the same invite path still joins (the gate doesn't over-refuse).
        bed.swap_to(&owner);
        set_banlist(&bed.relay, &community, &[]).await.unwrap();
        bed.swap_to(&member);
        let joined = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap();
        assert_eq!(joined.id().0, community.id().0, "unban restores joinability");
    }

    /// End-to-end member migration: a member holding a v1 community folds the owner's
    /// migration dissolution, opens `m`, joins the v2 twin (ban-gated), and the flip
    /// re-parents the stitched channel rows + stamps the fence — all from the single event.
    #[tokio::test]
    async fn member_migrates_v1_to_v2_from_the_dissolution_payload() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();

        // Owner builds the v2 twin (real, verifiable on the shared relay).
        bed.swap_to(&owner);
        let v2 = create_community(&bed.relay, "Guild v2", bed.relays.clone(), None).await.unwrap();
        let v2_hex = crate::simd::hex::bytes_to_hex_32(&v2.identity.community_id.0);
        let jm = join_material(&v2);

        // The member holds a v1 community owned by the SAME owner identity (the migration
        // premise) — construct + save it, and hold its server root.
        bed.swap_to(&member);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();
        let v1_channel = v1.channels[0].id.to_hex();

        // The dissolution payload: v2 JoinMaterial sealed under the v1 server root.
        let m = migration::seal_m(v1.server_root_key.as_bytes(), &serde_json::to_vec(&jm).unwrap()).unwrap();
        let signpost = migration::MigrationSignpost {
            v2_community_id: v2_hex.clone(),
            owner_xonly: owner.keys.public_key().to_hex(),
            owner_salt: crate::simd::hex::bytes_to_hex_32(&v2.identity.owner_salt),
            relays: bed.relays.clone(),
            name: "Guild".into(),
            primary_channel: v1_channel.clone(),
            root_epoch: 0,
        };
        let content = migration::build_migration_content(&signpost, Some(m)).unwrap();
        crate::db::community::set_migration_pointer(&v1_cid, &content).unwrap();

        // Drive the migration: opens m, joins v2 (ban-gated), flips.
        let flipped = migration::drive_migration(&bed.relay, &v1).await.unwrap();
        assert_eq!(flipped.as_deref(), Some(v2_hex.as_str()), "the flip completed to the v2 twin");

        // Fence: the v1 community is terminally marked, and the v2 twin is held + joined.
        assert_eq!(crate::db::community::get_migrated_to(&v1_cid).unwrap().as_deref(), Some(v2_hex.as_str()));
        assert!(crate::db::community::get_community_dissolved(&v1_cid).unwrap(), "flip also seals v1 (fence layer 0)");
        assert!(crate::db::community::load_community_v2(&v2.identity.community_id).unwrap().is_some(), "v2 twin held");
        let _ = v1_channel;

        // Idempotent: a second drive is a no-op (already flipped).
        assert_eq!(migration::drive_migration(&bed.relay, &v1).await.unwrap(), None);
    }

    /// The member half of a migration, for a member who already holds the twin. Every
    /// piece of the flip test bed except the pointer: owner runs the wizard (stitched
    /// twin), member holds the same v1 plus the twin via an ordinary save, which the
    /// hijack guard leaves channel-less because the stitched channel id is still v1-owned.
    async fn held_twin_bed(
        relay: &MemoryRelay,
        bed: &TestBed,
        owner: &Actor,
        member: &Actor,
    ) -> (crate::community::Community, String, String, String, CommunityV2) {
        use crate::community::migration;
        bed.swap_to(owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        let v1_channel = v1.channels[0].id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();
        let v2_hex = migration::migrate_community_to_v2(relay, &v1, migration::MIGRATION_UNLOCK_AT + 1).await.unwrap();
        let v2_id = crate::community::CommunityId(crate::simd::hex::hex_to_bytes_32(&v2_hex));
        let twin = crate::db::community::load_community_v2(&v2_id).unwrap().expect("owner holds the twin");

        bed.swap_to(member);
        let mut m_v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        m_v1.id = v1.id;
        m_v1.server_root_key = v1.server_root_key.clone();
        m_v1.channels[0].id = v1.channels[0].id;
        m_v1.owner_attestation = v1.owner_attestation.clone();
        crate::db::community::save_community(&m_v1).unwrap();
        crate::db::community::save_community_v2(&twin).unwrap();
        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v1_cid.as_str()),
            "precondition: the stitched channel is still v1-owned (channel-less twin)"
        );
        (m_v1, v1_cid, v1_channel, v2_hex, twin)
    }

    fn signpost_for(twin: &CommunityV2, v2_hex: &str, owner_xonly: String, salt: [u8; 32], primary: &str, relays: Vec<String>) -> crate::community::migration::MigrationSignpost {
        let _ = twin;
        crate::community::migration::MigrationSignpost {
            v2_community_id: v2_hex.to_string(),
            owner_xonly,
            owner_salt: crate::simd::hex::bytes_to_hex_32(&salt),
            relays,
            name: "Guild".into(),
            primary_channel: primary.to_string(),
            root_epoch: 0,
        }
    }

    /// `m` only carries join material. A member who already holds the twin has nothing to
    /// join, so join material that will never open (sealed under a root this member does
    /// not hold) must not stop the flip. The flip is DB-only: nothing is published and no
    /// key changes; the stitched channel simply moves to the twin and becomes visible.
    #[tokio::test]
    async fn a_held_twin_flips_without_opening_m() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();
        let (m_v1, v1_cid, v1_channel, v2_hex, twin) = held_twin_bed(&bed.relay, &bed, &owner, &member).await;
        let v2_id = twin.identity.community_id;

        // Sealed under a root nobody holds: a real read-cut / lost-DB shape.
        let m = migration::seal_m(&[7u8; 32], &serde_json::to_vec(&join_material(&twin)).unwrap()).unwrap();
        let signpost = signpost_for(&twin, &v2_hex, owner.keys.public_key().to_hex(), twin.identity.owner_salt, &v1_channel, bed.relays.clone());
        crate::db::community::set_migration_pointer(&v1_cid, &migration::build_migration_content(&signpost, Some(m)).unwrap()).unwrap();

        let published_before = bed.relay.stored_count();
        let roots_before = crate::db::community::held_epoch_keys(&v2_hex, crate::community::SERVER_ROOT_SCOPE_HEX).unwrap();

        let flipped = migration::drive_migration(&bed.relay, &m_v1).await.unwrap();
        assert_eq!(flipped.as_deref(), Some(v2_hex.as_str()), "a held twin flips even though m cannot open");

        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v2_hex.as_str()),
            "the stitched channel moved to the twin"
        );
        assert!(
            crate::db::community::load_community_v2(&v2_id).unwrap().unwrap().channels.iter().any(|c| c.id.0 == m_v1.channels[0].id.0),
            "the twin now lists the channel (what a member actually sees)"
        );
        assert_eq!(crate::db::community::get_migrated_to(&v1_cid).unwrap().as_deref(), Some(v2_hex.as_str()));
        assert!(crate::db::community::get_community_dissolved(&v1_cid).unwrap(), "fence layer 0 set");
        assert_eq!(bed.relay.stored_count(), published_before, "a held flip publishes nothing");
        assert_eq!(
            crate::db::community::held_epoch_keys(&v2_hex, crate::community::SERVER_ROOT_SCOPE_HEX).unwrap(),
            roots_before,
            "a held flip touches no keys"
        );
        assert_eq!(migration::drive_migration(&bed.relay, &m_v1).await.unwrap(), None, "idempotent");
    }

    /// The held-twin shortcut sits BEHIND owner continuity: a pointer whose owner is not
    /// this v1's proven owner must not flip, even when the account holds a twin that the
    /// signpost describes perfectly. Built so that ONLY the continuity gate refuses: the
    /// member owns the named twin, so self-cert and the held-owner check both pass, and
    /// the reparent would move the v1 channel if the gate were skipped.
    #[tokio::test]
    async fn a_held_twin_still_refuses_an_owner_discontinuity() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();
        let (m_v1, v1_cid, v1_channel, _v2_hex, _twin) = held_twin_bed(&bed.relay, &bed, &owner, &member).await;

        // The member's OWN v2 community: a twin the signpost can describe consistently.
        let mine = create_community(&bed.relay, "Mine", bed.relays.clone(), None).await.unwrap();
        let mine_hex = crate::simd::hex::bytes_to_hex_32(&mine.identity.community_id.0);
        let signpost = signpost_for(&mine, &mine_hex, member.keys.public_key().to_hex(), mine.identity.owner_salt, &v1_channel, bed.relays.clone());
        crate::db::community::set_migration_pointer(&v1_cid, &migration::build_migration_content(&signpost, None).unwrap()).unwrap();

        assert_eq!(migration::drive_migration(&bed.relay, &m_v1).await.unwrap(), None, "refused");
        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v1_cid.as_str()),
            "nothing moved"
        );
        assert!(crate::db::community::get_migrated_to(&v1_cid).unwrap().is_none(), "no fence");
    }

    /// The held-twin shortcut sits BEHIND the self-cert check: a signpost naming the real,
    /// held twin under the real owner but a wrong salt must not flip. Only self-cert
    /// refuses here (continuity and the held-owner check both pass).
    #[tokio::test]
    async fn a_held_twin_still_refuses_a_forged_self_cert() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();
        let (m_v1, v1_cid, v1_channel, v2_hex, twin) = held_twin_bed(&bed.relay, &bed, &owner, &member).await;

        let signpost = signpost_for(&twin, &v2_hex, owner.keys.public_key().to_hex(), [9u8; 32], &v1_channel, bed.relays.clone());
        crate::db::community::set_migration_pointer(&v1_cid, &migration::build_migration_content(&signpost, None).unwrap()).unwrap();

        assert_eq!(migration::drive_migration(&bed.relay, &m_v1).await.unwrap(), None, "refused");
        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v1_cid.as_str()),
            "nothing moved"
        );
        assert!(crate::db::community::get_migrated_to(&v1_cid).unwrap().is_none(), "no fence");
    }

    /// The held-twin flip runs under the twin's follow lock, like every other flip: a
    /// follow pass mid-flight holds a channel-less view whose whole-row save would prune
    /// the row the flip just moved.
    #[tokio::test]
    async fn a_held_twin_flip_waits_for_an_in_flight_follow_pass() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();
        let relay = std::sync::Arc::new(MemoryRelay::new());
        let (m_v1, v1_cid, v1_channel, v2_hex, twin) = held_twin_bed(&relay, &bed, &owner, &member).await;
        let v2_id = twin.identity.community_id;

        let signpost = signpost_for(&twin, &v2_hex, owner.keys.public_key().to_hex(), twin.identity.owner_salt, &v1_channel, bed.relays.clone());
        crate::db::community::set_migration_pointer(&v1_cid, &migration::build_migration_content(&signpost, None).unwrap()).unwrap();

        let held = crate::community::v2::realtime::follow_lock(&v2_id).lock_owned().await;
        let drive = crate::rt::spawn({
            let relay = relay.clone();
            let m_v1 = m_v1.clone();
            async move { migration::drive_migration(&*relay, &m_v1).await }
        });

        crate::rt::time::sleep(std::time::Duration::from_millis(300)).await;
        assert!(!drive.is_finished(), "the flip must wait for the in-flight follow pass");
        assert!(crate::db::community::get_migrated_to(&v1_cid).unwrap().is_none(), "no fence while the lock is held");
        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v1_cid.as_str()),
            "no reparent while the lock is held"
        );

        drop(held);
        assert_eq!(drive.await.unwrap().unwrap().as_deref(), Some(v2_hex.as_str()), "the flip completes once released");
        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v2_hex.as_str()),
            "the channel row is stitched to the twin"
        );
    }

    /// The OWNER wizard end-to-end: build the twin (primary channel reuses the v1 id),
    /// seal + publish the carrier, flip the owner. Then a MEMBER holding the v1 community
    /// folds the same carrier and stitches — proving the channel-STITCH the earlier test
    /// couldn't (that twin had mismatched ids).
    #[tokio::test]
    async fn owner_wizard_then_member_migrate_and_stitch() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;

        // Owner holds a v1 community (they created it) with one channel.
        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        let v1_channel = v1.channels[0].id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        // Run the wizard.
        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();
        assert_eq!(crate::db::community::get_migrated_to(&v1_cid).unwrap().as_deref(), Some(v2_hex.as_str()),
            "owner's own client flipped to v2");
        // The owner's v1 channel row re-parented to the twin (stitch), because the twin's
        // primary channel REUSES the v1 channel id.
        assert_eq!(crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(), Some(v2_hex.as_str()),
            "owner channel stitched to v2");

        // A MEMBER holding the same v1 community folds the carrier and migrates.
        bed.swap_to(&member);
        let mut m_v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        // The member's v1 community must be the SAME id + root the owner published under.
        m_v1.id = v1.id;
        m_v1.server_root_key = v1.server_root_key.clone();
        m_v1.channels[0].id = v1.channels[0].id;
        m_v1.owner_attestation = v1.owner_attestation.clone();
        crate::db::community::save_community(&m_v1).unwrap();

        // Fold the carrier off the relay: the dissolution arm seals, persists the pointer,
        // AND auto-drives the flip — the live one-event member experience, no manual step.
        crate::community::service::fetch_and_apply_control(&bed.relay, &m_v1).await.unwrap();
        assert!(crate::db::community::get_community_dissolved(&v1_cid).unwrap(), "member sees v1 sealed");
        assert_eq!(crate::db::community::get_migrated_to(&v1_cid).unwrap().as_deref(), Some(v2_hex.as_str()),
            "the FOLD ITSELF flipped the member (auto-drive)");
        assert!(crate::db::community::load_community_v2(&crate::community::CommunityId(crate::simd::hex::hex_to_bytes_32(&v2_hex))).unwrap().is_some(),
            "member holds the v2 twin");
        // A manual re-drive is an idempotent no-op.
        assert_eq!(migration::drive_migration(&bed.relay, &m_v1).await.unwrap(), None);
    }

    /// The wizard records the twin in the cross-device community list, like every other v2
    /// join/create path. Sibling devices normally discover the twin by folding the carrier
    /// themselves, but one that no longer holds the v1 community has no carrier to fold, so
    /// the list is its only route in.
    #[tokio::test]
    async fn wizard_publishes_the_twin_to_the_cross_device_list() {
        use crate::community::migration;
        let (bed, owner, _member) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;

        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();

        // The twin is live in the published list, so a fresh/carrier-less device finds it.
        let list = fetch_fragments(&bed.relay, &bed.relays).await.unwrap()
            .expect("the wizard published a community list").list;
        assert!(list.is_live(&v2_hex), "the twin must be live in the cross-device list");
        // The v1 community is NOT tombstoned there: a tombstone reads as "you left" and
        // `sync_community_list` would tear down a sibling's v1 row before it can fold the
        // carrier, stranding it. The local `migrated_to` fence is what stops v1 ghosts.
        assert!(
            !list.tombstones.iter().any(|t| t.community_id == v1_cid),
            "migration must not tombstone the v1 community"
        );
    }

    /// The wizard takes the same per-cid claim the member drive does, so a double-fired
    /// command (or the owner's own carrier self-fold racing the wizard's phase 2→3 gap)
    /// cannot run two wizards: the second would re-mint a twin before the ledger lands
    /// (the double-mint orphan) and race its flip against the first.
    #[tokio::test]
    async fn wizard_refuses_while_a_drive_holds_the_claim() {
        use crate::community::migration;
        let (bed, owner, _member) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;

        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        // Simulate the concurrent drive holding the cid (what the live carrier fold does).
        migration::test_hold_drive_claim(&v1_cid);
        let err = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap_err();
        assert!(err.contains("already in progress"), "second wizard refused, got: {err}");
        // Refused BEFORE minting: no twin, no ledger, nothing to orphan.
        assert!(crate::db::community::get_migration_ledger(&v1_cid).unwrap().is_none(), "no ledger row was written");
        assert!(crate::db::community::get_migrated_to(&v1_cid).unwrap().is_none(), "no flip happened");

        // Once the drive releases, the wizard runs normally.
        migration::test_release_drive_claim(&v1_cid);
        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();
        assert_eq!(crate::db::community::get_migrated_to(&v1_cid).unwrap().as_deref(), Some(v2_hex.as_str()));
    }

    /// The flip runs UNDER the twin's follow lock, so it can never straddle a follow
    /// worker's whole-row save (which deletes channel rows absent from its pre-flip,
    /// channel-less struct — pruning exactly the rows the flip just re-parented).
    /// Proves the lock actually serializes rather than being a no-op: with the lock held
    /// the wizard cannot reach its flip, and it completes once released.
    #[tokio::test]
    async fn wizard_flip_waits_for_an_in_flight_follow_pass() {
        use crate::community::migration;
        let (bed, owner, _member) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;
        // Shared across the spawned wizard, so both halves see the same relay state.
        let relay = std::sync::Arc::new(MemoryRelay::new());

        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        let v1_channel = v1.channels[0].id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        // Phase 1 alone, so the twin's id (and therefore its follow lock) is known before
        // the flip runs — exactly what a follow worker would have loaded.
        let twin = create_migration_twin(
            &*relay, "Guild", bed.relays.clone(), None,
            (v1.channels[0].id, "general".to_string()),
        ).await.unwrap();
        let v2_id = twin.identity.community_id;
        let v2_hex = crate::simd::hex::bytes_to_hex_32(&v2_id.0);
        crate::db::community::set_migration_ledger(&v1_cid, &v2_hex, migration::PHASE_TWIN_MINTED, "").unwrap();

        // A follow pass is in flight: it holds the lock across its network stage.
        let held = crate::community::v2::realtime::follow_lock(&v2_id).lock_owned().await;

        let wizard = crate::rt::spawn({
            let relay = relay.clone();
            let v1 = v1.clone();
            async move { migration::migrate_community_to_v2(&*relay, &v1, unlocked).await }
        });

        // The wizard runs its network phases but must BLOCK at the flip.
        crate::rt::time::sleep(std::time::Duration::from_millis(300)).await;
        assert!(!wizard.is_finished(), "the flip must wait for the in-flight follow pass");
        assert!(
            crate::db::community::get_migrated_to(&v1_cid).unwrap().is_none(),
            "the fence must not be stamped while the follow lock is held"
        );

        // The follow pass finishes; the flip proceeds.
        drop(held);
        let flipped = wizard.await.unwrap().unwrap();
        assert_eq!(flipped, v2_hex, "the wizard completed onto the SAME twin (resumed, never re-minted)");
        assert_eq!(
            crate::db::community::community_id_for_channel(&v1_channel).unwrap().as_deref(),
            Some(v2_hex.as_str()),
            "the channel row is stitched to the twin, not pruned"
        );
    }

    /// THE LYNCHPIN: a banned-but-never-cut v1 member CAN open `m` (they hold the v1
    /// root — no read-cut ever rotated it), but the wizard cloned the v1 banlist onto the
    /// twin, so the ban-gated accept refuses them: no Guestbook Join, no flip, room stays
    /// sealed. This is the exact residual JSKitty accepted, proven enforced.
    #[tokio::test]
    async fn banned_never_cut_member_opens_m_but_cannot_migrate() {
        use crate::community::migration;
        let (bed, owner, banned) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;

        // Owner's v1 community with the member on the BANLIST (never read-cut: epoch 0).
        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();
        crate::db::community::set_community_banlist(&v1_cid, &[banned.keys.public_key().to_hex()], 1_000).unwrap();

        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();

        // The banned member holds the same v1 (same root — never cut) and folds the carrier.
        bed.swap_to(&banned);
        let mut m_v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        m_v1.id = v1.id;
        m_v1.server_root_key = v1.server_root_key.clone();
        m_v1.channels[0].id = v1.channels[0].id;
        m_v1.owner_attestation = v1.owner_attestation.clone();
        crate::db::community::save_community(&m_v1).unwrap();
        crate::community::service::fetch_and_apply_control(&bed.relay, &m_v1).await.unwrap();

        // They hold the pointer AND can open `m` — but the drive is REFUSED at the ban gate.
        let raw = crate::db::community::get_migration_pointer(&v1_cid).unwrap().expect("pointer lands");
        let payload = migration::parse_migration_payload(&raw).unwrap();
        assert!(payload.m.is_some());
        let err = migration::drive_migration(&bed.relay, &m_v1).await.unwrap_err();
        assert!(err.contains("banned"), "refused at the join-time ban gate: {err}");
        assert!(crate::db::community::get_migrated_to(&v1_cid).unwrap().is_none(), "no flip");
        assert!(
            crate::db::community::load_community_v2(&crate::community::CommunityId(crate::simd::hex::hex_to_bytes_32(&v2_hex))).unwrap().is_none(),
            "banned member never acquires the v2 twin"
        );
    }

    /// Wizard resume never double-mints: a re-run after the TWIN_MINTED ledger row exists
    /// completes on the SAME v2 identity — with a NON-vacuous phase-1b re-run (a sibling
    /// channel + a banlist entry crash-recovered end-to-end, sibling stitched). Plus the
    /// crash-heal: flip landed but the FLIPPED ledger write didn't → re-run reports success.
    #[tokio::test]
    async fn wizard_resume_continues_on_the_same_twin() {
        use crate::community::migration;
        let (bed, owner, banned) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;

        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        // A second channel + a banned member make the resumed phase-1b tail REAL work.
        let mut sibling = v1.channels[0].clone();
        sibling.id = crate::community::ChannelId(crate::community::random_32());
        sibling.name = "offtopic".into();
        v1.channels.push(sibling.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();
        crate::db::community::set_community_banlist(&v1_cid, &[banned.keys.public_key().to_hex()], 1_000).unwrap();

        // Simulate a crash right after the mint: build the twin + ledger TWIN_MINTED, stop
        // BEFORE the sibling channel + banlist clone ever ran.
        let twin = create_migration_twin(&bed.relay, &v1.name, bed.relays.clone(), None, (v1.channels[0].id, "general".into())).await.unwrap();
        let minted_hex = crate::simd::hex::bytes_to_hex_32(&twin.identity.community_id.0);
        crate::db::community::set_migration_ledger(&v1_cid, &minted_hex, migration::PHASE_TWIN_MINTED, "").unwrap();

        // The re-run resumes onto the SAME identity, re-runs 1b, and completes.
        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();
        assert_eq!(v2_hex, minted_hex, "no second twin was minted");
        let (ledger_v2, phase, _) = crate::db::community::get_migration_ledger(&v1_cid).unwrap().unwrap();
        assert_eq!(ledger_v2, minted_hex);
        assert_eq!(phase, migration::PHASE_FLIPPED);
        // The crash-recovered sibling stitched too, and the banlist clone landed on the wire
        // (folding the twin's control plane yields the banned npub).
        assert_eq!(
            crate::db::community::community_id_for_channel(&sibling.id.to_hex()).unwrap().as_deref(),
            Some(minted_hex.as_str()),
            "sibling channel re-parented by the resumed run"
        );
        let twin_reloaded = crate::db::community::load_community_v2(&twin.identity.community_id).unwrap().unwrap();
        let wire_banlist = verify_owner_root_and_reconcile(&bed.relay, twin_reloaded.clone())
            .await
            .unwrap()
            .banned;
        assert!(wire_banlist.contains(&banned.keys.public_key().to_hex()),
            "the resumed banlist clone is folded from the twin's wire control plane");

        // Crash-heal: roll the ledger back to CARRIER_PUBLISHED (flip landed, ledger behind)
        // → the re-run reports SUCCESS and heals, never "already been migrated".
        crate::db::community::set_migration_ledger(&v1_cid, &minted_hex, migration::PHASE_CARRIER_PUBLISHED, "").unwrap();
        let healed = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();
        assert_eq!(healed, minted_hex);
        let (_, phase, _) = crate::db::community::get_migration_ledger(&v1_cid).unwrap().unwrap();
        assert_eq!(phase, migration::PHASE_FLIPPED, "ledger healed to FLIPPED");

        // Resume past a SELF-SEAL: a fold sealed the community after the carrier but
        // before the flip write (dissolved=1, migrated_to still NULL, ledger at
        // CARRIER_PUBLISHED). A wizard resume must NOT read this as a foreign dissolution.
        // Reuse THIS bed (a second TestBed would re-lock DB_TEST_GUARD and deadlock) with a
        // fresh v1 owned by the same owner.
        let mut v1b = crate::community::Community::create("Guild2", "general", bed.relays.clone());
        let v1b_cid = v1b.id.to_hex();
        v1b.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1b_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1b).unwrap();
        let twin2 = create_migration_twin(&bed.relay, &v1b.name, bed.relays.clone(), None, (v1b.channels[0].id, "general".into())).await.unwrap();
        let twin2_hex = crate::simd::hex::bytes_to_hex_32(&twin2.identity.community_id.0);
        crate::db::community::set_migration_ledger(&v1b_cid, &twin2_hex, migration::PHASE_CARRIER_PUBLISHED, "").unwrap();
        crate::db::community::set_community_dissolved(&v1b_cid).unwrap(); // the self-seal
        let resumed = migration::migrate_community_to_v2(&bed.relay, &v1b, unlocked).await.unwrap();
        assert_eq!(resumed, twin2_hex, "resume past a self-seal completes, not false-terminal");
        assert_eq!(crate::db::community::get_migrated_to(&v1b_cid).unwrap().as_deref(), Some(twin2_hex.as_str()));
    }

    /// The birth refound SEEDS the roster: rolling a genesis (epoch 0) twin to epoch 1 with an
    /// explicit member list makes those members fold into the memberlist WITHOUT any of them
    /// publishing a Join — the anti-ghost-town seed for not-yet-migrated v1 members (who hold
    /// no v2 keys). Genesis had no snapshot power; epoch 1 (owner = minting refounder) does.
    #[tokio::test]
    async fn birth_refound_seeds_an_explicit_roster() {
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let twin = create_migration_twin(&bed.relay, "Guild", bed.relays.clone(), None,
            (ChannelId(crate::community::random_32()), "general".into())).await.unwrap();
        assert_eq!(twin.root_epoch, Epoch(0), "twin starts at genesis");
        // Two strangers who never join — pure seeded members.
        let ghost_a = Keys::generate().public_key();
        let ghost_b = Keys::generate().public_key();

        let rolled = refound_at_birth(&bed.relay, &twin, &[owner.keys.public_key(), ghost_a, ghost_b]).await.unwrap();
        assert_eq!(rolled.root_epoch, Epoch(1), "birth refound advanced the twin to epoch 1");

        // The memberlist folds all three from the epoch-1 snapshot, though only the owner
        // ever published a Join.
        let members = memberlist(&bed.relay, &rolled).await.unwrap();
        assert!(members.contains(&owner.keys.public_key()), "owner in the roster");
        assert!(members.contains(&ghost_a) && members.contains(&ghost_b), "never-joined members are seeded (no ghost town)");

        // The compacted control plane still verifies (owner genesis carried to epoch 1) — a
        // fresh joiner at epoch 1 folds it. And a genesis-epoch snapshot has NO power: rolling
        // a fresh twin's snapshot only counts because the owner minted epoch 1.
        let _ = verify_owner_root_and_reconcile(&bed.relay, rolled.clone()).await
            .expect("the epoch-1 twin verifies from its compacted control plane");

        // RESUME IDEMPOTENCE: a re-call on the already-refounded twin is a no-op (returns
        // epoch 1), never a double-advance to epoch 2 — the crash-between-wire-and-ledger case.
        let again = refound_at_birth(&bed.relay, &rolled, &[owner.keys.public_key(), ghost_a, ghost_b]).await.unwrap();
        assert_eq!(again.root_epoch, Epoch(1), "re-running the birth refound does not advance past epoch 1");
        assert_eq!(crate::db::community::load_community_v2(&twin.identity.community_id).unwrap().unwrap().root_epoch, Epoch(1));
    }

    /// A banned entry in the seed list must NOT wedge the verify-back: fold_members
    /// subtracts the banlist, so a banned seed is never "readable" — the defensive filter drops
    /// it before the snapshot, so the refound still completes instead of aborting forever.
    #[tokio::test]
    async fn birth_refound_ignores_a_banned_seed_entry() {
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let twin = create_migration_twin(&bed.relay, "Guild", bed.relays.clone(), None,
            (ChannelId(crate::community::random_32()), "general".into())).await.unwrap();
        let good = Keys::generate().public_key();
        let banned = Keys::generate();
        // Ban `banned` on the twin, then hand refound a seed list that (wrongly) includes them.
        set_banlist(&bed.relay, &twin, &[banned.public_key().to_hex()]).await.unwrap();
        let twin = crate::db::community::load_community_v2(&twin.identity.community_id).unwrap().unwrap();

        let rolled = refound_at_birth(&bed.relay, &twin, &[owner.keys.public_key(), good, banned.public_key()]).await
            .expect("a banned seed entry is filtered, not a permanent verify-back wedge");
        assert_eq!(rolled.root_epoch, Epoch(1));
        let members = memberlist(&bed.relay, &rolled).await.unwrap();
        assert!(members.contains(&good), "the non-banned seed lands");
        assert!(!members.contains(&banned.public_key()), "the banned seed is not a member");
    }

    /// The "late migrator never misses an epoch" property: a SEEDED-but-never-landed
    /// member (in the roster only via the birth snapshot, holding no keys, never posted) is a
    /// RECIPIENT of a subsequent OWNER refound — so a rotation that happens before they migrate
    /// still mints them a rekey blob to walk forward on. Verified by checking the ghost lands
    /// in the refound's memberlist-derived recipient set (they get a base-rekey blob).
    #[tokio::test]
    async fn a_seeded_member_receives_a_later_refound_rekey() {
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let twin = create_migration_twin(&bed.relay, "Guild", bed.relays.clone(), None,
            (ChannelId(crate::community::random_32()), "general".into())).await.unwrap();
        let ghost = Keys::generate();
        // Birth refound seeds the ghost (never joins, holds no keys).
        let rolled = refound_at_birth(&bed.relay, &twin, &[owner.keys.public_key(), ghost.public_key()]).await.unwrap();
        assert!(memberlist(&bed.relay, &rolled).await.unwrap().contains(&ghost.public_key()), "ghost is seeded");

        // A later OWNER refound (epoch 1→2) derives its rekey recipients from memberlist(),
        // which folds the snapshot — so the ghost IS a recipient (a base-rekey blob is minted
        // for them by construction) AND is re-snapshotted at epoch 2. Surviving in the epoch-2
        // memberlist proves both: the refound saw them as a member and carried them forward, so
        // a late migrator who opens `m` (epoch 1) can then walk their epoch-2 blob forward.
        let refounded = refound_community(&bed.relay, &rolled, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(2), "the later refound advanced the epoch");
        assert!(
            memberlist(&bed.relay, &refounded).await.unwrap().contains(&ghost.public_key()),
            "a seeded member is a recipient of + re-seeded by a later refound (never misses an epoch)"
        );
    }

    /// Governance survives migration: a v1 ADMIN is re-granted @admin on the twin (holds
    /// MANAGE_ROLES there), while a plain member is not.
    #[tokio::test]
    async fn v1_admin_stays_admin_across_migration() {
        use crate::community::migration;
        use crate::community::roles::{CommunityRoles, MemberGrant, Role};
        let (bed, owner, admin) = TestBed::new();
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;

        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();
        // v1 governance: one Admin role, granted to `admin`.
        let admin_role = Role::admin("a1".repeat(32));
        let roles = CommunityRoles {
            roles: vec![admin_role.clone()],
            grants: vec![MemberGrant { member: admin.keys.public_key().to_hex(), role_ids: vec![admin_role.role_id.clone()] }],
        };
        crate::db::community::set_community_roles(&v1_cid, &roles, 1_000).unwrap();

        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();
        let twin = crate::db::community::load_community_v2(&crate::community::CommunityId(crate::simd::hex::hex_to_bytes_32(&v2_hex))).unwrap().unwrap();

        // Fold the twin's authority from the wire: the admin holds MANAGE_ROLES, a stranger doesn't.
        let authority = fetch_authority(&bed.relay, &twin).await;
        assert!(
            authority.roles.is_authorized(&admin.keys.public_key().to_hex(), Some(&owner.keys.public_key().to_hex()), Permissions::MANAGE_ROLES),
            "the v1 admin is an admin on the v2 twin"
        );
        assert!(
            !authority.roles.is_authorized(&Keys::generate().public_key().to_hex(), Some(&owner.keys.public_key().to_hex()), Permissions::MANAGE_ROLES),
            "a non-admin gains no authority"
        );
    }

    /// A device that never folded the dissolution tombstone still heals.
    ///
    /// Live two-device wedge: the control fold is what seals a migrated-away community,
    /// and the boot control probe can veto that fold indefinitely (it is `since`-windowed
    /// over the CONTROL plane, while the tombstone lives at the DISSOLVED coordinate). The
    /// second device therefore sat UNSEALED, which used to exclude it from the sweep
    /// (`dissolved = 1`) AND from the flip retry (no pointer) — the one state that most
    /// needed probing was the one nothing probed, so it stayed on v1 forever.
    #[tokio::test]
    async fn an_unsealed_v1_that_was_migrated_away_still_heals() {
        use crate::community::migration;
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);

        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        // The owner migrates on their FIRST device: this publishes the carrier tombstone.
        let unlocked = migration::MIGRATION_UNLOCK_AT + 1;
        let v2_hex = migration::migrate_community_to_v2(&bed.relay, &v1, unlocked).await.unwrap();

        // A MEMBER's device that holds the v1 community and never folded the tombstone:
        // unsealed, pointer-less, unchecked — exactly the wedged shape.
        bed.swap_to(&member);
        crate::db::community::save_community(&v1).unwrap();
        assert!(
            !crate::db::community::get_community_dissolved(&v1_cid).unwrap(),
            "precondition: the wedged device has NOT sealed its v1 row"
        );

        // It IS a sweep candidate now (the fix); before, `dissolved = 1` excluded it.
        assert!(
            crate::db::community::migration_sweep_candidates().unwrap().contains(&v1_cid),
            "an unsealed, migrated-away v1 must be probed"
        );

        migration::sweep_dissolved_for_migration(&bed.relay).await;

        // The sweep found the carrier, sealed the v1 row, and flipped it to the twin.
        assert!(crate::db::community::get_community_dissolved(&v1_cid).unwrap(), "sealed by the sweep");
        assert_eq!(
            crate::db::community::get_migrated_to(&v1_cid).unwrap().as_deref(),
            Some(v2_hex.as_str()),
            "flipped to the same twin the first device produced"
        );
        assert!(
            !crate::db::community::migration_sweep_candidates().unwrap().contains(&v1_cid),
            "and the sweep converges — no re-probing forever"
        );
    }

    /// The sweep converges on a PLAIN dissolution (owner-signed, no payload) but a
    /// non-owner tombstone (member-mintable) must NOT mark it checked — else a partial-relay
    /// probe returning only a stranger's record would permanently stop the sweep before the
    /// owner's real carrier is ever fetched.
    #[tokio::test]
    async fn sweep_marks_checked_only_on_an_owner_tombstone() {
        use crate::community::migration;
        let (bed, owner, stranger) = TestBed::new();

        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        let v1_cid = v1.id.to_hex();
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1_cid)
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        // A STRANGER publishes a (payload-less) tombstone at the dissolved coordinate, and
        // the community is locally sealed (as if folded on an old build) but not yet checked.
        let inner = crate::community::roster::build_group_dissolved_edition(&stranger.keys, &v1.id, 500).unwrap();
        let outer = crate::community::roster::seal_dissolved_edition(&Keys::generate(), &inner, &v1.id).unwrap();
        bed.relay.publish_durable(&outer, &bed.relays).await.unwrap();
        crate::db::community::set_community_dissolved(&v1_cid).unwrap();

        // Sweep: the only record is a stranger's → NOT marked checked (still a candidate).
        migration::sweep_dissolved_for_migration(&bed.relay).await;
        assert!(
            crate::db::community::migration_sweep_candidates().unwrap().contains(&v1_cid),
            "a stranger-only probe must not converge the sweep"
        );

        // Now the OWNER publishes a plain dissolution → sweep marks it checked.
        let owner_inner = crate::community::roster::build_group_dissolved_edition(&owner.keys, &v1.id, 600).unwrap();
        let owner_outer = crate::community::roster::seal_dissolved_edition(&Keys::generate(), &owner_inner, &v1.id).unwrap();
        bed.relay.publish_durable(&owner_outer, &bed.relays).await.unwrap();
        migration::sweep_dissolved_for_migration(&bed.relay).await;
        assert!(
            !crate::db::community::migration_sweep_candidates().unwrap().contains(&v1_cid),
            "an owner plain-dissolution converges the sweep"
        );
    }

    /// Wizard preflight refuses before the timelock and for non-owners.
    #[tokio::test]
    async fn wizard_preflight_gates_timelock_and_ownership() {
        use crate::community::migration;
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let mut v1 = crate::community::Community::create("Guild", "general", bed.relays.clone());
        v1.owner_attestation = Some({
            crate::community::owner::build_owner_attestation_unsigned(owner.keys.public_key(), &v1.id.to_hex())
                .finalize(&owner.keys).unwrap().as_json()
        });
        crate::db::community::save_community(&v1).unwrap();

        // Before the unlock → refused, nothing published.
        let err = migration::migrate_community_to_v2(&bed.relay, &v1, migration::MIGRATION_UNLOCK_AT - 1).await.unwrap_err();
        assert!(err.contains("not unlocked"), "{err}");
        assert!(crate::db::community::get_migration_ledger(&v1.id.to_hex()).unwrap().is_none(), "no ledger row before unlock");
    }

    #[tokio::test]
    async fn public_link_full_loop() {
        let (bed, owner, member) = TestBed::new();

        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Public Guild", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&bed.relay, &community, &general, "come on in").await.unwrap();
        // Mint a shareable link (a non-stock relay so the fragment carries it).
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();
        assert!(link.url.starts_with("https://vectorapp.io/invite/"));
        assert!(link.url.contains('#'), "the fragment carries the token");

        // Member joins purely from the URL string.
        bed.swap_to(&member);
        let joined = accept_public_link(&bed.relay, &link.url).await.unwrap();
        assert_eq!(joined.id().0, community.id().0);
        assert_eq!(texts_in(&bed.relay, &joined, &general).await, vec!["come on in"]);
    }

    #[test]
    fn bundle_of_snapshots_the_held_icon() {
        let owner = Keys::generate();
        let g = control::genesis(&owner, control::CommunityMetadata { name: "Logo".into(), ..Default::default() }, 1_000).unwrap();
        let mut c = CommunityV2::from_genesis(&g, "Logo", None, vec!["wss://r".into()], 0);
        let icon = control::ImageRef { url: "https://blossom.example/i".into(), key: "k".into(), nonce: "n".into(), hash: "h".into(), extra: Default::default() };
        c.icon = Some(icon.clone());
        let bundle = bundle_of(&c, BundleAudience::Link, None, None, None);
        assert_eq!(bundle.icon, Some(icon), "a parked invite renders the real logo from the mint-time snapshot");
    }

    #[test]
    fn addressing_roots_fan_current_plus_archived_bounded_and_deduped() {
        // follow_rekeys' fetch fan AND streamauth's plane registration share
        // this. A channel rekey rides the PRIOR root (CORD-06 D2), so the set
        // MUST include archived roots or an AUTH-gated relay never serves the
        // rotation crate → the channel stalls at its old epoch.
        let (_tmp, _guard, _owner) = init_test_db();
        let cur_root = [9u8; 32];
        let cid = crate::community::CommunityId([1u8; 32]);
        let cid_hex = cid.to_hex();

        // No archives yet → just the current root.
        let roots = channel_rekey_addressing_roots(cur_root, &cid_hex);
        assert_eq!(roots, vec![cur_root], "with no archived roots the fan is the current root alone");

        // Archive two prior roots (freshest-first ordering is asserted below).
        crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, 0, &[1u8; 32]).unwrap();
        crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, 1, &[2u8; 32]).unwrap();
        let roots = channel_rekey_addressing_roots(cur_root, &cid_hex);
        assert_eq!(roots[0], cur_root, "current root leads");
        assert!(roots.contains(&[1u8; 32]) && roots.contains(&[2u8; 32]), "both archived roots are in the fan");
        assert_eq!(roots.len(), 3, "current + 2 archived, no dupes");
        // Freshest-archived-first (epoch 1 before epoch 0).
        assert_eq!(roots[1], [2u8; 32], "higher archived epoch is addressed before the lower");

        // A stored root equal to the CURRENT one must not duplicate.
        crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, 2, &cur_root).unwrap();
        let roots = channel_rekey_addressing_roots(cur_root, &cid_hex);
        assert_eq!(roots.iter().filter(|r| **r == cur_root).count(), 1, "the current root is never duplicated");

        // Cap: many archives truncate to MAX_ADDRESSING_ROOTS.
        for e in 3..20u64 {
            crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, e, &[e as u8; 32]).unwrap();
        }
        let roots = channel_rekey_addressing_roots(cur_root, &cid_hex);
        assert_eq!(roots.len(), MAX_ADDRESSING_ROOTS, "the fan is bounded so a relay can't feed an unbounded walk");
    }

    #[tokio::test]
    async fn public_link_preview_shows_live_name_and_icon_without_joining() {
        let (bed, owner, member) = TestBed::new();

        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Soapbox", bed.relays.clone(), None).await.unwrap();
        // The icon lives on the Control Plane, never in the bundle — publish it
        // as a metadata edition so the preview must FOLD to see it.
        let icon = control::ImageRef {
            url: "https://blossom.example/soap".into(),
            key: "k".into(),
            nonce: "n".into(),
            hash: "h".into(),
            extra: Default::default(),
        };
        let mut meta = community.metadata();
        meta.icon = Some(icon.clone());
        edit_community_metadata(&bed.relay, &community, &meta).await.unwrap();
        // An any-host base — the naddr#fragment payload is domain-agnostic.
        let link = mint_public_link(&bed.relay, &community, "https://armada.buzz", None, None).await.unwrap();

        // A NON-member previews: the real name + the live icon, nothing persisted.
        bed.swap_to(&member);
        let preview = preview_public_link(&bed.relay, &link.url).await.unwrap();
        assert_eq!(preview.name, "Soapbox");
        assert_eq!(preview.icon, Some(icon), "the icon folds from the live Control Plane, not the bundle");
        assert!(
            crate::db::community::load_community_v2(preview.id()).unwrap().is_none(),
            "previewing must not persist a membership"
        );
    }

    #[tokio::test]
    async fn a_previewed_join_reuses_the_verified_fold() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "FastJoin", bed.relays.clone(), None).await.unwrap();
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();

        bed.swap_to(&member);
        let _ = preview_public_link(&bed.relay, &link.url).await.unwrap();
        let joined = accept_public_link(&bed.relay, &link.url).await.unwrap();
        assert_eq!(joined.id().0, community.id().0);
        assert!(joined.created_at_ms > 0, "the handoff stamps the JOIN's acquisition time, not the preview's");
        // The slot was CONSUMED by the join — proving the handoff path ran (a
        // verify re-walk would have left the preview's entry in place).
        assert!(VERIFIED_PREVIEW.lock().unwrap().is_none(), "the handoff slot must be consumed by the join");
    }

    #[tokio::test]
    async fn guestbook_store_seeds_syncs_incrementally_and_matches_the_live_fold() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "GB", bed.relays.clone(), None).await.unwrap();
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();

        bed.swap_to(&member);
        let joined = accept_public_link(&bed.relay, &link.url).await.unwrap();

        // Seed from zero: the stored fold equals the authoritative live fold.
        assert!(!sync_guestbook(&bed.relay, &joined).await.unwrap().is_empty(), "the seed folds fresh events");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        let (_, cursor) = crate::db::community::get_guestbook(&cid_hex).unwrap();
        assert!(cursor > 0, "the cursor advanced past zero");
        let stored: std::collections::BTreeSet<_> = stored_memberlist(&joined).unwrap().into_iter().collect();
        let live: std::collections::BTreeSet<_> = memberlist(&bed.relay, &joined).await.unwrap().into_iter().collect();
        assert_eq!(stored, live, "stored fold == live fold after the seed");
        assert!(stored.contains(&member.keys.public_key()));

        // Nothing new on the plane → an idle re-sync folds nothing.
        assert!(sync_guestbook(&bed.relay, &joined).await.unwrap().is_empty());

        // The owner kicks the member; a CURSOR catch-up folds the kick in — no full walk.
        bed.swap_to(&owner);
        kick_member(&bed.relay, &community, &member.keys.public_key()).await.unwrap();
        bed.swap_to(&member);
        assert!(!sync_guestbook(&bed.relay, &joined).await.unwrap().is_empty(), "the kick lands incrementally");
        assert!(
            !stored_memberlist(&joined).unwrap().contains(&member.keys.public_key()),
            "an owner kick removes the member from the stored fold"
        );
    }

    #[tokio::test]
    async fn a_preview_then_revoke_still_refuses_the_join() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "RevokeRace", bed.relays.clone(), None).await.unwrap();
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();

        // Member previews (warming the verified handoff), THEN the owner revokes.
        bed.swap_to(&member);
        let p = preview_public_link(&bed.relay, &link.url).await.unwrap();
        assert_eq!(p.name, "RevokeRace");
        bed.swap_to(&owner);
        let tombstone = invite::build_revocation(&link.link_signer).unwrap();
        bed.relay.publish_durable(&tombstone, &bed.relays).await.unwrap();

        // The join MUST refuse: the handoff skips only the root re-verify, never
        // the bundle re-fetch that carries the revocation gate.
        bed.swap_to(&member);
        let err = accept_public_link(&bed.relay, &link.url).await.unwrap_err();
        assert!(err.contains("revoked"), "got: {err}");
    }

    #[tokio::test]
    async fn a_revoked_link_refuses_to_join() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Revoked", bed.relays.clone(), None).await.unwrap();
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();
        // Owner retires the link (re-posts the coordinate as a tombstone).
        let tombstone = invite::build_revocation(&link.link_signer).unwrap();
        bed.relay.publish_durable(&tombstone, &bed.relays).await.unwrap();

        bed.swap_to(&member);
        let err = accept_public_link(&bed.relay, &link.url).await.unwrap_err();
        assert!(err.contains("revoked"), "a retired link finds the grave, not keys: {err}");
    }

    #[tokio::test]
    async fn an_expired_direct_invite_refuses_to_join() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Expired", bed.relays.clone(), None).await.unwrap();
        // Hand-mint an invite that expired in the past.
        let inviter = owner.keys.clone();
        let mut bundle = bundle_of(&community, BundleAudience::Link, Some(inviter.public_key()), Some(1_000), None);
        bundle.expires_at = Some(1_000); // unix ms, long past
        let wrap = invite::build_direct_invite(&inviter, &member.keys.public_key(), &bundle).unwrap();
        bed.relay.publish(&wrap, &bed.relays).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let err = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap_err();
        assert!(err.contains("expired"), "a past-expiry invite refuses to join: {err}");
    }

    #[tokio::test]
    async fn a_tombstone_beats_a_live_bundle_regardless_of_fetch_order() {
        // The revocation-durability fix: if ANY signer-valid tombstone is among the
        // fetched events, refuse — even when a Live bundle is returned FIRST (the
        // production union has no newest-first sort, so a stale relay's Live can lead).
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Rev", bed.relays.clone(), None).await.unwrap();
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();
        let tombstone = invite::build_revocation(&link.link_signer).unwrap();

        // A relay union that hands back [Live, tombstone] — Live FIRST. Old
        // `events.first()` would join the Live; the scan-all fix must refuse.
        let union = FixedFetch { events: vec![link.bundle_event.clone(), tombstone] };

        bed.swap_to(&member);
        let err = accept_public_link(&union, &link.url).await.unwrap_err();
        assert!(err.contains("revoked"), "a tombstone must beat a Live returned first: {err}");
    }

    #[test]
    fn from_bundle_refuses_an_over_cap_bundle_before_allocating() {
        // The accept-side DoS bound: from_bundle (which accept_bundle calls)
        // rejects a >256-channel bundle via validate() BEFORE the Vec allocation.
        // (The Direct-Invite wire path is additionally bounded by NIP-44's 64KB
        // cap, which trips even earlier — but the count guard is the real defense
        // for the single-layer public-link bundle.)
        let owner = Keys::generate();
        let identity = super::super::control::CommunityIdentity::mint(&owner.public_key());
        let hex = crate::simd::hex::bytes_to_hex_32;
        let root = [0x11u8; 32];
        let mut bundle = CommunityInvite {
            community_id: hex(&identity.community_id.0),
            owner: hex(&identity.owner_xonly),
            owner_salt: hex(&identity.owner_salt),
            community_root: hex(&root),
            root_epoch: 0,
            control_pk: None,
            channels: vec![],
            relays: vec!["wss://r".into()],
            name: "X".into(),
            icon: None,
            expires_at: None,
            creator_npub: None,
            label: None,
            extra: Default::default(),
        };
        bundle.channels = (0..=invite::MAX_BUNDLE_CHANNELS)
            .map(|i| {
                let mut id = [0u8; 32];
                id[..8].copy_from_slice(&(i as u64).to_be_bytes());
                invite::ChannelGrant { id: hex(&id), key: hex(&root), epoch: 0, name: "x".into() }
            })
            .collect();
        assert!(CommunityV2::from_bundle(&bundle, 0).is_err(), "an over-cap bundle is refused before allocating");
    }

    #[tokio::test]
    async fn a_join_swap_between_fetch_and_save_lands_in_the_joining_account() {
        // A public-link accept fetches, then saves. A swap in that window used to
        // abort the join outright; the community is now written to the account
        // that clicked the link, and the account swapped in gets nothing.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Straddle", bed.relays.clone(), None).await.unwrap();
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();
        bed.swap_to(&member);
        let joiner = crate::db::current_session();
        let swap_relay = SwapMidFetch::arm(&bed.relay);
        accept_public_link(&swap_relay, &link.url).await.unwrap();

        assert!(
            crate::db::with_session(joiner, async {
                crate::db::community::load_community_v2(community.id()).unwrap().is_some()
            })
            .await,
            "the join completed for the account that accepted the link"
        );
    }

    #[tokio::test]
    async fn the_owner_is_a_member_even_without_a_fetched_genesis_join() {
        // The owner is derived from the self-certifying community_id, so the
        // memberlist includes them independent of any Guestbook fetch.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Owned", vec!["wss://r".into()], None).await.unwrap();
        // A memberlist over an EMPTY guestbook (fetch a community-relay-less view)
        // still contains the owner.
        let empty = MemoryRelay::new();
        let members = memberlist(&empty, &community).await.unwrap();
        assert_eq!(members, vec![owner.public_key()], "owner present with no fetched Join");
    }

    #[tokio::test]
    async fn an_expiring_minted_invite_refuses_after_the_deadline() {
        // The mint path can now produce an expiring invite, and the accept gate
        // trips on it (end-to-end through the real service, not a hand-built bundle).
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Timed", bed.relays.clone(), None).await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), Some(1_000), Some("beta".into()))
            .await
            .unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        assert!(
            accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap_err().contains("expired"),
            "a minted expiring invite refuses past its deadline"
        );
    }

    #[tokio::test]
    async fn a_member_who_leaves_drops_from_the_memberlist() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Leaving", bed.relays.clone(), None).await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap();
        // Let the leave land strictly after the join.
        crate::rt::time::sleep(std::time::Duration::from_millis(2)).await;
        leave_community(&bed.relay, &joined).await.unwrap();

        bed.swap_to(&owner);
        let members = memberlist(&bed.relay, &community).await.unwrap();
        assert!(members.contains(&owner.keys.public_key()));
        assert!(!members.contains(&member.keys.public_key()), "a member who left drops from the list");
    }

    #[tokio::test]
    async fn a_swapped_member_cannot_see_the_owners_community_until_joining() {
        // Multi-account isolation: after the swap, the member's DB holds nothing
        // of the owner's community — the dual-stack storage is per-account.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Private-so-far", bed.relays.clone(), None).await.unwrap();
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_some());

        bed.swap_to(&member);
        assert!(
            crate::db::community::load_community_v2(community.id()).unwrap().is_none(),
            "the owner's community must be invisible in the member's account DB"
        );
        assert_eq!(crate::db::community::list_community_ids().unwrap().len(), 0);
    }

    // ── Live control-follow ──────────────────────────────────────────────────

    /// Publish an owner-grammar channel edition straight to the control plane,
    /// signed by `signer` (the owner for a legit edit, a stranger for the
    /// authority test). `version`/`deleted` drive add-vs-rename-vs-delete.
    /// The entity's current head `self_hash` on the relay (highest version wins),
    /// so a helper can chain a new edition the way a real owner client does.
    async fn head_hash_on_relay(relay: &MemoryRelay, community: &CommunityV2, entity_id: &[u8; 32]) -> Option<[u8; 32]> {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let query = Query { kinds: vec![stream::KIND_WRAP], authors: vec![group.pk_hex()], limit: Some(500), ..Default::default() };
        let wraps = relay.fetch(&query, &community.relays).await.ok()?;
        let mut head: Option<(u64, [u8; 32])> = None;
        for w in &wraps {
            if let Ok((ed, _)) = control::open_control_edition(w, &group) {
                if ed.entity_id == *entity_id && head.is_none_or(|(v, _)| ed.version > v) {
                    head = Some((ed.version, ed.self_hash));
                }
            }
        }
        head.map(|(_, h)| h)
    }

    /// The `vac` a non-owner signer must attach, read off the Grant they were
    /// given on the relay (CORD-04 §5). The owner cites nothing. Mirrors what a
    /// real client does via `my_authority_citation`, so the fixtures publish the
    /// shape Vector actually emits.
    async fn cite_on_relay(
        relay: &MemoryRelay,
        community: &CommunityV2,
        signer: &Keys,
    ) -> Option<crate::community::edition::AuthorityCitation> {
        if community.owner().ok() == Some(signer.public_key()) {
            return None;
        }
        let entity_id = crate::community::v2::derive::grant_locator(community.id(), &signer.public_key().to_bytes());
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let query = Query { kinds: vec![stream::KIND_WRAP], authors: vec![group.pk_hex()], limit: Some(500), ..Default::default() };
        let wraps = relay.fetch(&query, &community.relays).await.ok()?;
        let mut head: Option<(u64, [u8; 32])> = None;
        for w in &wraps {
            if let Ok((ed, _)) = control::open_control_edition(w, &group) {
                if ed.entity_id == entity_id && head.is_none_or(|(v, _)| ed.version > v) {
                    head = Some((ed.version, ed.self_hash));
                }
            }
        }
        head.map(|(version, edition_hash)| crate::community::edition::AuthorityCitation { entity_id, version, edition_hash })
    }

    async fn publish_channel_edition(
        relay: &MemoryRelay,
        community: &CommunityV2,
        signer: &Keys,
        channel_id: &ChannelId,
        name: &str,
        private: bool,
        version: u64,
        deleted: bool,
    ) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let prev = head_hash_on_relay(relay, community, &channel_id.0).await;
        let meta = control::ChannelMetadata { name: name.into(), private, deleted: deleted.then_some(true), ..Default::default() };
        let content = serde_json::to_string(&meta).unwrap();
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::CHANNEL_METADATA, &channel_id.0, version, prev.as_ref(), &content, 1_000, None);
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    /// A channel edition at an EXPLICIT time, so a paging test can order the plane —
    /// the default helper stamps everything 1_000, which leaves newest-first paging
    /// arbitrary and any "buried edition" scenario vacuous.
    #[allow(clippy::too_many_arguments)]
    async fn publish_channel_edition_at(
        relay: &MemoryRelay,
        community: &CommunityV2,
        signer: &Keys,
        channel_id: &ChannelId,
        name: &str,
        version: u64,
        at_secs: u64,
    ) {
        let group = control::ControlPlane::of(community).write_group().unwrap();
        let meta = control::ChannelMetadata { name: name.into(), private: false, deleted: None, ..Default::default() };
        let content = serde_json::to_string(&meta).unwrap();
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::CHANNEL_METADATA, &channel_id.0, version, None, &content, at_secs, None);
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(at_secs)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    /// Publish an owner-grammar community-metadata edition (rename etc.), chained
    /// to the current relay head like a real owner client.
    async fn publish_community_meta(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, name: &str, version: u64) {
        publish_community_meta_at(relay, community, signer, name, version, 1_000).await;
    }

    /// As [`publish_community_meta`] with an explicit timestamp, for tests that need
    /// relay-side newest-first ordering (paging/eviction scenarios).
    async fn publish_community_meta_at(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, name: &str, version: u64, at_secs: u64) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let prev = head_hash_on_relay(relay, community, &community.id().0).await;
        let meta = control::CommunityMetadata { name: name.into(), ..Default::default() };
        let content = serde_json::to_string(&meta).unwrap();
        let cite = cite_on_relay(relay, community, signer).await;
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, version, prev.as_ref(), &content, at_secs, cite.as_ref());
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(at_secs)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    #[test]
    fn metadata_apply_captures_undriven_fields_for_republish() {
        let owner = Keys::generate();
        let g = control::genesis(&owner, control::CommunityMetadata { name: "A".into(), ..Default::default() }, 1_000).unwrap();
        let mut held = CommunityV2::from_genesis(&g, "A", None, vec!["wss://r".into()], 0);
        let general = held.channels[0].id;

        // A foreign vsk-0 head carrying custom + unknown fields folds them in…
        let mut custom = serde_json::Map::new();
        custom.insert("accent".into(), serde_json::Value::from("#89f0b6"));
        let mut extra = serde_json::Map::new();
        extra.insert("vnd_flag".into(), serde_json::Value::Bool(true));
        let meta = control::CommunityMetadata { name: "A".into(), custom: Some(custom.clone()), extra: extra.clone(), ..Default::default() };
        assert!(apply_community_metadata(&mut held, meta), "gaining custom/extra is a change");
        assert_eq!(held.meta_custom, Some(custom.clone()));
        assert_eq!(held.meta_extra, extra);
        // …and the next local edit's base document republishes them verbatim.
        assert_eq!(held.metadata().custom, Some(custom));
        assert_eq!(held.metadata().extra, held.meta_extra);

        // Same contract for a vsk-2 channel head (voice included).
        let mut ch_custom = serde_json::Map::new();
        ch_custom.insert("slowmode".into(), serde_json::Value::from(30));
        let ch_meta = control::ChannelMetadata {
            name: "general".into(),
            private: false,
            voice: Some(true),
            deleted: None,
            custom: Some(ch_custom.clone()),
            extra: Default::default(),
        };
        assert!(apply_channel_metadata(&mut held, general, ch_meta), "gaining voice/custom is a change");
        let ch = held.channel(&general).unwrap();
        assert_eq!(ch.voice, Some(true));
        assert_eq!(ch.meta_custom, Some(ch_custom.clone()));
        let rename = { let mut d = ch.metadata(); d.name = "lounge".into(); d };
        assert_eq!(rename.voice, Some(true), "our rename edition carries the foreign voice flag");
        assert_eq!(rename.custom, Some(ch_custom));
    }

    #[test]
    fn community_metadata_apply_sets_and_clears_images() {
        let owner = Keys::generate();
        let g = control::genesis(&owner, control::CommunityMetadata { name: "A".into(), ..Default::default() }, 1_000).unwrap();
        let mut held = CommunityV2::from_genesis(&g, "A", None, vec!["wss://r".into()], 0);

        let icon = control::ImageRef {
            url: "https://blossom.example/i".into(),
            key: "k".into(),
            nonce: "n".into(),
            hash: "h".into(),
            extra: Default::default(),
        };
        let with_icon = control::CommunityMetadata { name: "A".into(), icon: Some(icon.clone()), ..Default::default() };
        assert!(apply_community_metadata(&mut held, with_icon), "gaining an icon is a change");
        assert_eq!(held.icon.as_ref(), Some(&icon));

        // An edition is the FULL document: a head without the icon removes it.
        let without = control::CommunityMetadata { name: "A".into(), ..Default::default() };
        assert!(apply_community_metadata(&mut held, without), "losing the icon is a change");
        assert_eq!(held.icon, None);
    }

    /// Publish a Role edition (vsk 1) signed by `signer`, chained to the current head.
    async fn publish_role(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, role: &Role, version: u64) {
        publish_role_at(relay, community, signer, role, version, 1_000).await
    }

    /// Page filler: a signed edition that occupies a slot in the pager's window and
    /// nothing else. It skips the head/citation relay scans `publish_role` does, which
    /// are linear in plane size and make a 500-edition test quadratic.
    async fn publish_filler_edition(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, role: &Role, version: u64, ts: u64) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let role_id = crate::simd::hex::hex_to_bytes_32_checked(&role.role_id).unwrap();
        let content = crate::community::v2::roles::role_content_json(role).unwrap();
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::ROLE, &role_id, version, None, &content, ts, None);
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(ts)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    /// `publish_role` with an explicit wall clock. Every other helper stamps 1_000, so a
    /// test needing more than one page of history must spread its editions out — a page
    /// that is entirely one second wide is a wall `until` cannot step past, and the
    /// pager correctly refuses rather than paging forever.
    async fn publish_role_at(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, role: &Role, version: u64, ts: u64) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let role_id = crate::simd::hex::hex_to_bytes_32_checked(&role.role_id).unwrap();
        let prev = head_hash_on_relay(relay, community, &role_id).await;
        let content = crate::community::v2::roles::role_content_json(role).unwrap();
        let cite = cite_on_relay(relay, community, signer).await;
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::ROLE, &role_id, version, prev.as_ref(), &content, ts, cite.as_ref());
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(ts)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    /// Hand-rotate a community view to `(new_root, epoch)`, minting the fresh
    /// split pair a real base rotation would (CORD-06 §3) — the control_root is
    /// the new root itself, which is fine for a test.
    fn rotate_view(c: &CommunityV2, new_root: [u8; 32], epoch: u64) -> CommunityV2 {
        let mut r = c.clone();
        r.community_root = new_root;
        r.root_epoch = Epoch(epoch);
        r.control_root = Some(new_root);
        r.control_pk = Some(crate::community::v2::derive::control_signer_group_key(&new_root, r.id(), Epoch(epoch)).pk());
        r
    }

    /// Publish a Grant edition (vsk 3) signed by `signer`, at grant_locator(cid, member).
    /// Like a compliant granter it delivers the staff write key inside the Grant
    /// (CORD-04 §3) whenever the community view holds one — the recipient's
    /// derive check drops it when it isn't owed, so attaching unconditionally
    /// keeps the helper simple while exercising the real delivery pipeline.
    async fn publish_grant(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, member: &PublicKey, role_ids: Vec<String>, version: u64) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let eid = crate::community::v2::derive::grant_locator(community.id(), &member.to_bytes());
        let prev = head_hash_on_relay(relay, community, &eid).await;
        let grant = MemberGrant { member: member.to_hex(), role_ids };
        let control_wrap = community.control_root.filter(|_| community.control_pk.is_some()).map(|cr| {
            let ck = nostr_sdk::prelude::nip44::v2::ConversationKey::derive(signer.secret_key(), member).unwrap();
            let payload = crate::community::cipher::encrypt_with_random_nonce(&ck, super::rekey::control_wrap_b64(community.root_epoch, &cr).as_bytes()).unwrap();
            base64_simd::STANDARD.encode_to_string(&payload)
        });
        let content = crate::community::v2::roles::grant_content_json_with_wrap(&grant, control_wrap).unwrap();
        let cite = cite_on_relay(relay, community, signer).await;
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::GRANT, &eid, version, prev.as_ref(), &content, 1_000, cite.as_ref());
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    /// Publish a Banlist edition (vsk 4) signed by `signer`, at banlist_locator(cid).
    async fn publish_banlist(relay: &MemoryRelay, community: &CommunityV2, signer: &Keys, banned: &[String], version: u64) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let eid = crate::community::v2::derive::banlist_locator(community.id());
        let prev = head_hash_on_relay(relay, community, &eid).await;
        let content = crate::community::v2::roles::banlist_content_json(banned).unwrap();
        let cite = cite_on_relay(relay, community, signer).await;
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::BANLIST, &eid, version, prev.as_ref(), &content, 1_000, cite.as_ref());
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    fn admin_role(role_id: &str, perms: u64) -> Role {
        Role { role_id: role_id.into(), name: "Admin".into(), position: 1, permissions: Permissions(perms), scope: RoleScope::Server, color: 0, extra: Default::default() }
    }

    /// Hand-roll a LEGACY (pre-split) community exactly as a pre-0.4.2 build
    /// created one: the whole Control Plane keyed by the community_root
    /// derivation, no control pair anywhere. Publishes the two genesis-shaped
    /// editions at the LEGACY address, persists, and folds to seed floors.
    async fn create_legacy_community(relay: &MemoryRelay, owner: &Keys, name: &str, relays: Vec<String>) -> CommunityV2 {
        let identity = control::CommunityIdentity::mint(&owner.public_key());
        let root = crate::community::random_32();
        let group = control_group_key(&root, &identity.community_id, Epoch(0));
        let meta = control::CommunityMetadata { name: name.into(), relays: relays.clone(), ..Default::default() };
        let meta_rumor = control::build_edition_rumor(owner.public_key(), vsk::COMMUNITY_METADATA, &identity.community_id.0, 1, None, &serde_json::to_string(&meta).unwrap(), 1_000, None);
        let ch_id = ChannelId(crate::community::random_32());
        let ch = control::ChannelMetadata { name: "general".into(), private: false, ..Default::default() };
        let ch_rumor = control::build_edition_rumor(owner.public_key(), vsk::CHANNEL_METADATA, &ch_id.0, 1, None, &serde_json::to_string(&ch).unwrap(), 1_000, None);
        for r in [&meta_rumor, &ch_rumor] {
            let (w, _) = control::seal_control_edition(r, &group, owner, Timestamp::from_secs(1_000)).unwrap();
            relay.publish(&w, &relays).await.unwrap();
        }
        let community = CommunityV2 {
            identity,
            community_root: root,
            root_epoch: Epoch(0),
            control_pk: None,
            control_root: None,
            name: name.into(),
            description: None,
            icon: None,
            banner: None,
            meta_custom: None,
            meta_extra: Default::default(),
            relays,
            channels: vec![ChannelV2 { id: ch_id, name: "general".into(), private: false, key: None, epoch: Epoch(0), voice: None, meta_custom: None, meta_extra: Default::default() }],
            dissolved: false,
            created_at_ms: 1_000_000,
        };
        crate::db::community::save_community_v2(&community).unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let _ = crate::db::community::store_epoch_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, 0, &root);
        let _ = follow_control(relay, &community).await;
        crate::db::community::load_community_v2(community.id()).unwrap().unwrap()
    }

    #[tokio::test]
    async fn a_refounding_mints_the_split_and_delivers_the_pair_by_staffness() {
        // CORD-06 §1/§3 end to end: the rotation mints a fresh control pair, a
        // STAFF recipient's blob carries the secret (136), a plain member's only
        // the address (104), the compaction publishes ONLY at the new split
        // address, and each follower adopts exactly what its blob delivered.
        let (bed, owner, admin) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "SplitRefound", bed.relays.clone(), None).await.unwrap();
        assert!(community.control_pk.is_some() && community.control_root.is_some(), "genesis mints the split");

        // A staff admin (granted; the Grant delivers the wrap) and a plain
        // member (Guestbook Join only — a recipient with no rank).
        let rid = "d1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.keys.public_key(), vec![rid], 1).await;
        let plain = Keys::generate();
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let join = guestbook::build_join_rumor(plain.public_key(), None, 1_000);
        let (w, _) = guestbook::seal_guestbook_rumor(&join, &gb, &plain, Timestamp::from_secs(1_000)).unwrap();
        bed.relay.publish(&w, &community.relays).await.unwrap();

        // The admin joins and folds — adopting the write key from their Grant.
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, None, None, None)).unwrap();
        bed.swap_to(&admin);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert_eq!(joined.control_pk, community.control_pk, "the bundle handed over the address");
        assert_eq!(joined.control_root, None, "a bundle never carries the secret");
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(joined.control_root, community.control_root, "the Grant's control_wrap delivered the secret");

        // The owner refounds: a FRESH pair beside the new root.
        bed.swap_to(&owner);
        let refounded = refound_community(&bed.relay, &community, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1));
        assert!(refounded.control_pk.is_some() && refounded.control_root.is_some());
        assert_ne!(refounded.control_pk, community.control_pk, "the pair rolls with the root");

        // Blob forms by staff-ness: the admin's carries the secret, the plain
        // member's only the pk (CORD-06 §1).
        let base_group = base_rekey_group_key(&community.community_root, community.id(), Epoch(1));
        let chunks = fetch_rekey_chunks(&bed.relay, &community.relays, &base_group).await.unwrap();
        let rotation = &rekey::collect_rotations(&chunks)[0];
        async fn open_as(rotation: &rekey::Rotation, community_id: &crate::community::CommunityId, keys: &Keys) -> rekey::BaseKeyDelivery {
            let blob = rekey::find_my_blob(&rotation.blobs, &rotation.rotator.to_bytes(), &keys.public_key().to_bytes(), rotation.scope, rotation.new_epoch).expect("a blob for every recipient");
            let signer = crate::signer::ActiveSigner::Keys(keys.clone());
            rekey::open_base_blob(&signer, &rotation.rotator, community_id, Epoch(1), blob).await.unwrap()
        }
        let admin_delivery = open_as(rotation, community.id(), &admin.keys).await;
        assert_eq!(admin_delivery.control_root, refounded.control_root, "staff blob = 136, secret included");
        let plain_delivery = open_as(rotation, community.id(), &plain).await;
        assert_eq!(plain_delivery.control_pk.map(|p| PublicKey::from_slice(p.as_slice()).unwrap()), refounded.control_pk);
        assert_eq!(plain_delivery.control_root, None, "member blob = 104, never the secret");

        // The compaction lives ONLY at the new split address — never mirrored to
        // the new epoch's legacy-derived address (CORD-06 §3).
        let legacy_new = control_group_key(&refounded.community_root, community.id(), Epoch(1));
        let q = |pk: String| Query { kinds: vec![stream::KIND_WRAP], authors: vec![pk], limit: Some(50), ..Default::default() };
        assert!(bed.relay.fetch(&q(legacy_new.pk_hex()), &community.relays).await.unwrap().is_empty(), "no legacy mirror");
        assert!(!bed.relay.fetch(&q(refounded.control_pk.unwrap().to_hex()), &community.relays).await.unwrap().is_empty(), "the compaction rides the split address");

        // The admin's follow adopts the whole pair from their 136-byte blob.
        bed.swap_to(&admin);
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        let adopted = follow.updated.expect("the admin adopts the rotation");
        assert_eq!(adopted.root_epoch, Epoch(1));
        assert_eq!(adopted.control_pk, refounded.control_pk);
        assert_eq!(adopted.control_root, refounded.control_root, "staff crossing a rotation get the new secret in the blob");
    }

    #[tokio::test]
    async fn a_rescue_lets_a_stranded_member_walk_every_missed_hop() {
        // A member forgotten by two consecutive rotations is wedged at epoch 0: their
        // client derives base_rekey_group(root_0, cid, 1), finds no blob, and can never
        // even compute where epoch 2 lives. The rescue publishes the blobs that should
        // have existed, correlated into the ORIGINAL rotations — then the walk just works.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Stranded", vec!["wss://r".into()], None).await.unwrap();
        let stranded = Keys::generate();

        // Two rotations that never vend to `stranded` (they are in no fold: never
        // joined the wire, never posted, not in the local store).
        let e1 = refound_community(&relay, &community, &[]).await.unwrap();
        let e2 = refound_community(&relay, &e1, &[]).await.unwrap();
        assert_eq!(e2.root_epoch, Epoch(2));

        // Wedged: no blob for them at the only plane they can derive.
        let hop1 = base_rekey_group_key(&community.community_root, community.id(), Epoch(1));
        let chunks = fetch_rekey_chunks(&relay, &community.relays, &hop1).await.unwrap();
        let r1 = &rekey::collect_rotations(&chunks)[0];
        assert!(
            rekey::find_my_blob(&r1.blobs, &r1.rotator.to_bytes(), &stranded.public_key().to_bytes(), r1.scope, r1.new_epoch).is_none(),
            "genuinely stranded before the rescue"
        );

        let report = rescue_stranded_members(&relay, &e2, &[stranded.public_key()]).await.unwrap();
        assert_eq!(report.hops, 2, "one catch-up per missed hop");
        assert_eq!(report.hops_skipped, 0);

        // Walk exactly as a client would: derive each hop's plane from the PREVIOUS
        // root, find our blob inside the correlated rotation, open, adopt, repeat.
        let signer = crate::signer::ActiveSigner::Keys(stranded.clone());
        let mut held_root = community.community_root;
        for e in 1..=2u64 {
            let group = base_rekey_group_key(&held_root, community.id(), Epoch(e));
            let chunks = fetch_rekey_chunks(&relay, &community.relays, &group).await.unwrap();
            let rotations = rekey::collect_rotations(&chunks);
            let rot = rotations
                .iter()
                .find(|r| {
                    rekey::find_my_blob(&r.blobs, &r.rotator.to_bytes(), &stranded.public_key().to_bytes(), r.scope, r.new_epoch).is_some()
                })
                .expect("a rotation now carries our blob");
            let blob = rekey::find_my_blob(&rot.blobs, &rot.rotator.to_bytes(), &stranded.public_key().to_bytes(), rot.scope, rot.new_epoch).unwrap();
            let delivery = rekey::open_base_blob(&signer, &rot.rotator, community.id(), Epoch(e), blob).await.unwrap();
            held_root = delivery.new_root;
        }
        assert_eq!(held_root, e2.community_root, "the walk ends on the live root");

        // Merge safety on DEPLOYED clients: the catch-up extended the original chunk
        // set (disjoint indices), so everything folds as ONE complete rotation and no
        // original recipient's blob was displaced — a slot collision would fold as
        // their removal.
        let chunks = fetch_rekey_chunks(&relay, &community.relays, &hop1).await.unwrap();
        let rotations = rekey::collect_rotations(&chunks);
        assert_eq!(rotations.len(), 1, "catch-up merged into the original rotation, not a fork");
        assert!(rotations[0].is_complete(), "the extended set still reads complete");
        let owner_pk = e2.owner().unwrap();
        assert!(
            rekey::find_my_blob(&rotations[0].blobs, &rotations[0].rotator.to_bytes(), &owner_pk.to_bytes(), rotations[0].scope, rotations[0].new_epoch).is_some(),
            "the original recipient's blob survived the extension"
        );

        // And the outside world counts them again: the snapshot addendum seeded them
        // onto the current epoch's guestbook plane.
        let wire = wire_guestbook_members(&relay, &e2).await.unwrap();
        assert!(wire.contains(&stranded.public_key()), "the invite page's fold now includes them");
    }

    #[tokio::test]
    async fn a_non_owner_refounders_snapshot_seeds_the_roster() {
        // CORD-02 §5: a snapshot is honored "only from the npub whose Refounding
        // minted that epoch". Vector read that as the OWNER always, so a moderation
        // bot's containment rolled the epoch and vended the keys while its survivor
        // list was thrown away — every client then folded its own accumulated Joins,
        // keeping members the containment had cut and disagreeing with each other.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "MintedBy", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let owner = community.owner().unwrap();

        // An admin (NOT the owner) refounded to epoch 1 — this device verified and
        // adopted that rotation, so it knows who minted it.
        let admin = Keys::generate();
        let mut at_epoch_1 = community.clone();
        at_epoch_1.root_epoch = Epoch(1);
        record_epoch_minter(&cid_hex, 1, &admin.public_key().to_hex());

        // Someone the containment cut: joined at the old epoch, never banned, and
        // absent from the survivor list the refounder published.
        let cut = Keys::generate().public_key();
        let join = guestbook::GuestbookEvent {
            epoch: None, observed_at: None, rumor_id: [11u8; 32],
            entry: guestbook::GuestbookEntry::Join { member: cut, invited_by: None, at_ms: 1_000 },
        };
        let snapshot = |by: &Keys, id: u8| guestbook::GuestbookEvent {
            epoch: Some(1), observed_at: None, rumor_id: [id; 32],
            entry: guestbook::GuestbookEntry::Snapshot {
                refounder: by.public_key(),
                members: vec![owner],           // survivors: the cut member is NOT here
                snapshot_id: [id; 32],
                chunk: (1, 1),
                at_ms: 5_000,                   // newer than the Join it supersedes
            },
        };

        // A stranger's snapshot must change nothing — authority is the minter, not
        // whoever manages to write a 3312.
        let stranger = Keys::generate();
        crate::db::community::set_guestbook(&cid_hex, &[join.clone(), snapshot(&stranger, 0x51)], 6).unwrap();
        assert!(
            stored_memberlist(&at_epoch_1).unwrap().contains(&cut),
            "a snapshot from an npub that minted nothing seeds no roster"
        );

        // The actual refounder's snapshot IS the guest list.
        crate::db::community::set_guestbook(&cid_hex, &[join, snapshot(&admin, 0x52)], 6).unwrap();
        let members = stored_memberlist(&at_epoch_1).unwrap();
        assert!(
            !members.contains(&cut),
            "the refounder's survivor list is adopted, so a cut member stops being one"
        );
        assert!(members.contains(&owner), "a survivor the snapshot names stays");
    }

    /// A moderation report quotes what was said, so it may only reach someone who
    /// could have read the room it was said in. Community power is NOT that
    /// question — BAN says what a moderator may do to people, never which rooms
    /// they may see — and a bot holding every key would otherwise forward a
    /// private channel's contents to whoever holds the ban bit.
    #[tokio::test]
    async fn reading_a_private_channel_needs_its_own_role_not_community_power() {
        let (bed, owner, mod_without_access) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Rooms", bed.relays.clone(), None).await.unwrap();
        let public = community.channels[0].id;
        let private = create_private_channel(&bed.relay, &community, "back-room").await.unwrap();
        let community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        use nostr_sdk::prelude::ToBech32;
        let them = mod_without_access.keys.public_key();
        let them_npub = them.to_bech32().unwrap();

        // Give them the fullest COMMUNITY powers there are. It must buy nothing
        // in a room they were never admitted to.
        let admin_rid = crate::simd::hex::bytes_to_hex_32(&[0xa7; 32]);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&admin_rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &them, vec![admin_rid], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();
        assert!(
            crate::VectorCore.member_has_permission(&cid_hex, &them_npub, Permissions::BAN).unwrap(),
            "they really do hold BAN"
        );

        let pub_hex = crate::simd::hex::bytes_to_hex_32(&public.0);
        let priv_hex = crate::simd::hex::bytes_to_hex_32(&private.0);
        assert!(
            crate::VectorCore.member_can_read_channel(&cid_hex, &pub_hex, &them_npub).unwrap(),
            "a public channel is the community's"
        );
        assert!(
            !crate::VectorCore.member_can_read_channel(&cid_hex, &priv_hex, &them_npub).unwrap(),
            "BAN is not a key: community power must never open a private room"
        );

        // The access role is what opens it — and it carries no powers at all.
        grant_channel_access(&bed.relay, &community, &private, &them).await.unwrap();
        let community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let _ = follow_control(&bed.relay, &community).await;
        assert!(
            crate::VectorCore.member_can_read_channel(&cid_hex, &priv_hex, &them_npub).unwrap(),
            "the channel-scoped grant is what admits them"
        );
    }

    /// An empty retain means "cut nobody", never "keep nobody".
    ///
    /// The console's "Rotate keys" sends an empty retain when nothing is unticked.
    /// `members_to_remove` reads that correctly and removes nobody — but the same
    /// empty list also became an ALLOW-LIST, and an allow-list keeps only the
    /// rotating device and the owner. So a plain rotation vended to two people and
    /// stranded everyone else at the previous epoch, permanently, presenting as
    /// members vanishing some time later nowhere near the button that did it.
    ///
    /// The two paths are pinned here against each other, because they take the same
    /// empty list and must disagree about what it means.
    #[tokio::test]
    async fn an_empty_retain_cuts_nobody_rather_than_keeping_nobody() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "EmptyRetain", bed.relays.clone(), None).await.unwrap();

        // A third party who is neither the rotator nor the owner — the only kind of
        // member an empty allow-list silently drops.
        let bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None)).unwrap();
        bed.swap_to(&member);
        accept_parked_invite(&bed.relay, &bundle, None).await.unwrap();
        bed.swap_to(&owner);
        assert!(memberlist(&bed.relay, &community).await.unwrap().contains(&member.keys.public_key()));

        // The plain reading: cut nobody, vend to everybody. This is what the button
        // must reach. (The allow-list reading of the same empty list is covered by
        // `a_rotation_that_would_strand_staff_refuses_to_publish`.)
        refound_community(&bed.relay, &community, &[]).await.expect("cutting nobody must succeed");
        assert!(
            vended_to(&bed, &community, &member.keys).await,
            "a plain rotation must vend to a member who is neither the rotator nor the owner"
        );
    }

    /// The console's rotate button reaches the "cut nobody" path, not the allow-list
    /// one. Pinned from source: the two are one `if` apart and read the same empty
    /// list in opposite directions, which is exactly how this shipped.
    #[test]
    fn an_empty_retain_does_not_become_an_allow_list() {
        let src = include_str!("../../lib.rs");
        let at = src.find("pub async fn purge_and_refound").expect("purge_and_refound");
        let body = &src[at..at + 3000];
        let guard = body.find("if keep.is_empty()").expect("an empty retain must branch away from the allow-list");
        let retaining = body.find("refound_community_retaining").expect("the allow-list call");
        assert!(guard < retaining, "the branch has to come BEFORE the allow-list call");
    }

    /// If the recipients would strand a granted member, publish NOTHING.
    ///
    /// A member missed at a hop is stranded there permanently, and every other
    /// client goes on reading them as staff — silent, irreversible without the
    /// rescue primitive, and only noticed because a human saw the member list
    /// shrink. So the rotation refuses instead, exactly as the entity carry-forward
    /// already refuses a floored head it cannot serve.
    #[tokio::test]
    async fn a_rotation_that_would_strand_staff_refuses_to_publish() {
        let (bed, owner, staffer) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoSilentSever", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let them = staffer.keys.public_key();

        let rid = crate::simd::hex::bytes_to_hex_32(&[0xb6; 32]);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &them, vec![rid], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();

        // An operator purge whose allow-list forgets an admin: the recipient set
        // ends up without somebody the roster still grants a role to.
        let err = refound_community_retaining(&bed.relay, &community, &[], &[owner.keys.public_key()])
            .await
            .expect_err("must refuse rather than strand staff");
        assert!(
            err.contains("stranded"),
            "the refusal has to say what it protected, got: {err}"
        );

        // And nothing was published: the epoch did not move.
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(held.root_epoch, community.root_epoch, "no state published");
        assert!(!vended_to(&bed, &community, &staffer.keys).await, "no half-rotation left on the plane");
        let _ = cid_hex;
    }

    /// The backstop protects a SILENT granted member. An ACTIVE one is the gap.
    ///
    /// `fold_members` seeds granted members with `observed.entry(pk).or_insert(0)`,
    /// and ts 0 is what dodges `stale_pre_refound`. A staffer who actually talks
    /// already sits in `observed` with a REAL timestamp, so `or_insert` leaves it
    /// alone — and if some earlier refounding's snapshot omitted them while their
    /// last word predates its cut, they are suppressed despite holding a grant.
    ///
    /// That is Sentire, 2026-08-26: admin, constantly posting, vended no key.
    #[tokio::test]
    async fn a_granted_member_who_talks_is_not_dropped_by_an_old_snapshot() {
        let (bed, owner, staffer) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "TalkingAdmin", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let them = staffer.keys.public_key();

        let rid = crate::simd::hex::bytes_to_hex_32(&[0xb5; 32]);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &them, vec![rid], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();

        // They joined and spoke — so `observed` holds a REAL timestamp for them,
        // not the 0 the grant backstop would have inserted.
        let spoke_at = 5_000u64;
        let join = guestbook::GuestbookEvent {
            epoch: Some(community.root_epoch.0), observed_at: None, rumor_id: [0x31; 32],
            entry: guestbook::GuestbookEntry::Join { member: them, invited_by: None, at_ms: spoke_at },
        };
        // A PRIOR refounding whose snapshot omitted them, cutting after they spoke.
        let snapshot = guestbook::GuestbookEvent {
            epoch: Some(community.root_epoch.0), observed_at: None, rumor_id: [0x32; 32],
            entry: guestbook::GuestbookEntry::Snapshot {
                refounder: owner.keys.public_key(),
                members: vec![owner.keys.public_key()],   // them: omitted
                snapshot_id: [0x32; 32],
                chunk: (1, 1),
                at_ms: spoke_at + 1_000,
            },
        };
        crate::db::community::set_guestbook(&cid_hex, &[join, snapshot], 9).unwrap();

        assert!(
            stored_memberlist(&community).unwrap().contains(&them),
            "a grant is proof of membership — an old snapshot must not shed the staff it forgot"
        );

        let _ = refound_community(&bed.relay, &community, &[]).await.unwrap();
        assert!(
            vended_to(&bed, &community, &staffer.keys).await,
            "and the rotation must vend to them, or they are stranded holding a grant"
        );
    }

    /// A GRANT is proof of membership, so a rotation must vend to it.
    ///
    /// Sentire's shape, 2026-08-26: an admin whose Join had been superseded by an
    /// earlier refounding's snapshot fell out of BOTH folds the recipient union is
    /// built from, held a valid admin grant the whole time, and was vended no key.
    /// It could then only derive `held + 1`, so it was stranded permanently while
    /// still appearing to be staff to everyone else.
    ///
    /// `fold_members` already treats a grant as consensus-complete proof — "this is
    /// what keeps a Refounding from severing a lurking admin". The rotation has to
    /// agree with it.
    #[tokio::test]
    async fn a_rotation_vends_to_a_granted_member_the_folds_forgot() {
        let (bed, owner, staffer) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "LurkingAdmin", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let them = staffer.keys.public_key();

        // Staff by GRANT, with no Join anywhere — the lurking admin the backstop
        // exists for. Never posted, never announced.
        let rid = crate::simd::hex::bytes_to_hex_32(&[0xb4; 32]);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &them, vec![rid], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();
        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&them.to_hex()),
            "they hold the grant"
        );

        // An empty guestbook is the whole point: neither fold can see them.
        crate::db::community::set_guestbook(&cid_hex, &[], 1).unwrap();

        let _rotated = refound_community(&bed.relay, &community, &[]).await.unwrap();

        // The blob is the answer. A member absent from the rotation's recipients is
        // stranded at the previous epoch for good — they can only ever derive
        // `held + 1`, so no later rotation reaches them.
        assert!(
            vended_to(&bed, &community, &staffer.keys).await,
            "a rotation removing nobody must vend to a granted member, or it severs its own staff"
        );
    }

    /// "Rotate keys" with nobody unticked must remove NOBODY — and must vend to
    /// everyone, not merely leave them on a list. A rotation that forgets a
    /// member strands them at the previous epoch permanently: they can only
    /// derive `held + 1`, so no later rotation can ever reach them.
    #[tokio::test]
    async fn a_rotation_that_removes_nobody_vends_to_everybody() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "KeepAll", bed.relays.clone(), None).await.unwrap();

        // A second member joins for real, via the invite path.
        let bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None)).unwrap();
        bed.swap_to(&member);
        accept_parked_invite(&bed.relay, &bundle, None).await.unwrap();
        bed.swap_to(&owner);
        let before = memberlist(&bed.relay, &community).await.unwrap();
        assert!(before.contains(&member.keys.public_key()), "present before the rotation");

        // Rotate keeping everyone — the empty `removed` the console sends when
        // nothing is unticked.
        let rotated = refound_community(&bed.relay, &community, &[]).await.unwrap();
        assert_eq!(rotated.root_epoch.0, community.root_epoch.0 + 1, "the epoch rolled");

        let after = memberlist(&bed.relay, &community).await.unwrap();
        assert!(
            after.contains(&member.keys.public_key()),
            "a rotation removing nobody must keep everybody: {before:?} -> {after:?}"
        );

        // And the member must actually be able to WALK to the new epoch, which is
        // the half a memberlist cannot show.
        bed.swap_to(&member);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let follow = follow_rekeys(&bed.relay, &held, &crate::db::current_session()).await.unwrap();
        assert!(!follow.self_removed, "they were not excluded");
        let now = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(now.root_epoch.0, rotated.root_epoch.0, "they adopted the new epoch — a blob was vended to them");
    }

    /// A revocation has to reach the NETWORK, not just the revoker.
    ///
    /// Every other client decides who is staff by folding the control plane, so
    /// an owner whose demotion never published is the only person who believes
    /// it happened — and the demoted admin keeps every power everywhere else,
    /// which is the worst possible direction for this to fail in.
    #[tokio::test]
    async fn revoking_admin_publishes_where_everyone_else_reads_it() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Demotion", bed.relays.clone(), None).await.unwrap();
        let them = member.keys.public_key();
        let them_hex = them.to_hex();

        grant_admin(&bed.relay, &community, &them).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(view.roles.is_admin(&them_hex), "granted, and readable from the plane");

        revoke_admin(&bed.relay, &community, &them).await.unwrap();

        // The plane, NOT the local row: this is the copy every peer folds.
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(
            !view.roles.is_admin(&them_hex),
            "the demotion must be on the plane, or only the owner believes it"
        );

        // And the same answer through the public API a bot or client would ask.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        use nostr_sdk::prelude::ToBech32;
        assert!(
            !crate::VectorCore
                .member_has_permission(&cid_hex, &them.to_bech32().unwrap(), crate::community::roles::Permissions::BAN)
                .unwrap(),
            "a demoted admin holds no powers"
        );
    }

    /// Authority must fail CLOSED. A bot gating a chat command on this is the
    /// only thing standing between "a moderator asked" and "anyone in the room
    /// asked", so an unfolded, empty or unreadable roster has to authorise
    /// nobody — `has_permission` finds no grant and denies. The owner is the one
    /// exception, and is answered without consulting the roster at all.
    #[tokio::test]
    async fn permission_is_refused_to_everyone_the_roster_does_not_name() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Authority", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        use nostr_sdk::prelude::ToBech32;
        let owner_npub = community.owner().unwrap().to_bech32().unwrap();
        let stranger = Keys::generate().public_key().to_bech32().unwrap();

        use crate::community::roles::Permissions;
        for p in [Permissions::KICK, Permissions::BAN, Permissions::MANAGE_ROLES] {
            assert!(
                !crate::VectorCore.member_has_permission(&cid_hex, &stranger, p).unwrap(),
                "an npub the roster never granted anything holds nothing"
            );
            assert!(
                crate::VectorCore.member_has_permission(&cid_hex, &owner_npub, p).unwrap(),
                "the owner is supreme without a grant to cite"
            );
        }

        // A banned npub holds nothing, whatever a stale grant still says.
        crate::db::community::set_community_banlist(&cid_hex, &[community.owner().unwrap().to_hex()], 1).unwrap();
        let banned_owner_is_still_owner =
            crate::VectorCore.member_has_permission(&cid_hex, &owner_npub, Permissions::BAN).unwrap();
        assert!(banned_owner_is_still_owner, "the owner cannot be locked out of their own community");

        // And a malformed npub is an error, never a silent grant.
        assert!(crate::VectorCore.member_has_permission(&cid_hex, "not-an-npub", Permissions::BAN).is_err());
    }

    #[tokio::test]
    async fn a_refound_keeps_a_quiet_member_the_network_fold_forgot() {
        // The network fold only sees the current guestbook + the recent posting window,
        // so a quiet member whose Join lives on a buried epoch vanishes from it — and a
        // rotation that trusts the fold alone silently sheds them. Being forgotten must
        // not be a removal: only the explicit `removed` list is.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "QuietOnes", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        // A member the LOCAL store remembers (an old synced Join) but the WIRE has no
        // trace of: never posted, Join never published on the current plane.
        let quiet = Keys::generate().public_key();
        let ev = guestbook::GuestbookEvent { epoch: None, observed_at: None,
            rumor_id: [7u8; 32],
            entry: guestbook::GuestbookEntry::Join { member: quiet, invited_by: None, at_ms: 1_000 },
        };
        crate::db::community::set_guestbook(&cid_hex, std::slice::from_ref(&ev), 1).unwrap();
        assert!(stored_memberlist(&community).unwrap().contains(&quiet), "locally known");
        assert!(!memberlist(&relay, &community).await.unwrap().contains(&quiet), "network fold has forgotten them");

        let rotated = refound_community(&relay, &community, &[]).await.unwrap();

        // They made the new epoch's snapshot — the wire now carries them, so an outside
        // reader counts them and their client has a rekey blob to walk forward on.
        let wire = wire_guestbook_members(&relay, &rotated).await.unwrap();
        assert!(wire.contains(&quiet), "the quiet member survived the rotation onto the wire");

        // The explicit removed list still removes, union or no union.
        let rotated2 = refound_community(&relay, &rotated, &[quiet]).await.unwrap();
        let wire2 = wire_guestbook_members(&relay, &rotated2).await.unwrap();
        assert!(!wire2.contains(&quiet), "an explicit removal is honoured");
    }

    #[tokio::test]
    async fn revoking_a_husk_prunes_the_local_row_instead_of_erroring_forever() {
        // The list is per-creator and cross-device: another device (or Armada) can
        // retire a link this one still holds a row for. That row carries no signer_sk,
        // so no revocation can ever be built from it — the old behaviour errored with
        // "no such link in the invite list" BEFORE the local delete, leaving an entry
        // the owner could neither use nor remove.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Husks", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let minted = mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        let token_hex = crate::simd::hex::bytes_to_hex_16(&minted.token);
        assert_eq!(crate::db::community::list_public_invites(&cid_hex).unwrap().len(), 1);

        // "Another device" retires the link: republish the invite list without it.
        let signer = crate::signer::active_signer().unwrap();
        let my_pk = me_pk().unwrap();
        let mut list = fetch_invite_list(&relay, &community.relays).await.unwrap().unwrap();
        list.entries.retain(|e| e.token != token_hex);
        let ev = invite::build_invite_list_event_signed(&signer, my_pk, &list).await.unwrap();
        relay.publish(&ev, &community.relays).await.unwrap();

        // This device's revoke now completes by pruning, not by erroring.
        revoke_public_link(&relay, &community, &token_hex).await.unwrap();
        assert!(
            crate::db::community::list_public_invites(&cid_hex).unwrap().is_empty(),
            "the husk row is gone — the panel can no longer show a link nobody can use or remove"
        );

        // An unreadable list is NOT proof of absence: only a fetched list may prune.
        // (Guarded by the ok_or above the husk branch; a fresh row + an empty relay
        // would hit "no invite list found", never the prune.)
    }

    #[tokio::test]
    async fn revoking_the_last_link_privatizes_and_rotates_but_an_earlier_revoke_does_not() {
        // CORD-06 §3: converting a Public Community to Private is a Refounding
        // trigger — revoking stops NEW acquisitions, only the rotation cuts off
        // everyone who already fetched the bundle. v1 does this; v2 shipped
        // without it. Revoking a link while ANOTHER stays live is not the
        // conversion, and must not burn an epoch.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Privatize", vec!["wss://r".into()], None).await.unwrap();
        assert_eq!(community.root_epoch, Epoch(0));

        let a = mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        let b = mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        assert!(community_is_public(&relay, &community).await, "two live links = Public");

        // Revoking ONE of two: still Public, still epoch 0 — no rotation.
        revoke_public_link(&relay, &community, &crate::simd::hex::bytes_to_hex_16(&a.token)).await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(held.root_epoch, Epoch(0), "a link remains live — not the Public→Private conversion");
        assert!(community_is_public(&relay, &held).await, "still Public");

        // Revoking the LAST one privatizes AND rotates.
        revoke_public_link(&relay, &held, &crate::simd::hex::bytes_to_hex_16(&b.token)).await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(!community_is_public(&relay, &held).await, "no live links = Private");
        assert_eq!(held.root_epoch, Epoch(1), "privatizing rotated the base key");
        // The rotation is a real one: the new epoch carries the split pair and
        // the old root is retired, so a link-joined lurker's key is now dead.
        assert!(held.control_pk.is_some(), "the privatize rotation mints the split like any base rotation");
        assert_ne!(held.community_root, community.community_root, "the base key actually rolled");
    }

    #[tokio::test]
    async fn a_legacy_community_upgrades_as_a_side_effect_of_its_next_refounding() {
        // CORD-06 §3: a compliant Rotator performing ANY base rotation MUST mint
        // the split — a pre-split community upgrades with nobody deciding to.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_legacy_community(&relay, &owner, "Legacy", vec!["wss://r".into()]).await;
        assert!(community.control_pk.is_none(), "starts pre-split");

        let refounded = refound_community(&relay, &community, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1));
        assert!(refounded.control_pk.is_some() && refounded.control_root.is_some(), "the rotation minted the split");
        // And the persisted row agrees (the pair survives a reload).
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(reloaded.control_pk, refounded.control_pk);
        assert_eq!(reloaded.control_root, refounded.control_root);
    }

    #[tokio::test]
    async fn an_old_build_deletion_recovers_from_the_stale_bundle_across_the_split() {
        // The 0.4.0/0.4.1 upgrade path: those builds hit the widened base blob,
        // conclude a false removal, and DELETE the community locally. Recovery on
        // upgrade is the Community-List resurrection: re-accept the STALE-epoch
        // material (the old plane is still served), then walk the rekey chain
        // forward — now parsing the 104-byte form — to the current epoch.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_legacy_community(&bed.relay, &owner.keys, "Recover", bed.relays.clone()).await;
        let stale_bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, None, None, None)).unwrap();

        // The member joins at the legacy epoch 0.
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &stale_bundle, None).await.unwrap();
        assert!(joined.control_pk.is_none());

        // The owner bans nobody but rotates (any refound upgrades to the split).
        bed.swap_to(&owner);
        let refounded = refound_community(&bed.relay, &community, &[]).await.unwrap();

        // The member's OLD build falsely self-removes and deletes the community.
        bed.swap_to(&member);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::delete_community(&cid_hex).unwrap();
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_none());

        // Upgrade-recovery: re-accept the stale epoch-0 material (what
        // sync_community_list does from the surviving 13302 entry)...
        let readopted = accept_parked_invite(&bed.relay, &stale_bundle, None).await.unwrap();
        assert_eq!(readopted.root_epoch, Epoch(0), "re-anchored at the stale epoch");
        // ...then the walk crosses the split rotation and adopts the pair.
        let follow = follow_rekeys(&bed.relay, &readopted, &crate::db::current_session()).await.unwrap();
        assert!(!follow.self_removed, "never a false removal on this build");
        let healed = follow.updated.expect("the walk adopts the split rotation");
        assert_eq!(healed.root_epoch, Epoch(1));
        assert_eq!(healed.control_pk, refounded.control_pk, "the member reads the upgraded plane");
        assert_eq!(healed.control_root, None, "a plain member never receives the secret");
        // And the upgraded control plane folds for them (the compacted state).
        let folded = follow_control(&bed.relay, &healed).await;
        assert!(folded.is_ok(), "the recovered member folds the split plane: {folded:?}");
    }

    #[tokio::test]
    async fn an_unopenable_blob_at_my_locator_never_concludes_removal() {
        // CORD-06 §2: removal = NO blob for my locator across a complete
        // rotation. A blob that EXISTS but won't open (a future width, a rotator
        // bug) must park — turning it into a self-removal is exactly how the
        // pre-split builds deleted communities on the first widened rotation.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Garbled", bed.relays.clone(), None).await.unwrap();
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, None, None, None)).unwrap();
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();

        // The owner mints a complete, authorized rotation whose blob AT THE
        // MEMBER'S LOCATOR is garbage (undecryptable), owner's own blob real.
        bed.swap_to(&owner);
        let new_epoch = Epoch(1);
        let new_root = [0x4Du8; 32];
        let control_root = [0x4Eu8; 32];
        let control_pk = super::super::derive::control_signer_group_key(&control_root, community.id(), new_epoch).pk();
        let prev_commit = super::super::derive::epoch_key_commitment(Epoch(0), &community.community_root);
        let garbled = rekey::RekeyBlob {
            locator: rekey::blob_locator(&owner.keys.public_key().to_bytes(), &member.keys.public_key().to_bytes(), RekeyScope::Root, new_epoch),
            wrapped: "bm90LWEtcmVhbC1uaXA0NC1wYXlsb2Fk".into(),
        };
        let own = rekey::build_base_blob(
            &crate::signer::ActiveSigner::Keys(owner.keys.clone()),
            &owner.keys.public_key().to_bytes(),
            &owner.keys.public_key(),
            new_epoch,
            &new_root,
            &control_pk.to_bytes(),
            Some(&control_root),
        )
        .await
        .unwrap();
        let base_group = base_rekey_group_key(&community.community_root, community.id(), new_epoch);
        let chunks = rekey::build_rekey_chunks_local(&owner.keys, &base_group, RekeyScope::Root, new_epoch, Epoch(0), &prev_commit, &[garbled, own], 2_000, None, false).unwrap();
        for c in &chunks {
            bed.relay.publish(c, &community.relays).await.unwrap();
        }

        // The member's follow PARKS: no adoption, and NEVER a removal.
        bed.swap_to(&member);
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(!follow.self_removed, "an unopenable blob at my locator is not an exclusion");
        assert!(follow.updated.is_none(), "nothing adopted from an unreadable blob");
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_some(), "the community survives");
        // …and the park is LEGIBLE. A silent park is indistinguishable from "no
        // rotation happened", which is what makes an undecryptable blob planted
        // at a protected member's locator an abusable severing tool.
        assert!(follow.wedged, "an unopenable key delivery must be surfaced, not swallowed");
    }

    #[tokio::test]
    async fn a_control_wrap_is_refused_on_a_stale_epoch_or_a_non_deriving_secret() {
        // What the "no rank-gating on adoption" argument rests on (CORD-04 §3):
        // a wrap is adopted only if its secret derives to the control_pk held
        // for the epoch named INSIDE its ciphertext. That derive check is the
        // load-bearing gate (revert-verified); the explicit epoch comparison
        // beside it is defense in depth and can't be isolated, since deriving
        // at a stale epoch already misses the held address. Compaction re-wraps
        // a Grant head verbatim across Refoundings, so stale wraps are a
        // structural certainty, not an edge case.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "AdoptGate", bed.relays.clone(), None).await.unwrap();
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, None, None, None)).unwrap();
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert!(joined.control_root.is_none());

        // Build a Grant edition carrying `control_wrap` with a chosen plaintext.
        let wrap_for = |epoch: Epoch, secret: &[u8; 32]| {
            let ck = nostr_sdk::prelude::nip44::v2::ConversationKey::derive(owner.keys.secret_key(), &member.keys.public_key()).unwrap();
            let ct = crate::community::cipher::encrypt_with_random_nonce(&ck, super::rekey::control_wrap_b64(epoch, secret).as_bytes()).unwrap();
            base64_simd::STANDARD.encode_to_string(&ct)
        };
        let eid = crate::community::v2::derive::grant_locator(community.id(), &member.keys.public_key().to_bytes());
        let ed_with = |wrap: String| {
            let grant = MemberGrant { member: member.keys.public_key().to_hex(), role_ids: vec![] };
            let content = crate::community::v2::roles::grant_content_json_with_wrap(&grant, Some(wrap)).unwrap();
            let rumor = control::build_edition_rumor(owner.keys.public_key(), vsk::GRANT, &eid, 1, None, &content, 1_000, None);
            control::parse_edition_rumor(&rumor).unwrap()
        };

        // (a) A wrap for a DIFFERENT epoch — the real secret, wrong epoch.
        let real = community.control_root.unwrap();
        let stale = ed_with(wrap_for(Epoch(joined.root_epoch.0 + 1), &real));
        assert_eq!(adopt_my_control_wrap(&joined, std::slice::from_ref(&stale)).await, None, "a stale-epoch wrap is refused");

        // (b) Right epoch, a secret that does NOT derive to the held pk.
        let forged = ed_with(wrap_for(joined.root_epoch, &[0x66u8; 32]));
        assert_eq!(adopt_my_control_wrap(&joined, std::slice::from_ref(&forged)).await, None, "a non-deriving secret is refused");

        // (c) The real secret at the held epoch IS adopted — the gates above
        // reject on their own merits, not because adoption is broken.
        let good = ed_with(wrap_for(joined.root_epoch, &real));
        assert_eq!(adopt_my_control_wrap(&joined, std::slice::from_ref(&good)).await, Some(real), "the true wrap adopts");
    }

    #[test]
    fn the_vault_carries_the_split_and_the_twin_strips_the_secret() {
        // CORD-02 §8: the list carries every key its holder has — the address
        // for all, the secret for staff. The migration `m` (member-bound) MUST
        // strip the secret.
        let owner = Keys::generate();
        let g = control::genesis(&owner, control::CommunityMetadata { name: "Vault".into(), ..Default::default() }, 1_000).unwrap();
        let c = CommunityV2::from_genesis(&g, "Vault", None, vec!["wss://r".into()], 0);
        let jm = join_material(&c);
        assert_eq!(jm.control_pk, c.control_pk.map(|p| p.to_hex()));
        assert_eq!(jm.control_root, Some(crate::simd::hex::bytes_to_hex_32(&g.control_root)));
        let twin = twin_join_material(&c);
        assert_eq!(twin.control_pk, jm.control_pk, "members get the address");
        assert_eq!(twin.control_root, None, "members never get the secret");
        let bundle = material_to_invite(&jm);
        assert_eq!(bundle.control_pk, jm.control_pk, "a rehydrating bundle carries the address");
    }

    // ── CORD-04 §1 author-aware fold: a seat-holder (holds community_root, so can seal
    // any control edition) must not be able to SUPPRESS a role or grant by forging a
    // higher version at its coordinate. Owner-only signers mask this entirely, so every
    // attacker below signs as a NON-owner member.

    #[tokio::test]
    async fn a_non_owner_cannot_suppress_the_admin_role_by_forging_a_higher_version() {
        let (bed, owner, attacker) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "AttackA", bed.relays.clone(), None).await.unwrap();
        let victim = Keys::generate().public_key();
        grant_admin(&bed.relay, &community, &victim).await.unwrap();

        // The admin role sits at a deterministic, publicly-computable coordinate.
        let admin_rid = fetch_authority(&bed.relay, &community)
            .await
            .roles
            .roles
            .iter()
            .find(|r| r.permissions.contains(Permissions::ADMIN_ALL))
            .unwrap()
            .role_id
            .clone();
        // Attacker forges v2 of that exact role, stripping its powers.
        publish_role(
            &bed.relay,
            &community,
            &attacker.keys,
            &Role { role_id: admin_rid.clone(), name: "pwned".into(), position: 1, permissions: Permissions(0), scope: RoleScope::Server, color: 0, extra: Default::default() },
            2,
        )
        .await;

        let authority = fold_authority(&community, &fetch_control(&bed.relay, &community).await, &load_floors(&community));
        assert!(authority.roles.is_admin(&victim.to_hex()), "the forged strip is DROPPED; the owner's admin role survives beneath it");
        assert!(
            authority.heads.iter().any(|h| h.entity_hex == admin_rid && h.version == 1),
            "the floor advances only to the AUTHORIZED head (owner v1)"
        );
        assert!(!authority.heads.iter().any(|h| h.version == 2), "the forged v2 never poisons the floor");
    }

    #[tokio::test]
    async fn a_non_owner_cannot_strip_a_members_grant_by_forging_a_higher_version() {
        let (bed, owner, attacker) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "AttackC", bed.relays.clone(), None).await.unwrap();
        let victim = Keys::generate();
        grant_admin(&bed.relay, &community, &victim.public_key()).await.unwrap();

        // Attacker forges a higher-version EMPTY grant at the victim's grant coordinate.
        publish_grant(&bed.relay, &community, &attacker.keys, &victim.public_key(), vec![], 9).await;

        let authority = fold_authority(&community, &fetch_control(&bed.relay, &community).await, &load_floors(&community));
        assert!(
            authority.roles.is_admin(&victim.public_key().to_hex()),
            "the forged strip is dropped; the owner's grant survives and the victim keeps admin"
        );
    }

    #[tokio::test]
    async fn forged_low_id_roles_by_a_non_owner_never_enter_the_authorized_roster() {
        let (bed, owner, attacker) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "AttackB", bed.relays.clone(), None).await.unwrap();
        let victim = Keys::generate().public_key();
        grant_admin(&bed.relay, &community, &victim).await.unwrap();

        // Low-id roles that WOULD evict the admin from a pre-authorize cap — but they're
        // unauthorized, so the post-authorize cap never sees them.
        for i in 0u8..6 {
            let rid = crate::simd::hex::bytes_to_hex_32(&[i; 32]);
            publish_role(&bed.relay, &community, &attacker.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        }

        let authority = fold_authority(&community, &fetch_control(&bed.relay, &community).await, &load_floors(&community));
        assert!(authority.roles.is_admin(&victim.to_hex()), "the legit admin survives the forged flood");
        assert_eq!(authority.roles.roles.len(), 1, "only the owner's admin role is authorized; every forgery is dropped");
    }

    /// A canonical (order-independent) fingerprint of an AuthoritySet's authorized
    /// roster + banlist — two clients converge iff these match.
    fn authority_fingerprint(a: &AuthoritySet) -> String {
        let mut roles = a.roles.roles.clone();
        roles.sort_by(|x, y| x.role_id.cmp(&y.role_id));
        let mut grants = a.roles.grants.clone();
        for g in &mut grants {
            g.role_ids.sort();
        }
        grants.sort_by(|x, y| x.member.cmp(&y.member));
        let banned: Vec<&String> = a.banned.iter().collect();
        serde_json::json!({ "roles": roles, "grants": grants, "banned": banned }).to_string()
    }

    fn folded_role<'a>(view: &'a AuthorityView, id: &str) -> &'a crate::community::roles::Role {
        view.roles.role(id).unwrap_or_else(|| panic!("role {id} folded"))
    }

    #[tokio::test]
    async fn roles_are_created_at_the_bottom_edited_in_place_and_reordered() {
        use crate::community::roles::{Permissions, RoleScope};
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Roles", bed.relays.clone(), None).await.unwrap();

        let a = create_role(&bed.relay, &community, "Alpha", 0, Permissions::KICK, RoleScope::Server).await.unwrap();
        let b = create_role(&bed.relay, &community, "Beta", 0, 0, RoleScope::Server).await.unwrap();
        let c = create_role(&bed.relay, &community, "Gamma", 0, 0, RoleScope::Server).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        let pos = |v: &AuthorityView, id: &str| folded_role(v, id).position;
        assert!(pos(&view, &a) < pos(&view, &b) && pos(&view, &b) < pos(&view, &c), "each new role lands beneath the last");
        assert!(pos(&view, &a) >= 1, "no role claims the owner's position");

        edit_role(&bed.relay, &community, &b, "Beta Prime", 0x59fcb3, Permissions::BAN, RoleScope::Server).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        let edited = folded_role(&view, &b);
        assert_eq!((edited.name.as_str(), edited.color, edited.permissions.0), ("Beta Prime", 0x59fcb3, Permissions::BAN));
        assert_eq!(edited.position, pos(&view, &b), "an edit keeps the role where it was");

        let moved = reorder_roles(&bed.relay, &community, &[c.clone(), a.clone(), b.clone()]).await.unwrap();
        assert_eq!(moved, 3, "every role whose position changed is republished");
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(pos(&view, &c) < pos(&view, &a) && pos(&view, &a) < pos(&view, &b), "the fold holds the requested order");
        assert_eq!(pos(&view, &c), 1, "renumbered from just beneath the owner");

        let again = reorder_roles(&bed.relay, &community, &[c, a, b]).await.unwrap();
        assert_eq!(again, 0, "the same order again publishes nothing");
    }

    #[tokio::test]
    async fn new_roles_stack_above_the_access_band_and_never_share_a_position() {
        use crate::community::roles::{Permissions, RoleScope};
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Band", bed.relays.clone(), None).await.unwrap();
        create_private_channel(&bed.relay, &community, "secret").await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let a = create_role(&bed.relay, &held, "A", 0, Permissions::empty().0, RoleScope::Server).await.unwrap();
        let b = create_role(&bed.relay, &held, "B", 0, Permissions::empty().0, RoleScope::Server).await.unwrap();
        let view = fetch_authority(&bed.relay, &held).await;
        let (pa, pb) = (folded_role(&view, &a).position, folded_role(&view, &b).position);
        assert!(pa < pb, "each new role lands beneath the last");
        assert!(pb < ACCESS_ROLE_POSITION, "and above the access band, never in the slot beneath it");
    }

    #[tokio::test]
    async fn a_members_role_set_is_written_whole_and_the_owner_is_never_a_target() {
        use crate::community::roles::{Permissions, RoleScope};
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Grants", bed.relays.clone(), None).await.unwrap();
        let a = create_role(&bed.relay, &community, "A", 0, Permissions::KICK, RoleScope::Server).await.unwrap();
        let b = create_role(&bed.relay, &community, "B", 0, 0, RoleScope::Server).await.unwrap();
        let member = Keys::generate().public_key();

        set_member_roles(&bed.relay, &community, &member, vec![a.clone(), b.clone()]).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        let held: Vec<String> = view.roles.roles_of(&member.to_hex()).map(|r| r.role_id.clone()).collect();
        assert!(held.contains(&a) && held.contains(&b), "both roles granted");

        set_member_roles(&bed.relay, &community, &member, vec![b.clone()]).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        let held: Vec<String> = view.roles.roles_of(&member.to_hex()).map(|r| r.role_id.clone()).collect();
        assert_eq!(held, vec![b.clone()], "the set replaces, it does not append");

        let err = set_member_roles(&bed.relay, &community, &owner.keys.public_key(), vec![a]).await.unwrap_err();
        assert!(err.contains("owner"), "the owner is never a role target: {err}");
    }

    #[tokio::test]
    async fn losing_the_last_role_that_opens_a_channel_rotates_it_and_keeping_one_does_not() {
        use crate::community::roles::{Permissions, RoleScope};
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Keys", bed.relays.clone(), None).await.unwrap();
        let chan = create_private_channel(&bed.relay, &community, "secret").await.unwrap();
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&chan.0);
        let reload = || crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let epoch = |c: &CommunityV2| c.channel(&chan).unwrap().epoch.0;

        let held = reload();
        let access = fetch_authority(&bed.relay, &held).await.roles.channel_role_ids(&chan_hex);
        assert!(!access.is_empty(), "the private channel came with its access role");
        let second = create_role(&bed.relay, &held, "Also Secret", 0, Permissions::empty().0, RoleScope::Channel(chan_hex.clone())).await.unwrap();
        let member = Keys::generate().public_key();

        set_member_roles(&bed.relay, &reload(), &member, vec![access[0].clone(), second.clone()]).await.unwrap();
        let start = epoch(&reload());

        // Drop one of the two: still entitled, so nobody is cut and nothing rotates.
        set_member_roles(&bed.relay, &reload(), &member, vec![second.clone()]).await.unwrap();
        assert_eq!(epoch(&reload()), start, "a kept role still opens the channel");

        // Drop the last: the channel rotates without them.
        set_member_roles(&bed.relay, &reload(), &member, vec![]).await.unwrap();
        assert_eq!(epoch(&reload()), start + 1, "losing the last access role severs them");
    }

    #[test]
    fn a_role_author_adds_only_bits_they_hold_and_acts_only_beneath_themselves() {
        use crate::community::roles::Permissions;
        let moderator = RoleAuthor {
            me_hex: "m".into(),
            owner_hex: "o".into(),
            is_owner: false,
            rank: 3,
            grantable: Permissions::MANAGE_ROLES | Permissions::KICK,
        };
        assert!(moderator.may_add(0, Permissions::KICK), "a bit they hold");
        assert!(!moderator.may_add(0, Permissions::BAN), "a bit they lack");
        assert!(moderator.may_add(Permissions::BAN, Permissions::BAN | Permissions::KICK), "an existing bit may stay");
        assert!(moderator.may_add(Permissions::BAN, 0), "and may always be taken away");
        assert!(moderator.outranks(4) && !moderator.outranks(3) && !moderator.outranks(1), "strictly beneath only");
        let owner = RoleAuthor { is_owner: true, rank: 0, grantable: u64::MAX, ..moderator };
        assert!(owner.may_add(0, u64::MAX) && owner.outranks(1));
    }

    #[tokio::test]
    async fn the_v2_authority_fold_is_order_independent() {
        // THE core consensus property: two honest clients that receive the SAME
        // control editions in DIFFERENT arrival orders must resolve the IDENTICAL
        // authorized roster + banlist (author-aware select_authorized + banlist
        // fold + cap, all deterministic). A divergence here would fork the
        // community's moderation state between honest members.
        let (bed, owner, _a) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Determinism", bed.relays.clone(), None).await.unwrap();

        // A rich control plane: two admins, an extra role, two grants (one of them a
        // grant to a member the owner then bans), a banlist, a rename, a channel.
        let admin1 = Keys::generate().public_key();
        let admin2 = Keys::generate().public_key();
        grant_admin(&bed.relay, &community, &admin1).await.unwrap();
        grant_admin(&bed.relay, &community, &admin2).await.unwrap();
        let mod_rid = "5c".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&mod_rid, Permissions::KICK | Permissions::MANAGE_MESSAGES), 1).await;
        let member = Keys::generate().public_key();
        publish_grant(&bed.relay, &community, &owner.keys, &member, vec![mod_rid.clone()], 1).await;
        let banned_member = Keys::generate().public_key();
        publish_grant(&bed.relay, &community, &owner.keys, &banned_member, vec![mod_rid], 1).await;
        set_banlist(&bed.relay, &community, &[banned_member.to_hex()]).await.unwrap();
        let meta = control::CommunityMetadata { name: "Renamed".into(), relays: community.relays.clone(), ..Default::default() };
        edit_community_metadata(&bed.relay, &community, &meta).await.unwrap();
        create_public_channel(&bed.relay, &community, "extra").await.unwrap();

        let editions = fetch_control(&bed.relay, &community).await;
        let floors = load_floors(&community);
        assert!(editions.len() >= 6, "a rich plane was built ({} editions)", editions.len());

        let baseline = authority_fingerprint(&fold_authority(&community, &editions, &floors));

        // Fold under many arrival permutations: reversed, and several deterministic
        // rotations/interleavings. Every one must match the baseline.
        let mut orders: Vec<Vec<ParsedEdition>> = Vec::new();
        let mut rev = editions.clone();
        rev.reverse();
        orders.push(rev);
        for shift in [1usize, 3, 5, 7] {
            let n = editions.len();
            orders.push((0..n).map(|i| editions[(i + shift) % n].clone()).collect());
        }
        // A deterministic "shuffle": interleave from both ends.
        let mut zip = Vec::with_capacity(editions.len());
        let (mut lo, mut hi) = (0isize, editions.len() as isize - 1);
        while lo <= hi {
            zip.push(editions[lo as usize].clone());
            if lo != hi {
                zip.push(editions[hi as usize].clone());
            }
            lo += 1;
            hi -= 1;
        }
        orders.push(zip);

        for (i, order) in orders.iter().enumerate() {
            let got = authority_fingerprint(&fold_authority(&community, order, &floors));
            assert_eq!(got, baseline, "arrival order #{i} must resolve the identical authority (consensus)");
        }
        // Sanity: the fingerprint reflects real state (the banned member is out, the
        // honest admins are in).
        assert!(baseline.contains(&admin1.to_hex()) || baseline.contains(&member.to_hex()), "grants are present in the fingerprint");
        assert!(baseline.contains(&banned_member.to_hex()), "the banlist entry is in the fingerprint");
    }

    /// A transport that ACKs publishes but ERRORS every fetch — a relay outage / withhold.
    struct FetchErrors(MemoryRelay);
    #[async_trait::async_trait]
    impl crate::community::transport::Transport for FetchErrors {
        async fn fetch_plane(&self, _plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> { Ok(crate::community::transport::PlaneFetch::whole(self.fetch(query, relays).await?)) }
        async fn publish(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.0.publish(e, r).await
        }
        async fn fetch(&self, _q: &Query, _r: &[String]) -> Result<Vec<Event>, String> {
            Err("relay down".to_string())
        }
        async fn publish_durable(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.0.publish_durable(e, r).await
        }
    }

    #[tokio::test]
    async fn fetch_authority_retains_the_persisted_banlist_on_a_transport_error() {
        let (bed, owner, victim) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "BanRetain", bed.relays.clone(), None).await.unwrap();
        let victim_hex = victim.keys.public_key().to_hex();
        // A ban is persisted locally (as a completed set_banlist + follow leaves it).
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::set_community_banlist(&cid_hex, &[victim_hex.clone()], 1).unwrap();

        // A relay that ERRORS on fetch must degrade FAIL-SAFE: retain the ban, never
        // return an empty banlist (which would silently un-ban on withheld data).
        let down = FetchErrors(MemoryRelay::new());
        let view = fetch_authority(&down, &community).await;
        assert!(view.banned.contains(&victim_hex), "a transport error retains the persisted banlist");
    }

    #[tokio::test]
    async fn the_fold_pages_past_a_full_window_to_find_the_roster_it_tracks() {
        // Soapbox's actual shape. The grants that define the admin list are OLDER than
        // one page of a busy control plane. An entity absent from the window dangles no
        // link, so it raises no gap, so the pager called the very first page "coherent"
        // and stopped — every fold offered zero grants, forever, and only the
        // completeness guard retaining the cache kept the admin list alive. That made
        // the cache the last surviving copy of the roster rather than a cache.
        //
        // Coherent is not complete. The fold must page until what it tracks is found.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "DeepFold", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let rid = "e7".repeat(32);
        let admin = Keys::generate();

        // The roster, at t=1_000 — the OLDEST thing on the plane.
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid.clone()], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();
        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()),
            "baseline: the admin folds while its editions are still in reach",
        );

        // Bury it under MORE than one page of strictly NEWER control traffic.
        for i in 0..(FOLLOW_PAGE + 50) {
            publish_channel_edition_at(
                &bed.relay, &community, &owner.keys,
                &ChannelId(crate::simd::hex::hex_to_bytes_32(&format!("{:064x}", i + 1))),
                &format!("ch{i}"), 1, 2_000 + i as u64,
            ).await;
        }

        // Forget the grant's FLOOR. Re-establishing it is the observable proof that
        // the fold actually reached the grant edition, rather than merely retaining a
        // cached roster it could not re-derive.
        let grant_eid = crate::simd::hex::bytes_to_hex_32(
            &crate::community::v2::derive::grant_locator(community.id(), &admin.public_key().to_bytes()),
        );
        crate::db::community::delete_edition_head(&cid_hex, &grant_eid).unwrap();
        assert!(
            crate::db::community::get_edition_head(&cid_hex, &grant_eid).unwrap().is_none(),
            "precondition: the floor is gone",
        );

        follow_control(&bed.relay, &community).await.unwrap();

        assert!(
            crate::db::community::get_edition_head(&cid_hex, &grant_eid).unwrap().is_some(),
            "the fold MUST page past the newest window and reach the grant that defines the \
             admin list — stopping at the first coherent-looking page is how a community \
             becomes unable to re-derive its own roster",
        );
        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()),
            "and the admin survives",
        );
    }

    #[tokio::test]
    async fn a_grant_naming_a_role_its_own_holder_created_still_folds() {
        // The deadlock that emptied two live communities' rosters.
        //
        // A community grows the ordinary way: the owner promotes an admin, the admin
        // creates a role of their own, and the owner then grants that role onward. Now
        // the grant references a role whose AUTHOR draws authority from a grant — and
        // under all-or-nothing resolution neither can go first. The fixpoint lands
        // empty, and every grant in the community dies with it, the owner's included.
        //
        // Resolving the roles a grant CAN resolve breaks the cycle without granting
        // anything the author did not write: the retained roles are still rank-checked,
        // and the rest fold in on a later iteration.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "GrantCycle", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let admin = Keys::generate();
        let member = Keys::generate();

        // 1. The owner's own role, and a grant of it to the admin.
        let owner_role = "aa".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&owner_role, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![owner_role.clone()], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();
        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()),
            "the admin is promoted",
        );

        // 2. The ADMIN creates a role of their own, beneath theirs.
        let admin_made = "bb".repeat(32);
        let mut made = admin_role(&admin_made, Permissions::BAN);
        made.position = 5;
        publish_role(&bed.relay, &community, &admin, &made, 1).await;

        follow_control(&bed.relay, &community).await.unwrap();
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(
            roster.role(&admin_made).is_some(),
            "an admin-authored role folds while its author's grant is resolvable",
        );
        assert!(
            roster.is_admin(&admin.public_key().to_hex()),
            "and the admin keeps their own standing — a cycle here empties the roster",
        );

        // 3. The owner grants the ADMIN-MADE role to a member, alongside a role that
        //    is not resolvable at all. Under all-or-nothing the whole grant dies and
        //    takes the roster with it; resolved partially, the member gets what the
        //    owner actually granted.
        publish_grant(
            &bed.relay, &community, &owner.keys, &member.public_key(),
            vec![admin_made.clone(), "cc".repeat(32)], 1,
        ).await;
        follow_control(&bed.relay, &community).await.unwrap();
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let mg = roster.grants.iter().find(|g| g.member == member.public_key().to_hex());
        assert!(
            mg.is_some_and(|g| g.role_ids.contains(&admin_made)),
            "the resolvable half of the grant is honored",
        );
        assert!(
            mg.is_some_and(|g| !g.role_ids.iter().any(|r| r == &"cc".repeat(32))),
            "and the unresolvable half is NOT — partial resolution only ever grants less",
        );
        assert!(
            roster.is_admin(&admin.public_key().to_hex()),
            "the rest of the roster survives it",
        );
    }

    #[tokio::test]
    async fn a_cold_device_pages_past_the_first_window_to_find_an_older_grant() {
        // The early break stops paging once every entity we track has a head. On a
        // COLD device we track NOTHING, so that condition is vacuously true and the
        // walk stops at page one — the roster is then whatever the newest window
        // happened to hold, and an admin granted before it silently is not one.
        // That is the roster collapse, arrived at by an optimisation.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "ColdPage", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        // The grant that matters goes down FIRST, so a full newest-first page buries it.
        let admin = Keys::generate();
        let rid = "e5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid.clone()], 1).await;

        // Then bury it under a full page of newer editions.
        for v in 2..(FOLLOW_PAGE as u64 + 2) {
            publish_filler_edition(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), v, 1_000 + v).await;
        }

        follow_control(&bed.relay, &community).await.unwrap();

        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()),
            "a cold device must page PAST the first window — stopping there caches a \
             partial authority as its own baseline and drops every older grant",
        );
    }

    #[tokio::test]
    async fn a_truncated_cold_fold_banks_nothing_at_all() {
        // A page that is entirely one second wide is a wall `until` cannot step past,
        // so the plane below it is unreachable and the fold is TRUNCATED. Refusing to
        // show that partial roster is not enough — it must not be BANKED either. A
        // stored baseline carries a provenance stamp that the next, complete fold has
        // to beat, and names entities that a complete fold may not head, so banking a
        // partial window is how a client talks itself into a permanent wedge.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Wall", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let admin = Keys::generate();
        let rid = "e5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid.clone()], 1).await;
        // A full page of editions sharing ONE second, burying the grant behind the wall.
        for v in 2..(FOLLOW_PAGE as u64 + 2) {
            publish_filler_edition(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), v, 1_000).await;
        }

        follow_control(&bed.relay, &community).await.unwrap();

        assert_eq!(
            crate::db::community::get_community_roles_at(&cid_hex).unwrap(),
            0,
            "a truncated fold must bank NO baseline — a stored partial roster outranks \
             the complete fold that follows it and can never be replaced",
        );
    }

    #[tokio::test]
    async fn an_older_window_never_overwrites_a_newer_cached_roster() {
        // The roster cache carries the provenance timestamp of the fold that wrote it.
        // A later fold reading an OLDER window (a lagging relay, a short page) must not
        // replace it — that is a downgrade with no gap and no truncation to catch it.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Monotone", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let admin = Keys::generate();
        let rid = "e5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid], 1).await;
        follow_control(&bed.relay, &community).await.unwrap();
        assert!(crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()));

        // Stamp the cached roster far in the future: any real fold now reads older.
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        crate::db::community::set_community_roles(&cid_hex, &roster, i64::MAX).unwrap();

        follow_control(&bed.relay, &community).await.unwrap();
        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()),
            "an older window must not overwrite a newer cached roster",
        );
        assert_eq!(
            crate::db::community::get_community_roles_at(&cid_hex).unwrap(),
            i64::MAX,
            "and the newer provenance stamp survives — otherwise the next fold downgrades freely",
        );
    }

    /// A fast majority that does not hold the older editions. Quorum returns as soon
    /// as it answers, so those editions read as absent; only a Full read waits for the
    /// relay that has them. This is the shape a slow Ditto/Soapbox relay produces.
    struct SlowMajority<'a>(&'a MemoryRelay, u64);
    #[async_trait::async_trait]
    impl Transport for SlowMajority<'_> {
        async fn publish(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.0.publish(e, r).await
        }
        async fn fetch(&self, query: &Query, relays: &[String]) -> Result<Vec<Event>, String> {
            let out = self.0.fetch(query, relays).await?;
            if query.evidence == crate::community::transport::Evidence::Full {
                return Ok(out);
            }
            Ok(out.into_iter().filter(|e| e.created_at.as_secs() > self.1).collect())
        }
        async fn fetch_plane(&self, plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> {
            self.0.fetch_plane(plane, query, relays).await
        }
        async fn publish_durable(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.0.publish_durable(e, r).await
        }
    }

    #[tokio::test]
    async fn a_live_link_a_quorum_cannot_see_still_reads_public() {
        // The ban path asks this to decide whether to refound. CORD-05 §5 forbids
        // refounding a Public community — the link refresh re-posts the bundle behind
        // the same URL, so the rotation severs nothing and strands foreign-link joiners
        // on a buried epoch. A Quorum read that misses another creator's Registry makes
        // a Public community read Private, which takes exactly that forbidden branch.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "QuorumBlind", vec!["wss://r".into()], None).await.unwrap();
        mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        assert!(community_is_public(&relay, &community).await, "the link is live on the plane");

        // u64::MAX: nothing is newer, so the Quorum read is blinded entirely. The
        // link is minted with the real clock, so a small cutoff filters nothing.
        let slow = SlowMajority(&relay, u64::MAX);
        assert!(
            community_is_public(&slow, &community).await,
            "a live link only a minority relay serves must still read Public — reading \
             Private here refounds a Public community on ban, severing nothing",
        );
    }

    #[tokio::test]
    async fn a_quorum_that_cannot_see_a_stored_entity_escalates_to_full() {
        // The roster fold draws an absence verdict, and an absence verdict from a
        // MAJORITY is not one: the same fast subset answers every boot, so the retain
        // never lifts and the cache freezes holding the only surviving copy of the
        // roster. Read again at Full before concluding anything is gone.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Escalate", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let admin = Keys::generate();
        let rid = "e5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid.clone()], 1).await;

        // Bank a complete roster the honest way, so the entities are STORED and floored.
        follow_control(&bed.relay, &community).await.unwrap();
        assert!(crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()));

        // A SECOND admin is granted. Its edition lands on the plane like every other,
        // below the cutoff — so a Quorum read cannot see it, and a client that concludes
        // from Quorum alone retains the old roster and never learns about them.
        let admin2 = Keys::generate();
        publish_grant(&bed.relay, &community, &owner.keys, &admin2.public_key(), vec![rid], 1).await;

        let slow = SlowMajority(&bed.relay, 5_000);
        follow_control(&slow, &community).await.unwrap();

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(
            roster.is_admin(&admin.public_key().to_hex()),
            "the first admin survives — the retain is doing its job",
        );
        assert!(
            roster.is_admin(&admin2.public_key().to_hex()),
            "and the roster still ADVANCES: a Quorum read that could not account for a \
             stored entity must re-read at Full, or the cache freezes holding the only \
             surviving copy of the roster and no promotion ever lands again",
        );
    }

    #[tokio::test]
    async fn one_gapped_entity_does_not_freeze_the_rest_of_the_roster() {
        // `authority.gapped` is a global OR across every entity, but the spec makes a
        // gap fail closed FOR THAT ENTITY — suspend it, refetch it — not for the whole
        // community. Treating it as a veto froze live rosters that were otherwise
        // folding perfectly, and permanently once the plane is exhausted and no further
        // paging can resolve the hole.
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "OneGap", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        // A healthy admin the plane fully describes.
        let admin = Keys::generate();
        let rid = "e5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid], 1).await;

        // And a second role the plane DOES serve, floored at a hash nothing chains to:
        // its editions are present but unanchored, which is the withholding shape that
        // fails closed and raises the gap. A floor on an entity absent from the window
        // would not — the fold only visits entities it sees.
        let rid2 = "c7".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid2, Permissions::BAN), 5).await;
        crate::db::community::set_edition_head_at_epoch(&cid_hex, &rid2, 3, &[9u8; 32], &[9u8; 32], community.root_epoch.0).unwrap();

        follow_control(&bed.relay, &community).await.unwrap();

        assert!(
            crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&admin.public_key().to_hex()),
            "a hole in ONE entity must not withhold every other entity's authority — that is \
             how a community that folds correctly still shows an empty roster",
        );
    }

    #[tokio::test]
    async fn follow_control_retains_the_roster_when_a_floored_role_ages_out() {
        let (bed, owner, _m) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Complete", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let (a, b) = (Keys::generate().public_key(), Keys::generate().public_key());
        let rid = crate::simd::hex::bytes_to_hex_32(&[0x7c; 32]);

        // Full state on relay1: an Admin role + two grants → both fold + persist as admins.
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &a, vec![rid.clone()], 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &b, vec![rid.clone()], 1).await;
        follow_control(&bed.relay, &community).await.unwrap().updated;
        assert!(crate::db::community::get_community_roles(&cid_hex).unwrap().is_admin(&a.to_hex()), "seeded");

        // relay2 serves A's grant but NOT the role (aged out of the window): the fold
        // drops both admins yet raises no gap. The completeness gate must RETAIN the
        // stored roster rather than persist the lossy one.
        let relay2 = MemoryRelay::new();
        publish_grant(&relay2, &community, &owner.keys, &a, vec![rid.clone()], 1).await;
        follow_control(&relay2, &community).await.unwrap().updated;
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(roster.is_admin(&a.to_hex()) && roster.is_admin(&b.to_hex()), "a floored-but-unfetched role retains the stored roster");
    }

    #[tokio::test]
    async fn an_uncited_metadata_or_banlist_edition_is_dropped() {
        // CORD-04 §5 covers EVERY control entity, not just the delegation chain.
        // Vector already gated roles and grants in-fold; metadata, channels and
        // the banlist resolved on permission alone, so a client one sweep behind
        // honored an edit from an admin whose demotion it had not read yet.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Base", vec!["wss://r".into()], None).await.unwrap();
        let admin = Keys::generate();
        let rid = "a7".repeat(32);
        publish_role(&relay, &community, &owner, &admin_role(&rid, Permissions::MANAGE_METADATA | Permissions::BAN), 1).await;
        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![rid], 1).await;

        // The admin acts WITHOUT citing (what every pre-citation client emitted).
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let meta = control::CommunityMetadata { name: "Uncited Rename".into(), ..Default::default() };
        let rumor = control::build_edition_rumor(
            admin.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 2,
            head_hash_on_relay(&relay, &community, &community.id().0).await.as_ref(),
            &serde_json::to_string(&meta).unwrap(), 1_000, None,
        );
        let (wrap, _) = control::seal_control_edition(&rumor, &group, &admin, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();

        let ban_eid = crate::community::v2::derive::banlist_locator(community.id());
        let victim = Keys::generate().public_key().to_hex();
        let ban_rumor = control::build_edition_rumor(
            admin.public_key(), vsk::BANLIST, &ban_eid, 1, None,
            &serde_json::to_string(&vec![victim.clone()]).unwrap(), 1_000, None,
        );
        let (ban_wrap, _) = control::seal_control_edition(&ban_rumor, &group, &admin, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&ban_wrap, &community.relays).await.unwrap();

        let updated = follow_control(&relay, &community).await.unwrap().updated;
        assert!(
            updated.as_ref().is_none_or(|c| c.name != "Uncited Rename"),
            "an uncited metadata edit must not be honored",
        );
        let authority = fetch_authority(&relay, &community).await;
        assert!(!authority.banned.contains(&victim), "an uncited banlist edition must not be honored");
        // The positive case (this same admin, citing, lands) is
        // `an_authorized_admin_edits_metadata_but_a_demoted_one_cannot` — its
        // helper cites, so it proves the gate is the CITATION and not the
        // permission. Re-proving it here would need a fresh chain anyway: a
        // cited edition chaining onto the rejected one above is gapped, not
        // refused.
    }

    #[tokio::test]
    async fn an_authorized_admin_edits_metadata_but_a_demoted_one_cannot() {
        // CORD-04 §5: an admin holding MANAGE_METADATA renames the community; once the
        // owner revokes the grant, the (now unauthorized) admin's further edit drops
        // and the name holds at the last authorized state.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Base", vec!["wss://r".into()], None).await.unwrap();
        let admin = Keys::generate();
        let rid = "a1".repeat(32);
        publish_role(&relay, &community, &owner, &admin_role(&rid, Permissions::MANAGE_METADATA), 1).await;
        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![rid.clone()], 1).await;
        publish_community_meta(&relay, &community, &admin, "Admin Rename", 2).await;

        let updated = follow_control(&relay, &community).await.unwrap().updated.expect("admin edit authorized");
        assert_eq!(updated.name, "Admin Rename", "an admin with MANAGE_METADATA renames");

        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![], 2).await; // revoke
        publish_community_meta(&relay, &community, &admin, "Demoted Rename", 3).await;
        let _ = follow_control(&relay, &community).await.unwrap().updated;
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(held.name, "Admin Rename", "a demoted admin's edit is dropped; the name holds");
    }

    #[tokio::test]
    async fn a_roleless_member_cannot_edit_metadata() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Guarded", vec!["wss://r".into()], None).await.unwrap();
        let stranger = Keys::generate();
        publish_community_meta(&relay, &community, &stranger, "Hijacked", 2).await;
        assert!(
            follow_control(&relay, &community).await.unwrap().updated.is_none(),
            "a roleless member's metadata edit never folds"
        );
    }

    #[tokio::test]
    async fn a_self_signed_grant_is_not_authority() {
        // The self-promotion defense: a member self-signs both a role and a grant of
        // it to themselves. authorize_delegation drops both (their signer never traces
        // to the owner), so their metadata edit stays unauthorized.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "NoSelfPromo", vec!["wss://r".into()], None).await.unwrap();
        let rogue = Keys::generate();
        let rid = "b2".repeat(32);
        publish_role(&relay, &community, &rogue, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&relay, &community, &rogue, &rogue.public_key(), vec![rid.clone()], 1).await;
        publish_community_meta(&relay, &community, &rogue, "Seized", 2).await;
        assert!(
            follow_control(&relay, &community).await.unwrap().updated.is_none(),
            "a self-signed grant confers no authority"
        );
    }

    #[tokio::test]
    async fn the_banlist_is_enforced_only_from_a_ban_holder() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Bans", vec!["wss://r".into()], None).await.unwrap();
        let target = "cc".repeat(32);

        // A non-BAN-holder's banlist edition is folded but NOT enforced.
        let rogue = Keys::generate();
        publish_banlist(&relay, &community, &rogue, &[target.clone()], 1).await;
        let floors = load_floors(&community);
        let editions = fetch_control(&relay, &community).await;
        let authority = fold_authority(&community, &editions, &floors);
        assert!(authority.banned.is_empty(), "a non-owner (no BAN) banlist is not enforced");

        // The owner (supreme, holds BAN) bans the target: now enforced.
        publish_banlist(&relay, &community, &owner, &[target.clone()], 2).await;
        let editions = fetch_control(&relay, &community).await;
        let authority = fold_authority(&community, &editions, &floors);
        assert!(authority.banned.contains(&target), "the owner's banlist is enforced");
    }

    #[tokio::test]
    async fn a_banned_admin_loses_all_authority() {
        // CORD-04 §4: a banned npub vanishes — even holding an un-stripped grant, a
        // banned admin's authority is dropped and their edits refused.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "BanAuth", vec!["wss://r".into()], None).await.unwrap();
        let admin = Keys::generate();
        let rid = "e5".repeat(32);
        publish_role(&relay, &community, &owner, &admin_role(&rid, Permissions::MANAGE_METADATA), 1).await;
        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![rid.clone()], 1).await;
        publish_banlist(&relay, &community, &owner, &[admin.public_key().to_hex()], 1).await; // ban, grant left intact
        publish_community_meta(&relay, &community, &admin, "Banned Rename", 2).await;

        assert!(
            follow_control(&relay, &community).await.unwrap().updated.is_none(),
            "a banned admin's edit is dropped even with an unstripped grant"
        );
        let authority = fold_authority(&community, &fetch_control(&relay, &community).await, &load_floors(&community));
        assert!(authority.banned.contains(&admin.public_key().to_hex()));
        assert!(
            !authority.roles.is_authorized(&admin.public_key().to_hex(), Some(&owner.public_key().to_hex()), Permissions::MANAGE_METADATA),
            "a banned admin holds no bit"
        );
    }

    #[tokio::test]
    async fn a_ban_holder_cannot_ban_a_superior_or_the_owner() {
        // CORD-04 §3/§5: BAN needs the bit AND a strict outrank of the target. A mod
        // (pos 2, holds BAN) can ban a lower member but NOT a superior admin (pos 1)
        // and NOT the owner (supreme, unbannable).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Ranks", vec!["wss://r".into()], None).await.unwrap();
        let admin = Keys::generate();
        let moder = Keys::generate();
        let stranger = Keys::generate();
        let (admin_rid, mod_rid) = ("a1".repeat(32), "b2".repeat(32));
        publish_role(&relay, &community, &owner, &Role { role_id: admin_rid.clone(), name: "Admin".into(), position: 1, permissions: Permissions(Permissions::ADMIN_ALL), scope: RoleScope::Server, color: 0, extra: Default::default() }, 1).await;
        publish_role(&relay, &community, &owner, &Role { role_id: mod_rid.clone(), name: "Mod".into(), position: 2, permissions: Permissions(Permissions::BAN), scope: RoleScope::Server, color: 0, extra: Default::default() }, 1).await;
        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![admin_rid], 1).await;
        publish_grant(&relay, &community, &owner, &moder.public_key(), vec![mod_rid], 1).await;
        publish_banlist(&relay, &community, &moder, &[admin.public_key().to_hex(), owner.public_key().to_hex(), stranger.public_key().to_hex()], 1).await;

        let authority = fold_authority(&community, &fetch_control(&relay, &community).await, &load_floors(&community));
        assert!(!authority.banned.contains(&admin.public_key().to_hex()), "a mod cannot ban a superior admin");
        assert!(!authority.banned.contains(&owner.public_key().to_hex()), "nobody can ban the owner");
        assert!(authority.banned.contains(&stranger.public_key().to_hex()), "the mod CAN ban a lower-ranked member");
    }

    #[tokio::test]
    async fn an_unauthorized_higher_banlist_cannot_unban() {
        // CORD-04 §4 anti-roster fail-CLOSED: a rogue's higher-version empty banlist
        // must not erase the owner's ban (author-aware head selection + persisted
        // banlist retention).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "NoUnban", vec!["wss://r".into()], None).await.unwrap();
        let target = "cc".repeat(32);
        publish_banlist(&relay, &community, &owner, &[target.clone()], 1).await;
        follow_control(&relay, &community).await.unwrap().updated; // persists the ban

        let rogue = Keys::generate();
        publish_banlist(&relay, &community, &rogue, &[], 2).await; // unauthorized higher, empty
        let authority = fold_authority(&community, &fetch_control(&relay, &community).await, &load_floors(&community));
        assert!(authority.banned.contains(&target), "an unauthorized higher banlist cannot un-ban");
    }

    #[tokio::test]
    async fn the_community_list_syncs_a_membership_to_a_fresh_device() {
        // CORD-02 §8: create publishes the 13302; a fresh device (community dropped
        // locally, the 13302 + genesis still on the relay) rehydrates it on sync.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        let community = create_community(&relay, "Synced", relays.clone(), None).await.unwrap();
        crate::db::community::delete_community(&crate::simd::hex::bytes_to_hex_32(&community.id().0)).unwrap();
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_none());

        let rehydrated = sync_community_list(&relay, &relays).await.unwrap().joined;
        assert_eq!(rehydrated.len(), 1, "the left-behind membership rehydrates");
        assert_eq!(rehydrated[0].id().0, community.id().0);
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_some(), "and is now held locally");
    }

    #[tokio::test]
    async fn a_retried_leave_tombstone_cannot_bury_a_rejoin_made_meanwhile() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        let community = create_community(&relay, "Left", relays.clone(), None).await.unwrap();
        let cid = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        // The leave stamps its own removal time, and its publish fails.
        let left_at = now_ms() - 1000;
        tombstone_community_list(&relay, community.id(), &relays, left_at).await.unwrap();
        // The user rejoins before the retry gets through.
        republish_community_list(&relay, Some(community.id())).await.unwrap();
        assert!(fetch_fragments(&relay, &relays).await.unwrap().unwrap().list.is_live(&cid));

        // The retry lands late, carrying the ORIGINAL stamp — which the rejoin outranks.
        tombstone_community_list(&relay, community.id(), &relays, left_at).await.unwrap();
        let set = fetch_fragments(&relay, &relays).await.unwrap().unwrap();
        assert!(set.list.is_live(&cid), "a retry re-stamping `now` would have buried the rejoin");
    }

    #[tokio::test]
    async fn a_boot_with_no_fragments_seeds_the_list_from_local_state() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        let community = create_community(&relay, "Seeded", relays.clone(), None).await.unwrap();

        // An account arriving from the retired single-event list: held locally, nothing
        // at the fragment coordinate. Boot alone has to write it — no membership changes.
        let bare = MemoryRelay::new();
        sync_community_list(&bare, &relays).await.unwrap();
        let set = fetch_fragments(&bare, &relays).await.unwrap().expect("boot seeded the List");
        let live = set.list.live_entries();
        assert_eq!(live.len(), 1);
        assert_eq!(live[0].community_id, crate::simd::hex::bytes_to_hex_32(&community.id().0));

        // Latched: a LATER empty read is a relay that lost the fragments, not a fresh
        // account, and republishing local state there would bury a sibling's tombstones.
        let empty = MemoryRelay::new();
        sync_community_list(&empty, &relays).await.unwrap();
        assert_eq!(empty.stored_count(), 0, "the seed runs once");
    }

    #[tokio::test]
    async fn a_dissolved_invite_retires_on_accept_and_tombstones_the_list() {
        // The invite to a dissolved community is the one join failure with no
        // retry: the refusal is an owner-signed grave. The boundary must retire
        // the parked row AND write the §8 tombstone siblings purge on.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Grave", bed.relays.clone(), None).await.unwrap();
        let bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None)).unwrap();
        dissolve_community(&bed.relay, &community).await.unwrap();

        bed.swap_to(&member);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::save_pending_invite(&cid_hex, &bundle, "inviter", i64::MAX).unwrap();
        let err = accept_parked_invite(&bed.relay, &bundle, None).await.unwrap_err();
        assert_eq!(err, ERR_DISSOLVED, "the grave refusal is the sentinel the boundary matches");

        retire_dead_invite(&bed.relay, &cid_hex, &bed.relays).await;
        assert!(crate::db::community::get_pending_invite(&cid_hex).unwrap().is_none(), "the dead invite leaves this device");
        let set = fetch_fragments(&bed.relay, &bed.relays).await.unwrap().expect("the tombstone published");
        assert!(set.list.tombstones.iter().any(|t| t.community_id == cid_hex), "and siblings get the §8 tombstone");
        assert!(!set.list.is_live(&cid_hex));
    }

    #[tokio::test]
    async fn an_owner_dissolve_tombstones_the_list_for_sibling_devices() {
        // Dissolving IS leaving. The grave alone reaches every MEMBER, but only a §8
        // tombstone reaches the owner's own sibling devices — without it they keep the
        // membership LIVE in the List, fold the grave, and show a sealed husk the owner
        // already deleted, on every device, until each is cleaned up by hand.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Doomed", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let before = fetch_fragments(&bed.relay, &bed.relays).await.unwrap().expect("create published the List");
        assert!(before.list.is_live(&cid_hex), "the membership is live before the dissolve");

        dissolve_community(&bed.relay, &community).await.unwrap();

        let set = fetch_fragments(&bed.relay, &bed.relays).await.unwrap().expect("the List outlives the dissolve");
        assert!(
            set.list.tombstones.iter().any(|t| t.community_id == cid_hex),
            "the dissolve published the §8 tombstone alongside the grave"
        );
        assert!(!set.list.is_live(&cid_hex), "sibling devices tear the husk down on their next list sync");
    }

    #[tokio::test]
    async fn a_sibling_devices_list_tombstone_purges_the_parked_invite() {
        // Device A declined (or retired a dead invite): its §8 tombstone must
        // clear device B's parked copy on the next list sync — and ONLY when the
        // removal post-dates the invite, so a fresh re-invite survives an old leave.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        let cid = crate::community::CommunityId([0x5A; 32]);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&cid.0);

        // An OLD tombstone (a past leave) must not kill an invite received after it.
        tombstone_community_list(&relay, &cid, &relays, now_ms() - 600_000).await.unwrap();
        crate::db::community::save_pending_invite(&cid_hex, "{}", "inviter", i64::MAX).unwrap();
        sync_community_list(&relay, &relays).await.unwrap();
        assert!(crate::db::community::get_pending_invite(&cid_hex).unwrap().is_some(), "a re-invite supersedes a past leave");

        // A tombstone NEWER than the invite is a verdict on it: purged on sync.
        tombstone_community_list(&relay, &cid, &relays, now_ms() + 10_000).await.unwrap();
        sync_community_list(&relay, &relays).await.unwrap();
        assert!(crate::db::community::get_pending_invite(&cid_hex).unwrap().is_none(), "the sibling's removal clears the parked copy");
    }

    #[tokio::test]
    async fn an_unchanged_republish_rewrites_no_fragment() {
        // Nothing changed since the last write: the rebuilt fragment serializes to
        // the bytes already on the relay, so the write must not touch the wire —
        // a bumped created_at on identical content is pure churn.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        create_community(&relay, "Stable", relays.clone(), None).await.unwrap();
        let before = fetch_fragments(&relay, &relays).await.unwrap().unwrap().created_at;

        republish_community_list(&relay, None).await.unwrap();
        let after = fetch_fragments(&relay, &relays).await.unwrap().unwrap().created_at;
        assert_eq!(before, after, "a byte-identical fragment must not republish");
    }

    #[tokio::test]
    async fn a_frags_tie_at_equal_age_resolves_to_the_larger_count() {
        // A torn repack's worst case: two fragments at the SAME created_at
        // disagreeing on the total. The larger count must govern (CORD-02 §8) —
        // the smaller would push index 2 out of range and its memberships dormant.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        let at = now_ms() / 1000;
        let two = super::super::list_frag::FragList { frags: 2, entries: vec![], tombstones: vec![], extra: Default::default() };
        let three = super::super::list_frag::FragList { frags: 3, entries: vec![], tombstones: vec![], extra: Default::default() };
        // The larger count sits at the LOWER index: an age-only rule that keeps
        // the last fragment seen would pick 2 here, not 3.
        for (frag, index) in [(&three, 0usize), (&two, 1usize)] {
            let e = super::super::list_frag::build_fragment_event_keys(&owner, frag, index, at).unwrap();
            relay.publish(&e, &relays).await.unwrap();
        }
        let set = fetch_fragments(&relay, &relays).await.unwrap().unwrap();
        assert_eq!(set.declared, 3, "an age tie resolves to the larger frags");
        assert!(!set.is_complete(), "index 2 is unread, so the set refuses to write");
    }

    /// Aggregate fetches answer from the healthy relay; asked alone, the dead
    /// relay errors — the partial-failure shape a boot read can't see through.
    struct HalfDeaf<'a>(&'a MemoryRelay, String);
    #[async_trait::async_trait]
    impl Transport for HalfDeaf<'_> {
        async fn publish(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.0.publish(e, r).await
        }
        async fn fetch(&self, query: &Query, relays: &[String]) -> Result<Vec<Event>, String> {
            if relays.len() == 1 && relays[0] == self.1 {
                return Err("relay did not answer the fetch".to_string());
            }
            self.0.fetch(query, relays).await
        }
        async fn fetch_plane(&self, plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> {
            self.0.fetch_plane(plane, query, relays).await
        }
        async fn publish_durable(&self, e: &Event, r: &[String]) -> Result<(), String> {
            self.0.publish_durable(e, r).await
        }
    }

    #[tokio::test]
    async fn an_unconfirmed_empty_read_never_seeds() {
        // One of the account's relays never answers. The aggregate read comes back
        // empty (the healthy relay has nothing), which is indistinguishable from a
        // fresh account — but the dead relay may hold a sibling's tombstones, so
        // seeding here would bury them. The seed must defer, unlatched, and land
        // once every relay confirms empty.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string(), "wss://dead".to_string()];
        let community = create_community(&relay, "Gated", relays.clone(), None).await.unwrap();
        let cid = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let bare = MemoryRelay::new();
        let half_deaf = HalfDeaf(&bare, "wss://dead".to_string());
        sync_community_list(&half_deaf, &relays).await.unwrap();
        assert_eq!(bare.stored_count(), 0, "a failed read must never seed");
        assert!(
            crate::db::settings::get_sql_setting(LIST_SEEDED_KEY.to_string()).unwrap().is_none(),
            "a deferred seed must not latch"
        );

        // The relay comes back: every relay now confirms empty, and the seed lands.
        sync_community_list(&bare, &relays).await.unwrap();
        let set = fetch_fragments(&bare, &relays).await.unwrap().expect("the confirmed-empty boot seeds");
        assert!(set.list.is_live(&cid));
        assert!(crate::db::settings::get_sql_setting(LIST_SEEDED_KEY.to_string()).unwrap().is_some());
    }

    #[tokio::test]
    async fn a_leave_tombstones_the_membership_so_sync_does_not_rejoin() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let relays = vec!["wss://r".to_string()];
        let community = create_community(&relay, "Left", relays.clone(), None).await.unwrap();
        leave_community(&relay, &community).await.unwrap(); // tombstones the 13302 + deletes

        let rehydrated = sync_community_list(&relay, &relays).await.unwrap().joined;
        assert!(rehydrated.is_empty(), "a tombstoned membership is not rejoined on sync");
    }

    #[tokio::test]
    async fn accepting_the_same_bundle_twice_is_idempotent() {
        // A bot restart or a duplicate invite delivery: accepting the SAME bundle
        // again must upsert cleanly — same community_id, no duplicate channels, no
        // corruption, the keys unchanged.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Idem", bed.relays.clone(), None).await.unwrap();
        create_public_channel(&bed.relay, &community, "extra").await.unwrap();
        let community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None)).unwrap();

        bed.swap_to(&member);
        let first = accept_parked_invite(&bed.relay, &bundle, None).await.unwrap();
        let channels_after_first = first.channels.len();
        let root_after_first = first.community_root;

        // Accept the identical bundle again (restart / redelivery).
        let second = accept_parked_invite(&bed.relay, &bundle, None).await.unwrap();
        assert_eq!(second.id().0, first.id().0, "same community_id");
        assert_eq!(second.channels.len(), channels_after_first, "no duplicate channels on re-accept");
        assert_eq!(second.community_root, root_after_first, "root unchanged");

        // The persisted state is a single clean community with the expected channels.
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(reloaded.channels.len(), channels_after_first, "the DB holds one clean channel set");
        assert_eq!(crate::db::community::list_community_ids().unwrap().iter().filter(|id| id.0 == community.id().0).count(), 1, "exactly one community row");
    }

    #[tokio::test]
    async fn a_fresh_joiner_can_authorize_a_moderators_hide_before_any_follow() {
        // The join walk reads the control plane to genesis anyway, and it already
        // folds the full roster for the ban gate. Throwing that roster away left
        // the fresh member's stored roles EMPTY until the follow worker's queued
        // re-walk — and the hide gate reads the stored roster, so every message a
        // moderator had hidden rendered to exactly the person who should never
        // see it: someone who just walked in.
        let (bed, owner, member) = TestBed::new();
        let admin = Keys::generate();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Moderated", bed.relays.clone(), None).await.unwrap();
        grant_admin(&bed.relay, &community, &admin.public_key()).await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();

        // A FRESH account accepts. No follow_control runs in this test — what the
        // join itself persisted is all the joiner has.
        bed.swap_to(&member);
        let invite = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(!roster.grants.is_empty(), "the join persisted the roster it already folded");
        let owner_hex = joined.owner().unwrap().to_hex();
        let victim = Keys::generate().public_key().to_hex();
        assert!(
            crate::community::moderation::can_hide(Some(&owner_hex), &roster, &admin.public_key().to_hex(), &victim),
            "the admin's hides are honorable on the FIRST history ingest, not after a follow"
        );
        // And the grant's refuse-downgrade floor is seeded, so the citation gate
        // (`actor_authority_pinned`) can resolve the same grant.
        let grant_hex = crate::simd::hex::bytes_to_hex_32(&crate::community::v2::derive::grant_locator(
            joined.id(),
            &admin.public_key().to_bytes(),
        ));
        assert!(
            crate::db::community::get_edition_head(&cid_hex, &grant_hex).unwrap().is_some(),
            "the admin-signed grant head survived the join"
        );
    }

    #[tokio::test]
    async fn a_severed_member_can_be_unbanned_and_re_admitted() {
        // The full moderation HEAL lifecycle: ban (banlist + grant strip + refound)
        // severs a member; the owner then unbans + sends a FRESH invite carrying the
        // NEW root; the member rejoins at the new epoch and converses again. Proves
        // a ban is reversible end-to-end, not a one-way door.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let mut community = create_community(&bed.relay, "Redeemable", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();
        send_message(&bed.relay, &community, &general, "owner: welcome").await.unwrap();

        bed.swap_to(&member);
        let invite = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite).await.unwrap();
        assert!(texts_in(&bed.relay, &joined, &general).await.contains(&"owner: welcome".to_string()));

        // Owner bans the member (CORD-04 §6 three-removal) → refound severs them.
        bed.swap_to(&owner);
        set_banlist(&bed.relay, &community, &[member.keys.public_key().to_hex()]).await.unwrap();
        grant_roles(&bed.relay, &community, &member.keys.public_key(), vec![]).await.unwrap();
        community = refound_community(&bed.relay, &community, &[member.keys.public_key()]).await.unwrap();
        assert_eq!(community.root_epoch, Epoch(1));
        send_message(&bed.relay, &community, &general, "owner: after the ban").await.unwrap();

        // The member's follow concludes severance (no blob at the new epoch).
        bed.swap_to(&member);
        let session = crate::db::current_session();
        assert!(follow_rekeys(&bed.relay, &joined, &session).await.unwrap().self_removed, "the member is cryptographically severed");

        // Owner unbans + re-invites: build the fresh epoch-1 bundle (accept it
        // directly, so the test picks the NEW invite unambiguously rather than an
        // arbitrary one of the two pending 3313s).
        bed.swap_to(&owner);
        set_banlist(&bed.relay, &community, &[]).await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(community.root_epoch, Epoch(1), "the owner's bundle carries epoch 1");
        let fresh_bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None)).unwrap();

        // Member accepts the fresh invite → rejoins at epoch 1, reads current + posts.
        bed.swap_to(&member);
        let rejoined = accept_parked_invite(&bed.relay, &fresh_bundle, None).await.unwrap();
        assert_eq!(rejoined.root_epoch, Epoch(1), "rejoined at the current epoch");
        assert_eq!(rejoined.community_root, community.community_root, "holds the NEW root");
        let seen = texts_in(&bed.relay, &rejoined, &general).await;
        assert!(seen.contains(&"owner: after the ban".to_string()), "reads post-ban history with the new root");
        send_message(&bed.relay, &rejoined, &general, "member: i am back").await.unwrap();

        bed.swap_to(&owner);
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(
            texts_in(&bed.relay, &community, &general).await.contains(&"member: i am back".to_string()),
            "the re-admitted member converses again at the new epoch"
        );
        // And they're back in the memberlist.
        let members = memberlist(&bed.relay, &community).await.unwrap();
        assert!(members.contains(&member.keys.public_key()), "the re-admitted member is in the list");
    }

    #[tokio::test]
    async fn dissolution_blocks_a_join() {
        // CORD-02 §9: the owner dissolves; a would-be joiner resolves the grave and
        // refuses to join.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Doomed", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        dissolve_community(&bed.relay, &community).await.unwrap();
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().unwrap().dissolved, "the owner's local hold is sealed");

        bed.swap_to(&member);
        let err = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap_err();
        assert!(err.contains("dissolved"), "a join refuses a dissolved community: {err}");
    }

    #[tokio::test]
    async fn dissolution_seals_writes_but_not_reads() {
        // CORD-02 §9: sealed means NO further activity, ever. Reads must survive —
        // the history stays browsable, and only explicit user intent deletes it.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Doomed", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&bed.relay, &community, &general, "before the end").await.unwrap();

        dissolve_community(&bed.relay, &community).await.unwrap();
        let sealed = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();

        for err in [
            send_message(&bed.relay, &sealed, &general, "after the end").await.unwrap_err(),
            send_reaction(&bed.relay, &sealed, &general, &"a".repeat(64), &"b".repeat(64), crate::community::v2::kind::MESSAGE, "+", None)
                .await
                .unwrap_err(),
            send_edit(&bed.relay, &sealed, &general, &"a".repeat(64), "revised", &[]).await.unwrap_err(),
        ] {
            assert!(err.contains("dissolved"), "every write is refused, got: {err}");
        }
        assert!(
            texts_in(&bed.relay, &sealed, &general).await.contains(&"before the end".to_string()),
            "but the history still reads"
        );
    }

    #[tokio::test]
    async fn only_the_owner_can_dissolve() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Mine", bed.relays.clone(), None).await.unwrap();
        bed.swap_to(&member);
        assert!(dissolve_community(&bed.relay, &community).await.is_err(), "only the owner can dissolve");
        assert!(!is_dissolved(&bed.relay, &community).await, "and no tombstone was published");
    }

    #[tokio::test]
    async fn a_foreign_tombstone_is_not_death() {
        // A non-owner sealing the dissolved plane is noise (verify_dissolved is
        // owner-gated), so the community is not treated as dead.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Safe", vec!["wss://r".into()], None).await.unwrap();
        let rogue = Keys::generate();
        let rumor = crate::community::v2::dissolution::dissolved_tombstone_rumor(rogue.public_key(), community.id(), 1_000);
        let wrap = crate::community::v2::dissolution::seal_dissolved(&rumor, community.id(), &rogue, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
        assert!(!is_dissolved(&relay, &community).await, "a foreign-signed tombstone is not death");
    }

    #[tokio::test]
    async fn a_public_channel_reads_history_across_a_refounding() {
        // CORD-03 §3: after a Refounding rolls the base root, a Public channel's
        // pre-rotation messages stay readable (the prior epoch's root is archived and
        // the read fans out across held epochs).
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "History", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&relay, &community, &general, "before the refounding").await.unwrap();

        let refounded = refound_community(&relay, &community, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1), "the epoch advanced");
        send_message(&relay, &refounded, &general, "after the refounding").await.unwrap();

        let open = texts_in(&relay, &refounded, &general).await;
        assert!(open.contains(&"after the refounding".to_string()), "opening reads the live epoch");
        assert!(
            !open.contains(&"before the refounding".to_string()),
            "and NOT the rotated-past one — that plane is the back-paging cursor's job"
        );
        let paged = all_texts_in(&relay, &refounded, &general).await;
        assert!(paged.contains(&"before the refounding".to_string()), "the epoch-0 message stays reachable by paging");
        assert!(paged.contains(&"after the refounding".to_string()), "alongside the epoch-1 one");
    }

    #[tokio::test]
    async fn refounding_aborts_when_control_state_is_withheld() {
        // B1 coverage gate (CORD-06 §3): a relay serving none of the committed control
        // heads must ABORT the Refounding — never silently drop state (e.g. unban a
        // member at the new epoch a fresh joiner bootstraps).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Withheld", vec!["wss://good".into()], None).await.unwrap();
        publish_banlist(&relay, &community, &owner, &["cc".repeat(32)], 1).await;
        follow_control(&relay, &community).await.unwrap().updated; // seed the banlist floor

        // Re-point the held community to an EMPTY relay + save, so the Refounding (which
        // reloads fresh state) fetches none of the committed heads.
        let mut moved = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        moved.relays = vec!["wss://empty".into()];
        crate::db::community::save_community_v2(&moved).unwrap();

        let err = refound_community(&relay, &moved, &[]).await.unwrap_err();
        assert!(err.contains("was not served"), "a withheld control head aborts the refounding: {err}");
        assert_eq!(
            crate::db::community::load_community_v2(community.id()).unwrap().unwrap().root_epoch,
            Epoch(0),
            "the epoch did NOT advance (zero published state)"
        );
    }

    #[tokio::test]
    async fn refounding_rolls_the_root_and_severs_a_removed_member() {
        // CORD-06 §3: the owner re-founds, removing a member. The base root rolls, the
        // epoch advances, and the removed member's rekey-follow concludes they're cut.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Refound", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();

        bed.swap_to(&owner);
        let refounded = refound_community(&bed.relay, &community, &[member.keys.public_key()]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1), "the epoch advanced");
        assert_ne!(refounded.community_root, community.community_root, "the base root rolled");
        // The owner still reads the compacted control plane at the new epoch.
        assert_eq!(
            crate::db::community::load_community_v2(community.id()).unwrap().unwrap().root_epoch,
            Epoch(1),
            "the owner committed the new epoch"
        );

        // The removed member, following rekeys, is severed (no blob in the rotation).
        // Guard captured AFTER the swap: it must belong to the ACTING account (the harness
        // swap now bumps the generation exactly like a production swap_session).
        bed.swap_to(&member);
        let session = crate::db::current_session();
        let follow = follow_rekeys(&bed.relay, &joined, &session).await.unwrap();
        assert!(follow.self_removed, "the removed member is cut by the re-founding");
    }

    #[tokio::test]
    async fn a_ban_holding_admin_can_re_found_but_not_evict_a_superior() {
        // CORD-06 §Authority: a Refounding requires BAN, not owner-identity. A
        // non-owner admin granted BAN CAN re-found (and every member follows it —
        // see the receive-side test), but the "strictly outrank every removed
        // target" rule still holds: they can't use it to evict the owner.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Guarded", bed.relays.clone(), None).await.unwrap();
        let rid = "b0".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &member.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        // Fold the roster so this member's own DB reflects their BAN grant (the
        // authority check reads the folded Roster, not the bundle).
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        // Can't evict the owner (no one outranks the owner).
        assert!(refound_community(&bed.relay, &joined, &[owner.keys.public_key()]).await.is_err(), "a BAN-holder can't re-found to evict the owner");
        // But CAN re-found removing a plain member they outrank (here, nobody).
        assert!(refound_community(&bed.relay, &joined, &[]).await.is_ok(), "a BAN-holding admin can re-found");
    }

    #[tokio::test]
    async fn follow_rekeys_adopts_an_authorized_non_owner_base_rotation() {
        // A BAN-holding ADMIN (not the owner) re-founds, and every member must
        // follow it — owner-only receive silently strands members whose community
        // was refounded by an admin (CORD-06 §Authority: "a Refounding requires
        // BAN", checked against the folded Roster).
        let (bed, owner, me) = TestBed::new();
        let admin = Keys::generate();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "AdminRefound", bed.relays.clone(), None).await.unwrap();
        let rid = "b0".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid], 1).await;

        // I (a plain member) join, then fold the roster so I know the admin holds BAN.
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // The admin re-founds keeping the owner + me — the owner must always be a
        // recipient of a non-owner Refounding.
        let new_root = [0xC7; 32];
        publish_base_rotation(&bed.relay, &joined, &admin, &[owner.keys.public_key(), me.keys.public_key()], &new_root, &joined.community_root).await;

        let updated = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap().updated
            .expect("an authorized admin's Refounding is adopted");
        assert_eq!(updated.root_epoch, Epoch(1), "advanced past the admin's rotation");
        assert_eq!(updated.community_root, new_root, "adopted the admin's fresh root");
    }

    #[tokio::test]
    async fn adopting_a_severing_rotation_revokes_my_own_links_instead_of_refreshing_them() {
        // The inverse of the sibling test: a SEVERING refound flips the stable-URL
        // contract. A raid arrives through the door, so every creator's client
        // buries its own links on adopt rather than carrying them into the new
        // epoch — which is the only way the OWNER's link dies when a bot admin ran
        // the containment (only the creator holds a link's signer secret).
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "SeverHeal", bed.relays.clone(), None).await.unwrap();
        let rid = "b1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        let minted = mint_public_link(&bed.relay, &joined, "https://x", None, None).await.unwrap();
        assert!(fetch_public_bundle(&bed.relay, &minted.url).await.is_ok(), "my link is live before the raid");

        // The owner runs a SEVERING refound (the raid lane).
        let new_root = [0xD5; 32];
        publish_severing_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &new_root, &joined.community_root).await;

        let updated = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap().updated
            .expect("the owner's severing Refounding is adopted");
        assert_eq!(updated.root_epoch, Epoch(1), "I still advance to the new epoch");

        let err = fetch_public_bundle(&bed.relay, &minted.url).await.unwrap_err();
        assert!(err.contains("revoked"), "my link must be a grave, not a refreshed door: {err}");
        assert!(
            crate::db::community::list_public_invites(&crate::simd::hex::bytes_to_hex_32(&updated.id().0)).unwrap().is_empty(),
            "and the local record goes with it",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_severing_adopt_never_deadlocks_the_last_link_creator() {
        // The severance runs INSIDE the follow, which holds `follow_lock` for the
        // whole call. `revoke_public_link`'s last-live-link escalation re-founds —
        // taking that same non-reentrant lock — so routing severance through it
        // would wedge this community's follow forever, for the very client whose
        // revocation empties the registry (typically the owner). The escalation-free
        // path is the fix; this test is its guard.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoDeadlock", bed.relays.clone(), None).await.unwrap();
        let rid = "b2".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        // My link is the ONLY one in the registry — revoking it empties the
        // aggregate, which is exactly the escalation's trigger condition.
        let minted = mint_public_link(&bed.relay, &joined, "https://x", None, None).await.unwrap();
        assert!(fetch_public_bundle(&bed.relay, &minted.url).await.is_ok());

        let new_root = [0xD6; 32];
        publish_severing_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &new_root, &joined.community_root).await;

        let followed = crate::rt::time::timeout(
            std::time::Duration::from_secs(20),
            follow_rekeys(&bed.relay, &joined, &crate::db::current_session()),
        )
        .await
        .expect("the severing follow must not deadlock on follow_lock")
        .unwrap();
        assert_eq!(followed.updated.expect("adopted").root_epoch, Epoch(1));
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_severing_adopt_spares_a_link_minted_after_the_raid() {
        // Severance is bounded by the rotation's own wire stamp, not "now". A
        // second device that adopts late must not eat the fresh link the owner
        // minted to re-open the community after the raid was over.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "FreshDoor", bed.relays.clone(), None).await.unwrap();
        let rid = "b3".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let raid_era = mint_public_link(&bed.relay, &joined, "https://old", None, None).await.unwrap();

        let new_root = [0xD7; 32];
        publish_severing_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &new_root, &joined.community_root).await;
        let updated = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap().updated.expect("adopted");
        assert!(
            fetch_public_bundle(&bed.relay, &raid_era.url).await.unwrap_err().contains("revoked"),
            "the raid-era link is buried",
        );

        // The raid is over and the owner deliberately re-opens the community. The
        // pending-severance retry runs on every follow, so a door minted after the
        // containment must survive them all — otherwise no one could ever re-open.
        let fresh = mint_public_link(&bed.relay, &updated, "https://new", None, None).await.unwrap();
        let _ = follow_rekeys(&bed.relay, &updated, &crate::db::current_session()).await.unwrap();
        assert!(
            fetch_public_bundle(&bed.relay, &fresh.url).await.is_ok(),
            "a link minted after the containment survives later follow passes",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn an_unauthorized_severing_rotation_never_touches_my_links() {
        // The sever tag grants no authority of its own: it rides a rotation the
        // adopt gate has already verified. A plain member's forged severing
        // rotation is refused whole, so the tag is never even read.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoForge", bed.relays.clone(), None).await.unwrap();
        let rid = "b4".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let minted = mint_public_link(&bed.relay, &joined, "https://x", None, None).await.unwrap();

        // A stranger with no BAN mints a severing rotation.
        let stranger = Keys::generate();
        publish_severing_base_rotation(&bed.relay, &joined, &stranger, &[me.keys.public_key(), owner.keys.public_key()], &[0xD8; 32], &joined.community_root).await;

        let followed = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(followed.updated.is_none(), "an unauthorized rotation is not adopted");
        assert!(fetch_public_bundle(&bed.relay, &minted.url).await.is_ok(), "and my link is untouched");
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_degraded_plane_read_is_not_evidence_of_absence() {
        // One honest relay is enough to RUN Concord — a sealed, signed rotation is
        // proof on its own. What one relay's silence is NOT enough for is concluding
        // a rotation does not exist. Those two cases used to be the same empty list,
        // so a client that could not reach anyone decided the community had simply
        // stopped rotating, and parked. Coverage is what separates them, and it is
        // measured against the REACHABLE set, so a single-relay community still gets
        // definitive answers.
        use crate::community::transport::adversarial::{AdversarialRelay, Fault, Match};
        let relay = AdversarialRelay::new();
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(relay.relay(), "Coverage", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(relay.relay(), &bundle_json, None).await.unwrap();
        let _ = follow_control(relay.relay(), &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        bed.swap_to(&owner);
        publish_base_rotation(relay.relay(), &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &[0xE9; 32], &joined.community_root).await;
        bed.swap_to(&me);

        // The plane cannot be reached at all: an Err, not an empty answer.
        let plane = base_rekey_group_key(&joined.community_root, joined.id(), Epoch(1));
        relay.on(Match::author(&plane.pk_hex()), Fault::FailFetch("relay down".into()));
        let _ = follow_rekeys(&relay, &joined, &crate::db::current_session()).await;
        let during = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(
            during.root_epoch, joined.root_epoch,
            "an unreachable plane must not advance anything — but it must also not be \
             mistaken for a community that stopped rotating",
        );

        // The relay comes back. The rotation was there the whole time.
        relay.heal();
        let _ = follow_rekeys(&relay, &during, &crate::db::current_session()).await;
        let after = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(
            after.root_epoch, Epoch(1),
            "once a relay answers, the rotation it was holding is adopted — the earlier \
             silence was never evidence",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn an_older_banlist_edition_can_never_un_ban() {
        // Un-banning is the fail-open direction: the un-banned party's rotations and
        // messages start being honored again. So a stale edition arriving late — a
        // slow relay, a replay, a re-fold under a narrowed window — must never
        // overwrite a newer list. Enforced at the storage layer so no future folding
        // change can reintroduce it.
        let (bed, owner, _me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "BanMonotonic", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let villain_keys = Keys::generate();
        let villain = villain_keys.public_key().to_hex();

        crate::db::community::set_community_banlist(&cid_hex, &[villain.clone()], 5).unwrap();
        assert!(crate::db::community::get_community_banlist(&cid_hex).unwrap().contains(&villain));

        // An OLDER edition (version 3) tries to replace it with an empty list.
        crate::db::community::set_community_banlist(&cid_hex, &[], 3).unwrap();
        assert!(
            crate::db::community::get_community_banlist(&cid_hex).unwrap().contains(&villain),
            "a lower-versioned edition must not un-ban",
        );
        assert!(
            crate::db::community::is_author_banned(&cid_hex, &villain_keys.public_key()),
            "and the hot cache must not hold the list we declined to persist",
        );

        // A NEWER edition legitimately un-bans.
        crate::db::community::set_community_banlist(&cid_hex, &[], 6).unwrap();
        assert!(
            !crate::db::community::is_author_banned(&cid_hex, &villain_keys.public_key()),
            "a newer edition still lifts a ban — monotonic, not frozen",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_withholding_relay_cannot_wipe_the_banlist_or_the_roster() {
        // Absence is not evidence. A relay that serves NO control editions folds an
        // empty aggregate, and an empty fold raises no gap flag — nothing is missing
        // from a window that contains nothing. Persisting that would un-ban every
        // banned member and strip every admin, locally, on one bad fetch. Un-banning
        // is the fail-OPEN direction: the un-banned party's rotations start being
        // honored again, which is how one client ends up on a branch minted by
        // someone everyone else has evicted.
        use crate::community::transport::adversarial::{AdversarialRelay, Fault, Match};
        let relay = AdversarialRelay::new();
        let (bed, owner, _me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(relay.relay(), "WitholdWipe", bed.relays.clone(), None).await.unwrap();
        let rid = "c4".repeat(32);
        let admin = Keys::generate();
        publish_role(relay.relay(), &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(relay.relay(), &community, &owner.keys, &admin.public_key(), vec![rid], 1).await;
        let villain = Keys::generate();
        set_banlist(relay.relay(), &community, &[villain.public_key().to_hex()]).await.unwrap();
        let _ = follow_control(&relay, &community).await;

        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        assert!(
            crate::db::community::get_community_banlist(&cid_hex).unwrap().contains(&villain.public_key().to_hex()),
            "the ban folded",
        );
        let roster_before = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(!roster_before.grants.is_empty(), "the admin's grant folded");

        // Now the control plane serves nothing at all.
        let control_pk = control::ControlPlane::of(&community).pk_hex();
        relay.on(Match::author(&control_pk), Fault::Empty);
        let _ = follow_control(&relay, &community).await;

        assert!(
            crate::db::community::get_community_banlist(&cid_hex).unwrap().contains(&villain.public_key().to_hex()),
            "an empty control window must NEVER un-ban — that is the fail-open direction",
        );
        let roster_after = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert_eq!(
            roster_after.grants.len(), roster_before.grants.len(),
            "and must never strip standing: an empty fold is absence, not a demotion",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_banned_rotators_refounding_is_never_honored() {
        // Holding a key is never authority (CORD-06 §Authority). A member banned
        // moments ago still holds the current root, so they can mint a perfectly
        // shaped Refounding — right prev_commit, right epoch, real blobs. If a
        // client honors it, the banned party has just re-keyed the community around
        // itself and split every member who folded the ban from every member who
        // did not. The banlist has to be consulted at ADOPT time, not only at send.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "BannedRotator", bed.relays.clone(), None).await.unwrap();
        let rid = "a9".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        let rogue = Keys::generate();
        publish_grant(&bed.relay, &community, &owner.keys, &rogue.public_key(), vec![rid], 1).await;
        let _ = follow_control(&bed.relay, &community).await;

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // The rogue admin is banned, and we fold that ban.
        bed.swap_to(&owner);
        set_banlist(&bed.relay, &community, &[rogue.public_key().to_hex()]).await.unwrap();
        bed.swap_to(&me);
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        assert!(
            crate::db::community::get_community_banlist(&cid_hex).unwrap().contains(&rogue.public_key().to_hex()),
            "the ban folded before the rotation arrives",
        );

        // Still holding the root, the banned admin mints a Refounding anyway.
        bed.swap_to(&owner);
        publish_base_rotation(
            &bed.relay, &joined, &rogue,
            &[owner.keys.public_key(), me.keys.public_key(), rogue.public_key()],
            &[0xBA; 32], &joined.community_root,
        ).await;

        bed.swap_to(&me);
        let held_before = joined.root_epoch;
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(!follow.self_removed, "a banned rotator can never remove anyone");
        let after = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(
            after.root_epoch, held_before,
            "a banned member's rotation must not move the epoch — honoring it hands the community to the party just evicted",
        );
        assert_eq!(after.community_root, joined.community_root, "and must not move the root");
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_rekey_exclusion_keeps_my_epoch_keys() {
        // Being removed must not cost me the ability to scrub my own history. The
        // epoch keys open no FUTURE epoch — post-removal keys are never delivered —
        // so retaining them leaks nothing; they are only what lets me author a 3305
        // self-delete of messages I already sent, each sealed under the epoch it was
        // sent at. Every other self-removal path retains them. The rekey-exclusion
        // path silently did not, so an eviction (or a false positive) destroyed that.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "ExclusionKeys", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        assert!(
            !crate::db::community::held_epoch_keys(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX).unwrap().is_empty(),
            "the joiner archived its epoch key",
        );

        // The owner rotates and leaves me out — a genuine, authorized removal.
        bed.swap_to(&owner);
        publish_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key()], &[0xD1; 32], &joined.community_root).await;

        bed.swap_to(&me);
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(follow.self_removed, "an authorized rotation that excluded me IS a removal");

        // The teardown the caller performs on self_removed.
        crate::db::community::delete_community_retain_keys(&cid_hex).unwrap();
        assert!(
            crate::db::community::load_community_v2(joined.id()).unwrap().is_none(),
            "the community is gone",
        );
        assert!(
            !crate::db::community::held_epoch_keys(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX).unwrap().is_empty(),
            "but my epoch keys survive, so I can still self-delete what I wrote",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_client_that_adopted_the_losing_fork_converges_down_onto_the_canonical_one() {
        // Two authorized rotators mint the same epoch concurrently. The tiebreak is
        // deterministic — lowest new base key wins — but it only ever ran across
        // rotations seen in ONE fetch. A client that saw only the higher sibling
        // adopted it and then looked exclusively for its successor, so the canonical
        // branch became permanently unreachable: two halves of a community at the
        // same epoch number, different keys, unable to read each other, with nobody
        // misbehaving. Convergence has to be re-checked, not decided once.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "ForkHeal", bed.relays.clone(), None).await.unwrap();
        let rid = "f1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // TWO rotators, which is what a real fork requires: rotations correlate on
        // (rotator, scope, epoch, prevcommit), so one rotator minting twice would
        // merge into a single rotation rather than fork — and `mint_or_reuse` stops
        // an honest rotator doing that anyway. A second BAN-holder is the genuine
        // concurrent-refound case. Low wins the spec's tiebreak.
        let rival = Keys::generate();
        bed.swap_to(&owner);
        publish_grant(&bed.relay, &community, &owner.keys, &rival.public_key(), vec!["f1".repeat(32)], 1).await;
        // The owner's client must fold the grant before minting the rival's rotation:
        // a non-owner rotation carries a `vac` citing the Grant it acts under, and an
        // uncited one is inadmissible by design.
        let _ = follow_control(&bed.relay, &community).await;
        bed.swap_to(&me);
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        let low = [0x11u8; 32];
        let high = [0xF1u8; 32];
        let recipients = [owner.keys.public_key(), me.keys.public_key(), rival.public_key()];
        bed.swap_to(&owner);
        publish_base_rotation(&bed.relay, &joined, &owner.keys, &recipients, &high, &joined.community_root).await;

        // We see ONLY the high sibling first and adopt it — the fork is now set.
        bed.swap_to(&me);
        let session = crate::db::current_session();
        let _ = follow_rekeys(&bed.relay, &joined, &session).await.unwrap();
        let forked = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(forked.root_epoch, Epoch(1), "adopted the sibling we could see");
        assert_eq!(forked.community_root, high, "and it is the LOSING branch");

        // The rival BAN-holder's sibling surfaces afterwards — a separate rotation,
        // and the one the deterministic tiebreak says everyone must land on.
        bed.swap_to(&owner);
        publish_base_rotation(&bed.relay, &joined, &rival, &recipients, &low, &joined.community_root).await;

        bed.swap_to(&me);
        let _ = follow_rekeys(&bed.relay, &forked, &session).await.unwrap();
        let healed = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(
            healed.community_root, low,
            "a settled epoch MUST converge down onto the canonical sibling, or the community stays split",
        );
        assert_eq!(healed.root_epoch, Epoch(1), "same epoch — this is a sideways step, not an advance");

        // Down-only: re-running must not bounce back up to the higher sibling, or two
        // clients seeing the pair in different orders would oscillate forever.
        let _ = follow_rekeys(&bed.relay, &healed, &session).await.unwrap();
        let settled = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(settled.community_root, low, "convergence is down-only and stable");
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_deep_catch_up_never_loses_ground_and_lands_on_the_head() {
        // The scenario this program exists for: a member returns after a community
        // rotated hard while they were away, on a link that keeps dropping.
        //
        // This asserts MONOTONICITY and CONVERGENCE — the epoch never moves
        // backward across passes, and the client ends exactly on the head, not one
        // short and not overshooting. Retention of a partial walk is a different
        // property with its own test (see the interrupted-mid-walk case, which fails
        // without per-hop banking); this one would still pass without banking, and
        // is not claiming otherwise.
        use crate::community::transport::adversarial::{AdversarialRelay, Fault, Match};
        const HOPS: u64 = 12;

        let relay = AdversarialRelay::new();
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(relay.relay(), "DeepStorm", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(relay.relay(), &bundle_json, None).await.unwrap();
        let _ = follow_control(relay.relay(), &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // The community rotates HOPS times while we are offline. Owner-signed, so
        // authority is never the variable under test here — reachability is.
        bed.swap_to(&owner);
        let recipients = [owner.keys.public_key(), me.keys.public_key()];
        let mut cur = community.clone();
        let mut planes: Vec<String> = Vec::new();
        for i in 1..=HOPS {
            let root = [(0x40 + i) as u8; 32];
            planes.push(base_rekey_group_key(&cur.community_root, cur.id(), Epoch(i)).pk_hex());
            publish_base_rotation(relay.relay(), &cur, &owner.keys, &recipients, &root, &cur.community_root).await;
            cur.community_root = root;
            cur.root_epoch = Epoch(i);
        }

        // Come back into a storm. The failures are placed MID-WALK on purpose: each
        // pass gets several hops in before dying, so a walk that does not bank as it
        // goes loses a batch of work every time and can never get past the first
        // barrier. Failing only the first ask of each barrier means the link is
        // genuinely recovering, so the only question is whether progress survives.
        bed.swap_to(&me);
        for barrier in [5usize, 9] {
            relay.on(Match::author(&planes[barrier - 1]).nth(1), Fault::FailFetch("flaky link".into()));
        }

        let session = crate::db::current_session();
        let mut last = 0u64;
        // Bounded retries — the point is that each pass strictly advances, so a
        // finite number of them suffices however unlucky the link is.
        for pass in 0..(HOPS * 3) {
            let held = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
            let now = held.root_epoch.0;
            assert!(
                now >= last,
                "pass {pass}: epoch went BACKWARD ({last} -> {now}); a catch-up must never lose ground",
            );
            last = now;
            if now == HOPS {
                break;
            }
            let _ = follow_rekeys(&relay, &held, &session).await;
        }

        let healed = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(
            healed.root_epoch, Epoch(HOPS),
            "a deep backlog on a failing link must still converge on the head; stuck at {}",
            healed.root_epoch.0,
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_missing_chunk_does_not_block_adopting_the_key_i_already_hold() {
        // Completeness gates ADOPTION today, not just removal. A 1,000-member
        // rotation spans thirteen chunks, so one unreachable chunk parks every
        // member of the community — including everyone whose key is sitting in a
        // chunk they already fetched and can open right now. Requiring the whole set
        // to adopt makes a large community's rotation as fragile as its worst chunk,
        // and the walk is sequential, so the strand blocks every epoch above it too.
        //
        // Completeness is required to conclude REMOVAL, which is destructive and
        // must stay conservative. Adoption is the safe direction: the blob is bound
        // to (scope, epoch) inside its ciphertext, so a key that opens is the key
        // for this rotation whatever else is missing.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "PartialChunks", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // A two-chunk rotation where only the chunk carrying MY blob is published.
        bed.swap_to(&owner);
        let new_root = [0xC7u8; 32];
        let new_epoch = Epoch(joined.root_epoch.0 + 1);
        let prev_commit = super::super::derive::epoch_key_commitment(joined.root_epoch, &joined.community_root);
        let group = base_rekey_group_key(&joined.community_root, joined.id(), new_epoch);
        let my_blob = rekey::build_blob_local(
            owner.keys.secret_key(), &owner.keys.public_key().to_bytes(),
            &me.keys.public_key(), RekeyScope::Root, new_epoch, &new_root,
        ).unwrap();
        // Declares 2 chunks; only chunk 1 ever reaches the relay.
        let rumor = rekey::build_rekey_rumor(
            owner.keys.public_key(), RekeyScope::Root, new_epoch, joined.root_epoch,
            &prev_commit, &[my_blob], 1, 2, 2_000,
            my_authority_citation(&joined, &owner.keys.public_key()).as_ref(), false,
        ).unwrap();
        let (wrap, _) = rekey::seal_rekey_chunk(&rumor, &group, &owner.keys, Timestamp::from_secs(2_000)).unwrap();
        bed.relay.publish(&wrap, &bed.relays).await.unwrap();

        bed.swap_to(&me);
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(!follow.self_removed, "a missing chunk is never a removal");
        let after = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(
            after.root_epoch, new_epoch,
            "my blob was present and opened — the missing sibling chunk says nothing about MY key, \
             and parking here strands the whole community behind its least reachable chunk",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn an_empty_rotation_is_never_a_mass_removal() {
        // `is_complete` is satisfied by a single chunk declaring n=1 — including one
        // carrying ZERO blobs, which the builders emit verbatim for an empty
        // recipient set. Read literally that is "a complete, authorized rotation
        // containing no blob for me", i.e. removal — and the removal path DELETES the
        // community locally, keys and all. From the owner, one such rotation would
        // evict every member of the community at once, irreversibly.
        //
        // Nobody can be removed by a rotation that removed everybody.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "EmptyRotation", bed.relays.clone(), None).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // The owner publishes a complete rotation with no recipients at all.
        bed.swap_to(&owner);
        publish_base_rotation(&bed.relay, &joined, &owner.keys, &[], &[0xB0; 32], &joined.community_root).await;

        bed.swap_to(&me);
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(
            !follow.self_removed,
            "an all-empty rotation must NEVER read as my removal — that path deletes the community",
        );
        assert!(
            crate::db::community::load_community_v2(joined.id()).unwrap().is_some(),
            "and the community must still be held",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_catch_up_interrupted_mid_walk_keeps_the_hops_it_already_took() {
        // A client back from a week offline walks many epochs in one pass. Today the
        // community row is written ONCE, after the loop, so a fetch failure on the
        // last hop discards every hop already walked — the next attempt starts from
        // zero, costs the same again, and on a flaky link may never converge at all.
        // Progress must be banked per hop.
        use crate::community::transport::adversarial::{AdversarialRelay, Fault, Match};
        // The bed supplies isolated per-account DBs; the adversarial relay replaces
        // its transport so a fault plan governs what the client can read back.
        let relay = AdversarialRelay::new();
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(relay.relay(), "DeepCatchUp", bed.relays.clone(), None).await.unwrap();

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(relay.relay(), &bundle_json, None).await.unwrap();
        let _ = follow_control(relay.relay(), &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // Owner rotates three times while we are away. Owner rotations need no roster.
        bed.swap_to(&owner);
        let mut cur = community.clone();
        let roots = [[0xA1u8; 32], [0xA2; 32], [0xA3; 32]];
        let recipients = [owner.keys.public_key(), me.keys.public_key()];
        for (i, root) in roots.iter().enumerate() {
            publish_base_rotation(relay.relay(), &cur, &owner.keys, &recipients, root, &cur.community_root).await;
            cur.community_root = *root;
            cur.root_epoch = Epoch(i as u64 + 1);
        }

        // Come back, but the plane for the LAST hop is unreachable.
        bed.swap_to(&me);
        let third_hop = base_rekey_group_key(&roots[1], joined.id(), Epoch(3));
        relay.on(Match::author(&third_hop.pk_hex()), Fault::FailFetch("relay dropped".into()));

        let _ = follow_rekeys(&relay, &joined, &crate::db::current_session()).await;

        let after = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert!(
            after.root_epoch.0 >= 2,
            "hops 1 and 2 succeeded and MUST be banked; an interrupted walk that reverts to epoch {} \
             restarts from scratch every attempt and may never converge on a flaky link",
            after.root_epoch.0,
        );

        // Faults cease: the walk resumes from where it banked and reaches the head.
        relay.heal();
        let _ = follow_rekeys(&relay, &after, &crate::db::current_session()).await;
        let healed = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert_eq!(healed.root_epoch, Epoch(3), "once faults cease the walk converges on the head");
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_promote_is_reported_as_an_authority_change() {
        // The single line whose absence was the fork. A promote moves the ROSTER,
        // which lives in its own column and never appears in the returned document —
        // so a caller keying its retry off `updated` alone sees "nothing happened",
        // skips the re-walk, and leaves the rekey pass that just refused this admin's
        // rotation to never reconsider it. Asserted at the unit level deliberately:
        // an integration drill can pass for the wrong reason (a roster cached on some
        // earlier pass), and this codebase has been bitten by exactly that before.
        let (bed, owner, admin) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "PromoteReports", bed.relays.clone(), None).await.unwrap();
        follow_control(&bed.relay, &community).await.unwrap(); // settle the baseline

        let rid = "e1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.keys.public_key(), vec![rid], 1).await;

        let control = follow_control(&bed.relay, &community).await.unwrap();
        assert!(
            control.authority_changed,
            "a promote MUST report an authority change — this is what re-runs the rekey walk",
        );
        assert!(control.moved(), "and therefore counts as movement");
        assert!(
            control.updated.is_none(),
            "while moving no document at all — which is precisely why `updated` alone was blind",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_seeded_roster_never_vetoes_a_coherent_control_fold() {
        // `merge_local_roster` seeds an optimistic roster at `roles_at = 0` so a
        // just-created role works before its edition folds. That seed names entities
        // the plane may never head, which made `stored_complete` false FOREVER — the
        // roster could never be replaced, and a roster that never updates cannot
        // authorize anyone, so the client silently refused every rotation that admin
        // published. It landed on owners, who seed the most.
        let (bed, owner, admin) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "SeedVeto", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let rid = "c1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.keys.public_key(), vec![rid], 1).await;

        // A seed naming an entity the plane will never head, with NO provenance —
        // exactly what creating a private channel leaves behind.
        let ghost = "d4".repeat(32);
        let mut seeded = crate::community::roles::CommunityRoles::default();
        seeded.roles.push(admin_role(&ghost, Permissions::MANAGE_CHANNELS));
        seeded.grants.push(crate::community::roles::MemberGrant {
            member: owner.keys.public_key().to_hex(),
            role_ids: vec![ghost.clone()],
        });
        crate::db::community::set_community_roles(&cid_hex, &seeded, 0).unwrap();
        // A floor for the ghost is what turns `stored_complete` false.
        crate::db::community::set_edition_head_at_epoch(&cid_hex, &ghost, 1, &[0u8; 32], &[0u8; 32], community.root_epoch.0).unwrap();

        follow_control(&bed.relay, &community).await.unwrap().updated;

        let folded = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(
            folded.grants.iter().any(|g| g.member == admin.keys.public_key().to_hex()),
            "a coherent fold must replace a provenance-less seed, or the client is deaf to this admin forever",
        );
        assert_ne!(
            crate::db::community::get_community_roles_at(&cid_hex).unwrap(),
            0,
            "and the replacement carries the plane's provenance",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_pending_severance_heals_on_a_quiet_follow_pass() {
        // The retry must run on passes that adopt NOTHING. A one-shot transport
        // blip during the original severance otherwise has no healing trigger
        // until some future rotation happens to be adopted — and until then the
        // community reads Public, which silently strips the refound from every
        // ordinary ban.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "QuietHeal", bed.relays.clone(), None).await.unwrap();
        let rid = "b5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let minted = mint_public_link(&bed.relay, &joined, "https://x", None, None).await.unwrap();

        // A containment was adopted but its revoke was interrupted: the mark is
        // down, the epoch-0 link still stands.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        add_sever_mark(&cid_hex, 1, 5_000);
        assert!(fetch_public_bundle(&bed.relay, &minted.url).await.is_ok());

        // A QUIET follow — no rotation anywhere — must finish the burial.
        let followed = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(followed.updated.is_none(), "nothing to adopt");
        assert!(
            fetch_public_bundle(&bed.relay, &minted.url).await.unwrap_err().contains("revoked"),
            "the interrupted severance healed with no rotation to carry it",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_sever_survives_a_later_ordinary_rotation_in_the_same_walk() {
        // Sticky severance: a client catching up walks EVERY missed rotation in
        // one pass. If the containment hop is followed by an ordinary one,
        // last-hop-wins semantics would refresh the links right back open — the
        // door the raid came through, re-armed with the newest root.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "StickySever", bed.relays.clone(), None).await.unwrap();
        let rid = "b6".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let minted = mint_public_link(&bed.relay, &joined, "https://x", None, None).await.unwrap();

        // Hop 1: the containment. Hop 2: an ordinary rotation on top of it.
        let root1 = [0xE1; 32];
        publish_severing_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &root1, &joined.community_root).await;
        let mut stepped = joined.clone();
        stepped.community_root = root1;
        stepped.root_epoch = Epoch(1);
        let root2 = [0xE2; 32];
        publish_base_rotation(&bed.relay, &stepped, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &root2, &root1).await;

        let updated = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap().updated.expect("both hops adopt");
        assert_eq!(updated.root_epoch, Epoch(2), "the walk reached the ordinary head");
        assert!(
            fetch_public_bundle(&bed.relay, &minted.url).await.unwrap_err().contains("revoked"),
            "the containment's burial survived the ordinary hop behind it",
        );
    }

    /// Did the severing refound vend `who` a key? Opens the base rotation and looks
    /// for a blob at their locator.
    async fn vended_to(bed: &TestBed, before: &CommunityV2, who: &Keys) -> bool {
        let next = Epoch(before.root_epoch.0 + 1);
        let group = base_rekey_group_key(&before.community_root, before.id(), next);
        let chunks = fetch_rekey_chunks(&bed.relay, &before.relays, &group).await.unwrap();
        rekey::collect_rotations(&chunks).iter().any(|r| {
            rekey::find_my_blobs(
                &r.blobs,
                &r.rotator.to_bytes(),
                &who.public_key().to_bytes(),
                RekeyScope::Root,
                next,
            )
            .next()
            .is_some()
        })
    }

    /// Local guestbook row for `who`, claiming `at_ms` but OBSERVED at `seen`.
    fn local_join_observed(who: &Keys, at_ms: u64, seen: u64, epoch: u64, tag: u8) -> guestbook::GuestbookEvent {
        guestbook::GuestbookEvent {
            rumor_id: [tag; 32],
            entry: guestbook::GuestbookEntry::Join { member: who.public_key(), invited_by: None, at_ms },
            epoch: Some(epoch),
            observed_at: Some(seen),
        }
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_backdated_join_cannot_slide_under_the_window_when_we_watched_it_arrive() {
        // `at_ms` is author-claimed, so a raider can put it a year in the past and pass
        // any window computed from the claim alone. What this client WATCHED arrive is
        // not theirs to write.
        let (bed, owner, _o) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Backdate", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let liar = Keys::generate();

        // Claims it joined long before the window; we saw it arrive INSIDE the window.
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let join = guestbook::build_join_rumor(liar.public_key(), None, 1_000);
        let (wrap, _) = guestbook::seal_guestbook_rumor(&join, &gb, &liar, Timestamp::from_secs(1)).unwrap();
        bed.relay.publish(&wrap, &bed.relays).await.unwrap();
        crate::db::community::set_guestbook(&cid_hex, &[local_join_observed(&liar, 1_000, 9_000, community.root_epoch.0, 3)], 0).unwrap();
        // We were following well before the window opened.
        crate::db::settings::set_sql_setting(format!("gb_observed_since:{cid_hex}"), "100".into()).unwrap();

        refound_community_severing(&bed.relay, &community, &[], 5_000).await.unwrap();

        assert!(
            !vended_to(&bed, &community, &liar).await,
            "a backdated Join must not beat the arrival we watched with our own clock",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_client_that_started_watching_late_evicts_nobody() {
        // Same row, same claim, same observation — but this client only began following
        // the guestbook AFTER the window opened, so everything looks new to it. Its
        // observations prove nothing, and acting on them would evict the community.
        let (bed, owner, _o) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "LateWatcher", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let quiet = Keys::generate();

        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let join = guestbook::build_join_rumor(quiet.public_key(), None, 1_000);
        let (wrap, _) = guestbook::seal_guestbook_rumor(&join, &gb, &quiet, Timestamp::from_secs(1)).unwrap();
        bed.relay.publish(&wrap, &bed.relays).await.unwrap();
        crate::db::community::set_guestbook(&cid_hex, &[local_join_observed(&quiet, 1_000, 9_000, community.root_epoch.0, 4)], 0).unwrap();
        // Coverage begins INSIDE the window — we were not here before it.
        crate::db::settings::set_sql_setting(format!("gb_observed_since:{cid_hex}"), "7000".into()).unwrap();

        refound_community_severing(&bed.relay, &community, &[], 5_000).await.unwrap();

        assert!(
            vended_to(&bed, &community, &quiet).await,
            "without coverage predating the window our observations prove nothing — an \
             old member must not be evicted for having been noticed late",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_purge_vends_only_to_the_retain_list_however_late_a_stranger_arrives() {
        // The Admin Terminal hands over a RETAIN list. Internally that used to become a
        // removal list computed from the memberlist at one instant, while the refound
        // fetched its own later — so an account appearing in between was on neither
        // list and got a key by DEFAULT, implicitly retained by the purge meant to be
        // exhaustive. An allow-list closes it with no window and nothing to backdate.
        let (bed, owner, _o) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Purge", bed.relays.clone(), None).await.unwrap();
        let kept = Keys::generate();
        let stranger = Keys::generate();
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        // The stranger even BACKDATES their Join — an allow-list does not care.
        for (who, at_ms) in [(&kept, 2_000_000u64), (&stranger, 1_000u64)] {
            let join = guestbook::build_join_rumor(who.public_key(), None, at_ms);
            let (wrap, _) = guestbook::seal_guestbook_rumor(&join, &gb, who, Timestamp::from_secs(at_ms / 1000)).unwrap();
            bed.relay.publish(&wrap, &bed.relays).await.unwrap();
        }

        // The operator selected exactly one member. Nobody named the stranger.
        refound_community_retaining(&bed.relay, &community, &[], &[kept.public_key()]).await.unwrap();

        assert!(
            vended_to(&bed, &community, &kept).await,
            "the selected member keeps their key",
        );
        assert!(
            !vended_to(&bed, &community, &stranger).await,
            "an account not on the retain list is vended NO key, no matter when it \
             appeared or what Join time it claims",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_raid_window_joiner_is_vended_no_key_even_if_nobody_named_them() {
        // The recipient set is a LIVE fetch taken AFTER the cut was computed, and
        // re-taken on every retry. A bot arriving in that gap is in the memberlist and
        // absent from the cut — and was handed a working key for the very epoch meant
        // to evict it. Testing join TIME catches it with nobody naming it.
        let (bed, owner, _o) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "RaceCut", bed.relays.clone(), None).await.unwrap();
        let established = Keys::generate();
        let late = Keys::generate();
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        for (who, at_ms) in [(&established, 2_000_000u64), (&late, 9_000_000)] {
            let join = guestbook::build_join_rumor(who.public_key(), None, at_ms);
            let (wrap, _) = guestbook::seal_guestbook_rumor(&join, &gb, who, Timestamp::from_secs(at_ms / 1000)).unwrap();
            bed.relay.publish(&wrap, &bed.relays).await.unwrap();
        }

        // Window opens at 5_000s. `late` is named by NOBODY — the cut is empty.
        refound_community_severing(&bed.relay, &community, &[], 5_000).await.unwrap();

        assert!(
            !vended_to(&bed, &community, &late).await,
            "a raid-window joiner must be vended NO key, even when nobody named them",
        );
        assert!(
            vended_to(&bed, &community, &established).await,
            "and the member who was already here keeps theirs",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn a_member_whose_join_is_not_on_the_plane_is_never_read_as_a_late_joiner() {
        // THE regression that matters. A quiet member's Join lives on a buried epoch,
        // so the reachable guestbook has no trace of them at all. Absence must read as
        // OLD, never as new — reading it the other way shed 39 real members across five
        // rotations. Here the Join exists ONLY locally, exactly as a buried one does.
        let (bed, owner, _o) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Buried", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let quiet = Keys::generate();
        let local_join = guestbook::GuestbookEvent {
            rumor_id: [7u8; 32],
            entry: guestbook::GuestbookEntry::Join { member: quiet.public_key(), invited_by: None, at_ms: 9_900_000 },
            epoch: Some(community.root_epoch.0),
            observed_at: None,
        };
        crate::db::community::set_guestbook(&cid_hex, &[local_join], 0).unwrap();

        // Even stamped INSIDE the window, a Join the plane does not serve must not evict.
        refound_community_severing(&bed.relay, &community, &[], 5_000).await.unwrap();

        assert!(
            vended_to(&bed, &community, &quiet).await,
            "no Join on the reachable plane means OLD — absence of evidence must never evict",
        );
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn contain_raid_bans_cuts_and_severs_end_to_end() {
        let (bed, owner, _other) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Containment", bed.relays.clone(), None).await.unwrap();
        let minted = mint_public_link(&bed.relay, &community, "https://x", None, None).await.unwrap();

        // Three arrivals: an established member (before the window), a convicted
        // raider and a quiet lurker (both inside it).
        let established = Keys::generate();
        let raider = Keys::generate();
        let lurker = Keys::generate();
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        for (who, at_ms) in [(&established, 2_000_000u64), (&raider, 9_000_000), (&lurker, 9_500_000)] {
            let join = guestbook::build_join_rumor(who.public_key(), None, at_ms);
            let (wrap, _) = guestbook::seal_guestbook_rumor(&join, &gb, who, Timestamp::from_secs(at_ms / 1000)).unwrap();
            bed.relay.publish(&wrap, &bed.relays).await.unwrap();
        }

        let report = contain_raid(&bed.relay, community.id(), &[raider.public_key()], 5_000, &[]).await.unwrap();
        assert_eq!(report.banned, 1, "the convicted raider is banned");
        assert_eq!(report.window_cut, 1, "the lurker who joined inside the window is cut");
        assert!(report.refound_ok, "the severing refound landed: {:?}", report.warnings);
        assert_eq!((report.epoch_before, report.epoch_after), (0, 1), "the root rolled");
        assert_eq!(report.own_links_revoked, 1, "the door closed with it");

        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let banlist = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        assert!(banlist.contains(&raider.public_key().to_hex()), "raider on the banlist");
        assert!(!banlist.contains(&lurker.public_key().to_hex()), "the lurker is cut, never banned — they can rejoin through a fresh link");
        assert!(!banlist.contains(&established.public_key().to_hex()));
        assert!(
            fetch_public_bundle(&bed.relay, &minted.url).await.unwrap_err().contains("revoked"),
            "the invite URL the raid used is a grave",
        );

        // The rotation's recipient set is the severance line: the established
        // member rides into the new epoch, the raider and the lurker do not.
        let updated = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(updated.root_epoch, Epoch(1));
        let members = memberlist(&bed.relay, &updated).await.unwrap();
        assert!(members.contains(&established.public_key()), "established member survives");
        assert!(!members.contains(&raider.public_key()), "raider gone");
    }

    #[tokio::test(flavor = "multi_thread")]
    async fn adopting_someone_elses_rotation_refreshes_my_own_live_links() {
        // CORD-05 §2: a link shared once keeps working across rotations, because
        // its bundle is re-posted behind the same URL. The Refounder can only
        // refresh the bundles they hold signer secrets for — their OWN — so
        // every other creator has to heal their links when they ADOPT the
        // rotation. Without that, an admin's links keep vending the superseded
        // root and drop new joiners onto a dead epoch, which is precisely the
        // stranding the stable-URL refresh exists to prevent.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "LinkHeal", bed.relays.clone(), None).await.unwrap();
        let rid = "b1".repeat(32);
        // CREATE_INVITE too: minting is offer-gated by the same bit readers use.
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::CREATE_INVITE), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // I mint a link of my own at the CURRENT epoch.
        let minted = mint_public_link(&bed.relay, &joined, "https://x", None, None).await.unwrap();
        let vended_before = fetch_public_bundle(&bed.relay, &minted.url).await.unwrap();
        assert_eq!(vended_before.root_epoch, 0, "my link vends the epoch I minted it at");

        // The OWNER re-founds. Their refresh can't touch my bundle: only I hold
        // its signer secret.
        let new_root = [0xD4; 32];
        publish_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &new_root, &joined.community_root).await;

        let updated = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap().updated
            .expect("the owner's Refounding is adopted");
        assert_eq!(updated.root_epoch, Epoch(1), "I advanced to the new epoch");

        let vended_after = fetch_public_bundle(&bed.relay, &minted.url).await.unwrap();
        assert_eq!(vended_after.root_epoch, 1, "my link must now vend the NEW epoch, not strand its joiners");
        assert_eq!(
            crate::simd::hex::hex_to_bytes_32(&vended_after.community_root),
            new_root,
            "and the new root behind the same URL",
        );
    }

    #[tokio::test]
    async fn follow_rekeys_refuses_a_refounding_that_excludes_the_owner() {
        // Authority escalation: a BAN-admin can't use a Refounding to evict the
        // OWNER (no one outranks the owner). Excluding them makes the rotation
        // inadmissible — members fork-reject it rather than migrate to the coup.
        let (bed, owner, me) = TestBed::new();
        let admin = Keys::generate();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoCoup", bed.relays.clone(), None).await.unwrap();
        let rid = "b0".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.public_key(), vec![rid], 1).await;

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // The admin re-founds delivering to me but NOT the owner — a takeover.
        publish_base_rotation(&bed.relay, &joined, &admin, &[me.keys.public_key()], &[0xEE; 32], &joined.community_root).await;
        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(follow.updated.is_none() && !follow.self_removed, "an owner-excluding Refounding is not adopted");
    }

    #[tokio::test]
    async fn follow_rekeys_refuses_a_refounding_that_excludes_a_peer_admin() {
        // Authority escalation: two equal-rank BAN-admins — neither strictly
        // outranks the other, so one can't Refound the other out. Excluding a
        // peer makes the rotation inadmissible.
        let (bed, owner, me) = TestBed::new();
        let admin_a = Keys::generate();
        let admin_b = Keys::generate(); // the peer admin the rotation excludes.
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Peers", bed.relays.clone(), None).await.unwrap();
        let rid = "b0".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        // Both A and B hold the SAME role (same position 1) → peers.
        publish_grant(&bed.relay, &community, &owner.keys, &admin_a.public_key(), vec![rid.clone()], 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin_b.public_key(), vec![rid], 1).await;

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // Admin A re-founds keeping the owner + me but EXCLUDING peer admin B.
        publish_base_rotation(&bed.relay, &joined, &admin_a, &[owner.keys.public_key(), me.keys.public_key()], &[0xDD; 32], &joined.community_root).await;

        let follow = follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert!(follow.updated.is_none() && !follow.self_removed, "excluding an equal-rank peer admin is inadmissible");
    }

    #[tokio::test]
    async fn a_retried_refounding_reuses_the_same_root() {
        // B1 idempotency: minting for the same (scope, epoch) twice yields the SAME
        // root, so a retried Refounding re-delivers one root — never a double-mint fork.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Retry", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let first = mint_or_reuse_rotation_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, 1).unwrap();
        let second = mint_or_reuse_rotation_key(&cid_hex, crate::community::SERVER_ROOT_SCOPE_HEX, 1).unwrap();
        assert_eq!(first, second, "a retry reuses the archived root, never double-mints");
    }

    #[tokio::test]
    async fn a_mid_rank_admin_cannot_demote_a_role_that_outranks_them() {
        // CORD-04 §2 rank inversion. Minting at a position you outrank is
        // necessary but NOT sufficient: an edition replaces the entity, so a
        // gate that only reads the NEW position lets an admin at position 5
        // rewrite the position-1 role to position 9. Every check passes (9 is
        // beneath them), and the role that outranked them — plus everyone
        // holding it — is now beneath them.
        let (bed, owner, attacker) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Ranks", bed.relays.clone(), None).await.unwrap();

        // A senior role at position 1, and a mid role at position 5 the attacker holds.
        let senior = "a1".repeat(32);
        let mid = "a5".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys,
            &Role { role_id: senior.clone(), name: "Senior".into(), position: 1, permissions: Permissions(Permissions::BAN), scope: RoleScope::Server, color: 0, extra: Default::default() }, 1).await;
        publish_role(&bed.relay, &community, &owner.keys,
            &Role { role_id: mid.clone(), name: "Mid".into(), position: 5, permissions: Permissions(Permissions::MANAGE_ROLES), scope: RoleScope::Server, color: 0, extra: Default::default() }, 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &attacker.keys.public_key(), vec![mid.clone()], 1).await;

        // The attacker republishes the SENIOR role, dropping it beneath themselves.
        publish_role(&bed.relay, &community, &attacker.keys,
            &Role { role_id: senior.clone(), name: "Senior".into(), position: 9, permissions: Permissions(Permissions::BAN), scope: RoleScope::Server, color: 0, extra: Default::default() }, 2).await;

        let authority = fetch_authority(&bed.relay, &community).await;
        let folded_senior = authority.roles.role(&senior).expect("the senior role survives the fold");
        assert_eq!(
            folded_senior.position, 1,
            "a role may only be repositioned by someone who outranks where it STOOD, not just where it lands",
        );
    }

    #[tokio::test]
    async fn a_non_owner_admins_edition_cites_its_grant_and_the_owners_does_not() {
        // CORD-04 §5. Armada's reader REQUIRES this on every non-owner control
        // edition (`citationOk`: "a non-owner action MUST cite its grant"), so
        // an uncited Vector admin's ban/role/channel edit was silently dropped
        // by every Armada client — only the owner's actions crossed. The
        // citation must name the actor's OWN grant coordinate, at the version
        // and edition hash the verifier can match against a grant it holds.
        let (bed, owner, admin) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Cited", bed.relays.clone(), None).await.unwrap();
        let rid = "c1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN | Permissions::MANAGE_METADATA), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin.keys.public_key(), vec![rid], 1).await;

        // The owner's own edition carries NO citation: their rank is the id.
        let owner_meta = control::CommunityMetadata { name: "By Owner".into(), relays: community.relays.clone(), ..Default::default() };
        edit_community_metadata(&bed.relay, &community, &owner_meta).await.unwrap();
        let owner_ed = fetch_control(&bed.relay, &community).await.into_iter()
            .filter(|e| e.author == owner.keys.public_key() && e.vsk == vsk::COMMUNITY_METADATA)
            .max_by_key(|e| e.version).expect("the owner's metadata edition");
        assert!(owner_ed.authority.is_none(), "the owner cites nothing — rank comes from the community id");

        // The admin JOINS and folds — the citation names the grant head their own
        // client has actually synced, so the fold must have persisted it.
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&admin);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        set_banlist(&bed.relay, &joined, &["ee".repeat(32)]).await.unwrap();

        let ban_ed = fetch_control(&bed.relay, &joined).await.into_iter()
            .find(|e| e.author == admin.keys.public_key() && e.vsk == vsk::BANLIST)
            .expect("the admin's banlist edition");
        let cite = ban_ed.authority.as_ref().expect("a non-owner MUST cite its grant");
        assert_eq!(
            cite.entity_id,
            crate::community::v2::derive::grant_locator(community.id(), &admin.keys.public_key().to_bytes()),
            "the citation must name the ACTOR'S OWN grant coordinate",
        );
        assert!(cite.version >= 1, "pinned to a real grant version");
    }

    #[tokio::test]
    async fn a_folded_metadata_edition_cannot_push_the_relay_set_past_the_cap() {
        // `cap_relays` is the truncate-on-read invariant everywhere else, and the
        // fold is a boundary like any other: MANAGE_METADATA makes an editor
        // authorized, not trusted. An oversize list costs every member a fan-out
        // per publish and the slowest of N per fetch — and Armada caps at 5, so
        // an uncapped fold also splits the two clients' operative sets.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Fanout", vec!["wss://a".into()], None).await.unwrap();

        let many: Vec<String> = (0..30).map(|i| format!("wss://r{i}")).collect();
        let meta = control::CommunityMetadata { name: "Fanout".into(), relays: many, ..Default::default() };
        edit_community_metadata(&relay, &community, &meta).await.unwrap();

        let updated = follow_control(&relay, &community).await.unwrap().updated
            .expect("the metadata edition is folded");
        assert_eq!(
            updated.relays.len(),
            crate::community::MAX_COMMUNITY_RELAYS,
            "a folded relay list must be truncated, never adopted whole",
        );

        // …and the fold must SETTLE: comparing an oversize edition against the
        // capped working set would never be equal, so every later fold would
        // report a change and re-save forever.
        let again = follow_control(&relay, &updated).await.unwrap().updated;
        assert!(again.is_none(), "re-folding the same oversize edition must be a no-op");
    }

    #[tokio::test]
    async fn adopting_a_rotation_writes_no_registry_where_i_never_minted() {
        // One Invite List spans every community, so "I hold links" must never be
        // read as "I hold links HERE". A member with links elsewhere adopting a
        // rotation would otherwise publish an empty Registry edition into this
        // community — a control-plane write and a version bump on a coordinate
        // they never owned, every rotation, forever.
        let (bed, owner, me) = TestBed::new();
        bed.swap_to(&owner);
        let host = create_community(&bed.relay, "Host", bed.relays.clone(), None).await.unwrap();
        let rid = "b2".repeat(32);
        publish_role(&bed.relay, &host, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &host, &owner.keys, &me.keys.public_key(), vec![rid], 1).await;

        let bundle = bundle_of(&host, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&me);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();

        // My only link lives in a DIFFERENT community — one I own, since minting
        // is offer-gated on CREATE_INVITE.
        let elsewhere = create_community(&bed.relay, "Elsewhere", bed.relays.clone(), None).await.unwrap();
        mint_public_link(&bed.relay, &elsewhere, "https://other", None, None).await.unwrap();

        let before = bed.relay.stored_count();
        let new_root = [0xE1; 32];
        publish_base_rotation(&bed.relay, &joined, &owner.keys, &[owner.keys.public_key(), me.keys.public_key()], &new_root, &joined.community_root).await;
        let rotation_events = bed.relay.stored_count() - before;

        let after_adopt = bed.relay.stored_count();
        follow_rekeys(&bed.relay, &joined, &crate::db::current_session()).await.unwrap();
        assert_eq!(
            bed.relay.stored_count(),
            after_adopt,
            "adopting a rotation must publish NOTHING when I minted no links here",
        );
        assert!(rotation_events > 0, "the rotation itself did publish (guards the counter)");
    }

    #[tokio::test]
    async fn an_expired_link_stops_keeping_the_community_public() {
        // CORD-05 §1/§5: expiry is the one way a link dies with no user action.
        // A joiner is refused by `InviteBundle::expired`, so leaving the link in
        // the Registry states a door that isn't there — the aggregate never
        // empties and the community reads Public forever, silently inverting
        // every gate that hangs off that reading.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Lapsing", vec!["wss://r".into()], None).await.unwrap();

        // A link that lapsed a minute ago.
        let past = now_ms() - 60_000;
        mint_public_link(&relay, &community, "https://x", Some(past), None).await.unwrap();
        assert!(
            !community_is_public(&relay, &community).await,
            "an already-expired link must never read as a live door",
        );

        // …and one that hasn't, to prove the filter isn't just dropping everything.
        mint_public_link(&relay, &community, "https://y", Some(now_ms() + 600_000), None).await.unwrap();
        assert!(community_is_public(&relay, &community).await, "an unexpired link is still live");
    }

    #[tokio::test]
    async fn minting_a_link_makes_the_community_public_and_revoke_makes_it_private() {
        // CORD-05 §5: the Registry is the Public/Private source of truth. Minting a
        // link publishes it (Public); retiring the last link empties it (Private).
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Invitable", vec!["wss://r".into()], None).await.unwrap();
        assert!(!community_is_public(&relay, &community).await, "a fresh community is Private");

        let minted = mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        assert!(community_is_public(&relay, &community).await, "a live link makes it Public");
        let list = fetch_invite_list(&relay, &community.relays).await.unwrap().expect("the 13303 list was published");
        assert_eq!(list.entries.len(), 1, "the minted link is recorded across devices");

        let token_hex = crate::simd::hex::bytes_to_hex_16(&minted.token);
        revoke_public_link(&relay, &community, &token_hex).await.unwrap();
        assert!(!community_is_public(&relay, &community).await, "retiring the last link makes it Private again");
        let after = fetch_invite_list(&relay, &community.relays).await.unwrap().unwrap();
        assert!(after.entries.is_empty() && after.tombstones.len() == 1, "the link is tombstoned in the invite list");
    }

    #[tokio::test]
    async fn the_registry_is_cached_locally_so_public_private_is_a_sync_read() {
        // Every caller reads the `invite_registry` COLUMN, never the async fold. v2
        // published the Registry to the plane but never mirrored it locally, so every
        // v2 community read Private no matter how many live links it had.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Cached", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let cached = || crate::db::community::get_community_invite_registry(&cid_hex).unwrap();
        // The per-creator split is a SEPARATE table, and it drives the "first link flips
        // the community Public" confirm — an empty one re-asks on every later link.
        let per_creator = || crate::db::community::get_invite_link_sets(&cid_hex).unwrap();
        assert!(cached().is_empty(), "a fresh community caches an empty registry");
        assert!(per_creator().is_empty(), "…and no per-creator sets");

        let minted = mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        assert!(!cached().is_empty(), "minting caches the registry, so the UI reads Public without folding");
        let sets = per_creator();
        assert_eq!(sets.len(), 1, "the minting creator gets a set");
        assert_eq!(sets[0].locators.len(), 1, "carrying exactly their one live link");

        // Both caches must SHRINK too — a union-only mirror would strand it Public.
        let token_hex = crate::simd::hex::bytes_to_hex_16(&minted.token);
        revoke_public_link(&relay, &community, &token_hex).await.unwrap();
        assert!(cached().is_empty(), "retiring the last link empties the cache back to Private");
        assert!(per_creator().is_empty(), "…and clears the per-creator sets");
    }

    #[tokio::test]
    async fn a_rogue_registry_fork_cannot_retire_the_owners_live_link() {
        // Registries are coordinate-bound to their creator, but `fold_head` picks an
        // equal-version winner AUTHOR-BLIND, by lowest inner id — and an author grinds
        // that freely by varying content. Folding before authorising would let any
        // member occupy the owner's registry head, fail the authority check, and drop
        // the whole registry: a live invite link silently retired, flipping the
        // community to Private and steering a moderator into the wrong ban remedy.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Forked", vec!["wss://r".into()], None).await.unwrap();
        mint_public_link(&relay, &community, "https://x", None, None).await.unwrap();
        assert!(community_is_public(&relay, &community).await, "a live link makes it Public");

        let cid = community.id();
        let control = control::ControlPlane::of(&community).write_group().unwrap();
        let eid = crate::community::v2::derive::invite_links_locator(cid, &owner.public_key().to_bytes());

        let query = Query {
            kinds: vec![stream::KIND_WRAP],
            authors: vec![control.pk_hex()],
            limit: Some(FOLLOW_PAGE),
            ..Default::default()
        };
        let wraps = relay.fetch(&query, &community.relays).await.unwrap();
        let target = wraps
            .iter()
            .filter_map(|w| control::open_control_edition(w, &control).ok().map(|(e, _)| e))
            .filter(|e| e.entity_id == eid)
            .max_by_key(|e| e.version)
            .expect("the owner published a registry");

        // Grind a same-version fork under the owner's coordinate that OUTRANKS the
        // real head on the tiebreak (~2 tries against a uniform id).
        let rogue = Keys::generate();
        let mut planted = false;
        for n in 0..4_000u64 {
            let content = format!("[{{\"token\":\"{n:032x}\",\"url\":\"https://evil\",\"expires_at\":0}}]");
            let rumor = control::build_edition_rumor(
                rogue.public_key(),
                vsk::INVITE_LINKS,
                &eid,
                target.version,
                target.prev_hash.as_ref(),
                &content,
                9_000,
                None,
            );
            let (w, _) = control::seal_control_edition(&rumor, &control, &rogue, Timestamp::from_secs(9_000)).unwrap();
            let (ed, _) = control::open_control_edition(&w, &control).unwrap();
            if ed.inner_id < target.inner_id {
                relay.publish(&w, &community.relays).await.unwrap();
                planted = true;
                break;
            }
        }
        assert!(planted, "the test needs a fork that wins the tiebreak");

        assert!(
            community_is_public(&relay, &community).await,
            "an unauthorised fork must not retire the owner's live link"
        );
    }

    #[tokio::test]
    async fn a_registry_from_a_non_create_invite_holder_does_not_make_it_public() {
        // The CREATE_INVITE gate: a rogue publishing a registry can't fake Public.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Gated", vec!["wss://r".into()], None).await.unwrap();
        let rogue = Keys::generate();
        // Rogue publishes a registry edition at THEIR coordinate with a fake signer.
        let eid = crate::community::v2::derive::invite_links_locator(community.id(), &rogue.public_key().to_bytes());
        let content = crate::community::v2::invite::build_registry_content(&[Keys::generate().public_key()]);
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let rumor = control::build_edition_rumor(rogue.public_key(), vsk::INVITE_LINKS, &eid, 1, None, &content, 1_000, None);
        let (wrap, _) = control::seal_control_edition(&rumor, &group, &rogue, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
        let _ = owner;
        assert!(!community_is_public(&relay, &community).await, "a non-CREATE_INVITE registry is ignored");
    }

    #[tokio::test]
    async fn full_lifecycle_e2e() {
        // The whole stack end to end across two accounts: create -> Public link ->
        // owner grants an admin -> member joins + reads history -> admin edits metadata
        // (authorized fold) -> owner bans the member (CORD-04 §6: banlist + strip +
        // Refounding) -> the banned member is severed AND stays banned across the new
        // epoch -> pre-ban history still reads -> owner dissolves -> sealed.
        let (bed, owner, member) = TestBed::new();

        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Lifecycle", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&bed.relay, &community, &general, "owner: welcome").await.unwrap();

        // Public link → the community reads Public.
        let _minted = mint_public_link(&bed.relay, &community, "https://x", None, None).await.unwrap();
        assert!(community_is_public(&bed.relay, &community).await, "a live link makes it Public");

        // Owner defines + grants an Admin role (MANAGE_METADATA among the bits).
        let rid = "aa".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &member.keys.public_key(), vec![rid], 1).await;

        // Member joins from the bundle + reads the owner's message.
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert_eq!(texts_in(&bed.relay, &joined, &general).await, vec!["owner: welcome"]);
        // The admin folds first — adopting the staff write key their Grant
        // delivered (CORD-04 §3) — then renames the community.
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        assert!(joined.control_root.is_some(), "the Grant's control_wrap was adopted on fold");
        publish_community_meta(&bed.relay, &joined, &member.keys, "Lifecycle Renamed", 2).await;

        // Owner follows: the admin's rename folds (authorized).
        bed.swap_to(&owner);
        let updated = follow_control(&bed.relay, &community).await.unwrap().updated.expect("the admin edit folds");
        assert_eq!(updated.name, "Lifecycle Renamed", "an authorized admin's metadata edit is honored");

        // Ban the member (the three-removal composition, in order).
        set_banlist(&bed.relay, &updated, &[member.keys.public_key().to_hex()]).await.unwrap();
        grant_roles(&bed.relay, &updated, &member.keys.public_key(), vec![]).await.unwrap();
        let refounded = refound_community(&bed.relay, &updated, &[member.keys.public_key()]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1), "the ban rolled the root");
        // The ban survives the Refounding (the banlist head compacted forward).
        let post = fold_authority(&refounded, &fetch_control(&bed.relay, &refounded).await, &load_floors(&refounded));
        assert!(post.banned.contains(&member.keys.public_key().to_hex()), "the ban survives the re-founding");
        // Pre-ban history still reads across the new epoch.
        assert!(
            all_texts_in(&bed.relay, &refounded, &general).await.contains(&"owner: welcome".to_string()),
            "pre-refounding history stays reachable by paging"
        );

        // The banned member's rekey-follow concludes they're severed. Guard captured AFTER
        // the swap (the harness swap bumps the generation like production).
        bed.swap_to(&member);
        let session = crate::db::current_session();
        let follow = follow_rekeys(&bed.relay, &joined, &session).await.unwrap();
        assert!(follow.self_removed, "the banned member is cryptographically cut");

        // Owner dissolves → sealed.
        bed.swap_to(&owner);
        dissolve_community(&bed.relay, &refounded).await.unwrap();
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().unwrap().dissolved, "the community is sealed");
    }

    /// The deep two-account e2e the way a real deployment runs: owner (A) + member (B)
    /// over one shared relay, create → channels (public + private) → converse both ways →
    /// persist (get_messages-level) → react/edit/delete → moderate (ban/unban) → dissolve.
    /// Every account, community, channel, and action is LOGGED (run with --nocapture) so it
    /// doubles as a reference transcript and a re-runnable regression.
    #[tokio::test]
    async fn a_forged_edition_cannot_suppress_a_role_across_a_refounding() {
        // A member forges a higher-version role edition at the admin coordinate before a
        // refounding. The compaction must carry the AUTHORIZED floor head, not the
        // author-blind version tip — else the forgery is re-anchored, honest folders drop
        // it, and the admin role vanishes at the new epoch (silent suppression).
        let (bed, owner, member) = TestBed::new();
        let attacker = Keys::generate();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoSuppress", bed.relays.clone(), None).await.unwrap();
        let rid = crate::simd::hex::bytes_to_hex_32(&[0xa1; 32]);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &member.keys.public_key(), vec![rid.clone()], 1).await;
        // Owner folds → the authorized role/grant heads are floored.
        follow_control(&bed.relay, &community).await.unwrap().updated;
        assert!(fetch_authority(&bed.relay, &community).await.roles.is_admin(&member.keys.public_key().to_hex()), "member is admin pre-attack");

        // The attacker (a non-owner) forges v2 of the admin role, chaining onto v1.
        publish_role(&bed.relay, &community, &attacker, &Role { role_id: rid.clone(), name: "pwn".into(), position: 1, permissions: Permissions(0), scope: RoleScope::Server, color: 0, extra: Default::default() }, 2).await;

        // Owner refounds (keeping everyone).
        let refounded = refound_community(&bed.relay, &community, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1), "root rolled");

        // Post-refound, the admin role SURVIVES (the authorized floor head was carried).
        let post = fold_authority(&refounded, &fetch_control(&bed.relay, &refounded).await, &load_floors(&refounded));
        assert!(post.roles.is_admin(&member.keys.public_key().to_hex()), "the admin role survives the refounding despite the forgery");
    }

    #[tokio::test]
    async fn memberlist_survives_a_refounding_via_the_snapshot() {
        // A silent survivor (didn't re-post at the new epoch) must stay in the memberlist
        // after a refounding — the owner's 3312 snapshot re-seeds them (CORD-02 §5).
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Snapshot", bed.relays.clone(), None).await.unwrap();

        // Member joins (a Guestbook Join at epoch 0).
        let bundle = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None)).unwrap();
        bed.swap_to(&member);
        accept_parked_invite(&bed.relay, &bundle, None).await.unwrap();
        bed.swap_to(&owner);
        assert!(memberlist(&bed.relay, &community).await.unwrap().contains(&member.keys.public_key()), "member present pre-refound");

        // Owner refounds keeping everyone (removed = []); survivors are snapshotted to epoch 1.
        let refounded = refound_community(&bed.relay, &community, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1), "the root rolled");

        // The member is STILL a member at epoch 1 purely via the snapshot (never re-posted).
        let members = memberlist(&bed.relay, &refounded).await.unwrap();
        assert!(members.contains(&member.keys.public_key()), "a silent survivor stays a member after the refounding");
        assert!(members.contains(&owner.keys.public_key()), "owner is always a member");
    }

    #[tokio::test]
    async fn e2e_two_accounts_channels_converse_moderate() {
        use crate::community::v2::inbound::{apply_chat_to_state, persist_chat};
        use nostr_sdk::prelude::ToBech32;
        let (bed, a, b) = TestBed::new();
        let (a_npub, b_npub) = (a.keys.public_key().to_bech32().unwrap(), b.keys.public_key().to_bech32().unwrap());
        let (a_hex, b_hex) = (a.keys.public_key().to_hex(), b.keys.public_key().to_hex());
        println!("\n===== Concord v2 deep e2e =====");
        println!("[acct] A (owner)  = {a_npub}");
        println!("[acct] B (member) = {b_npub}");

        // ── A creates the community + a PRIVATE channel + two extra PUBLIC channels ──
        bed.swap_to(&a);
        let mut community = create_community(&bed.relay, "Deep E2E", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        println!("[create] community {} · #general {}", crate::simd::hex::bytes_to_hex_32(&community.id().0), crate::simd::hex::bytes_to_hex_32(&general.0));

        // A PRIVATE channel via the REAL create path: an independent key minted at
        // channel-epoch 1, delivered over the rekey plane (A is the only member yet),
        // then announced (vsk 2) — later carried to B in the join bundle.
        let priv_id = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let priv_ch = community.channel(&priv_id).unwrap();
        assert!(priv_ch.private && priv_ch.key.is_some() && priv_ch.epoch == Epoch(1), "born-private: keyed at epoch 1");
        println!("[channel] +private #mods {} (native create: key over the rekey plane)", crate::simd::hex::bytes_to_hex_32(&priv_id.0));

        // Two more PUBLIC channels via the real create path.
        let announcements = create_public_channel(&bed.relay, &community, "announcements").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let random = create_public_channel(&bed.relay, &community, "random").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        println!("[channel] +public #announcements {} · #random {}", crate::simd::hex::bytes_to_hex_32(&announcements.0), crate::simd::hex::bytes_to_hex_32(&random.0));
        assert_eq!(community.channels.len(), 4, "general + mods + announcements + random");

        // A talks in a few channels.
        let m1 = send_message(&bed.relay, &community, &general, "A: welcome to the deep e2e").await.unwrap();
        send_message(&bed.relay, &community, &announcements, "A: read the rules").await.unwrap();
        send_message(&bed.relay, &community, &priv_id, "A: mods-only channel").await.unwrap();
        println!("[msg] A posted in #general / #announcements / #mods");

        // ── A grants B admin, mints a public link, B joins from the bundle ──
        let admin_rid = crate::simd::hex::bytes_to_hex_32(&[0xa1; 32]);
        publish_role(&bed.relay, &community, &a.keys, &admin_role(&admin_rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &a.keys, &b.keys.public_key(), vec![admin_rid], 1).await;
        let link = mint_public_link(&bed.relay, &community, "https://vectorapp.io", None, None).await.unwrap();
        assert!(community_is_public(&bed.relay, &community).await, "a live link makes it Public");
        println!("[invite] granted B @admin · minted link {}", link.url);

        // A private channel is readable only by granted role-holders (CORD-03), so
        // B is added to its access list before the bundle is minted.
        grant_channel_access(&bed.relay, &community, &priv_id, &b.keys.public_key()).await.unwrap();
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Member(b.keys.public_key()), Some(a.keys.public_key()), None, None)).unwrap();
        bed.swap_to(&b);
        let mut b_view = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        println!("[join] B joined; sees {} channels", b_view.channels.len());
        assert_eq!(b_view.channels.len(), 4, "B receives all four channels (incl. the private one's key) in the bundle");
        assert!(b_view.channels.iter().any(|c| c.id.0 == priv_id.0 && c.private && c.key.is_some()), "B holds the private channel key");
        assert!(texts_in(&bed.relay, &b_view, &general).await.contains(&"A: welcome to the deep e2e".to_string()), "B reads A's #general history");
        assert!(texts_in(&bed.relay, &b_view, &priv_id).await.contains(&"A: mods-only channel".to_string()), "B reads the PRIVATE channel with the bundle key");
        // B folds the control plane (persisting the roster) — the live worker does
        // this right after any join; B's admin standing gates B's channel ops below.
        if let Some(fresh) = follow_control(&bed.relay, &b_view).await.unwrap().updated {
            b_view = fresh;
        }
        println!("[follow] B folded control (roster persisted: B is @admin)");

        // ── Conversation both ways + persistence (get_messages-level) ──
        send_message(&bed.relay, &b_view, &general, "B: thanks, glad to be here").await.unwrap();
        send_message(&bed.relay, &b_view, &priv_id, "B: mods checking in").await.unwrap();
        println!("[msg] B replied in #general + #mods");
        // Persist B's own #general view into the shared store (what sync/live ingest does)
        // and confirm it reads back via STATE — get_messages parity.
        let my_pk = b.keys.public_key();
        let gh = crate::simd::hex::bytes_to_hex_32(&general.0);
        for f in fetch_channel(&bed.relay, &b_view, &general, 100).await.unwrap() {
            let outcome = { let mut st = crate::state::STATE.lock().await; apply_chat_to_state(&mut st, &f.event, &gh, &my_pk) };
            if let Some(o) = outcome { persist_chat(&gh, &o).await; }
        }
        assert!(crate::db::events::event_exists(&m1).unwrap(), "A's message persisted into B's shared store (get_messages backfill)");
        println!("[persist] #general history persisted into the shared events store");

        // B (admin) reacts to + the author edits/deletes — the chat-op surface.
        send_reaction(&bed.relay, &b_view, &general, &m1, &a_hex, super::super::kind::MESSAGE, "🔥", None).await.unwrap();
        bed.swap_to(&a);
        let m_edit = send_message(&bed.relay, &community, &general, "A: this will be edited").await.unwrap();
        send_edit(&bed.relay, &community, &general, &m_edit, "A: edited!", &[]).await.unwrap();
        let m_del = send_message(&bed.relay, &community, &general, "A: this will be deleted").await.unwrap();
        send_delete(&bed.relay, &community, &general, &m_del, super::super::kind::MESSAGE).await.unwrap();
        println!("[ops] reaction + edit + delete round-tripped");

        // ── B creates a channel as admin, A folds it in ──
        bed.swap_to(&b);
        let bugs = create_public_channel(&bed.relay, &b_view, "bug-reports").await.unwrap();
        println!("[channel] B(admin) +public #bug-reports {}", crate::simd::hex::bytes_to_hex_32(&bugs.0));
        bed.swap_to(&a);
        if let Some(updated) = follow_control(&bed.relay, &community).await.unwrap().updated {
            community = updated;
        }
        assert!(community.channels.iter().any(|c| c.id.0 == bugs.0), "A folds in B's authorized new channel");
        println!("[follow] A folded in B's #bug-reports (now {} channels)", community.channels.len());

        // ── A creates a SECOND private channel while B is already a member. B is
        // NOT on its access list, so B learns the channel exists (control-follow,
        // keyless) and gets no key: CORD-03's private channel is readable only by
        // granted role-holders, never by every member. B keys up if and when A
        // grants them the channel's access role and vends the key ──
        let vault = create_private_channel(&bed.relay, &community, "vault").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        send_message(&bed.relay, &community, &vault, "A: vault is open").await.unwrap();
        println!("[channel] +private #vault {} (B is unentitled — no delivery)", crate::simd::hex::bytes_to_hex_32(&vault.0));
        bed.swap_to(&b);
        let session_b2 = crate::db::current_session();
        if let Some(fresh) = follow_control(&bed.relay, &b_view).await.unwrap().updated {
            b_view = fresh;
        }
        let ch = b_view.channel(&vault).expect("B recorded the announced private channel");
        assert!(ch.private && ch.key.is_none() && ch.epoch == Epoch(0), "B's record is keyless at cursor 0");
        let rf = follow_rekeys(&bed.relay, &b_view, &session_b2).await.unwrap();
        if let Some(fresh) = rf.updated {
            b_view = fresh;
        }
        let ch = b_view.channel(&vault).expect("still recorded");
        assert!(ch.key.is_none(), "an unentitled member is never delivered the key");
        assert!(
            texts_in(&bed.relay, &b_view, &vault).await.is_empty(),
            "and reads nothing from it"
        );
        assert!(
            send_message(&bed.relay, &b_view, &vault, "B: in the vault").await.is_err(),
            "an unentitled member cannot post into the channel either"
        );
        bed.swap_to(&a);
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        println!("[private] #vault stayed sealed to the unentitled B (no key, no read, no send)");

        // ── Members ──
        let members = memberlist(&bed.relay, &community).await.unwrap();
        let member_hexes: std::collections::BTreeSet<String> = members.iter().map(|m| m.to_hex()).collect();
        assert!(member_hexes.contains(&a_hex) && member_hexes.contains(&b_hex), "A + B both in the memberlist");
        println!("[members] {} members: A + B present", members.len());

        // ── Moderate: ban B (banlist + strip + refound), verify severance + survival ──
        set_banlist(&bed.relay, &community, &[b_hex.clone()]).await.unwrap();
        grant_roles(&bed.relay, &community, &b.keys.public_key(), vec![]).await.unwrap();
        let refounded = refound_community(&bed.relay, &community, &[b.keys.public_key()]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1), "the ban rolled the root");
        let post = fold_authority(&refounded, &fetch_control(&bed.relay, &refounded).await, &load_floors(&refounded));
        assert!(post.banned.contains(&b_hex), "the ban survives the refounding");
        assert!(all_texts_in(&bed.relay, &refounded, &general).await.iter().any(|t| t == "A: welcome to the deep e2e"), "pre-ban history pages back across the new epoch");
        assert!(
            all_texts_in(&bed.relay, &refounded, &priv_id).await.iter().any(|t| t == "A: mods-only channel"),
            "PRIVATE history pages back across the channel's own rotation (per-channel multi-epoch archive)"
        );
        println!("[ban] B banned; root rolled to epoch 1; ban survives; pre-ban history intact (public + private)");
        // B concludes it's severed.
        bed.swap_to(&b);
        let session_b3 = crate::db::current_session();
        assert!(follow_rekeys(&bed.relay, &b_view, &session_b3).await.unwrap().self_removed, "B is cryptographically cut by the ban-refound");
        println!("[ban] B's rekey-follow: self_removed = true (severed)");

        // ── Unban: A lifts the ban ──
        bed.swap_to(&a);
        set_banlist(&bed.relay, &refounded, &[]).await.unwrap();
        let after_unban = fold_authority(&refounded, &fetch_control(&bed.relay, &refounded).await, &load_floors(&refounded));
        assert!(!after_unban.banned.contains(&b_hex), "the unban clears B from the banlist");
        println!("[unban] B removed from the banlist (re-invitable)");

        // ── Dissolve ──
        dissolve_community(&bed.relay, &refounded).await.unwrap();
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().unwrap().dissolved, "the community is sealed");
        println!("[dissolve] community sealed (read-only)\n===== e2e PASS =====\n");
    }

    /// The same scenario on a REAL relay with TWO throwaway accounts, off by default. It
    /// LOGS both nsecs (+ every id) so you can inspect the run and RE-RUN against the same
    /// accounts by exporting `VECTOR_E2E_NSEC_A` / `_B`. Set `VECTOR_E2E_LOG=<path>` to also
    /// append the transcript to a file, `VECTOR_E2E_RELAY=<url>` to pick the relay.
    ///   cargo test -p vector-core -- --ignored --nocapture live_e2e_two_accounts
    #[tokio::test]
    #[ignore]
    async fn live_e2e_two_accounts() {
        use crate::community::transport::LiveTransport;
        use nostr_sdk::prelude::ToBech32;

        let relay = std::env::var("VECTOR_E2E_RELAY").unwrap_or_else(|_| "wss://jskitty.com/nostr".to_string());
        let relays = vec![relay.clone()];
        let _g = crate::db::DB_TEST_GUARD.lock().unwrap_or_else(|e| e.into_inner());
        crate::db::close_database();
        crate::db::clear_id_caches();
        let tmp = tempfile::tempdir().unwrap();
        crate::db::set_app_data_dir(crate::db::shared_test_data_dir().to_path_buf());

        // Throwaway (or bring-your-own via env for a re-run against the same accounts).
        let a = std::env::var("VECTOR_E2E_NSEC_A").ok().and_then(|n| Keys::parse(&n).ok()).unwrap_or_else(Keys::generate);
        let b = std::env::var("VECTOR_E2E_NSEC_B").ok().and_then(|n| Keys::parse(&n).ok()).unwrap_or_else(Keys::generate);

        let log = |line: String| {
            println!("{line}");
            if let Ok(p) = std::env::var("VECTOR_E2E_LOG") {
                use std::io::Write;
                if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open(&p) {
                    let _ = writeln!(f, "{line}");
                }
            }
        };
        log(format!("===== LIVE Concord v2 e2e on {relay} ====="));
        log(format!("VECTOR_E2E_NSEC_A={}  ({})", a.secret_key().to_bech32().unwrap(), a.public_key().to_bech32().unwrap()));
        log(format!("VECTOR_E2E_NSEC_B={}  ({})", b.secret_key().to_bech32().unwrap(), b.public_key().to_bech32().unwrap()));

        for k in [&a, &b] {
            let npub = k.public_key().to_bech32().unwrap();
            std::fs::create_dir_all(tmp.path().join(&npub)).unwrap();
            crate::db::set_current_account(npub.clone()).unwrap();
            crate::db::init_database(&npub).unwrap();
        }
        // One relay connection: a v2 wrap is pre-signed (ephemeral p-key) and its seal is
        // signed by MY_SECRET_KEY, so publishing needs no per-account client signer.
        let client = crate::nostr_client_builder().build();
        client.add_managed_relay(relay.as_str()).await.ok();
        client.connect().await;
        crate::state::set_nostr_client(client);
        let transport = LiveTransport::with_timeout(std::time::Duration::from_secs(15));
        let become_acct = |k: &Keys| {
            let npub = k.public_key().to_bech32().unwrap();
            crate::db::set_current_account(npub.clone()).unwrap();
            crate::db::init_database(&npub).unwrap();
            crate::db::clear_id_caches();
            crate::state::MY_SECRET_KEY.store_from_keys(k, &[]);
            crate::state::set_my_public_key(k.public_key());
        };
        let settle = || crate::rt::time::sleep(std::time::Duration::from_secs(2));

        // A: create + a channel + grant B admin + mint link.
        become_acct(&a);
        let mut community = create_community(&transport, "Live E2E", relays.clone(), None).await.expect("create");
        let general = community.channels[0].id;
        log(format!("[create] community {} · #general {}", crate::simd::hex::bytes_to_hex_32(&community.id().0), crate::simd::hex::bytes_to_hex_32(&general.0)));
        send_message(&transport, &community, &general, "A: live hello").await.expect("send");
        let ann = create_public_channel(&transport, &community, "announcements").await.expect("channel");
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        log(format!("[channel] +public #announcements {}", crate::simd::hex::bytes_to_hex_32(&ann.0)));
        grant_admin(&transport, &community, &b.public_key()).await.expect("grant admin");
        let link = mint_public_link(&transport, &community, "https://vectorapp.io", None, None).await.expect("mint");
        log(format!("[invite] B granted @admin · link {}", link.url));
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Link, Some(a.public_key()), None, None)).unwrap();
        settle().await;

        // B: join + read A's history + reply.
        become_acct(&b);
        let b_view = accept_parked_invite(&transport, &bundle_json, None).await.expect("join");
        log(format!("[join] B joined; {} channels", b_view.channels.len()));
        settle().await;
        let page = fetch_channel(&transport, &b_view, &general, 50).await.expect("fetch");
        let seen: Vec<String> = page.iter().map(|f| f.event.opened().rumor.content.clone()).collect();
        log(format!("[read] B sees #general: {seen:?}"));
        assert!(seen.iter().any(|t| t == "A: live hello"), "B reads A's message over the real relay");
        send_message(&transport, &b_view, &general, "B: live reply").await.expect("reply");

        // B posts a NIP-22 kind-1111 THREADED REPLY to A's message (the shape Armada
        // sends) directly onto the chat plane — proving the cross-client thread
        // RECEIVE path works live, not just in the offline fixture.
        let hello = page.iter().find(|f| f.event.opened().rumor.content == "A: live hello").expect("A's message");
        let hello_id = hello.event.opened().rumor_id.to_hex();
        let bkeys = crate::state::MY_SECRET_KEY.to_keys().unwrap();
        let cgroup = channel_group_key(&b_view.community_root, &general, b_view.root_epoch);
        let reply_rumor = chat::build_comment_rumor(bkeys.public_key(), &general, b_view.root_epoch, "B: threaded reply to hello", &hello_id, super::super::kind::MESSAGE, &a.public_key().to_hex(), None, &[], now_ms());
        let (reply_wrap, _) = chat::seal_chat_rumor(&reply_rumor, &cgroup, &bkeys, Timestamp::from_secs(now_ms() / 1000), false).expect("seal 1111");
        transport.publish(&reply_wrap, &b_view.relays).await.expect("publish 1111");
        log("[thread] B published a kind-1111 threaded reply to A's message".to_string());
        settle().await;

        // A reads the thread reply back, rendered inline with A's message as parent.
        become_acct(&a);
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let a_page = fetch_channel(&transport, &community, &general, 50).await.expect("A fetch");
        let thread = a_page.iter().find(|f| f.event.opened().rumor.content == "B: threaded reply to hello").expect("A sees the 1111");
        if let chat::ChatEvent::Message { reply_to, opened, .. } = &thread.event {
            assert_eq!(opened.rumor.kind.as_u16(), super::super::kind::COMMENT, "wire kind preserved as 1111");
            assert_eq!(reply_to.as_ref().map(|r| crate::simd::hex::bytes_to_hex_32(&r.id)), Some(hello_id.clone()), "the 1111 renders inline with A's message as parent");
        } else {
            panic!("the 1111 parsed as a Message");
        }
        log("[thread] A read B's threaded reply, parent resolved — cross-client 1111 interop OK".to_string());
        become_acct(&b);
        settle().await;

        // A: create a PRIVATE channel while B is already a member — B is a recipient
        // of the creation delivery, so B keys up from the rekey plane over the real
        // relay (no bundle involved), then the two converse on it.
        become_acct(&a);
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let vault = create_private_channel(&transport, &community, "vault").await.expect("private channel");
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        send_message(&transport, &community, &vault, "A: vault live").await.expect("vault send");
        log(format!("[channel] +private #vault {} (key delivered over the rekey plane)", crate::simd::hex::bytes_to_hex_32(&vault.0)));
        settle().await;

        become_acct(&b);
        let session_b = crate::db::current_session();
        let mut b_view = crate::db::community::load_community_v2(b_view.id()).unwrap().unwrap();
        if let Some(fresh) = follow_control(&transport, &b_view).await.expect("B control follow").updated {
            b_view = fresh;
        }
        if let Some(fresh) = follow_rekeys(&transport, &b_view, &session_b).await.expect("B rekey follow").updated {
            b_view = fresh;
        }
        let vch = b_view.channel(&vault).expect("B folded the vault");
        assert!(vch.key.is_some() && vch.epoch == Epoch(1), "B adopted the vault key from the live rekey plane");
        let vseen = texts_in(&transport, &b_view, &vault).await;
        log(format!("[read] B sees #vault: {vseen:?}"));
        assert!(vseen.iter().any(|t| t == "A: vault live"), "B reads the private channel with the ADOPTED key");
        send_message(&transport, &b_view, &vault, "B: in the live vault").await.expect("vault reply");
        settle().await;

        become_acct(&a);
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(
            texts_in(&transport, &community, &vault).await.iter().any(|t| t == "B: in the live vault"),
            "A reads B's private reply"
        );
        log("[private] two-way #vault conversation over the live relay".to_string());

        // A: ban B (three-removal) + dissolve.
        set_banlist(&transport, &community, &[b.public_key().to_hex()]).await.expect("banlist");
        grant_roles(&transport, &community, &b.public_key(), vec![]).await.expect("strip");
        let refounded = refound_community(&transport, &community, &[b.public_key()]).await.expect("refound");
        log(format!("[ban] B banned; root → epoch {}", refounded.root_epoch.0));
        settle().await;
        dissolve_community(&transport, &refounded).await.expect("dissolve");
        log("[dissolve] community sealed".to_string());
        log("===== LIVE e2e PASS =====".to_string());
    }

    #[tokio::test]
    async fn an_offline_member_learns_of_a_dissolution_on_catch_up() {
        // The tombstone rides its own public plane, watched live — an OFFLINE
        // member's catch-up must fetch it too, or they follow (and post into) a
        // grave forever.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Doomed", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap();

        // The owner dissolves while the member sleeps.
        bed.swap_to(&owner);
        dissolve_community(&bed.relay, &community).await.unwrap();

        // The member's catch-up learns of the death, seals, and refuses to post.
        bed.swap_to(&member);
        let session = crate::db::current_session();
        let follow = follow_rekeys(&bed.relay, &joined, &session).await.unwrap();
        assert!(follow.dissolved, "the catch-up surfaces the tombstone");
        assert!(!follow.self_removed && follow.updated.is_none());
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        assert!(crate::db::community::get_community_dissolved(&cid_hex).unwrap(), "sealed read-only locally");
        let err = send_message(&bed.relay, &joined, &general, "into the void").await.unwrap_err();
        assert!(err.contains("dissolved"), "sends refuse a grave: {err}");
        // Subsequent follows take the local fast path — still dissolved, no churn.
        let again = follow_rekeys(&bed.relay, &joined, &session).await.unwrap();
        assert!(again.dissolved && again.updated.is_none());
    }

    #[tokio::test]
    async fn a_wide_community_survives_refoundings_and_an_offline_member_converges() {
        // Scale stress: MANY private channels, each rotated on every Refounding.
        // A member offline across two refoundings must converge on all of them
        // (the per-channel rotation fan in refound + the follow's channel×root×step
        // loops stay bounded) with every channel's history readable.
        const PRIV_CHANNELS: usize = 6;
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let mut community = create_community(&bed.relay, "Wide", bed.relays.clone(), None).await.unwrap();
        let mut priv_ids = Vec::new();
        for i in 0..PRIV_CHANNELS {
            let id = create_private_channel(&bed.relay, &community, &format!("priv{i}")).await.unwrap();
            community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
            send_message(&bed.relay, &community, &id, &format!("priv{i} epoch0")).await.unwrap();
            priv_ids.push(id);
        }
        // Private channels are readable only by granted role-holders (CORD-03).
        for id in &priv_ids {
            grant_channel_access(&bed.relay, &community, id, &member.keys.public_key()).await.unwrap();
        }
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Member(member.keys.public_key()), Some(owner.keys.public_key()), None, None)).unwrap();

        // Member joins at epoch 0 with all channel keys, then goes offline.
        bed.swap_to(&member);
        let member_view = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert_eq!(member_view.channels.iter().filter(|c| c.private && c.key.is_some()).count(), PRIV_CHANNELS, "joined with all private keys");

        // Two refoundings (each rotates the base + every private channel).
        bed.swap_to(&owner);
        for epoch in 1..=2u64 {
            community = refound_community(&bed.relay, &community, &[]).await.unwrap();
            assert_eq!(community.root_epoch, Epoch(epoch));
            for id in &priv_ids {
                send_message(&bed.relay, &community, id, &format!("{} epoch{epoch}", crate::simd::hex::bytes_to_hex_32(&id.0))).await.unwrap();
            }
        }

        // Member returns: bounded follow to quiescence.
        bed.swap_to(&member);
        let session = crate::db::current_session();
        let mut passes = 0;
        loop {
            passes += 1;
            assert!(passes <= 8, "a wide catch-up must converge, not churn (pass {passes})");
            let cur = crate::db::community::load_community_v2(member_view.id()).unwrap().unwrap();
            let rk = follow_rekeys(&bed.relay, &cur, &session).await.unwrap();
            assert!(!rk.self_removed);
            let cur = crate::db::community::load_community_v2(member_view.id()).unwrap().unwrap();
            let ctl = follow_control(&bed.relay, &cur).await.unwrap().updated;
            if rk.updated.is_none() && ctl.is_none() {
                break;
            }
        }
        let caught_up = crate::db::community::load_community_v2(member_view.id()).unwrap().unwrap();
        assert_eq!(caught_up.root_epoch, Epoch(2), "walked both refoundings");
        // Every private channel converged to the owner's current key + reads all epochs.
        for id in &priv_ids {
            let mine = caught_up.channel(id).expect("channel survived");
            let theirs = community.channel(id).unwrap();
            assert_eq!(mine.key, theirs.key, "channel {} converged on the owner key", crate::simd::hex::bytes_to_hex_32(&id.0));
            assert_eq!(mine.epoch, theirs.epoch, "…at the same epoch");
            let id_hex = crate::simd::hex::bytes_to_hex_32(&id.0);
            // Opening reads the live planes; the rotated-past ones are the
            // back-paging cursor's job. Both halves asserted — the point is that
            // every epoch stays REACHABLE, not that opening drags it all in.
            let open = texts_in(&bed.relay, &caught_up, id).await;
            assert!(open.iter().any(|t| t.contains("epoch2")), "channel {id_hex} opens onto its live epoch");
            let paged = all_texts_in(&bed.relay, &caught_up, id).await;
            assert!(paged.iter().any(|t| t.contains("epoch0")), "channel {id_hex} pages back to epoch-0 history");
            for epoch in 1..=2u64 {
                assert!(paged.iter().any(|t| t.contains(&format!("epoch{epoch}"))), "channel {id_hex} pages back to epoch-{epoch} history");
            }
        }
    }

    #[tokio::test]
    async fn a_backlog_deeper_than_max_steps_still_converges() {
        // MAX_STEPS bounds ONE walk, not the catch-up. A member who slept through more
        // rotations than the bound must still land on the head — silently stopping at
        // the bound leaves them on a dead epoch reading nothing, which is
        // indistinguishable from a quiet community.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let mut community = create_community(&bed.relay, "DeepSleeper", bed.relays.clone(), None).await.unwrap();
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Member(member.keys.public_key()), Some(owner.keys.public_key()), None, None)).unwrap();

        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert_eq!(joined.root_epoch, Epoch(0));

        // Past the bound, deliberately.
        bed.swap_to(&owner);
        let depth = MAX_WALK_STEPS + 3;
        for _ in 0..depth {
            community = refound_community(&bed.relay, &community, &[]).await.unwrap();
        }
        assert_eq!(community.root_epoch, Epoch(depth as u64));

        // The member follows repeatedly, exactly as a client does on each sync. Every
        // pass must make forward progress and none may lose ground.
        bed.swap_to(&member);
        let mut last = 0u64;
        for pass in 1..=8 {
            // Reload from the DB each pass, exactly as a client does: this is what
            // proves every hop was CHECKPOINTED, not merely held in the walk's memory.
            let view = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
            let session = crate::db::current_session();
            let _ = follow_rekeys(&bed.relay, &view, &session).await.unwrap();
            let view = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
            assert!(
                view.root_epoch.0 >= last,
                "pass {pass} lost ground: {} -> {}",
                last, view.root_epoch.0
            );
            last = view.root_epoch.0;
            if last == depth as u64 {
                break;
            }
        }
        let view = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(
            view.root_epoch, Epoch(depth as u64),
            "a backlog deeper than one walk's step bound must still converge across passes",
        );
    }

    #[tokio::test]
    async fn an_offline_member_catches_up_across_three_refoundings() {
        // The deep offline-online scenario: a member sleeps through THREE
        // Refoundings, per-refound private-channel rotations, a mid-life private
        // channel CREATED while they slept, a public channel, a rename, and a
        // ban — then returns and converges by follow alone (no rejoin).
        use nostr_sdk::prelude::ToBech32;
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let mut community = create_community(&bed.relay, "Sleeper", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let mods = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        send_message(&bed.relay, &community, &general, "epoch0: hello").await.unwrap();
        send_message(&bed.relay, &community, &mods, "epoch0: mods secret").await.unwrap();
        // Private channels are readable only by granted role-holders (CORD-03).
        grant_channel_access(&bed.relay, &community, &mods, &member.keys.public_key()).await.unwrap();
        let bundle_json = serde_json::to_string(&bundle_of(&community, BundleAudience::Member(member.keys.public_key()), Some(owner.keys.public_key()), None, None)).unwrap();

        // Member joins at epoch 0, then goes OFFLINE.
        bed.swap_to(&member);
        let member_view = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert_eq!(member_view.root_epoch, Epoch(0));

        // While they sleep, the owner reshapes everything across three epochs.
        bed.swap_to(&owner);
        let stranger = Keys::generate();
        for epoch in 1..=3u64 {
            community = refound_community(&bed.relay, &community, &[]).await.unwrap();
            assert_eq!(community.root_epoch, Epoch(epoch));
            send_message(&bed.relay, &community, &general, &format!("epoch{epoch}: general news")).await.unwrap();
            send_message(&bed.relay, &community, &mods, &format!("epoch{epoch}: mods word")).await.unwrap();
        }
        let news = create_public_channel(&bed.relay, &community, "news").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let vault = create_private_channel(&bed.relay, &community, "vault").await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        // The sleeper is on this channel's access list, so the refoundings that
        // follow deliver its key to them (CORD-03).
        grant_channel_access(&bed.relay, &community, &vault, &member.keys.public_key()).await.unwrap();
        community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        send_message(&bed.relay, &community, &vault, "epoch3: vault opened").await.unwrap();
        set_banlist(&bed.relay, &community, &[stranger.public_key().to_hex()]).await.unwrap();
        let meta = control::CommunityMetadata { name: "Sleeper Reborn".into(), relays: community.relays.clone(), ..Default::default() };
        edit_community_metadata(&bed.relay, &community, &meta).await.unwrap();

        // The member RETURNS: rekey+control follow to quiescence (the worker's
        // loop, driven explicitly). Bounded — convergence must be fast.
        bed.swap_to(&member);
        let session = crate::db::current_session();
        let mut passes = 0;
        loop {
            passes += 1;
            assert!(passes <= 6, "catch-up must converge, not churn");
            let cur = crate::db::community::load_community_v2(member_view.id()).unwrap().unwrap();
            let rekeyed = follow_rekeys(&bed.relay, &cur, &session).await.unwrap();
            assert!(!rekeyed.self_removed, "the member was never removed");
            let cur = crate::db::community::load_community_v2(member_view.id()).unwrap().unwrap();
            let controlled = follow_control(&bed.relay, &cur).await.unwrap().updated;
            if rekeyed.updated.is_none() && controlled.is_none() {
                break;
            }
        }
        let caught_up = crate::db::community::load_community_v2(member_view.id()).unwrap().unwrap();

        // Base + name converged.
        assert_eq!(caught_up.root_epoch, Epoch(3), "walked all three refoundings");
        assert_eq!(caught_up.community_root, community.community_root, "landed on the owner's root");
        assert_eq!(caught_up.name, "Sleeper Reborn");
        // Channels: renamed set incl. the mid-sleep public + private ones.
        assert!(caught_up.channels.iter().any(|c| c.id.0 == news.0), "folded the new public channel");
        let m = caught_up.channel(&mods).expect("mods survived");
        let owner_mods = community.channel(&mods).unwrap();
        assert_eq!(m.epoch, owner_mods.epoch, "mods walked every per-refound rotation");
        assert_eq!(m.key, owner_mods.key, "…to the owner's exact key");
        let v = caught_up.channel(&vault).expect("vault folded in");
        // The sleeper is on vault's access list, but it was created AFTER the last
        // refounding — no rotation followed the grant, so no blob was ever
        // addressed to them. They hold the channel keyless until the grant's own
        // key vend lands (CORD-05 §6), which is what a rekey-only walk cannot do.
        assert!(v.private && v.key.is_none(), "vault folds in keyless: entitled, but never delivered");
        // Banlist survived the compactions.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&caught_up.id().0);
        let banned = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        assert!(banned.contains(&stranger.public_key().to_hex()), "the ban folded through");
        // Opening reads the live planes only; paging back reaches EVERY epoch
        // (public via the base-root archive, private via the per-channel archive
        // built during the walk). A sleeper's deep history stays reachable — it
        // just arrives when they scroll for it rather than on open.
        let gen_open = texts_in(&bed.relay, &caught_up, &general).await;
        assert!(gen_open.contains(&"epoch3: general news".to_string()), "general opens onto its live epoch: {gen_open:?}");
        let gen_texts = all_texts_in(&bed.relay, &caught_up, &general).await;
        for epoch in 0..=3u64 {
            let needle = if epoch == 0 { "epoch0: hello".to_string() } else { format!("epoch{epoch}: general news") };
            assert!(gen_texts.contains(&needle), "general pages back to epoch {epoch}: {gen_texts:?}");
        }
        let mods_open = texts_in(&bed.relay, &caught_up, &mods).await;
        assert!(mods_open.contains(&"epoch3: mods word".to_string()), "mods opens onto its live epoch: {mods_open:?}");
        let mods_texts = all_texts_in(&bed.relay, &caught_up, &mods).await;
        for epoch in 0..=3u64 {
            let needle = if epoch == 0 { "epoch0: mods secret".to_string() } else { format!("epoch{epoch}: mods word") };
            assert!(mods_texts.contains(&needle), "private pages back to epoch {epoch}: {mods_texts:?}");
        }
        // Keyless (above) means unreadable — a rekey walk cannot substitute for the
        // key vend that a grant carries.
        assert!(texts_in(&bed.relay, &caught_up, &vault).await.is_empty());
        // And the member can still speak.
        send_message(&bed.relay, &caught_up, &general, "member: good morning").await.unwrap();
        bed.swap_to(&owner);
        assert!(
            texts_in(&bed.relay, &community, &general).await.contains(&"member: good morning".to_string()),
            "the caught-up member converses at the new epoch ({})",
            member.keys.public_key().to_bech32().unwrap()
        );
    }

    /// Seal `n` messages onto a community's #general, one per second starting at
    /// `base_secs` (distinct wrap seconds so relay-side `until` paging engages).
    async fn flood_general(relay: &MemoryRelay, community: &CommunityV2, author: &Keys, n: usize, base_secs: u64) {
        let general = community.channels[0].id;
        let group = channel_group_key(&community.community_root, &general, community.root_epoch);
        for i in 0..n {
            let at = base_secs + i as u64;
            let rumor = chat::build_message_rumor(author.public_key(), &general, community.root_epoch, &format!("msg {i}"), None, &[], vec![], at * 1000);
            let (wrap, _) = chat::seal_chat_rumor(&rumor, &group, author, Timestamp::from_secs(at), false).unwrap();
            relay.publish(&wrap, &community.relays).await.unwrap();
        }
    }

    #[tokio::test]
    async fn the_history_walk_pages_past_a_multi_page_burst() {
        // A bot offline through 120 messages must catch ALL of them, not the
        // newest page — the v1 sync-gap class, closed by until-paging.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Burst", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        flood_general(&relay, &community, &owner, 120, 10_000).await;

        let all = fetch_channel_history(&relay, &community, &general, 50, 8, None, None, crate::community::transport::Evidence::Quorum, |_| true).await.unwrap();
        assert_eq!(all.len(), 120, "the walk pages the whole burst");
        // Oldest→newest, no duplicates.
        let contents: Vec<String> = all.iter().map(|f| f.event.opened().rumor.content.clone()).collect();
        assert_eq!(contents.first().map(String::as_str), Some("msg 0"));
        assert_eq!(contents.last().map(String::as_str), Some("msg 119"));
        let unique: std::collections::HashSet<&String> = contents.iter().collect();
        assert_eq!(unique.len(), 120, "wrap-id + rumor-id dedup holds across page boundaries");

        // The single-page fetch stays a single page.
        let one = fetch_channel(&relay, &community, &general, 50).await.unwrap();
        assert_eq!(one.len(), 50, "fetch_channel is one newest page");
        assert_eq!(one.last().map(|f| f.event.opened().rumor.content.clone()).as_deref(), Some("msg 119"));
    }

    #[tokio::test]
    async fn a_start_until_cursor_pages_history_from_that_point_backwards() {
        // The back-paging cursor: a walk that starts at an explicit `until`
        // returns only what lies at-or-before it, oldest→newest — the relay-side
        // half of the SDK's walk-until-dry loop.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Paged", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        flood_general(&relay, &community, &owner, 120, 10_000).await;

        let older = fetch_channel_history(
            &relay, &community, &general, 50, 8, None, Some(10_059),
            crate::community::transport::Evidence::Quorum, |_| true,
        )
        .await
        .unwrap();
        let contents: Vec<String> = older.iter().map(|f| f.event.opened().rumor.content.clone()).collect();
        assert_eq!(contents.len(), 60, "everything at-or-before the cursor, nothing after");
        assert_eq!(contents.first().map(String::as_str), Some("msg 0"));
        assert_eq!(contents.last().map(String::as_str), Some("msg 59"));
    }

    #[tokio::test]
    async fn the_history_walk_stops_when_the_caller_is_caught_up() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Caught", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        flood_general(&relay, &community, &owner, 120, 10_000).await;

        // The caller says "I hold everything" after the first page — no deeper fetch.
        let mut pages = 0usize;
        let got = fetch_channel_history(&relay, &community, &general, 50, 8, None, None, crate::community::transport::Evidence::Quorum, |_| {
            pages += 1;
            false
        })
        .await
        .unwrap();
        assert_eq!(pages, 1, "the early stop is consulted once");
        assert_eq!(got.len(), 50, "only the newest page is fetched");
        assert_eq!(got.last().map(|f| f.event.opened().rumor.content.clone()).as_deref(), Some("msg 119"));
    }

    #[tokio::test]
    async fn a_same_second_history_wall_terminates_instead_of_looping() {
        // 60 messages in ONE second with a 25-wrap page: a second-granular
        // `until` can never page past the wall — the walk must step over it
        // (bounded loss, logged) rather than spin.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Wall", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        let group = channel_group_key(&community.community_root, &general, community.root_epoch);
        for i in 0..60usize {
            let rumor = chat::build_message_rumor(owner.public_key(), &general, community.root_epoch, &format!("burst {i}"), None, &[], vec![], 5_000_000 + i as u64);
            let (wrap, _) = chat::seal_chat_rumor(&rumor, &group, &owner, Timestamp::from_secs(5_000), false).unwrap();
            relay.publish(&wrap, &community.relays).await.unwrap();
        }
        let got = fetch_channel_history(&relay, &community, &general, 25, 8, None, None, crate::community::transport::Evidence::Quorum, |_| true).await.unwrap();
        assert!(got.len() >= 25, "at least the relay page is read");
        assert!(got.len() <= 60, "sane bound");
        // Termination is the assertion: reaching here means the wall didn't loop.
    }

    #[tokio::test]
    async fn a_grant_revoke_survives_a_withholding_relay() {
        // Floor persistence on the delegation plane: after the owner revokes an admin,
        // a relay serving only the OLD (still owner-signed) grant can't resurrect it.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Revoke", vec!["wss://good".into()], None).await.unwrap();
        let admin = Keys::generate();
        let rid = "d4".repeat(32);
        publish_role(&relay, &community, &owner, &admin_role(&rid, Permissions::MANAGE_METADATA), 1).await;
        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![rid.clone()], 1).await;
        follow_control(&relay, &community).await.unwrap().updated; // seed floors incl. the grant at v1
        publish_grant(&relay, &community, &owner, &admin.public_key(), vec![], 2).await; // revoke → grant floor v2
        follow_control(&relay, &community).await.unwrap().updated;

        // A stale relay serves only the grant prefix (v1, the live grant).
        inject_stale_prefix(&relay, &community, 1, "wss://stale").await;
        let mut stale = community.clone();
        stale.relays = vec!["wss://stale".into()];
        let floors = load_floors(&community);
        let editions = fetch_control(&relay, &stale).await;
        let authority = fold_authority(&stale, &editions, &floors);
        assert!(
            !authority.roles.is_authorized(&admin.public_key().to_hex(), Some(&owner.public_key().to_hex()), Permissions::MANAGE_METADATA),
            "the persisted grant floor refuses the rolled-back (re-granted) view"
        );
    }

    /// Load the current-epoch floors for a community (test mirror of follow_control).
    fn load_floors(community: &CommunityV2) -> Floors {
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::get_all_edition_heads_full(&cid_hex)
            .unwrap_or_default()
            .into_iter()
            .filter(|(_, f)| f.0 == community.root_epoch.0)
            .map(|(e, f)| (e, (f.1, f.2, f.3)))
            .collect()
    }

    /// Fetch + open every control edition at a community's control plane (test helper).
    async fn fetch_control(relay: &MemoryRelay, community: &CommunityV2) -> Vec<ParsedEdition> {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let q = Query { kinds: vec![stream::KIND_WRAP], authors: vec![group.pk_hex()], limit: Some(500), ..Default::default() };
        relay
            .fetch(&q, &community.relays)
            .await
            .unwrap_or_default()
            .iter()
            .filter_map(|w| control::open_control_edition(w, &group).ok().map(|(ed, _)| ed))
            .collect()
    }

    #[tokio::test]
    async fn follow_control_is_a_noop_on_a_freshly_created_community() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Fresh", vec!["wss://r".into()], None).await.unwrap();
        // Only the genesis editions exist; folding them reproduces the held view.
        assert!(follow_control(&relay, &community).await.unwrap().updated.is_none());
    }

    #[tokio::test]
    async fn follow_control_adds_a_new_public_channel_and_re_subscribes_it() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Grow", vec!["wss://r".into()], None).await.unwrap();
        let new_id = ChannelId([0x5a; 32]);
        publish_channel_edition(&relay, &community, &owner, &new_id, "announcements", false, 1, false).await;

        let updated = follow_control(&relay, &community).await.unwrap().updated.expect("a new channel changed the view");
        assert_eq!(updated.channels.len(), 2);
        let added = updated.channel(&new_id).expect("the new channel folded in");
        assert_eq!(added.name, "announcements");
        assert!(!added.private);
        assert_eq!(added.key, None, "a public channel derives from the root (no stored key)");

        // The new channel is now in the realtime author-set (it would be subscribed).
        let authors = super::super::realtime::plane_authors(std::slice::from_ref(&updated));
        let addr = channel_group_key(&updated.community_root, &new_id, updated.root_epoch).pk();
        assert!(authors.contains(&addr), "the added channel joins the live subscription");

        // Persisted: a reload sees it too.
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(reloaded.channel(&new_id).is_some());
    }

    #[tokio::test]
    async fn follow_control_renames_the_community_and_an_existing_channel() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Old Name", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        // A v2 metadata edition renames the community; a v2 channel edition renames #general.
        publish_community_meta(&relay, &community, &owner, "New Name", 2).await;
        publish_channel_edition(&relay, &community, &owner, &general, "lobby", false, 2, false).await;

        let updated = follow_control(&relay, &community).await.unwrap().updated.unwrap();
        assert_eq!(updated.name, "New Name");
        assert_eq!(updated.channel(&general).unwrap().name, "lobby");
        assert_eq!(updated.channels.len(), 1, "a rename doesn't add a channel");
    }

    #[tokio::test]
    async fn follow_control_deletes_a_channel() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Prune", vec!["wss://r".into()], None).await.unwrap();
        let extra = ChannelId([0x77; 32]);

        // The channel is first added and folded into the held view.
        publish_channel_edition(&relay, &community, &owner, &extra, "temp", false, 1, false).await;
        let with_extra = follow_control(&relay, &community).await.unwrap().updated.expect("added");
        assert!(with_extra.channel(&extra).is_some());

        // Then it's tombstoned — the delete (higher version) folds the held one back out.
        publish_channel_edition(&relay, &community, &owner, &extra, "temp", false, 2, true).await;
        let updated = follow_control(&relay, &with_extra).await.unwrap().updated.expect("removed");
        assert!(updated.channel(&extra).is_none(), "a deleted channel folds out");
        assert_eq!(updated.channels.len(), 1, "only #general remains");
    }

    /// Re-inject only the OLD prefix (every edition at/below `max_version`) of a
    /// community's control plane onto a second relay URL — the withholding-relay
    /// simulation: everything it serves is genuinely owner-signed, just stale.
    async fn inject_stale_prefix(relay: &MemoryRelay, community: &CommunityV2, max_version: u64, stale_relay: &str) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let query = Query { kinds: vec![stream::KIND_WRAP], authors: vec![group.pk_hex()], limit: Some(500), ..Default::default() };
        let wraps = relay.fetch(&query, &community.relays).await.unwrap();
        for w in &wraps {
            if let Ok((ed, _)) = control::open_control_edition(w, &group) {
                if ed.version <= max_version {
                    relay.inject(w, &[stale_relay.to_string()]);
                }
            }
        }
    }

    #[tokio::test]
    async fn a_withholding_relay_cannot_roll_back_a_rename() {
        // W2 persisted floor: after adopting the owner's v2 rename, a relay serving
        // only the (owner-signed) v1 genesis must not revert the held name.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Original", vec!["wss://good".into()], None).await.unwrap();
        publish_community_meta(&relay, &community, &owner, "Renamed", 2).await;

        let updated = follow_control(&relay, &community).await.unwrap().updated.expect("rename adopted");
        assert_eq!(updated.name, "Renamed");

        // The stale relay holds only the genesis prefix; point the follow at it.
        inject_stale_prefix(&relay, &community, 1, "wss://stale").await;
        let mut stale_view = updated.clone();
        stale_view.relays = vec!["wss://stale".into()];
        assert!(
            follow_control(&relay, &stale_view).await.unwrap().updated.is_none(),
            "a stale-only relay must not change the held view"
        );
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(held.name, "Renamed", "the persisted floor refuses the rollback");
    }

    #[tokio::test]
    async fn a_withholding_relay_cannot_resurrect_a_deleted_channel() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Prune2", vec!["wss://good".into()], None).await.unwrap();
        let extra = ChannelId([0x44; 32]);

        // A same-content metadata edit: no visible change (None), but the floor must
        // still advance to v2 (so the genesis metadata can't re-present below).
        publish_community_meta(&relay, &community, &owner, "Prune2", 2).await;
        assert!(follow_control(&relay, &community).await.unwrap().updated.is_none());

        publish_channel_edition(&relay, &community, &owner, &extra, "temp", false, 1, false).await;
        let with_extra = follow_control(&relay, &community).await.unwrap().updated.expect("added");
        publish_channel_edition(&relay, &community, &owner, &extra, "temp", false, 2, true).await;
        let pruned = follow_control(&relay, &with_extra).await.unwrap().updated.expect("removed");
        assert!(pruned.channel(&extra).is_none());

        // The stale relay serves the add (v1) but withholds the delete (v2).
        inject_stale_prefix(&relay, &community, 1, "wss://stale").await;
        let mut stale_view = pruned.clone();
        stale_view.relays = vec!["wss://stale".into()];
        assert!(
            follow_control(&relay, &stale_view).await.unwrap().updated.is_none(),
            "the withheld delete must not resurrect the channel"
        );
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(held.channel(&extra).is_none(), "the deleted channel stays deleted");
    }

    #[tokio::test]
    async fn a_new_epoch_bootstraps_past_an_old_epoch_floor() {
        // The Armada-convergence carve-out: a Refounding compacts the chain and
        // re-wraps a detached head at the NEW epoch's control plane. The old epoch's
        // floor must not block it — epoch-filtering makes the entity bootstrap.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Before", vec!["wss://good".into()], None).await.unwrap();
        publish_community_meta(&relay, &community, &owner, "Edited", 2).await;
        let updated = follow_control(&relay, &community).await.unwrap().updated.expect("edit adopted");
        assert_eq!(updated.name, "Edited");

        // Refounding lands (epoch bump saved by the rekey path); the compacted head
        // arrives DETACHED (high version, no prev) on the new epoch's plane.
        let refounded = rotate_view(&updated, updated.community_root, 1);
        crate::db::community::save_community_v2(&refounded).unwrap();
        publish_community_meta(&relay, &refounded, &owner, "Compacted", 5).await;

        let adopted = follow_control(&relay, &refounded).await.unwrap().updated.expect("compacted head adopted");
        assert_eq!(adopted.name, "Compacted", "a fresh epoch bootstraps despite the dangling prev");
        // The persisted floor is stamped with the epoch the FOLD ran under.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let heads = crate::db::community::get_all_edition_heads_epoched(&cid_hex).unwrap();
        assert!(
            heads.get(&cid_hex).is_some_and(|(e, v, _)| *e == 1 && *v == 5),
            "the adopted head carries the fold's epoch + version"
        );
    }

    #[tokio::test]
    async fn a_same_version_owner_fork_at_the_floor_converges_to_the_deterministic_winner() {
        // Two owner-signed editions at the SAME version (publish retry / two owner
        // devices): every client must land on the lower-inner-id winner. A hash-strict
        // floor would wedge here forever while Armada converges — the floor must
        // CONVERGE instead (the v1 decide() rule).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Fork", vec!["wss://r".into()], None).await.unwrap();
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let genesis_hash = head_hash_on_relay(&relay, &community, &community.id().0).await.unwrap();

        publish_community_meta(&relay, &community, &owner, "Ours", 2).await;
        let ours = follow_control(&relay, &community).await.unwrap().updated.expect("ours adopted");
        assert_eq!(ours.name, "Ours");

        // Our committed v2 edition's tiebreak id.
        let our_inner = {
            let q = Query { kinds: vec![stream::KIND_WRAP], authors: vec![group.pk_hex()], limit: Some(500), ..Default::default() };
            let wraps = relay.fetch(&q, &community.relays).await.unwrap();
            wraps
                .iter()
                .find_map(|w| {
                    control::open_control_edition(w, &group)
                        .ok()
                        .filter(|(ed, _)| ed.version == 2 && ed.vsk == vsk::COMMUNITY_METADATA)
                        .map(|(ed, _)| ed.inner_id)
                })
                .unwrap()
        };

        // Craft the concurrent fork so it WINS the deterministic tiebreak (vary the
        // authored timestamp until its inner id is lower).
        let meta = control::CommunityMetadata { name: "Theirs".into(), ..Default::default() };
        let content = serde_json::to_string(&meta).unwrap();
        let mut ts = 2_000u64;
        let fork_wrap = loop {
            let rumor = control::build_edition_rumor(owner.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 2, Some(&genesis_hash), &content, ts, None);
            let inner = rumor.id.unwrap().to_bytes();
            if inner < our_inner {
                break control::seal_control_edition(&rumor, &group, &owner, Timestamp::from_secs(ts)).unwrap().0;
            }
            ts += 1;
        };
        relay.publish(&fork_wrap, &community.relays).await.unwrap();

        let converged = follow_control(&relay, &ours).await.unwrap().updated.expect("fork winner adopted");
        assert_eq!(converged.name, "Theirs", "the floor converges to the lower-inner-id winner");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let held = crate::db::community::get_edition_head_inner_id(&cid_hex, &cid_hex).unwrap();
        assert!(held.is_some_and(|h| h < our_inner), "the persisted floor's tiebreak key moved to the winner");
    }

    #[tokio::test]
    async fn an_anchored_prefix_applies_while_a_gap_above_awaits_the_missing_link() {
        // v2 chains to the floor; v4 arrives but its v3 link is withheld. The
        // chain-verified prefix (v2) applies NOW — refuse-downgrade holds for it —
        // while the detached v4 waits. When v3 lands, the chain heals to v4.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Prefix", vec!["wss://r".into()], None).await.unwrap();
        let group = control::ControlPlane::of(&community).write_group().unwrap();

        publish_community_meta(&relay, &community, &owner, "Two", 2).await;
        let v2_hash = head_hash_on_relay(&relay, &community, &community.id().0).await.unwrap();

        // Craft v3 (held back) and v4 (published, chained to the withheld v3).
        let c3 = serde_json::to_string(&control::CommunityMetadata { name: "Three".into(), ..Default::default() }).unwrap();
        let r3 = control::build_edition_rumor(owner.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 3, Some(&v2_hash), &c3, 3_000, None);
        let (w3, _) = control::seal_control_edition(&r3, &group, &owner, Timestamp::from_secs(3_000)).unwrap();
        let (ed3, _) = control::open_control_edition(&w3, &group).unwrap();
        let c4 = serde_json::to_string(&control::CommunityMetadata { name: "Four".into(), ..Default::default() }).unwrap();
        let r4 = control::build_edition_rumor(owner.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 4, Some(&ed3.self_hash), &c4, 4_000, None);
        let (w4, _) = control::seal_control_edition(&r4, &group, &owner, Timestamp::from_secs(4_000)).unwrap();
        relay.publish(&w4, &community.relays).await.unwrap();

        let updated = follow_control(&relay, &community).await.unwrap().updated.expect("the verified prefix applies");
        assert_eq!(updated.name, "Two", "the anchored prefix lands; the detached v4 does not");

        relay.publish(&w3, &community.relays).await.unwrap();
        let healed = follow_control(&relay, &updated).await.unwrap().updated.expect("the chain heals");
        assert_eq!(healed.name, "Four", "once the link arrives, the head advances past the prefix");
    }

    #[tokio::test]
    async fn paging_rescues_a_floor_link_evicted_from_the_newest_window() {
        // The held floor is v2; the owner publishes v3, then a flood of foreign junk
        // wraps fills the newest window, then v4. Page 1 sees only v4 (detached →
        // gapped); paging older must recover v3 (and the floor link) and heal to v4.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Paged", vec!["wss://r".into()], None).await.unwrap();
        let group = control::ControlPlane::of(&community).write_group().unwrap();

        publish_community_meta(&relay, &community, &owner, "Two", 2).await;
        let base = follow_control(&relay, &community).await.unwrap().updated.expect("floor at v2");
        publish_community_meta(&relay, &base, &owner, "Three", 3).await; // ts 1_000 (old)
        let v3_hash = head_hash_on_relay(&relay, &community, &community.id().0).await.unwrap();

        // Rogue flood occupying the newest window (sealed to the control plane, but
        // non-owner — the authority gate drops them; they only crowd the page).
        let rogue = Keys::generate();
        for i in 0..(FOLLOW_PAGE as u64 - 1) {
            let rumor = control::build_edition_rumor(rogue.public_key(), vsk::CHANNEL_METADATA, &[0xCC; 32], 1, None, "{\"name\":\"junk\",\"private\":false}", 4_000 + i, None);
            let (w, _) = control::seal_control_edition(&rumor, &group, &rogue, Timestamp::from_secs(4_000 + i)).unwrap();
            relay.publish(&w, &community.relays).await.unwrap();
        }
        // v4 chained to the real v3 (crafted directly: the flood also blinds the
        // helper's own newest-window head lookup), timestamped newest of all.
        let c4 = serde_json::to_string(&control::CommunityMetadata { name: "Four".into(), ..Default::default() }).unwrap();
        let r4 = control::build_edition_rumor(owner.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 4, Some(&v3_hash), &c4, 10_000, None);
        let (w4, _) = control::seal_control_edition(&r4, &group, &owner, Timestamp::from_secs(10_000)).unwrap();
        relay.publish(&w4, &community.relays).await.unwrap();

        let healed = follow_control(&relay, &base).await.unwrap().updated.expect("paging recovered the chain");
        assert_eq!(healed.name, "Four", "the gap paged past the flood to the floor link");
    }

    #[tokio::test]
    async fn a_follow_after_delete_does_not_resurrect_the_community() {
        // A leave/delete racing an in-flight follow: the follow must not re-insert
        // the community row or floor rows past delete_community's wipe.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Gone", vec!["wss://r".into()], None).await.unwrap();
        publish_community_meta(&relay, &community, &owner, "Edited", 2).await;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::delete_community(&cid_hex).unwrap();

        assert!(
            follow_control(&relay, &community).await.unwrap().updated.is_none(),
            "a follow racing a delete is a no-op"
        );
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_none(), "the community stays deleted");
        assert!(crate::db::community::edition_head_entity_ids(&cid_hex).unwrap().is_empty(), "no orphan floor rows");
    }

    #[tokio::test]
    async fn a_rekey_follow_after_delete_does_not_resurrect_the_community() {
        // The rekey sibling of the follow_control guard: an owner rotation adopted
        // mid-race must not upsert the community row back after a leave/delete.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "GoneKeys", vec!["wss://r".into()], None).await.unwrap();
        let new_root = [0xB2; 32];
        publish_base_rotation(&relay, &community, &owner, &[owner.public_key()], &new_root, &community.community_root).await;
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::delete_community(&cid_hex).unwrap();

        let session = crate::db::current_session();
        let follow = follow_rekeys(&relay, &community, &session).await.unwrap();
        assert!(follow.updated.is_none() && !follow.self_removed, "a rekey follow racing a delete adopts nothing");
        assert!(crate::db::community::load_community_v2(community.id()).unwrap().is_none(), "the community stays deleted");
    }

    #[tokio::test]
    async fn a_joiner_bootstraps_the_highest_head_across_a_lost_middle_edition() {
        // {v1, v3} on the relays with v2 lost at publish time (a rate-limiting relay
        // that still ACKed): the genesis anchors, so an anchored-prefix-first fold
        // would take v1 and SEED the joiner's floor there — pinning them below the
        // head Armada shows, forever. A joiner (floor 0) must bootstrap v3.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Skip", bed.relays.clone(), None).await.unwrap();
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let genesis_hash = head_hash_on_relay(&bed.relay, &community, &community.id().0).await.unwrap();

        // v2 is crafted but NEVER published; v3 chains to it and is published.
        let c2 = serde_json::to_string(&control::CommunityMetadata { name: "Two".into(), ..Default::default() }).unwrap();
        let r2 = control::build_edition_rumor(owner.keys.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 2, Some(&genesis_hash), &c2, 2_000, None);
        let (w2, _) = control::seal_control_edition(&r2, &group, &owner.keys, Timestamp::from_secs(2_000)).unwrap();
        let (ed2, _) = control::open_control_edition(&w2, &group).unwrap();
        let c3 = serde_json::to_string(&control::CommunityMetadata { name: "Three".into(), ..Default::default() }).unwrap();
        let r3 = control::build_edition_rumor(owner.keys.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 3, Some(&ed2.self_hash), &c3, 3_000, None);
        let (w3, _) = control::seal_control_edition(&r3, &group, &owner.keys, Timestamp::from_secs(3_000)).unwrap();
        bed.relay.publish(&w3, &community.relays).await.unwrap();

        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        assert_eq!(joined.name, "Three", "the joiner bootstraps the highest signed head, not the anchored stale prefix");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        let head = crate::db::community::get_edition_head(&cid_hex, &cid_hex).unwrap();
        assert!(head.is_some_and(|(v, _)| v == 3), "the seeded floor is the bootstrap head");
    }

    #[tokio::test]
    async fn a_losing_same_version_fork_cannot_replace_the_held_floor() {
        // The refusal half of fork convergence: a relay withholding OUR committed
        // floor edition while serving only a same-version fork with a HIGHER inner
        // id must be treated as withholding — held state and floor unchanged.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Fork2", vec!["wss://good".into()], None).await.unwrap();
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let genesis_hash = head_hash_on_relay(&relay, &community, &community.id().0).await.unwrap();

        publish_community_meta(&relay, &community, &owner, "Ours", 2).await;
        let ours = follow_control(&relay, &community).await.unwrap().updated.expect("ours adopted");
        assert_eq!(ours.name, "Ours");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let held_before = crate::db::community::get_edition_head(&cid_hex, &cid_hex).unwrap().unwrap();
        let our_inner = crate::db::community::get_edition_head_inner_id(&cid_hex, &cid_hex).unwrap().unwrap();

        // Grind the fork to LOSE the tiebreak (higher inner id), then serve it —
        // with the genesis but WITHOUT our v2 — from a withholding relay.
        let meta = control::CommunityMetadata { name: "Theirs".into(), ..Default::default() };
        let content = serde_json::to_string(&meta).unwrap();
        let mut ts = 5_000u64;
        let fork_wrap = loop {
            let rumor = control::build_edition_rumor(owner.public_key(), vsk::COMMUNITY_METADATA, &community.id().0, 2, Some(&genesis_hash), &content, ts, None);
            if rumor.id.unwrap().to_bytes() > our_inner {
                break control::seal_control_edition(&rumor, &group, &owner, Timestamp::from_secs(ts)).unwrap().0;
            }
            ts += 1;
        };
        inject_stale_prefix(&relay, &community, 1, "wss://stale").await; // genesis only
        relay.inject(&fork_wrap, &["wss://stale".to_string()]);
        let mut stale_view = ours.clone();
        stale_view.relays = vec!["wss://stale".into()];

        assert!(
            follow_control(&relay, &stale_view).await.unwrap().updated.is_none(),
            "a losing fork served without our floor edition changes nothing"
        );
        let held_after = crate::db::community::get_edition_head(&cid_hex, &cid_hex).unwrap().unwrap();
        assert_eq!(held_after, held_before, "the floor row is untouched");
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(held.name, "Ours", "the held state is untouched");
    }

    #[tokio::test]
    async fn follow_control_ignores_a_non_owner_edition() {
        // A member holds the community_root, so they CAN seal a control edition —
        // but they aren't the owner, so the authority gate drops it (first cut:
        // owner-only). The rogue channel must never appear.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Guarded", vec!["wss://r".into()], None).await.unwrap();
        let rogue = Keys::generate();
        let rogue_id = ChannelId([0x99; 32]);
        publish_channel_edition(&relay, &community, &rogue, &rogue_id, "backdoor", false, 1, false).await;

        assert!(
            follow_control(&relay, &community).await.unwrap().updated.is_none(),
            "a non-owner control edition is not folded"
        );
    }

    #[tokio::test]
    async fn follow_control_records_a_new_private_channel_keyless_and_unreadable() {
        // A Private channel's key rides the rekey plane, not the control edition —
        // control-follow records it KEYLESS (epoch 0, the rekey-scan cursor), and
        // every read/send path refuses it until the key lands (never the root plane).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Priv", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = ChannelId([0x33; 32]);
        publish_channel_edition(&relay, &community, &owner, &priv_id, "mods", true, 1, false).await;

        let updated = follow_control(&relay, &community)
            .await
            .unwrap()
            .updated
            .expect("the keyless record is a change");
        let ch = updated.channel(&priv_id).expect("the private channel is recorded");
        assert!(ch.private && ch.key.is_none(), "recorded keyless");
        assert_eq!(ch.epoch, Epoch(0), "epoch 0 = the root generation (scan cursor)");
        assert!(updated.channel_read_coords(ch).is_empty(), "unreadable until keyed");
        assert!(
            fetch_channel(&relay, &updated, &priv_id, 50).await.unwrap().is_empty(),
            "a keyless fetch returns empty (and never queries the root plane)"
        );
        assert!(
            send_message(&relay, &updated, &priv_id, "nope").await.is_err(),
            "a keyless send refuses"
        );
        // The keyless record round-trips (the stored placeholder never surfaces
        // as a real key).
        let reloaded = crate::db::community::load_community_v2(updated.id()).unwrap().unwrap();
        let rch = reloaded.channel(&priv_id).unwrap();
        assert!(rch.private && rch.key.is_none() && rch.epoch == Epoch(0), "keyless survives reload");
        // And a bundle minted while keyless never carries the placeholder — a
        // MEMBER audience, so it's the keyless filter proving it (the link
        // filter would drop the channel for the weaker reason).
        let bundle = bundle_of(&reloaded, BundleAudience::Member(Keys::generate().public_key()), None, None, None);
        assert!(
            !bundle.channels.iter().any(|c| c.id == crate::simd::hex::bytes_to_hex_32(&priv_id.0)),
            "an ungrantable keyless channel stays out of invite bundles"
        );
    }

    #[tokio::test]
    async fn a_link_bundle_never_carries_a_private_channel_key() {
        // A link's audience holds no Role by construction (CORD-05), so a HELD
        // private key must never ride a link bundle — anyone with the URL would
        // get the channel. A member bundle carries it; a link bundle only the
        // public channels.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Leak", vec!["wss://r".into()], None).await.unwrap();
        create_private_channel(&relay, &community, "mods").await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let priv_hex = held
            .channels
            .iter()
            .find(|c| c.private)
            .map(|c| crate::simd::hex::bytes_to_hex_32(&c.id.0))
            .expect("the private channel is held WITH its key");

        let link = bundle_of(&held, BundleAudience::Link, None, None, None);
        assert!(
            !link.channels.iter().any(|c| c.id == priv_hex),
            "a held private key must never ride a link bundle"
        );
        assert!(
            link.channels.iter().any(|c| c.id != priv_hex),
            "the public channels still ride it"
        );

        // A member bundle grants it only to the ENTITLED. An unrelated npub holds
        // no scoped role, so it gets nothing; the creator (granted the companion
        // access role at create) gets the key.
        let stranger = bundle_of(&held, BundleAudience::Member(Keys::generate().public_key()), None, None, None);
        assert!(
            !stranger.channels.iter().any(|c| c.id == priv_hex),
            "an unentitled member gets no private key"
        );
        let mine = bundle_of(&held, BundleAudience::Member(me_pk().unwrap()), None, None, None);
        assert!(
            mine.channels.iter().any(|c| c.id == priv_hex),
            "the creator is entitled via the companion access role"
        );
    }

    /// Mint a server-scope role at `position` carrying `permissions`, grant it to
    /// `member`, and return its id. Used to build a RANKED roster (the owner-only
    /// tests can't exercise outranking, since the owner outranks everyone).
    async fn seat_ranked_role(
        relay: &MemoryRelay,
        community: &CommunityV2,
        member: &PublicKey,
        name: &str,
        position: u32,
        permissions: crate::community::roles::Permissions,
    ) -> String {
        let role_id = crate::crypto::sha256_hex(format!("test/role/{name}/{position}").as_bytes());
        let role = crate::community::roles::Role {
            role_id: role_id.clone(),
            name: name.to_string(),
            position,
            permissions,
            scope: crate::community::roles::RoleScope::Server,
            color: 0, extra: Default::default(),
        };
        set_role(relay, community, &role).await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let mut ids: Vec<String> = {
            let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
            let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
            roster.roles_of(&member.to_hex()).map(|r| r.role_id.clone()).collect()
        };
        if !ids.contains(&role_id) {
            ids.push(role_id.clone());
        }
        grant_roles(relay, &held, member, ids).await.unwrap();
        role_id
    }

    /// Become `who` without touching the account DB — the acting identity only.
    /// Enough to exercise an offer-side authority gate from a non-owner's seat.
    fn act_as(who: &Keys) {
        crate::state::MY_SECRET_KEY.store_from_keys(who, &[]);
        crate::state::set_my_public_key(who.public_key());
    }

    #[tokio::test]
    async fn a_moderator_cannot_revoke_channel_access_from_a_superior_and_the_channel_never_rotates() {
        // CORD-04 §2: the fold drops a Grant aimed at a peer or superior, but the
        // channel rotation is gated on the citation alone — so without an
        // offer-side rank check the Grant dies and the target is severed anyway.
        // The epoch assertion is the point: refusing the publish is worthless if
        // the rekey still runs.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Ranked", vec!["wss://r".into()], None).await.unwrap();
        let vault = create_private_channel(&relay, &community, "vault").await.unwrap();

        let superior = Keys::generate();
        let moderator = Keys::generate();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        grant_admin(&relay, &held, &superior.public_key()).await.unwrap();
        seat_ranked_role(
            &relay,
            &community,
            &moderator.public_key(),
            "Moderator",
            5,
            crate::community::roles::Permissions(crate::community::roles::Permissions::MANAGE_ROLES),
        )
        .await;

        // The superior legitimately holds the channel (granted by the owner).
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        grant_channel_access(&relay, &held, &vault, &superior.public_key()).await.unwrap();
        let before = crate::db::community::load_community_v2(community.id())
            .unwrap()
            .unwrap()
            .channel(&vault)
            .unwrap()
            .epoch;

        act_as(&moderator);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let err = revoke_channel_access(&relay, &held, &vault, &superior.public_key())
            .await
            .expect_err("a moderator must not act on an admin");
        assert!(err.contains("outrank"), "refused for RANK, not some incidental reason: {err}");

        let after = crate::db::community::load_community_v2(community.id())
            .unwrap()
            .unwrap()
            .channel(&vault)
            .unwrap()
            .epoch;
        assert_eq!(after, before, "the refusal must also stop the rotation — the rekey IS the severance");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&vault.0);
        let owner_hex = owner.public_key().to_hex();
        assert!(
            roster.is_entitled(Some(&owner_hex), &superior.public_key().to_hex(), &chan_hex, &[], &[]),
            "and the superior keeps their access role"
        );
    }

    #[tokio::test]
    async fn a_moderator_cannot_grant_channel_access_to_a_superior_but_the_owner_stays_grantable() {
        // The grant direction of the same gate. The owner is never a valid rank
        // target, yet IS a legitimate recipient of a key an admin minted — the
        // rank check must not swallow that case.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Ranked", vec!["wss://r".into()], None).await.unwrap();
        let vault = create_private_channel(&relay, &community, "vault").await.unwrap();

        let superior = Keys::generate();
        let moderator = Keys::generate();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        grant_admin(&relay, &held, &superior.public_key()).await.unwrap();
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&vault.0);
        // Scoped access so the moderator holds the channel key itself, else the
        // refusal could come from "we hold no key" and prove nothing about rank.
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        grant_channel_access(&relay, &held, &vault, &moderator.public_key()).await.unwrap();
        seat_ranked_role(
            &relay,
            &community,
            &moderator.public_key(),
            "Moderator",
            5,
            crate::community::roles::Permissions(crate::community::roles::Permissions::MANAGE_ROLES),
        )
        .await;

        act_as(&moderator);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let err = grant_channel_access(&relay, &held, &vault, &superior.public_key())
            .await
            .expect_err("a moderator must not grant against an admin");
        assert!(err.contains("outrank"), "refused for RANK: {err}");

        // Same seat, same channel, owner as the target: allowed.
        grant_channel_access(&relay, &held, &vault, &owner.public_key())
            .await
            .expect("the owner is not a rank target, and may still be handed a key");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let owner_hex = owner.public_key().to_hex();
        assert!(
            roster.is_entitled(Some(&owner_hex), &owner_hex, &chan_hex, &[], &[]),
            "the owner's access role landed"
        );
    }

    #[tokio::test]
    async fn a_private_channel_mints_its_access_role_and_entitlement_follows_the_grant() {
        // CORD-03/04: the roles scoped to a channel ARE its access list. Proven
        // against a NON-owner so the owner-is-always-entitled rule can't carry it.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Scoped", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = create_private_channel(&relay, &community, "mods").await.unwrap();
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let access = roster.channel_roles(&chan_hex);
        assert_eq!(access.len(), 1, "the channel minted exactly one access role");
        assert!(
            access[0].permissions == crate::community::roles::Permissions::empty(),
            "the access role confers READ access (key possession), never authority"
        );
        assert_eq!(access[0].name, "mods", "named for its channel");

        // A stranger holds no scoped role: unentitled, and no key rides their bundle.
        let stranger = Keys::generate().public_key();
        let owner_hex = community.owner().unwrap().to_hex();
        assert!(!roster.is_entitled(Some(&owner_hex), &stranger.to_hex(), &chan_hex, &[], &[]));

        // Granting the access role entitles them; revoking un-entitles them. Both
        // proven through the roster, which is what routes keys.
        let role_id = access[0].role_id.clone();
        assert!(
            roster.is_entitled(Some(&owner_hex), &stranger.to_hex(), &chan_hex, std::slice::from_ref(&role_id), &[]),
            "the grant overlay entitles before the fold catches up"
        );

        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        grant_channel_access(&relay, &held, &priv_id, &stranger).await.unwrap();
        let after = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(
            after.is_entitled(Some(&owner_hex), &stranger.to_hex(), &chan_hex, &[], &[]),
            "the grant landed in the local roster (the fold runs later)"
        );
        let vend = bundle_of(&held, BundleAudience::Member(stranger), None, None, None);
        assert!(
            vend.channels.iter().any(|c| c.id == chan_hex),
            "a now-entitled member's bundle carries the channel key"
        );

        revoke_channel_access(&relay, &held, &priv_id, &stranger).await.unwrap();
        let after = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(
            !after.is_entitled(Some(&owner_hex), &stranger.to_hex(), &chan_hex, &[], &[]),
            "the revoke dropped the access role"
        );
        let rotated = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(
            rotated.channel(&priv_id).unwrap().epoch,
            Epoch(2),
            "the revoke rotated the channel — a removal that doesn't rekey severs nobody"
        );

        // The access summary a bot reads back: roles, holders, and key state.
        let access = crate::VectorCore.channel_access(&cid_hex, &chan_hex).unwrap();
        assert_eq!(access["private"], true);
        assert_eq!(access["readable"], true, "we minted it, so we hold its key");
        assert_eq!(access["roles"].as_array().unwrap().len(), 1, "one access role");
        let holders = access["members"].as_array().unwrap();
        let me_npub = {
            use nostr_sdk::prelude::ToBech32;
            me_pk().unwrap().to_bech32().unwrap()
        };
        assert_eq!(holders.len(), 1, "only the creator holds it — the revoked member is gone");
        assert_eq!(holders[0], serde_json::json!(me_npub), "and that holder is the creator");
    }

    #[tokio::test]
    async fn a_public_ban_severs_the_private_channels_the_member_could_read() {
        // CORD-06 §1 per channel: a Public-community ban skips the Refounding
        // (CORD-05 §5), so without this rotation the banned member keeps each
        // held channel key and reads on forever. Only channels they could
        // actually reach rotate — the rest keep their epoch.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Sever", vec!["wss://r".into()], None).await.unwrap();
        let mods = create_private_channel(&relay, &community, "mods").await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let vault = create_private_channel(&relay, &held, "vault").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        let spammer = Keys::generate().public_key();
        let bystander = Keys::generate().public_key();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        grant_channel_access(&relay, &held, &mods, &spammer).await.unwrap();
        grant_channel_access(&relay, &held, &mods, &bystander).await.unwrap();

        // The ban composition's capture-then-strip: entitlement must be judged
        // from the PRE-strip roles, whether or not the strip has folded.
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let stripped: Vec<String> = roster.roles_of(&spammer.to_hex()).map(|r| r.role_id.clone()).collect();
        assert!(!stripped.is_empty(), "the grant landed before the strip");
        grant_roles(&relay, &held, &spammer, vec![]).await.unwrap();

        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let rotated = sever_banned_private_reads(&relay, &held, &[(spammer, stripped)]).await.unwrap();
        assert_eq!(rotated, 1, "exactly the one channel they could read rotated");
        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(after.channel(&mods).unwrap().epoch, Epoch(2), "the reachable channel advanced");
        assert_eq!(after.channel(&vault).unwrap().epoch, Epoch(1), "the unreachable channel did not");

        // A member who never had reach rotates nothing.
        let stranger = Keys::generate().public_key();
        let n = sever_banned_private_reads(&relay, &after, &[(stranger, Vec::new())]).await.unwrap();
        assert_eq!(n, 0, "no entitlement, no rotation");
    }

    #[tokio::test]
    async fn ban_severance_refuses_without_manage_channels() {
        // Offer-side mirror of `channel_rotator_ok`: readers honor a channel
        // rotation only from MANAGE_CHANNELS holders, so a BAN-only moderator
        // publishing one would adopt an epoch every reader rejects — a fork.
        let (bed, owner, moderator) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Gated", bed.relays.clone(), None).await.unwrap();
        create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        let rid = "c1".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &moderator.keys.public_key(), vec![rid], 1).await;
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let bundle = bundle_of(&held, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();

        bed.swap_to(&moderator);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let target = Keys::generate().public_key();
        let err = sever_banned_private_reads(&bed.relay, &joined, &[(target, Vec::new())]).await.unwrap_err();
        assert!(err.contains("permission"), "refused at the gate, not mid-rotation: {err}");
    }

    #[tokio::test]
    async fn set_banlist_refuses_an_author_the_fold_would_reject() {
        // The reader gates the banlist head on BAN and each added entry on strict
        // outrank. Publishing anyway would be silently void everywhere while the
        // author's own echo caches the phantom — fail-closed at the offer instead.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Soap", bed.relays.clone(), None).await.unwrap();
        let rid = "c2".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::BAN), 1).await;
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let bundle = bundle_of(&held, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();

        // A roleless member holds no BAN: refused before any publish.
        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let target = Keys::generate().public_key().to_hex();
        let err = set_banlist(&bed.relay, &joined, std::slice::from_ref(&target)).await.unwrap_err();
        assert!(err.contains("BAN"), "refused for the missing bit: {err}");
        assert!(
            crate::db::community::get_community_banlist(&crate::simd::hex::bytes_to_hex_32(&joined.id().0)).unwrap().is_empty(),
            "no phantom echo cached"
        );

        // Grant them BAN: adding a peer they don't outrank still refuses (the
        // fold drops per-target on outrank), while an unranked target passes.
        bed.swap_to(&owner);
        publish_grant(&bed.relay, &community, &owner.keys, &member.keys.public_key(), vec![rid.clone()], 1).await;
        let peer = Keys::generate().public_key();
        publish_grant(&bed.relay, &community, &owner.keys, &peer, vec![rid], 2).await;
        bed.swap_to(&member);
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let err = set_banlist(&bed.relay, &joined, &[peer.to_hex()]).await.unwrap_err();
        assert!(err.contains("outrank"), "an equal is not actionable: {err}");
        set_banlist(&bed.relay, &joined, std::slice::from_ref(&target)).await.unwrap();
    }

    #[tokio::test]
    async fn metadata_and_link_minting_refuse_unauthorized_authors() {
        // Both are reader-gated (MANAGE_METADATA; CREATE_INVITE on the registry) —
        // the offer must mirror or the SDK reports success on a void publish.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Locked", bed.relays.clone(), None).await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let bundle = bundle_of(&held, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();

        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let joined = crate::db::community::load_community_v2(joined.id()).unwrap().unwrap();
        let meta = control::CommunityMetadata {
            name: "Hijacked".into(),
            description: None,
            relays: vec![],
            icon: None,
            banner: None,
            custom: None,
            extra: Default::default(),
        };
        assert!(edit_community_metadata(&bed.relay, &joined, &meta).await.is_err(), "metadata edit refused");
        assert!(
            mint_public_link(&bed.relay, &joined, "https://vectorapp.io/i/", None, None).await.is_err(),
            "link minting refused"
        );
    }

    #[tokio::test]
    async fn a_vended_key_parks_until_the_fold_proves_the_grant_then_adopts() {
        // JSKitty's race: the vend can land BEFORE the control fold that proves
        // the grant. It must park quietly (a lagging fold is not an anomaly) and
        // be adopted on the re-judge once the roster catches up.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Vend", bed.relays.clone(), None).await.unwrap();
        let priv_id = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let real_key = held.channel(&priv_id).unwrap().key.unwrap();
        let owner_hex = community.owner().unwrap().to_hex();

        // Judge as the MEMBER — the owner is always entitled, so only a non-owner
        // can exercise the grant rule at all.
        bed.swap_to(&member);
        let me = member.keys.public_key().to_hex();
        // Their fold has the channel (control-follow records it keyless) but not
        // yet the grant that entitles them.
        let mut member_view = held.clone();
        if let Some(c) = member_view.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.key = None;
            c.epoch = Epoch(0);
        }

        // Ungranted → PARK, never refuse: this is exactly the "not synced enough
        // to judge" case, and it must stay quiet and retryable.
        let empty = crate::community::roles::CommunityRoles::default();
        assert!(matches!(
            judge_channel_key_vend(&member_view, &empty, &priv_id, Epoch(1), &owner_hex),
            VendVerdict::Park(_)
        ));

        // A channel our fold says is PUBLIC never heals — that's a spoof shape.
        let mut public_view = member_view.clone();
        if let Some(c) = public_view.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.private = false;
        }
        assert!(matches!(
            judge_channel_key_vend(&public_view, &empty, &priv_id, Epoch(1), &owner_hex),
            VendVerdict::Refuse(_)
        ));

        // An unknown channel parks (our fold may simply be behind), never refuses.
        assert!(matches!(
            judge_channel_key_vend(&member_view, &empty, &ChannelId([0x77; 32]), Epoch(1), &owner_hex),
            VendVerdict::Park(_)
        ));

        // Park the vend, then re-judge with a roster that still lacks our grant:
        // it must SURVIVE, not be discarded.
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 1, &real_key, &owner_hex).unwrap();
        crate::db::community::set_community_roles(&cid_hex, &empty, 0).unwrap();
        crate::db::community::save_community_v2(&member_view).unwrap();
        let session = crate::db::current_session();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(absorb_parked_channel_keys(&reloaded, &session).is_empty(), "unprovable vend adopts nothing");
        assert_eq!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().len(),
            1,
            "and stays parked for the next fold"
        );

        // The fold catches up: our grant lands, so the same vend now adopts.
        let access = crate::community::roles::Role {
            role_id: "44".repeat(32),
            name: "mods".into(),
            position: u32::MAX - 1,
            permissions: crate::community::roles::Permissions::empty(),
            scope: crate::community::roles::RoleScope::Channel(chan_hex.clone()),
            color: 0, extra: Default::default(),
        };
        let folded = crate::community::roles::CommunityRoles {
            grants: vec![crate::community::roles::MemberGrant { member: me.clone(), role_ids: vec![access.role_id.clone()] }],
            roles: vec![access],
        };
        crate::db::community::set_community_roles(&cid_hex, &folded, 1).unwrap();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let adopted = absorb_parked_channel_keys(&reloaded, &session);
        assert_eq!(adopted.len(), 1, "the re-judge adopts once the grant folds");

        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let ch = after.channel(&priv_id).unwrap();
        assert_eq!(ch.key, Some(real_key), "adopted the vended key");
        assert_eq!(ch.epoch, Epoch(1));
        assert!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().is_empty(),
            "and the park is discharged"
        );
    }

    #[tokio::test]
    async fn a_vend_from_an_unentitled_sender_is_never_seated_but_survives_for_the_real_one() {
        // Vend rule 4: the VENDOR must be entitled too. Every other test sends as
        // the owner, which short-circuits the check one line above it, so the rule
        // itself has never been exercised. Both halves matter — a stranger must not
        // seat a key, and their row must not consume the slot either, which is the
        // suppression the candidate table exists to prevent.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Vendors", bed.relays.clone(), None).await.unwrap();
        let priv_id = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let owner_hex = community.owner().unwrap().to_hex();

        bed.swap_to(&member);
        let mut member_view = held.clone();
        if let Some(c) = member_view.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.key = None;
            c.epoch = Epoch(0);
        }
        crate::db::community::save_community_v2(&member_view).unwrap();

        // WE are entitled (rule 3 passes, so the judge reaches rule 4). The vendor
        // below is not, and is not the owner.
        let access = crate::community::roles::Role {
            role_id: "66".repeat(32),
            name: "mods".into(),
            position: u32::MAX - 1,
            permissions: crate::community::roles::Permissions::empty(),
            scope: crate::community::roles::RoleScope::Channel(chan_hex.clone()),
            color: 0, extra: Default::default(),
        };
        let roster = crate::community::roles::CommunityRoles {
            grants: vec![crate::community::roles::MemberGrant {
                member: member.keys.public_key().to_hex(),
                role_ids: vec![access.role_id.clone()],
            }],
            roles: vec![access],
        };
        crate::db::community::set_community_roles(&cid_hex, &roster, 1).unwrap();

        let stranger_hex = Keys::generate().public_key().to_hex();
        let junk = [0x11; 32];
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 0, &junk, &stranger_hex).unwrap();

        let session = crate::db::current_session();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(
            absorb_parked_channel_keys(&reloaded, &session).is_empty(),
            "an unentitled vendor seats nothing"
        );
        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(after.channel(&priv_id).unwrap().key, None, "the channel is still keyless");
        assert_eq!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().len(),
            1,
            "parked, not refused — the vendor's own entitlement may simply not have folded here yet"
        );

        // The entitled vendor's key lands despite the stranger's row sitting there.
        let real = [0x5a; 32];
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 0, &real, &owner_hex).unwrap();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(
            absorb_parked_channel_keys(&reloaded, &session).len(),
            1,
            "the genuine vend is seated — a stranger cannot occupy the slot"
        );
        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(after.channel(&priv_id).unwrap().key, Some(real), "and it is the ENTITLED vendor's key");
        assert!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().is_empty(),
            "both candidates discharge once one is seated"
        );
    }

    #[tokio::test]
    async fn a_vend_at_epoch_zero_is_adopted_onto_a_keyless_channel() {
        // Live cross-client finding: a peer that mints born-private channels at
        // epoch 0 vends epoch 0, which collides with our keyless cursor (also 0).
        // The monotonic guard (`new > current`) would refuse the only key we are
        // ever offered, and refuse it SILENTLY. First delivery is not a rotation.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "EpochZero", bed.relays.clone(), None).await.unwrap();
        let priv_id = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let vended = [0x5a; 32];
        let owner_hex = community.owner().unwrap().to_hex();

        bed.swap_to(&member);
        // The member's view: channel known, keyless, parked at the epoch-0 cursor.
        let mut member_view = held.clone();
        if let Some(c) = member_view.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.key = None;
            c.epoch = Epoch(0);
        }
        crate::db::community::save_community_v2(&member_view).unwrap();

        // Entitle them, then park a vend AT EPOCH 0 (what the peer actually sends).
        let access = crate::community::roles::Role {
            role_id: "77".repeat(32),
            name: "mods".into(),
            position: u32::MAX - 1,
            permissions: crate::community::roles::Permissions::empty(),
            scope: crate::community::roles::RoleScope::Channel(chan_hex.clone()),
            color: 0, extra: Default::default(),
        };
        let roster = crate::community::roles::CommunityRoles {
            grants: vec![crate::community::roles::MemberGrant {
                member: member.keys.public_key().to_hex(),
                role_ids: vec![access.role_id.clone()],
            }],
            roles: vec![access],
        };
        crate::db::community::set_community_roles(&cid_hex, &roster, 1).unwrap();
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 0, &vended, &owner_hex).unwrap();

        let session = crate::db::current_session();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let adopted = absorb_parked_channel_keys(&reloaded, &session);
        assert_eq!(adopted.len(), 1, "an epoch-0 vend onto a keyless channel is adopted");

        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let ch = after.channel(&priv_id).unwrap();
        assert_eq!(ch.key, Some(vended), "the key actually landed on the row");
        assert_eq!(ch.epoch, Epoch(0), "at the epoch the vendor named");
        assert!(
            !after.channel_read_coords(ch).is_empty(),
            "and the channel is readable — the whole point"
        );
        assert!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().is_empty(),
            "the park is discharged"
        );
    }

    #[tokio::test]
    async fn a_wildly_ahead_vend_epoch_is_refused_not_seated() {
        // The channel head is MONOTONIC, so over-advancing it can never be walked
        // back: every genuine rotation afterwards lands at head+1, reads as stale,
        // and the channel dies for us with no heal path at all. An entitled
        // insider vending a garbage key costs isolation (accepted); one vending a
        // garbage EPOCH would cost the channel permanently, which is not.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Poison", bed.relays.clone(), None).await.unwrap();
        let priv_id = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let owner_hex = community.owner().unwrap().to_hex();

        bed.swap_to(&member);
        let mut member_view = held.clone();
        if let Some(c) = member_view.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.key = None;
            c.epoch = Epoch(0);
        }
        crate::db::community::save_community_v2(&member_view).unwrap();
        let access = crate::community::roles::Role {
            role_id: "99".repeat(32),
            name: "mods".into(),
            position: u32::MAX - 1,
            permissions: crate::community::roles::Permissions::empty(),
            scope: crate::community::roles::RoleScope::Channel(chan_hex.clone()),
            color: 0, extra: Default::default(),
        };
        let roster = crate::community::roles::CommunityRoles {
            grants: vec![crate::community::roles::MemberGrant {
                member: member.keys.public_key().to_hex(),
                role_ids: vec![access.role_id.clone()],
            }],
            roles: vec![access],
        };
        crate::db::community::set_community_roles(&cid_hex, &roster, 1).unwrap();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();

        // Everything else about this vend is valid — only the epoch is absurd.
        assert!(matches!(
            judge_channel_key_vend(&reloaded, &roster, &priv_id, Epoch(1 << 40), &owner_hex),
            VendVerdict::Refuse(_)
        ));
        // REFUSED, not parked: a row nothing can ever discharge is its own leak.
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 1 << 40, &[0xEE; 32], &owner_hex).unwrap();
        let session = crate::db::current_session();
        assert!(absorb_parked_channel_keys(&reloaded, &session).is_empty(), "a poison epoch adopts nothing");
        assert!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().is_empty(),
            "and the row is discharged rather than parked forever"
        );
        // The head is untouched, so the genuine vend still lands afterwards.
        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(after.channel(&priv_id).unwrap().epoch, Epoch(0), "head never advanced");
        assert!(matches!(
            judge_channel_key_vend(&after, &roster, &priv_id, Epoch(1), &owner_hex),
            VendVerdict::Accept
        ));
    }

    #[tokio::test]
    async fn a_channel_rename_lands_locally_without_waiting_for_the_fold() {
        // The fold is the authority but runs later, so publishing alone leaves the
        // edit reading back stale — it looks like the rename silently failed.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Renames", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = create_private_channel(&relay, &community, "mods").await.unwrap();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let key_before = held.channel(&priv_id).unwrap().key;

        let mut meta = held.channel(&priv_id).unwrap().metadata();
        meta.name = "staff".into();
        edit_channel_metadata(&relay, &held, &priv_id, &meta).await.unwrap();

        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let ch = after.channel(&priv_id).unwrap();
        assert_eq!(ch.name, "staff", "the rename is visible immediately");
        assert!(ch.private, "and privacy survives the edit");
        assert_eq!(ch.key, key_before, "as does the key — a rename is not a rotation");
    }

    #[tokio::test]
    async fn a_channel_rename_carries_its_companion_access_role() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Renames", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = create_private_channel(&relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let before = roster.channel_roles(&chan_hex);
        assert_eq!(before.len(), 1, "one companion role, minted at create");
        assert_eq!(before[0].name, "mods", "named after the channel it gates");
        let role_id = before[0].role_id.clone();

        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let mut meta = held.channel(&priv_id).unwrap().metadata();
        meta.name = "staff".into();
        edit_channel_metadata(&relay, &held, &priv_id, &meta).await.unwrap();

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let after = roster.channel_roles(&chan_hex);
        assert_eq!(after.len(), 1, "renamed in place, never duplicated");
        assert_eq!(after[0].role_id, role_id, "a rename is a versioned edit of the same id");
        assert_eq!(after[0].name, "staff", "the access role followed the channel");
        assert_eq!(
            after[0].permissions,
            crate::community::roles::Permissions::empty(),
            "and still confers read access, never authority"
        );
    }

    #[tokio::test]
    async fn a_customised_access_role_name_survives_a_channel_rename() {
        // The label is cosmetic — entitlement rides the scope. Overwriting a name
        // someone chose deliberately is the surprising half of "keep them in step".
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Renames", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = create_private_channel(&relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let mut role = roster.channel_roles(&chan_hex)[0].clone();
        role.name = "Lab Insiders".into();
        set_role(&relay, &community, &role).await.unwrap();
        merge_local_roster(&cid_hex, Some(&role), None);

        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let mut meta = held.channel(&priv_id).unwrap().metadata();
        meta.name = "staff".into();
        edit_channel_metadata(&relay, &held, &priv_id, &meta).await.unwrap();

        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert_eq!(
            roster.channel_roles(&chan_hex)[0].name,
            "Lab Insiders",
            "a deliberate name is left alone"
        );
    }

    #[tokio::test]
    async fn a_squatted_park_row_cannot_suppress_the_genuine_vend() {
        // Parking is reachable by ANY npub that can gift-wrap us — the bundle
        // self-certifies and its inputs are public for a public community. With a
        // single slot per channel, a stranger could pre-park and the admin's real
        // vend would be a silent no-op, leaving the member keyless with no retry.
        // Candidates + judge-them-all is what closes that.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Squat", bed.relays.clone(), None).await.unwrap();
        let priv_id = create_private_channel(&bed.relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan_hex = crate::simd::hex::bytes_to_hex_32(&priv_id.0);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let real_key = held.channel(&priv_id).unwrap().key.unwrap();
        let owner_hex = community.owner().unwrap().to_hex();

        bed.swap_to(&member);
        let mut member_view = held.clone();
        if let Some(c) = member_view.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.key = None;
            c.epoch = Epoch(0);
        }
        crate::db::community::save_community_v2(&member_view).unwrap();
        let access = crate::community::roles::Role {
            role_id: "aa".repeat(32),
            name: "mods".into(),
            position: u32::MAX - 1,
            permissions: crate::community::roles::Permissions::empty(),
            scope: crate::community::roles::RoleScope::Channel(chan_hex.clone()),
            color: 0, extra: Default::default(),
        };
        let roster = crate::community::roles::CommunityRoles {
            grants: vec![crate::community::roles::MemberGrant {
                member: member.keys.public_key().to_hex(),
                role_ids: vec![access.role_id.clone()],
            }],
            roles: vec![access],
        };
        crate::db::community::set_community_roles(&cid_hex, &roster, 1).unwrap();

        // A stranger squats FIRST, at a higher epoch than the genuine vend.
        let stranger = Keys::generate().public_key().to_hex();
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 9, &[0xBA; 32], &stranger).unwrap();
        // The admin's real vend arrives after, at the true epoch.
        crate::db::community::park_channel_key(&cid_hex, &chan_hex, 1, &real_key, &owner_hex).unwrap();
        assert_eq!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().len(),
            2,
            "the squatter never displaces the genuine vend — both are candidates"
        );

        let session = crate::db::current_session();
        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let adopted = absorb_parked_channel_keys(&reloaded, &session);
        assert_eq!(adopted.len(), 1, "exactly one adoption");

        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let ch = after.channel(&priv_id).unwrap();
        assert_eq!(ch.key, Some(real_key), "the OWNER's key won, not the squatter's");
        assert_eq!(ch.epoch, Epoch(1), "at the genuine epoch");
        assert!(
            crate::db::community::get_pending_channel_keys(&cid_hex).unwrap().is_empty(),
            "and every candidate for the channel is discharged"
        );
    }

    #[tokio::test]
    async fn revoking_without_a_folded_access_role_refuses_instead_of_evicting_everyone() {
        // With no access role folded, the retained-set filter matches NOBODY, so
        // the rotation would cut off every legitimately entitled member while the
        // Grant it published revoked nothing. Reachable with no attacker: the
        // channel was made on another admin's client and its role hasn't folded.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "NoRole", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = create_private_channel(&relay, &community, "mods").await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let before = held.channel(&priv_id).unwrap().epoch;

        // Neither the cache nor the plane serves the access role — a withholding
        // relay, or a channel minted on another admin's client. (Wiping only the
        // cache is no longer enough: the revoke re-fetches authority first.)
        crate::db::community::set_community_roles(&cid_hex, &crate::community::roles::CommunityRoles::default(), 0).unwrap();
        let mut blind = held.clone();
        blind.relays = vec!["wss://empty".into()];
        let err = revoke_channel_access(&relay, &blind, &priv_id, &Keys::generate().public_key())
            .await
            .unwrap_err();
        assert!(err.contains("has not folded"), "refuses with a retryable reason: {err}");

        let after = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(after.channel(&priv_id).unwrap().epoch, before, "and rotates nothing");
    }

    // ── Live rekey-follow ────────────────────────────────────────────────────

    /// Publish an owner-grammar base rotation (Refounding) delivering `new_root`
    /// to each recipient. `rotator` is the seal signer (owner for a legit rotation,
    /// a stranger for the authority test); `prev_key` is the root it claims to
    /// extend (mismatch → a fork).
    async fn publish_base_rotation(
        relay: &MemoryRelay,
        community: &CommunityV2,
        rotator: &Keys,
        recipients: &[PublicKey],
        new_root: &[u8; 32],
        prev_key: &[u8; 32],
    ) {
        let new_epoch = Epoch(community.root_epoch.0 + 1);
        let prev_epoch = community.root_epoch;
        let prev_commit = super::super::derive::epoch_key_commitment(prev_epoch, prev_key);
        let group = base_rekey_group_key(&community.community_root, community.id(), new_epoch);
        let blobs: Vec<_> = recipients
            .iter()
            .map(|r| rekey::build_blob_local(rotator.secret_key(), &rotator.public_key().to_bytes(), r, RekeyScope::Root, new_epoch, new_root).unwrap())
            .collect();
        let events = rekey::build_rekey_chunks_local(rotator, &group, RekeyScope::Root, new_epoch, prev_epoch, &prev_commit, &blobs, 2_000, my_authority_citation(community, &rotator.public_key()).as_ref(), false).unwrap();
        for e in &events {
            relay.publish(e, &community.relays).await.unwrap();
        }
    }

    /// A base rotation that carries the containment marker (CORD-06 Severing).
    async fn publish_severing_base_rotation(
        relay: &MemoryRelay,
        community: &CommunityV2,
        rotator: &Keys,
        recipients: &[PublicKey],
        new_root: &[u8; 32],
        prev_key: &[u8; 32],
    ) {
        let new_epoch = Epoch(community.root_epoch.0 + 1);
        let prev_epoch = community.root_epoch;
        let prev_commit = super::super::derive::epoch_key_commitment(prev_epoch, prev_key);
        let group = base_rekey_group_key(&community.community_root, community.id(), new_epoch);
        let blobs: Vec<_> = recipients
            .iter()
            .map(|r| rekey::build_blob_local(rotator.secret_key(), &rotator.public_key().to_bytes(), r, RekeyScope::Root, new_epoch, new_root).unwrap())
            .collect();
        let events = rekey::build_rekey_chunks_local(rotator, &group, RekeyScope::Root, new_epoch, prev_epoch, &prev_commit, &blobs, 2_000, my_authority_citation(community, &rotator.public_key()).as_ref(), true).unwrap();
        for e in &events {
            relay.publish(e, &community.relays).await.unwrap();
        }
    }

    /// Attach a Private channel (key + epoch) to a held community and persist it.
    fn add_private_channel(community: &mut CommunityV2, id: ChannelId, key: [u8; 32], epoch: Epoch) {
        community.channels.push(ChannelV2 { id, name: "mods".into(), private: true, key: Some(key), epoch, voice: None, meta_custom: None, meta_extra: Default::default() });
        crate::db::community::save_community_v2(community).unwrap();
    }

    #[tokio::test]
    async fn follow_rekeys_is_a_noop_without_rotations() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Still", vec!["wss://r".into()], None).await.unwrap();
        let session = crate::db::current_session();
        let follow = follow_rekeys(&relay, &community, &session).await.unwrap();
        assert!(follow.updated.is_none() && !follow.self_removed, "no rotation → nothing to adopt");
    }

    #[tokio::test]
    async fn follow_rekeys_adopts_an_owner_base_rotation() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Refound", vec!["wss://r".into()], None).await.unwrap();
        let new_root = [0xB1; 32];
        // Owner rotates the base to epoch 1, delivering the new root to me.
        publish_base_rotation(&relay, &community, &owner, &[owner.public_key()], &new_root, &community.community_root).await;

        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("adopted");
        assert_eq!(updated.root_epoch, Epoch(1), "advanced one epoch");
        assert_eq!(updated.community_root, new_root, "adopted the fresh root");
        // The public channel now reads under the NEW root/epoch (its address moved).
        let addr = super::super::realtime::plane_authors(std::slice::from_ref(&updated));
        let general = updated.channels[0].id;
        let new_chat = channel_group_key(&new_root, &general, Epoch(1)).pk();
        assert!(addr.contains(&new_chat), "the public channel re-addresses under the new root");
    }

    #[tokio::test]
    async fn follow_rekeys_adopts_an_owner_private_channel_rotation() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "PrivRot", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = ChannelId([0x33; 32]);
        add_private_channel(&mut community, priv_id, [0x44; 32], Epoch(0));

        // Owner rotates the private channel to epoch 1 with a fresh key, delivered to me.
        let new_key = [0x55; 32];
        let prev_commit = super::super::derive::epoch_key_commitment(Epoch(0), &[0x44; 32]);
        let group = channel_rekey_group_key(&community.community_root, &priv_id, Epoch(1));
        let blob = rekey::build_blob_local(owner.secret_key(), &owner.public_key().to_bytes(), &owner.public_key(), RekeyScope::Channel(priv_id), Epoch(1), &new_key).unwrap();
        let events = rekey::build_rekey_chunks_local(&owner, &group, RekeyScope::Channel(priv_id), Epoch(1), Epoch(0), &prev_commit, &[blob], 2_000, None, false).unwrap();
        for e in &events {
            relay.publish(e, &community.relays).await.unwrap();
        }

        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("adopted");
        let ch = updated.channel(&priv_id).unwrap();
        assert_eq!(ch.epoch, Epoch(1), "the private channel advanced an epoch");
        assert_eq!(ch.key, Some(new_key), "adopted the fresh channel key");
        assert_eq!(updated.root_epoch, Epoch(0), "the base is untouched by a channel rotation");
    }

    #[tokio::test]
    async fn a_whole_channel_fan_rotates_in_one_hop_without_crossing_keys() {
        // The fan is fetched concurrently and keyed by (channel, addressing root). A
        // mis-keyed prefetch cannot hand channel A's key to channel B — the blob's
        // scope is authenticated, so a wrong batch is refused rather than adopted — but
        // it CAN starve a channel of the chunks that are sitting on the plane for it,
        // which reads as "that channel never rotates" and strands its members.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "FanRot", vec!["wss://r".into()], None).await.unwrap();

        // Distinct held key AND distinct fresh key per channel — a swap between any
        // two is then visible as an equality failure rather than a silent pass.
        let fan: Vec<(ChannelId, [u8; 32], [u8; 32])> = (0u8..12)
            .map(|i| (ChannelId([0x30 + i; 32]), [0x40 + i; 32], [0x80 + i; 32]))
            .collect();
        for (id, held, _) in &fan {
            add_private_channel(&mut community, *id, *held, Epoch(0));
        }

        for (id, held, fresh) in &fan {
            let prev_commit = super::super::derive::epoch_key_commitment(Epoch(0), held);
            let group = channel_rekey_group_key(&community.community_root, id, Epoch(1));
            let blob = rekey::build_blob_local(owner.secret_key(), &owner.public_key().to_bytes(), &owner.public_key(), RekeyScope::Channel(*id), Epoch(1), fresh).unwrap();
            let events = rekey::build_rekey_chunks_local(&owner, &group, RekeyScope::Channel(*id), Epoch(1), Epoch(0), &prev_commit, &[blob], 2_000, None, false).unwrap();
            for e in &events {
                relay.publish(e, &community.relays).await.unwrap();
            }
        }

        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("adopted");
        for (id, _, fresh) in &fan {
            let ch = updated.channel(id).expect("channel survived the fan");
            assert_eq!(ch.epoch, Epoch(1), "every channel in the fan advanced");
            assert_eq!(ch.key, Some(*fresh), "each channel adopted ITS OWN key, not a neighbour's");
        }
    }

    #[tokio::test]
    async fn follow_rekeys_ignores_a_non_owner_rotation() {
        // A member holds the community_root, so they can derive the rekey group key
        // and mint a rotation — but they aren't the owner, so it's not adopted.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Guarded", vec!["wss://r".into()], None).await.unwrap();
        let rogue = Keys::generate();
        publish_base_rotation(&relay, &community, &rogue, &[rogue.public_key()], &[0xEE; 32], &community.community_root).await;

        let session = crate::db::current_session();
        let follow = follow_rekeys(&relay, &community, &session).await.unwrap();
        assert!(follow.updated.is_none() && !follow.self_removed, "a non-owner rotation is not adopted");
    }

    #[tokio::test]
    async fn follow_rekeys_ignores_a_rotation_off_the_wrong_prev() {
        // A rotation whose prevcommit doesn't match the key I hold is a fork, not an
        // extension — never adopted (would splice me onto an unrelated chain).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Forked", vec!["wss://r".into()], None).await.unwrap();
        // prev_key ≠ the real community_root → the continuity check reads Fork.
        publish_base_rotation(&relay, &community, &owner, &[owner.public_key()], &[0xB2; 32], &[0x00; 32]).await;

        let session = crate::db::current_session();
        let follow = follow_rekeys(&relay, &community, &session).await.unwrap();
        assert!(follow.updated.is_none(), "a fork off the wrong prev is not adopted");
    }

    #[tokio::test]
    async fn follow_rekeys_holds_on_an_incomplete_rotation() {
        // A 2-chunk rotation with only chunk 1 present can never conclude — not an
        // adoption, and crucially NOT a removal (a missing chunk might carry my blob).
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Partial", vec!["wss://r".into()], None).await.unwrap();
        let new_epoch = Epoch(1);
        let prev_commit = super::super::derive::epoch_key_commitment(Epoch(0), &community.community_root);
        let group = base_rekey_group_key(&community.community_root, community.id(), new_epoch);
        // Chunk 1 of a declared 2, carrying someone else's blob (not mine).
        let other = Keys::generate();
        let blob = rekey::build_blob_local(owner.secret_key(), &owner.public_key().to_bytes(), &other.public_key(), RekeyScope::Root, new_epoch, &[0xB3; 32]).unwrap();
        let rumor = rekey::build_rekey_rumor(owner.public_key(), RekeyScope::Root, new_epoch, Epoch(0), &prev_commit, &[blob], 1, 2, 2_000, None, false).unwrap();
        let (wrap, _) = rekey::seal_rekey_chunk(&rumor, &group, &owner, Timestamp::from_secs(2_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();

        let session = crate::db::current_session();
        let follow = follow_rekeys(&relay, &community, &session).await.unwrap();
        assert!(follow.updated.is_none() && !follow.self_removed, "an incomplete rotation neither adopts nor removes");
    }

    #[tokio::test]
    async fn follow_rekeys_removes_a_member_dropped_by_a_base_rotation() {
        // Realistic two-actor removal: the owner Refounds the base and delivers the
        // new root to a THIRD party, not the member — a complete rotation with no
        // blob for the member is a removal.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Evict", bed.relays.clone(), None).await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap();

        // Owner rotates, delivering only to a stranger (the member is dropped).
        bed.swap_to(&owner);
        let stranger = Keys::generate();
        publish_base_rotation(&bed.relay, &community, &owner.keys, &[stranger.public_key()], &[0xC4; 32], &community.community_root).await;

        // The member's follow concludes removal (a complete rotation without their blob).
        bed.swap_to(&member);
        let session = crate::db::current_session();
        let follow = follow_rekeys(&bed.relay, &joined, &session).await.unwrap();
        assert!(follow.self_removed, "a complete base rotation dropping the member removes them");
        assert!(follow.updated.is_none(), "a removed member adopts nothing");
    }

    #[tokio::test]
    async fn follow_rekeys_finds_a_channel_rekey_under_an_archived_prior_root() {
        // PROTO-B2 regression: a Refounding's channel rekeys ride the PRIOR root
        // (CORD-06 §3). A follower who adopted the BASE first (the live window:
        // the base crate landed and was walked before the channel crates) must
        // still find them — the lookup fans across the archived roots, not just
        // the current one.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "Strand", vec!["wss://r".into()], None).await.unwrap();
        let root0 = community.community_root;
        let priv_id = ChannelId([0x33; 32]);
        let key1 = [0x44; 32];
        add_private_channel(&mut community, priv_id, key1, Epoch(1));

        // The refounder's channel rekey (1 → 2), sealed + addressed under the PRIOR
        // root (root0), delivering the fresh key to me.
        let key2 = [0x55; 32];
        let prev_commit = super::super::derive::epoch_key_commitment(Epoch(1), &key1);
        let group = channel_rekey_group_key(&root0, &priv_id, Epoch(2));
        let blob = rekey::build_blob_local(owner.secret_key(), &owner.public_key().to_bytes(), &owner.public_key(), RekeyScope::Channel(priv_id), Epoch(2), &key2).unwrap();
        for e in rekey::build_rekey_chunks_local(&owner, &group, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &prev_commit, &[blob], 2_000, None, false).unwrap() {
            relay.publish(&e, &community.relays).await.unwrap();
        }

        // Simulate the base having ALREADY advanced (the stranding order): the head
        // moved to a fresh root while root0 sits in the epoch-key archive (where
        // genesis put it).
        community.community_root = [0xB7; 32];
        community.root_epoch = Epoch(1);
        crate::db::community::save_community_v2(&community).unwrap();

        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("the prior-root crate is found");
        let ch = updated.channel(&priv_id).unwrap();
        assert_eq!(ch.epoch, Epoch(2), "the channel advanced despite the moved base");
        assert_eq!(ch.key, Some(key2), "adopted the key delivered under the prior root");
    }

    #[tokio::test]
    async fn follow_rekeys_keyless_cursor_walks_past_an_excluding_rotation_then_adopts() {
        // A keyless private channel (announced by vsk-2, key not yet held) has no
        // chain, so its epoch is a scan cursor: a complete rotation that excludes
        // us advances the cursor (never a removal — we were never in); a later
        // rotation that includes us is the entry point.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "Cursor", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = ChannelId([0x66; 32]);
        community.channels.push(ChannelV2 { id: priv_id, name: "vault".into(), private: true, key: None, epoch: Epoch(0), voice: None, meta_custom: None, meta_extra: Default::default() });
        crate::db::community::save_community_v2(&community).unwrap();
        let community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(community.channel(&priv_id).unwrap().key.is_none(), "keyless survives the round-trip");

        // Epoch 1: the creation delivery went to a stranger only (pre-dates us).
        let stranger = Keys::generate();
        let key1 = [0x71; 32];
        let pc1 = super::super::derive::epoch_key_commitment(Epoch(0), &community.community_root);
        let g1 = channel_rekey_group_key(&community.community_root, &priv_id, Epoch(1));
        let b1 = rekey::build_blob_local(owner.secret_key(), &owner.public_key().to_bytes(), &stranger.public_key(), RekeyScope::Channel(priv_id), Epoch(1), &key1).unwrap();
        for e in rekey::build_rekey_chunks_local(&owner, &g1, RekeyScope::Channel(priv_id), Epoch(1), Epoch(0), &pc1, &[b1], 2_000, None, false).unwrap() {
            relay.publish(&e, &community.relays).await.unwrap();
        }
        // Epoch 2: a later rotation includes ME (e.g. a removal-forced re-mint whose
        // recipient set is the CURRENT members).
        let key2 = [0x72; 32];
        let pc2 = super::super::derive::epoch_key_commitment(Epoch(1), &key1);
        let g2 = channel_rekey_group_key(&community.community_root, &priv_id, Epoch(2));
        let b2 = rekey::build_blob_local(owner.secret_key(), &owner.public_key().to_bytes(), &owner.public_key(), RekeyScope::Channel(priv_id), Epoch(2), &key2).unwrap();
        for e in rekey::build_rekey_chunks_local(&owner, &g2, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc2, &[b2], 2_100, None, false).unwrap() {
            relay.publish(&e, &community.relays).await.unwrap();
        }

        // ONE follow: the cursor walks 0→1 (excluded, still keyless) and 1→2 (my
        // blob — adopt), because each real step re-loops.
        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("the walk lands on the included epoch");
        let ch = updated.channel(&priv_id).unwrap();
        assert_eq!(ch.epoch, Epoch(2), "cursor walked through the excluding epoch to the included one");
        assert_eq!(ch.key, Some(key2), "adopted the delivery that includes us");
    }

    #[tokio::test]
    async fn follow_rekeys_honors_an_admin_channel_rotation_but_never_a_strangers() {
        // CORD-06 §Authority: a CHANNEL rekey is honored from the owner or a
        // MANAGE_CHANNELS holder under the persisted roster — so an admin-run
        // rotation keys members up; a mere keyholder's forgery never does.
        use crate::community::roles::{CommunityRoles, MemberGrant, Role};
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "AdminRot", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = ChannelId([0x88; 32]);
        let key1 = [0x91; 32];
        add_private_channel(&mut community, priv_id, key1, Epoch(1));

        // Persist a roster granting `admin` the Admin role (MANAGE_CHANNELS ⊂ ADMIN_ALL).
        let admin = Keys::generate();
        let role = Role::admin("aa".repeat(32));
        let roster = CommunityRoles {
            roles: vec![role.clone()],
            grants: vec![MemberGrant { member: admin.public_key().to_hex(), role_ids: vec![role.role_id.clone()] }],
        };
        seed_roster_with_heads(&community, &roster, 1_000);

        // The ADMIN rotates the channel 1 → 2, delivering to me: adopted.
        let key2 = [0x92; 32];
        let pc = super::super::derive::epoch_key_commitment(Epoch(1), &key1);
        let g2 = channel_rekey_group_key(&community.community_root, &priv_id, Epoch(2));
        let me_pk = crate::state::MY_SECRET_KEY.to_keys().unwrap().public_key();
        let blob = rekey::build_blob_local(admin.secret_key(), &admin.public_key().to_bytes(), &me_pk, RekeyScope::Channel(priv_id), Epoch(2), &key2).unwrap();
        for e in rekey::build_rekey_chunks_local(&admin, &g2, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc, &[blob], 2_000, my_authority_citation(&community, &admin.public_key()).as_ref(), false).unwrap() {
            relay.publish(&e, &community.relays).await.unwrap();
        }
        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("an admin rotation is honored");
        assert_eq!(updated.channel(&priv_id).unwrap().key, Some(key2), "adopted the admin's key");

        // A STRANGER (keyholder, no roster standing) rotates 2 → 3: refused.
        let rogue = Keys::generate();
        let key3 = [0x93; 32];
        let pc3 = super::super::derive::epoch_key_commitment(Epoch(2), &key2);
        let g3 = channel_rekey_group_key(&updated.community_root, &priv_id, Epoch(3));
        let rb = rekey::build_blob_local(rogue.secret_key(), &rogue.public_key().to_bytes(), &me_pk, RekeyScope::Channel(priv_id), Epoch(3), &key3).unwrap();
        for e in rekey::build_rekey_chunks_local(&rogue, &g3, RekeyScope::Channel(priv_id), Epoch(3), Epoch(2), &pc3, &[rb], 2_100, None, false).unwrap() {
            relay.publish(&e, &updated.relays).await.unwrap();
        }
        let follow = follow_rekeys(&relay, &updated, &session).await.unwrap();
        assert!(follow.updated.is_none(), "a stranger's channel rotation is never adopted");
    }

    #[tokio::test]
    async fn a_non_outranking_admins_rotation_never_concludes_my_removal() {
        // CORD-06 §Authority: the Rotator must strictly OUTRANK every removed
        // target. An equal-rank bit-holder's complete rotation that skips my blob
        // must read Stay (my record survives); the OWNER's reads Removed. Needs a
        // two-account bed: the follower must be a NON-owner admin.
        use crate::community::roles::{CommunityRoles, MemberGrant, Role};
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Outrank", bed.relays.clone(), None).await.unwrap();

        // The MEMBER's device: holds the community + the private channel, with a
        // persisted roster granting the member AND a peer the same Admin role.
        bed.swap_to(&member);
        let mut held = community.clone();
        let priv_id = ChannelId([0xAB; 32]);
        let key1 = [0xA1; 32];
        add_private_channel(&mut held, priv_id, key1, Epoch(1));
        let peer = Keys::generate();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let role = Role::admin("bb".repeat(32));
        let roster = CommunityRoles {
            roles: vec![role.clone()],
            grants: vec![
                MemberGrant { member: peer.public_key().to_hex(), role_ids: vec![role.role_id.clone()] },
                MemberGrant { member: member.keys.public_key().to_hex(), role_ids: vec![role.role_id.clone()] },
            ],
        };
        crate::db::community::set_community_roles(&cid_hex, &roster, 1_000).unwrap();

        // The equal-rank PEER rotates 1 → 2 delivering only to themselves.
        let key2 = [0xA2; 32];
        let pc = super::super::derive::epoch_key_commitment(Epoch(1), &key1);
        let g2 = channel_rekey_group_key(&held.community_root, &priv_id, Epoch(2));
        let pb = rekey::build_blob_local(peer.secret_key(), &peer.public_key().to_bytes(), &peer.public_key(), RekeyScope::Channel(priv_id), Epoch(2), &key2).unwrap();
        for e in rekey::build_rekey_chunks_local(&peer, &g2, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc, &[pb], 2_000, my_authority_citation(&held, &peer.public_key()).as_ref(), false).unwrap() {
            bed.relay.publish(&e, &held.relays).await.unwrap();
        }
        let session = crate::db::current_session();
        let follow = follow_rekeys(&bed.relay, &held, &session).await.unwrap();
        assert!(follow.updated.is_none(), "an equal-rank rotation excluding me is Stay, never my removal");
        let reloaded = crate::db::community::load_community_v2(held.id()).unwrap().unwrap();
        assert!(reloaded.channel(&priv_id).is_some(), "my channel record survives the peer's rotation");

        // The OWNER's rotation excluding me IS a removal (owner outranks everyone).
        let key3 = [0xA3; 32];
        let stranger = Keys::generate();
        let ob = rekey::build_blob_local(owner.keys.secret_key(), &owner.keys.public_key().to_bytes(), &stranger.public_key(), RekeyScope::Channel(priv_id), Epoch(2), &key3).unwrap();
        for e in rekey::build_rekey_chunks_local(&owner.keys, &g2, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc, &[ob], 2_100, None, false).unwrap() {
            bed.relay.publish(&e, &held.relays).await.unwrap();
        }
        let follow = follow_rekeys(&bed.relay, &held, &session).await.unwrap();
        let updated = follow.updated.expect("the owner's removal folds");
        assert!(updated.channel(&priv_id).is_none(), "the owner's exclusion cuts my channel record");
    }

    #[tokio::test]
    async fn converting_a_public_channel_to_private_is_refused() {
        // The conversion (CORD-03 §2) is a key rotation this build doesn't mint yet:
        // the producer refuses the flag flip, so no reader is left unkeyable.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "NoConvert", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        let meta = control::ChannelMetadata { name: "general".into(), private: true, voice: None, deleted: None, custom: None, extra: Default::default() };
        let err = edit_channel_metadata(&relay, &community, &general, &meta).await.unwrap_err();
        assert!(err.contains("not supported"), "conversion is refused at the producer: {err}");
        // A rename of the same public channel still works.
        let meta = control::ChannelMetadata { name: "lobby".into(), private: false, voice: None, deleted: None, custom: None, extra: Default::default() };
        edit_channel_metadata(&relay, &community, &general, &meta).await.unwrap();
    }

    /// Publish a 13302 (signed by `me`) carrying a leave tombstone for `cid_hex` at
    /// `removed_at` — simulating a sibling device having left that community.
    async fn publish_remote_tombstone(relay: &MemoryRelay, me: &Keys, relays: &[String], cid_hex: &str, removed_at: u64) {
        let doc = super::super::list::CommunityList {
            entries: vec![],
            tombstones: vec![super::super::list::Tombstone { community_id: cid_hex.to_string(), removed_at, extra: Default::default() }],
            extra: Default::default(),
        };
        // A sibling device writes fragments, like any §8 client.
        for (i, frag) in super::super::list_frag::fragment(&doc).iter().enumerate() {
            let event = super::super::list_frag::build_fragment_event_keys(me, frag, i, now_ms() / 1000).unwrap();
            relay.publish(&event, relays).await.unwrap();
        }
    }

    #[tokio::test]
    async fn joining_one_community_does_not_resurrect_a_sibling_left_community() {
        // W1 (send side): a sibling device left X (a remote tombstone). Joining a
        // DIFFERENT community must not re-add X to the 13302 with added_at=now,
        // which would silently undo the leave everywhere.
        let (_tmp, _guard, me) = init_test_db();
        let relay = MemoryRelay::new();
        let x = create_community(&relay, "X", vec!["wss://r".into()], None).await.unwrap();
        let x_hex = crate::simd::hex::bytes_to_hex_32(&x.id().0);

        // A sibling leaves X: a remote tombstone strictly newer than X's add.
        publish_remote_tombstone(&relay, &me, &x.relays, &x_hex, now_ms() + 10_000).await;

        // Now join a different community Y → republish(just_joined = Y).
        let y = create_community(&relay, "Y", vec!["wss://r".into()], None).await.unwrap();
        republish_community_list(&relay, Some(y.id())).await.unwrap();

        // X must still read as LEFT in the published list; Y must be live.
        let list = fetch_fragments(&relay, &x.relays).await.unwrap().unwrap().list;
        assert!(!list.is_live(&x_hex), "joining Y did not resurrect the sibling-left X");
        assert!(list.is_live(&crate::simd::hex::bytes_to_hex_32(&y.id().0)), "Y is live");
    }

    #[tokio::test]
    async fn sync_tears_down_a_community_a_sibling_left() {
        // W1 (receive side): a community still held locally that the synced 13302
        // shows tombstoned-and-not-live is torn down, so a leave propagates.
        let (_tmp, _guard, me) = init_test_db();
        let relay = MemoryRelay::new();
        let x = create_community(&relay, "Leaveme", vec!["wss://r".into()], None).await.unwrap();
        let x_hex = crate::simd::hex::bytes_to_hex_32(&x.id().0);
        assert!(crate::db::community::load_community_v2(x.id()).unwrap().is_some(), "held before sync");

        publish_remote_tombstone(&relay, &me, &x.relays, &x_hex, now_ms() + 10_000).await;
        sync_community_list(&relay, &x.relays).await.unwrap();
        assert!(crate::db::community::load_community_v2(x.id()).unwrap().is_none(), "the sibling's leave tore X down locally");
    }

    #[tokio::test]
    async fn a_rejoined_community_survives_a_stale_tombstone_on_sync() {
        // The re-join case must NOT be torn down: a fresh join re-adds live (beating
        // the tombstone), so a later sync keeps it.
        let (_tmp, _guard, me) = init_test_db();
        let relay = MemoryRelay::new();
        let x = create_community(&relay, "Rejoin", vec!["wss://r".into()], None).await.unwrap();
        let x_hex = crate::simd::hex::bytes_to_hex_32(&x.id().0);
        // A stale tombstone from a prior leave (OLDER than the current hold's re-add).
        publish_remote_tombstone(&relay, &me, &x.relays, &x_hex, 1).await;
        // Re-record the membership (a re-join) → live entry at now >> 1.
        republish_community_list(&relay, Some(x.id())).await.unwrap();
        sync_community_list(&relay, &x.relays).await.unwrap();
        assert!(crate::db::community::load_community_v2(x.id()).unwrap().is_some(), "a re-joined community is not torn down by a stale tombstone");
    }

    #[tokio::test]
    async fn a_failed_remote_fetch_never_clobbers_the_published_list() {
        // W2: a transient fetch failure during republish must not drive the
        // replaceable-event write (which would drop other entries / regress seeds).
        let (_tmp, _guard, _me) = init_test_db();
        let good = MemoryRelay::new();
        let community = create_community(&good, "Seeded", vec!["wss://r".into()], None).await.unwrap();
        assert!(fetch_fragments(&good, &community.relays).await.unwrap().is_some());

        // A transport whose fetch always errors: republish must bail, publishing nothing.
        struct FetchErrors;
        #[async_trait::async_trait]
        impl Transport for FetchErrors {
            async fn fetch_plane(&self, _plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> { Ok(crate::community::transport::PlaneFetch::whole(self.fetch(query, relays).await?)) }
            async fn publish(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
                panic!("republish must NOT publish when the remote fetch failed");
            }
            async fn publish_durable(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
                Ok(())
            }
            async fn fetch(&self, _q: &Query, _r: &[String]) -> Result<Vec<Event>, String> {
                Err("relay unreachable".to_string())
            }
        }
        // Returns Ok (best-effort) but must not have published (the panic guards it).
        republish_community_list(&FetchErrors, Some(community.id())).await.unwrap();
    }

    #[tokio::test]
    async fn a_granted_member_survives_a_refounding_even_with_no_guestbook_join() {
        // B1 regression: refound_community's recipient set = memberlist. A member
        // the owner GRANTED a role to but who never left a (surviving) Guestbook
        // Join — a lurking admin, or one whose Join aged out of the window — must
        // still be a rekey recipient, or the Refounding SEVERS them. The folded
        // roster's granted members are the consensus-complete backstop.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Backstop", vec!["wss://r".into()], None).await.unwrap();

        // A lurker gets an admin grant but publishes NO Guestbook Join and no chat.
        let lurker = Keys::generate();
        let rid = "b1".repeat(32);
        publish_role(&relay, &community, &owner, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&relay, &community, &owner, &lurker.public_key(), vec![rid.clone()], 1).await;

        // memberlist includes the lurker purely via the roster backstop.
        let members = memberlist(&relay, &community).await.unwrap();
        assert!(members.contains(&lurker.public_key()), "a granted member with no Join is still a member");

        // A banned grantee whose grant wasn't stripped is NOT re-admitted.
        let banned_grantee = Keys::generate();
        publish_grant(&relay, &community, &owner, &banned_grantee.public_key(), vec![rid], 1).await;
        set_banlist(&relay, &community, &[banned_grantee.public_key().to_hex()]).await.unwrap();
        let members = memberlist(&relay, &community).await.unwrap();
        assert!(members.contains(&lurker.public_key()), "the honest grantee still counts");
        assert!(!members.contains(&banned_grantee.public_key()), "a banned grantee is not re-admitted by the union");

        // And the Refounding actually delivers the new root to the lurker.
        let refounded = refound_community(&relay, &community, &[]).await.unwrap();
        assert_eq!(refounded.root_epoch, Epoch(1));
        let base_group = base_rekey_group_key(&community.community_root, community.id(), Epoch(1));
        let chunks = fetch_rekey_chunks(&relay, &community.relays, &base_group).await.unwrap();
        let rotations = rekey::collect_rotations(&chunks);
        let lurker_x = lurker.public_key().to_bytes();
        let delivered = rotations.iter().any(|r| {
            rekey::find_my_blob(&r.blobs, &r.rotator.to_bytes(), &lurker_x, r.scope, r.new_epoch).is_some()
        });
        assert!(delivered, "the Refounding delivered the new root to the granted lurker");
    }

    #[tokio::test]
    async fn the_memberlist_pages_past_a_guestbook_flood() {
        // The roleless-member half of B1: >500 Guestbook events must not evict an
        // honest member's Join from the counted set (an insider can flood throwaway
        // Joins to force exactly this). The pager sees them all.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "GBFlood", vec!["wss://r".into()], None).await.unwrap();
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);

        // An honest member's Join (oldest), then 600 throwaway Joins on top.
        let honest = Keys::generate();
        let join = guestbook::build_join_rumor(honest.public_key(), None, 1_000);
        let (w, _) = guestbook::seal_guestbook_rumor(&join, &gb, &honest, Timestamp::from_secs(1)).unwrap();
        relay.publish(&w, &community.relays).await.unwrap();
        for i in 0..600u64 {
            let throwaway = Keys::generate();
            let j = guestbook::build_join_rumor(throwaway.public_key(), None, 2_000 + i);
            let (w, _) = guestbook::seal_guestbook_rumor(&j, &gb, &throwaway, Timestamp::from_secs(2 + i)).unwrap();
            relay.publish(&w, &community.relays).await.unwrap();
        }

        let members = memberlist(&relay, &community).await.unwrap();
        assert!(members.contains(&honest.public_key()), "the honest member's aged-out Join is still counted past the flood");
    }

    #[tokio::test]
    async fn a_rekey_plane_flood_cannot_bury_a_genuine_rotation() {
        // An insider floods the next-epoch rekey address (community_root-derived,
        // so any member can seal there) with >200 junk 3303s to push the owner's
        // genuine rotation out of a single fetch window. The paginated fetch must
        // still recover it and adopt.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Flooded", vec!["wss://r".into()], None).await.unwrap();
        let new_root = [0xD9; 32];
        let new_epoch = Epoch(1);
        let group = base_rekey_group_key(&community.community_root, community.id(), new_epoch);

        // The GENUINE owner rotation lands first (oldest).
        publish_base_rotation(&relay, &community, &owner, &[owner.public_key()], &new_root, &community.community_root).await;

        // Then a member floods 260 well-formed-but-unauthorized junk chunks ON TOP
        // (newer), burying the genuine one past the 200 newest.
        let rogue = Keys::generate();
        let prev_commit = super::super::derive::epoch_key_commitment(Epoch(0), &community.community_root);
        for i in 0..260u64 {
            let blob = rekey::build_blob_local(rogue.secret_key(), &rogue.public_key().to_bytes(), &rogue.public_key(), RekeyScope::Root, new_epoch, &[0xEE; 32]).unwrap();
            let rumor = rekey::build_rekey_rumor(rogue.public_key(), RekeyScope::Root, new_epoch, Epoch(0), &prev_commit, &[blob], 1, 1, 3_000 + i, None, false).unwrap();
            let (wrap, _) = rekey::seal_rekey_chunk(&rumor, &group, &rogue, Timestamp::from_secs(3_000 + i)).unwrap();
            relay.publish(&wrap, &community.relays).await.unwrap();
        }

        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("the genuine rotation is recovered past the flood");
        assert_eq!(updated.root_epoch, Epoch(1));
        assert_eq!(updated.community_root, new_root, "adopted the owner's root, not a junk one");
    }

    #[tokio::test]
    async fn a_swap_during_create_private_channel_lands_in_the_creating_account() {
        // create_private_channel publishes the key crate, then the channel
        // edition, then whole-row-saves. A swap in that window used to abandon
        // the whole thing — leaving the key crate published to relays but no
        // local channel to open it, which is the worse of the two outcomes.
        //
        // The operation is pinned to the account that started it, so it now
        // finishes into that account's storage, and the account swapped in gets
        // nothing.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let creator = crate::db::current_session();
        let community = create_community(&bed.relay, "SwapCreate", bed.relays.clone(), None).await.unwrap();
        let before = crate::db::community::load_community_v2(community.id()).unwrap().unwrap().channels.len();

        // The key-crate publish inside create swaps the account mid-flight.
        let swap_relay = SwapMidPublish { inner: MemoryRelay::new() };
        create_private_channel(&swap_relay, &community, "ghost").await.unwrap();

        let mine = crate::db::with_session(creator, async {
            crate::db::community::load_community_v2(community.id()).unwrap().unwrap()
        })
        .await;
        assert_eq!(mine.channels.len(), before + 1, "the channel is minted for the account that asked");
        assert!(mine.channels.iter().any(|c| c.name == "ghost"), "and it is the one requested");
    }

    #[tokio::test]
    async fn an_uncited_admin_rotation_is_not_adopted() {
        // CORD-06 §Authority: "a rotation cites the Grant it acts under like any
        // authority action, so a just-demoted admin's rotation is never honored by
        // a lagging client." An uncited rotation is skipped entirely — neither
        // adopted nor allowed to conclude a removal.
        use crate::community::roles::{CommunityRoles, MemberGrant, Role};
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "Uncited", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = ChannelId([0x8A; 32]);
        let key1 = [0x93; 32];
        add_private_channel(&mut community, priv_id, key1, Epoch(1));

        let admin = Keys::generate();
        let role = Role::admin("cf".repeat(32));
        let roster = CommunityRoles {
            roles: vec![role.clone()],
            grants: vec![MemberGrant { member: admin.public_key().to_hex(), role_ids: vec![role.role_id.clone()] }],
        };
        seed_roster_with_heads(&community, &roster, 1_000);

        let key2 = [0x94; 32];
        let pc = super::super::derive::epoch_key_commitment(Epoch(1), &key1);
        let g2 = channel_rekey_group_key(&community.community_root, &priv_id, Epoch(2));
        let me_pk = crate::state::MY_SECRET_KEY.to_keys().unwrap().public_key();
        let blob = rekey::build_blob_local(admin.secret_key(), &admin.public_key().to_bytes(), &me_pk, RekeyScope::Channel(priv_id), Epoch(2), &key2).unwrap();
        // Authorized admin, correct continuity, my blob present — but NO citation.
        for e in rekey::build_rekey_chunks_local(&admin, &g2, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc, &[blob], 2_000, None, false).unwrap() {
            relay.publish(&e, &community.relays).await.unwrap();
        }

        let out = follow_rekeys(&relay, &community, &crate::db::current_session()).await.unwrap();
        assert!(out.updated.is_none(), "an uncited rotation is not adopted");

        // The SAME rotation, cited, is adopted — proving the refusal was the
        // citation and not the rank or the continuity.
        let cited = my_authority_citation(&community, &admin.public_key());
        assert!(cited.is_some(), "the seeded head yields a citation");
        let blob2 = rekey::build_blob_local(admin.secret_key(), &admin.public_key().to_bytes(), &me_pk, RekeyScope::Channel(priv_id), Epoch(2), &key2).unwrap();
        for e in rekey::build_rekey_chunks_local(&admin, &g2, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc, &[blob2], 2_100, cited.as_ref(), false).unwrap() {
            relay.publish(&e, &community.relays).await.unwrap();
        }
        let out = follow_rekeys(&relay, &community, &crate::db::current_session()).await.unwrap();
        assert!(out.updated.is_some(), "the cited rotation IS adopted");
    }

    #[tokio::test]
    async fn two_admins_racing_a_channel_rotation_converge_on_one_key() {
        // CORD-06 §Failure-and-races: two DISTINCT authorized rotators mint the
        // same channel epoch concurrently (reachable — both hold MANAGE_CHANNELS).
        // Every follower must converge on the SAME key (the lexicographically
        // lowest), so the community never permanently forks. (Retaining the losing
        // fork's key for its race-window messages needs a multi-key-per-epoch
        // archive — a deferred refinement shared with v1; convergence, the
        // security-critical property, is what this pins.)
        use crate::community::roles::{CommunityRoles, MemberGrant, Role};
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let mut community = create_community(&relay, "Race", vec!["wss://r".into()], None).await.unwrap();
        let priv_id = ChannelId([0xC0; 32]);
        let key1 = [0xC1; 32];
        add_private_channel(&mut community, priv_id, key1, Epoch(1));

        // Two admins (a, b) both hold the Admin role; I hold the channel key.
        let (a, b) = (Keys::generate(), Keys::generate());
        let role = Role::admin("ce".repeat(32));
        let roster = CommunityRoles {
            roles: vec![role.clone()],
            grants: [&a, &b].iter().map(|k| MemberGrant { member: k.public_key().to_hex(), role_ids: vec![role.role_id.clone()] }).collect(),
        };
        seed_roster_with_heads(&community, &roster, 1_000);

        // Both rotate 1 → 2, each delivering their OWN fresh key to me, off the
        // same prevcommit — a genuine same-epoch fork.
        let me_pk = crate::state::MY_SECRET_KEY.to_keys().unwrap().public_key();
        let pc = super::super::derive::epoch_key_commitment(Epoch(1), &key1);
        let group = channel_rekey_group_key(&community.community_root, &priv_id, Epoch(2));
        let key_a = [0x0A; 32];
        let key_b = [0xFB; 32]; // higher — a's must win regardless of publish order
        for (signer, k) in [(&a, &key_a), (&b, &key_b)] {
            let blob = rekey::build_blob_local(signer.secret_key(), &signer.public_key().to_bytes(), &me_pk, RekeyScope::Channel(priv_id), Epoch(2), k).unwrap();
            for e in rekey::build_rekey_chunks_local(signer, &group, RekeyScope::Channel(priv_id), Epoch(2), Epoch(1), &pc, &[blob], 2_000, my_authority_citation(&community, &signer.public_key()).as_ref(), false).unwrap() {
                relay.publish(&e, &community.relays).await.unwrap();
            }
        }

        let session = crate::db::current_session();
        let updated = follow_rekeys(&relay, &community, &session).await.unwrap().updated.expect("adopts a winner");
        let adopted = updated.channel(&priv_id).unwrap().key.unwrap();
        assert_eq!(adopted, key_a, "converges on the lexicographically lowest key (deterministic across clients)");

        // A SECOND follower (fresh, holding the same epoch-1 key) converges identically.
        let mut peer = community.clone();
        if let Some(c) = peer.channels.iter_mut().find(|c| c.id.0 == priv_id.0) {
            c.key = Some(key1);
            c.epoch = Epoch(1);
        }
        // Re-run the same fold from the peer's identical starting point → same winner.
        let updated2 = follow_rekeys(&relay, &peer, &session).await.unwrap().updated.expect("peer adopts");
        assert_eq!(updated2.channel(&priv_id).unwrap().key.unwrap(), key_a, "every follower lands on the identical key");
    }

    #[tokio::test]
    async fn create_private_channel_refuses_a_member_without_manage_channels() {
        // The local mirror of the reader's gate: an unauthorized member is refused
        // BEFORE any publish (no floor pollution, no orphan key crate).
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Gate", bed.relays.clone(), None).await.unwrap();
        send_direct_invite(&bed.relay, &community, &member.keys.public_key(), None, None).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let joined = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap();
        let err = create_private_channel(&bed.relay, &joined, "sneaky").await.unwrap_err();
        assert!(err.contains("MANAGE_CHANNELS"), "refused with the permission it lacks: {err}");
        let err = create_public_channel(&bed.relay, &joined, "sneaky-too").await.unwrap_err();
        assert!(err.contains("MANAGE_CHANNELS"), "public creation gates identically: {err}");
    }

    // ── Audit regressions ────────────────────────────────────────────────────

    #[tokio::test]
    async fn accept_rejects_a_bundle_with_a_forged_community_root() {
        // The eclipse: community_id commits only to (owner, salt) — both semi-public
        // — so a forged invite pairs the REAL triple with an attacker root, and every
        // plane derives from it. The join-time owner-genesis check must refuse.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Real", bed.relays.clone(), None).await.unwrap();

        let fake = crate::simd::hex::bytes_to_hex_32(&[0xEE; 32]);
        let mut forged = bundle_of(&community, BundleAudience::Link, None, None, None);
        forged.community_root = fake.clone();
        for ch in &mut forged.channels {
            ch.key = fake.clone();
        }
        let attacker = Keys::generate();
        let wrap = invite::build_direct_invite(&attacker, &member.keys.public_key(), &forged).unwrap();
        bed.relay.publish(&wrap, &bed.relays).await.unwrap();

        bed.swap_to(&member);
        let invite_wrap = fetch_direct_invite(&bed.relay, &bed.relays, &member.keys.public_key()).await;
        let err = accept_direct_invite(&bed.relay, &invite_wrap).await.unwrap_err();
        assert!(err.contains("could not verify"), "a forged root fails the owner-genesis check: {err}");
        assert!(
            crate::db::community::load_community_v2(community.id()).unwrap().is_none(),
            "a rejected join persists nothing"
        );
    }

    #[tokio::test]
    async fn accept_verifies_a_rotated_plane_whose_metadata_head_is_admin_signed() {
        // CORD-06 compaction re-wraps CURRENT heads with their original signatures,
        // so a rotated plane whose metadata an admin last edited carries no
        // owner-signed vsk-0. The join anchor there is the community-bound metadata
        // head plus any owner-signed edition under the same root.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Rotated", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;

        let rotated = rotate_view(&community, [0x5A; 32], 1);
        let admin = Keys::generate();
        publish_community_meta(&bed.relay, &rotated, &admin, "Rotated", 3).await;
        publish_channel_edition(&bed.relay, &rotated, &owner.keys, &general, "general", false, 2, false).await;

        bed.swap_to(&member);
        let bundle = bundle_of(&rotated, BundleAudience::Link, None, None, None);
        let joined = accept_bundle(&bed.relay, &bundle, None, true).await.unwrap();
        assert_eq!(joined.root_epoch, Epoch(1), "the rotated root is adopted");
    }

    #[tokio::test]
    async fn only_an_actual_join_publishes_a_guestbook_join() {
        // A Guestbook Join is a member's own word that they JOINED. A re-accept of
        // a held community and a cross-device key sync (announce_join=false) must
        // both stay silent — each re-publish renders as "<user> has joined" spam.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Quiet", bed.relays.clone(), None).await.unwrap();

        let gb_pk = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch).pk_hex();
        async fn gb_count(relay: &MemoryRelay, gb_pk: &str, relays: &[String]) -> usize {
            let q = Query { kinds: vec![stream::KIND_WRAP], authors: vec![gb_pk.to_string()], ..Default::default() };
            relay.fetch(&q, relays).await.map(|v| v.len()).unwrap_or(0)
        }
        let baseline = gb_count(&bed.relay, &gb_pk, &bed.relays).await; // the owner's creation Join

        bed.swap_to(&member);
        let bundle = bundle_of(&community, BundleAudience::Link, None, None, None);
        accept_bundle(&bed.relay, &bundle, None, true).await.unwrap();
        assert_eq!(gb_count(&bed.relay, &gb_pk, &bed.relays).await, baseline + 1, "a first join announces exactly once");

        accept_bundle(&bed.relay, &bundle, None, true).await.unwrap();
        assert_eq!(gb_count(&bed.relay, &gb_pk, &bed.relays).await, baseline + 1, "a re-accept of a held community stays silent");

        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::delete_community(&cid_hex).unwrap();
        // A key sync is not a membership event, and it is not a membership
        // RECORD either: the entry was just read from the very list a republish
        // would rewrite. A device adopting N entries used to rebuild and
        // publish the whole document N times over, concurrently, on boot.
        // 13302 is REPLACEABLE, so a republish swaps the stored event rather
        // than adding one — the id is the tell, and it always changes on a
        // real republish because the list is NIP-44 sealed with a random nonce.
        async fn list_id(relay: &MemoryRelay, me: &PublicKey, relays: &[String]) -> Option<String> {
            let q = Query { kinds: vec![crate::community::v2::kind::COMMUNITY_LIST_FRAG], authors: vec![me.to_hex()], ..Default::default() };
            let mut evs = relay.fetch(&q, relays).await.unwrap_or_default();
            evs.sort_by_key(|e| e.created_at.as_secs());
            evs.last().map(|e| e.id.to_hex())
        }
        let my_pk = me_pk().unwrap();
        let list_before = list_id(&bed.relay, &my_pk, &bed.relays).await;
        accept_bundle(&bed.relay, &bundle, None, false).await.unwrap();
        assert_eq!(gb_count(&bed.relay, &gb_pk, &bed.relays).await, baseline + 1, "a cross-device key sync is not a membership event");
        assert_eq!(
            list_id(&bed.relay, &my_pk, &bed.relays).await,
            list_before,
            "adopting an entry FROM the list must not republish the list"
        );

        // A genuine join still records, so the storm fix can't have muted the
        // thing the republish exists for.
        crate::db::community::delete_community(&cid_hex).unwrap();
        accept_bundle(&bed.relay, &bundle, None, true).await.unwrap();
        assert_ne!(
            list_id(&bed.relay, &my_pk, &bed.relays).await,
            list_before,
            "a real join still records the membership across devices"
        );
    }

    #[tokio::test]
    async fn accept_refuses_a_rotated_plane_with_no_owner_signed_edition() {
        // The fallback's second half is load-bearing: a community-bound metadata
        // head alone is self-signable by anyone who knows the (public) community_id.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoOwner", bed.relays.clone(), None).await.unwrap();

        let rotated = rotate_view(&community, [0x5B; 32], 1);
        let attacker = Keys::generate();
        publish_community_meta(&bed.relay, &rotated, &attacker, "NoOwner", 3).await;

        bed.swap_to(&member);
        let bundle = bundle_of(&rotated, BundleAudience::Link, None, None, None);
        let err = accept_bundle(&bed.relay, &bundle, None, true).await.unwrap_err();
        assert!(err.contains("could not verify"), "no owner-signed edition → refuse: {err}");
    }

    #[tokio::test]
    async fn accept_requires_the_strict_owner_genesis_on_an_epoch_zero_plane() {
        // The fallback applies to rotated planes only: at epoch 0 the spec guarantees
        // an owner-signed genesis, so owner material without it stays insufficient.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Strict", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;

        let mut fake = community.clone();
        fake.community_root = [0x5C; 32]; // epoch stays 0
        let admin = Keys::generate();
        publish_community_meta(&bed.relay, &fake, &admin, "Strict", 2).await;
        publish_channel_edition(&bed.relay, &fake, &owner.keys, &general, "general", false, 2, false).await;

        bed.swap_to(&member);
        let bundle = bundle_of(&fake, BundleAudience::Link, None, None, None);
        let err = accept_bundle(&bed.relay, &bundle, None, true).await.unwrap_err();
        assert!(err.contains("could not verify"), "epoch 0 demands the owner genesis: {err}");
    }

    #[tokio::test]
    async fn follow_control_heals_a_bundle_misclassified_public_channel() {
        // A bundle can set a PUBLIC channel's grant key to the attacker's, so the
        // joiner addresses it at a plane only the attacker reads. The owner's genuine
        // public:false edition must override it on follow.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Heal", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        let mut poisoned = community.clone();
        poisoned.channels[0].private = true;
        poisoned.channels[0].key = Some([0x66; 32]);
        crate::db::community::save_community_v2(&poisoned).unwrap();

        let healed = follow_control(&relay, &poisoned).await.unwrap().updated.expect("healed");
        let ch = healed.channel(&general).unwrap();
        assert!(!ch.private, "the owner's public declaration overrides the bundle");
        assert_eq!(ch.key, None, "a healed public channel derives from the root");
    }

    #[tokio::test]
    async fn a_deleted_channel_does_not_resurrect_on_reload() {
        // save_community_v2 must prune orphan channel rows, or a control-follow delete
        // reappears (with a stale key) on the next reload.
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Prune", vec!["wss://r".into()], None).await.unwrap();
        let extra = ChannelId([0x77; 32]);
        publish_channel_edition(&relay, &community, &owner, &extra, "temp", false, 1, false).await;
        let with_extra = follow_control(&relay, &community).await.unwrap().updated.unwrap();
        assert!(with_extra.channel(&extra).is_some());
        publish_channel_edition(&relay, &community, &owner, &extra, "temp", false, 2, true).await;
        let after = follow_control(&relay, &with_extra).await.unwrap().updated.unwrap();
        assert!(after.channel(&extra).is_none());

        let reloaded = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert!(reloaded.channel(&extra).is_none(), "a deleted channel must not resurrect on reload");
        assert_eq!(reloaded.channels.len(), 1);
    }

    #[tokio::test]
    async fn a_channel_owned_by_another_community_is_skipped_not_clobbered() {
        // channel_id is the sole DB primary key, so a bundle/replay reusing another
        // community's channel_id must NOT overwrite that row. It's skipped (not an
        // error — erroring would wedge all of this community's control persistence).
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let a = create_community(&relay, "A", vec!["wss://r".into()], None).await.unwrap();
        let a_channel = a.channels[0].id;
        let mut b = create_community(&relay, "B", vec!["wss://r".into()], None).await.unwrap();
        let b_channel = b.channels[0].id;
        // B's set includes a phantom whose id collides with A's channel.
        b.channels.push(ChannelV2 { id: a_channel, name: "phantom".into(), private: false, key: None, epoch: b.root_epoch, voice: None, meta_custom: None, meta_extra: Default::default() });

        crate::db::community::save_community_v2(&b).expect("save succeeds, the phantom is skipped");
        // A's channel row is untouched.
        let a_reloaded = crate::db::community::load_community_v2(a.id()).unwrap().unwrap();
        assert!(!a_reloaded.channels.iter().any(|c| c.private), "A's channel is untouched");
        assert_eq!(a_reloaded.channels[0].id.0, a_channel.0);
        // B keeps its own channel but never acquired a row for the foreign id.
        let b_reloaded = crate::db::community::load_community_v2(b.id()).unwrap().unwrap();
        assert!(b_reloaded.channel(&b_channel).is_some(), "B's own channel persists");
        assert!(b_reloaded.channel(&a_channel).is_none(), "the foreign-owned channel is skipped, not stolen");
    }

    /// A single relay that CAPS every query below the page size (modelling a real
    /// relay's maxFilterLimit) and honors `until` — so the join-verify walk MUST
    /// paginate to reach an old genesis. MemoryRelay can't model this (it unions then
    /// truncates the whole set), which is why a MemoryRelay flood test gives false
    /// confidence about the production `LiveTransport` behaviour.
    struct CappedRelay {
        events: Vec<Event>,
        cap: usize,
    }
    #[async_trait::async_trait]
    impl Transport for CappedRelay {
        async fn fetch_plane(&self, _plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> { Ok(crate::community::transport::PlaneFetch::whole(self.fetch(query, relays).await?)) }
        async fn publish(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
            Ok(())
        }
        async fn publish_durable(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
            Ok(())
        }
        async fn fetch(&self, q: &Query, _r: &[String]) -> Result<Vec<Event>, String> {
            let mut m: Vec<Event> = self
                .events
                .iter()
                .filter(|e| q.authors.is_empty() || q.authors.contains(&e.pubkey.to_hex()))
                .filter(|e| q.until.is_none_or(|u| e.created_at.as_secs() <= u))
                .cloned()
                .collect();
            m.sort_by(|a, b| b.created_at.cmp(&a.created_at)); // newest first
            m.truncate(self.cap.min(q.limit.unwrap_or(usize::MAX)));
            Ok(m)
        }
    }

    #[tokio::test]
    async fn refound_aborts_when_the_control_plane_cannot_be_read_in_full() {
        // CORD-06 §3: a Refounder that cannot fold every Control Event must abort.
        // `until` is inclusive, so a page-wide block of same-second wraps is a wall
        // no cursor steps past — everything older (the genesis editions, a Banlist)
        // is unreachable. Compacting THAT view carries only what was read into the
        // new epoch, dropping the rest for every member, permanently. Any member can
        // build the wall: the plane key comes from the community root they hold.
        let (_tmp, _guard, _owner) = init_test_db();
        let memory = MemoryRelay::new();
        let community = create_community(&memory, "Walled", vec!["wss://r".into()], None).await.unwrap();
        // Post-split the plane is staff-write-only, so the wall is built with the
        // write group (any control_root holder can still flood; the pager
        // property under test is unchanged).
        let control = control::ControlPlane::of(&community).write_group().unwrap();

        let rogue = Keys::generate();
        let mut events: Vec<Event> = Vec::new();
        for i in 0..FOLLOW_PAGE {
            let content = format!("{{\"name\":\"junk{i}\",\"private\":false}}");
            let rumor = control::build_edition_rumor(
                rogue.public_key(),
                vsk::CHANNEL_METADATA,
                &[0xAB; 32],
                1,
                None,
                &content,
                9_000,
                None,
            );
            let (w, _) = control::seal_control_edition(&rumor, &control, &rogue, Timestamp::from_secs(9_000)).unwrap();
            events.push(w);
        }
        let relay = CappedRelay { events, cap: FOLLOW_PAGE };

        let err = refound_community(&relay, &community, &[])
            .await
            .expect_err("a plane that can't be read whole must never be compacted");
        assert!(err.contains("too deep to read in full"), "unexpected error: {err}");
    }

    #[tokio::test]
    async fn verify_pages_a_capped_relay_past_a_flood_to_the_genesis() {
        // The join-verify DoS mitigation, tested against a relay that caps below PAGE
        // (production behaviour MemoryRelay hides): a rogue root-holder buries the
        // genesis under junk, and the `until`-walk must page past it. Uses fixed OLD
        // timestamps so `until = now` includes everything and the walk is deterministic.
        let (_tmp, _guard, owner) = init_test_db();
        let meta = control::CommunityMetadata { name: "Capped".into(), relays: vec!["wss://r".into()], ..Default::default() };
        let g = control::genesis(&owner, meta, 1_000).unwrap();
        let community = CommunityV2::from_genesis(&g, "Capped", None, vec!["wss://r".into()], 1_000);

        let control = control::ControlPlane::of(&community).write_group().unwrap();
        let rogue = Keys::generate();
        let mut events: Vec<Event> = g.wraps.to_vec();
        for i in 0..250u64 {
            let rumor = control::build_edition_rumor(rogue.public_key(), vsk::CHANNEL_METADATA, &[0xAB; 32], 1, None, "{\"name\":\"junk\",\"private\":false}", 1_001 + i, None);
            let (wrap, _) = control::seal_control_edition(&rumor, &control, &rogue, Timestamp::from_secs(1_001 + i)).unwrap();
            events.push(wrap);
        }
        // Cap 100/query forces the walk across ~3 pages down to the genesis at ts 1000.
        let relay = CappedRelay { events, cap: 100 };
        let verified = verify_owner_root_and_reconcile(&relay, community.clone()).await;
        assert!(verified.is_ok(), "the until-walk pages a capped relay past the flood to the genesis: {:?}", verified.err());
    }

    #[tokio::test]
    async fn accept_parked_invite_joins_from_the_stored_bundle() {
        // The 3313 receive path: an invite is parked as its bundle JSON, then accepted
        // from the stored bundle (re-verifying the owner root over the network).
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Parked", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        send_message(&bed.relay, &community, &general, "owner: hi").await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();
        let inviter_hex = owner.keys.public_key().to_hex();

        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, Some(&inviter_hex)).await.unwrap();
        assert_eq!(joined.id().0, community.id().0, "joined the community from the parked bundle");
        assert!(joined.identity.verify());
        assert_eq!(texts_in(&bed.relay, &joined, &general).await, vec!["owner: hi"]);
        // The join seeded the verified fold as the member's initial floor, so their
        // first follow can't roll below the state the join just showed.
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        assert!(
            crate::db::community::get_edition_head(&cid_hex, &cid_hex).unwrap().is_some(),
            "the joiner's control floor is seeded from the join-time fold"
        );

        // The Guestbook memberlist now folds both participants.
        bed.swap_to(&owner);
        let members = memberlist(&bed.relay, &community).await.unwrap();
        assert!(members.contains(&member.keys.public_key()), "the parked-invite joiner is a member");
    }

    #[tokio::test]
    async fn accept_parked_invite_rejects_a_forged_root() {
        // A forged-root parked bundle (real identity triple, attacker-chosen root) fails
        // accept — the shared accept path re-verifies the owner root, so a parked invite
        // gets the same eclipse protection as a live one.
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Real", vec!["wss://r".into()], None).await.unwrap();
        let mut forged = bundle_of(&community, BundleAudience::Link, None, None, None);
        let fake = crate::simd::hex::bytes_to_hex_32(&[0xEE; 32]);
        forged.community_root = fake.clone();
        for ch in &mut forged.channels {
            ch.key = fake.clone();
        }
        let bundle_json = serde_json::to_string(&forged).unwrap();

        let err = accept_parked_invite(&relay, &bundle_json, None).await.unwrap_err();
        assert!(err.contains("could not verify"), "a forged-root parked bundle fails definitively: {err}");
    }

    #[test]
    fn v2_and_v1_bundles_are_distinguishable_by_parse() {
        // The protocol discriminator the facade list/accept relies on: a v2 bundle
        // (self-certifying: owner + owner_salt + community_root) parses; a v1-shaped
        // one does not, so a parked invite routes to the right accept path.
        let owner = Keys::generate();
        let identity = super::super::control::CommunityIdentity::mint(&owner.public_key());
        let hex = crate::simd::hex::bytes_to_hex_32;
        let v2 = invite::CommunityInvite {
            community_id: hex(&identity.community_id.0),
            owner: hex(&identity.owner_xonly),
            owner_salt: hex(&identity.owner_salt),
            community_root: hex(&[0x11; 32]),
            root_epoch: 0,
            control_pk: None,
            channels: vec![],
            relays: vec!["wss://r".into()],
            name: "V2".into(),
            icon: None,
            expires_at: None,
            creator_npub: None,
            label: None,
            extra: Default::default(),
        };
        let v2_json = serde_json::to_string(&v2).unwrap();
        assert!(invite::CommunityInvite::from_bundle_json(&v2_json).is_ok(), "a real v2 bundle parses");
        let v1_like = r#"{"community_id":"aa","name":"X","relays":[]}"#;
        assert!(invite::CommunityInvite::from_bundle_json(v1_like).is_err(), "a v1 bundle is not a v2 bundle");
    }

    #[tokio::test]
    async fn verify_rejects_a_cross_community_owner_edition_replay() {
        // The eclipse-via-replay: an owner-signed edition from community X (eid == X.id)
        // rewrapped onto a FORGED community T's fake control plane must NOT authenticate
        // T. T's genesis has eid == T.id, so X's edition — a genuine owner signature but
        // a different eid — is not a valid proof of T's root. This is why "any owner
        // edition" is unsound and the eid==community_id genesis pin is required.
        let (_tmp, _guard, owner) = init_test_db();

        // Community X (real), owned by `owner`.
        let gx = control::genesis(&owner, control::CommunityMetadata { name: "X".into(), ..Default::default() }, 1_000).unwrap();
        let x_control = control::split_write_group(&gx.control_root, &gx.community_root, &gx.identity.community_id, Epoch(0));
        let (_ed, opened) = control::open_control_edition(&gx.wraps[0], &x_control).unwrap();

        // Forged community T: the real owner triple but an ATTACKER-chosen root.
        let t_identity = control::CommunityIdentity::mint(&owner.public_key());
        let fake_root = [0xEE; 32];
        let t = CommunityV2 {
            identity: t_identity,
            community_root: fake_root,
            root_epoch: Epoch(0),
            control_pk: None,
            control_root: None,
            name: "T".into(),
            description: None,
            icon: None,
            banner: None,
            meta_custom: None,
            meta_extra: Default::default(),
            relays: vec!["wss://r".into()],
            channels: vec![],
            dissolved: false,
            created_at_ms: 0,
        };
        // Rewrap X's owner-signed genesis onto T's fake control plane (the attacker
        // controls the fake root, so they can derive its control group key).
        let t_control = control_group_key(&fake_root, t.id(), t.root_epoch);
        let (replayed, _) = stream::rewrap_seal(&opened.seal, &t_control, Timestamp::from_secs(1_000)).unwrap();
        let relay = MemoryRelay::new();
        relay.publish(&replayed, &t.relays).await.unwrap();

        let verified = verify_owner_root_and_reconcile(&relay, t.clone()).await;
        assert!(verified.is_err(), "a cross-community owner-edition replay must not authenticate a forged root");
    }

    /// LIVE smoke test (network) — ignored by default. Creates a v2 community on a
    /// REAL relay via `LiveTransport`, sends a message, fetches it back, and mints
    /// a public link. A fresh throwaway identity in an isolated temp data dir, so
    /// it never touches real accounts. Run explicitly:
    /// ```sh
    /// cargo test -p vector-core -- --ignored --nocapture live_smoke
    /// ```
    #[tokio::test]
    #[ignore = "hits a real relay over the network"]
    async fn live_smoke_create_send_fetch_on_a_real_relay() {
        use crate::community::transport::LiveTransport;
        use nostr_sdk::prelude::ToBech32;

        let relay = std::env::var("VECTOR_SMOKE_RELAY").unwrap_or_else(|_| "wss://jskitty.com/nostr".to_string());
        let relays = vec![relay.clone()];

        // Isolated account + data dir (a fresh throwaway key — never a real account).
        let _g = crate::db::DB_TEST_GUARD.lock().unwrap_or_else(|e| e.into_inner());
        crate::db::close_database();
        crate::db::clear_id_caches();
        let tmp = tempfile::tempdir().unwrap();
        // Bring your own key (VECTOR_SMOKE_NSEC) to create a community you can log
        // into elsewhere; otherwise a fresh throwaway.
        let keys = match std::env::var("VECTOR_SMOKE_NSEC") {
            Ok(n) => Keys::parse(&n).expect("VECTOR_SMOKE_NSEC is not a valid nsec"),
            Err(_) => Keys::generate(),
        };
        let npub = keys.public_key().to_bech32().unwrap();
        // Off by default (never leak secrets from a committed test); set
        // VECTOR_SMOKE_PRINT_NSEC=1 to print the owner nsec for cross-client login.
        if std::env::var("VECTOR_SMOKE_PRINT_NSEC").is_ok() {
            println!("[smoke] OWNER nsec (throwaway — do NOT reuse): {}", keys.secret_key().to_bech32().unwrap());
        }
        std::fs::create_dir_all(tmp.path().join(&npub)).unwrap();
        crate::db::set_app_data_dir(crate::db::shared_test_data_dir().to_path_buf());
        crate::db::set_current_account(npub.clone()).unwrap();
        crate::db::init_database(&npub).unwrap();
        crate::state::MY_SECRET_KEY.store_from_keys(&keys, &[]);
        crate::state::set_my_public_key(keys.public_key());
        println!("[smoke] throwaway identity {npub}");

        // A live client (LiveTransport rides the global NOSTR_CLIENT + warms relays).
        let client = crate::nostr_client_builder().build();
        client.add_managed_relay(relay.as_str()).await.ok();
        client.connect().await;
        crate::state::set_nostr_client(client);
        let transport = LiveTransport::with_timeout(std::time::Duration::from_secs(15));

        // Create → send → fetch-back → verify.
        let community = create_community(&transport, "V2 Live Smoke", relays.clone(), None).await.expect("create");
        let general = community.channels[0].id;
        println!("[smoke] created community {} on {relay}", crate::simd::hex::bytes_to_hex_32(&community.id().0));

        let text = "hello from a Vector Concord v2 live smoke test";
        let sent_id = send_message(&transport, &community, &general, text).await.expect("send");
        println!("[smoke] sent message {sent_id}");

        // Give the relay a moment to store + be ready to serve it.
        crate::rt::time::sleep(std::time::Duration::from_secs(3)).await;

        let page = fetch_channel(&transport, &community, &general, 50).await.expect("fetch");
        let texts: Vec<String> = page
            .iter()
            .filter_map(|f| match &f.event {
                ChatEvent::Message { .. } => Some(f.event.opened().rumor.content.clone()),
                _ => None,
            })
            .collect();
        println!("[smoke] fetched {} message(s) back: {texts:?}", texts.len());
        assert!(texts.contains(&text.to_string()), "the message did not round-trip through the real relay");

        // Mint a shareable v2 link (the thing a bot hands out).
        let link = mint_public_link(&transport, &community, "https://vectorapp.io", None, None).await.expect("mint link");
        println!("[smoke] invite link: {}", link.url);
        println!("[smoke] PASS — v2 create+send+fetch+invite round-tripped on {relay}");
    }

    #[tokio::test]
    async fn chat_ops_react_edit_delete_round_trip() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Ops", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let me_hex = owner.keys.public_key().to_hex();

        let msg_id = send_message(&bed.relay, &community, &general, "original").await.unwrap();
        send_reaction(&bed.relay, &community, &general, &msg_id, &me_hex, super::super::kind::MESSAGE, ":fire:", Some(("fire", "https://e/f.png")))
            .await
            .unwrap();
        send_edit(&bed.relay, &community, &general, &msg_id, "edited", &[]).await.unwrap();
        send_delete(&bed.relay, &community, &general, &msg_id, super::super::kind::MESSAGE).await.unwrap();

        let page = fetch_channel(&bed.relay, &community, &general, 50).await.unwrap();
        let target = crate::simd::hex::hex_to_bytes_32(&msg_id);
        let mut saw = (false, false, false);
        for f in &page {
            match &f.event {
                ChatEvent::Reaction { target: t, emoji, emoji_url, .. } if *t == target => {
                    assert_eq!(emoji, ":fire:");
                    assert_eq!(emoji_url.as_deref(), Some("https://e/f.png"));
                    saw.0 = true;
                }
                ChatEvent::Edit { target: t, new_content, .. } if *t == target => {
                    assert_eq!(new_content, "edited");
                    saw.1 = true;
                }
                ChatEvent::Delete { target: t, .. } if *t == target => saw.2 = true,
                _ => {}
            }
        }
        assert!(saw.0 && saw.1 && saw.2, "reaction/edit/delete all round-trip: {saw:?}");
    }

    #[tokio::test]
    async fn a_typing_signal_rides_the_ephemeral_wrap_and_is_never_stored() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Typ", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let group = channel_group_key(&community.community_root, &general, community.root_epoch);

        // A live subscriber sees the 21059 wrap and it opens as Typing…
        let mut sub = bed.relay.subscribe(Query {
            kinds: vec![stream::KIND_WRAP_EPHEMERAL],
            authors: vec![group.pk_hex()],
            ..Default::default()
        });
        send_typing(&bed.relay, &community, &general).await.unwrap();
        let wrap = sub.try_recv().expect("the typing wrap streams to a live subscriber");
        let opened = match chat::open_chat_event(&wrap, &group, &general, community.root_epoch) {
            Ok(ChatEvent::Typing { opened }) => opened,
            other => panic!("the ephemeral wrap must open as a Typing event, got {other:?}"),
        };

        // …while nothing durable is stored (relays never keep the ephemeral tier),
        // so channel history stays free of typing noise…
        let page = fetch_channel(&bed.relay, &community, &general, 50).await.unwrap();
        assert!(page.iter().all(|f| !matches!(f.event, ChatEvent::Typing { .. })));

        // …and no scrub key is retained (there is no durable wrap to ever delete).
        assert!(
            crate::db::community::get_message_key(&opened.rumor_id.to_hex()).unwrap().is_none(),
            "ephemeral sends must not retain scrub keys"
        );
    }

    #[tokio::test]
    async fn a_durable_send_retains_the_wrap_scrub_key_and_full_delete_nukes_the_relay_copy() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Nuke", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let group = channel_group_key(&community.community_root, &general, community.root_epoch);

        let id = send_message(&bed.relay, &community, &general, "scrub me").await.unwrap();

        // Retained: the row maps the rumor id to the exact published wrap, holds the
        // key that SIGNED that wrap (same-author NIP-09), and the relay set.
        let (keys, outer_hex, relays) =
            crate::db::community::get_message_key(&id).unwrap().expect("a durable send retains its scrub key");
        assert_eq!(relays, community.relays);
        let wrap_query = Query {
            kinds: vec![stream::KIND_WRAP],
            authors: vec![group.pk_hex()],
            ..Default::default()
        };
        let wraps = bed.relay.fetch(&wrap_query, &community.relays).await.unwrap();
        let wrap = wraps.iter().find(|w| w.id.to_hex() == outer_hex).expect("retained outer id is the published wrap");
        assert_eq!(keys.public_key(), wrap.pubkey, "retained key is the wrap's author");

        // Reactions ride the same retention (revoke_reaction's relay-nuke layer).
        let me_hex = owner.keys.public_key().to_hex();
        let rid = send_reaction(&bed.relay, &community, &general, &id, &me_hex, super::super::kind::MESSAGE, "🔥", None)
            .await
            .unwrap();
        assert!(crate::db::community::get_message_key(&rid).unwrap().is_some(), "reaction sends retain too");

        // The shared v1 delete path (Layer 1 of delete_community_message / revoke_reaction)
        // scrubs the wrap off the relay via the retained key, then consumes the row.
        crate::community::service::delete_message(&bed.relay, &id).await.unwrap();
        assert!(crate::db::community::get_message_key(&id).unwrap().is_none(), "key consumed after the scrub");
        let after = bed.relay.fetch(&wrap_query, &community.relays).await.unwrap();
        assert!(!after.iter().any(|w| w.id.to_hex() == outer_hex), "wrap scrubbed from the relay");
    }

    #[tokio::test]
    async fn backfill_heals_scrub_keys_for_own_pre_retention_messages_only() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Heal", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let group = channel_group_key(&community.community_root, &general, community.root_epoch);

        // Simulate a pre-retention / other-device send: our message on the relay,
        // but no local mapping row.
        let id = send_message(&bed.relay, &community, &general, "old send").await.unwrap();
        crate::db::community::delete_message_key(&id).unwrap();
        assert!(crate::db::community::get_message_key(&id).unwrap().is_none());

        // A stranger member's message rides the same channel.
        let mkeys = Keys::generate();
        let rumor = chat::build_message_rumor(mkeys.public_key(), &general, community.root_epoch, "foreign", None, &[], vec![], 6_000);
        let foreign_id = rumor.id.unwrap().to_hex();
        let (fw, _) = chat::seal_chat_rumor(&rumor, &group, &mkeys, Timestamp::from_secs(6), false).unwrap();
        bed.relay.publish(&fw, &community.relays).await.unwrap();

        // One history open re-derives the mapping for the OWN message…
        fetch_channel(&bed.relay, &community, &general, 50).await.unwrap();
        let (keys, _outer, relays) =
            crate::db::community::get_message_key(&id).unwrap().expect("backfill heals own unretained rows");
        assert_eq!(keys.public_key(), group.pk(), "healed key is the wrap's signing key");
        assert_eq!(relays, community.relays);

        // …and never manufactures one for a foreign author.
        assert!(crate::db::community::get_message_key(&foreign_id).unwrap().is_none());

        // The healed row is a working full delete: the shared path scrubs the wrap.
        crate::community::service::delete_message(&bed.relay, &id).await.unwrap();
        let left = fetch_channel(&bed.relay, &community, &general, 50).await.unwrap();
        assert!(
            !left.iter().any(|f| f.event.opened().rumor_id.to_hex() == id),
            "healed message scrubbed from the relay"
        );
    }

    #[tokio::test]
    async fn send_chat_message_threads_the_reply_and_extra_tags() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Re", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let me_hex = owner.keys.public_key().to_hex();

        let parent_id = send_message(&bed.relay, &community, &general, "parent").await.unwrap();
        let imeta = nostr_sdk::prelude::Tag::custom(
            "imeta",
            ["url https://e/blob".to_string(), "m image/png".to_string()],
        );
        let child_id = send_chat_message(
            &bed.relay, &community, &general, "child",
            Some((parent_id.as_str(), me_hex.as_str())), &[], vec![imeta],
        )
        .await
        .unwrap();

        let page = fetch_channel(&bed.relay, &community, &general, 50).await.unwrap();
        let child = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Message { opened, reply_to, .. } if opened.rumor_id.to_hex() == child_id => Some((opened, reply_to)),
                _ => None,
            })
            .expect("the reply message round-trips");
        let reply = child.1.as_ref().expect("the reply reference is carried");
        assert_eq!(crate::simd::hex::bytes_to_hex_32(&reply.id), parent_id);
        assert_eq!(reply.author, Some(owner.keys.public_key()));
        assert!(
            child.0.rumor.tags.iter().any(|t| t.kind() == "imeta"),
            "the imeta attachment tag rides the rumor verbatim"
        );
    }

    #[tokio::test]
    async fn a_kick_needs_kick_authority_and_removes_the_target() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Kick", bed.relays.clone(), None).await.unwrap();

        // The target announces a Join (as an accepted invite would).
        let gb = super::super::derive::guestbook_group_key(&community.community_root, community.id(), community.root_epoch);
        let join = guestbook::build_join_rumor(member.keys.public_key(), None, 2_000);
        let (wrap, _) = guestbook::seal_guestbook_rumor(&join, &gb, &member.keys, Timestamp::from_secs(2)).unwrap();
        bed.relay.publish(&wrap, &bed.relays).await.unwrap();
        let before = memberlist(&bed.relay, &community).await.unwrap();
        assert!(before.contains(&member.keys.public_key()), "the join lands first");

        // An unprivileged member's kick of the owner is refused locally…
        bed.swap_to(&member);
        let err = kick_member(&bed.relay, &community, &owner.keys.public_key()).await.unwrap_err();
        assert!(err.contains("not authorized"), "unprivileged kick refused: {err}");

        // …and the owner (supreme, no grant needed) kicks the member out.
        bed.swap_to(&owner);
        kick_member(&bed.relay, &community, &member.keys.public_key()).await.unwrap();
        let after = memberlist(&bed.relay, &community).await.unwrap();
        assert!(!after.contains(&member.keys.public_key()), "the kicked member leaves the fold");
        assert!(after.contains(&owner.keys.public_key()), "the owner remains");
    }

    #[tokio::test]
    async fn a_rejoin_survives_a_stale_kick_and_an_uncaught_up_store() {
        // The self-eviction race: on a REJOIN the guestbook store starts empty while the
        // control fold has already re-derived the member's old ban mark, so the MEMBERLIST
        // legitimately excludes them for that window. A stale Kick landing there used to
        // read as an authorized eviction and the client nuked its own community.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Rejoin", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let (o, m) = (owner.keys.public_key(), member.keys.public_key());
        let join = |at: u64, id: u8| guestbook::GuestbookEvent { epoch: None, observed_at: None,
            rumor_id: [id; 32],
            entry: guestbook::GuestbookEntry::Join { member: m, invited_by: None, at_ms: at },
        };
        let kick = |at: u64, id: u8| guestbook::GuestbookEvent { epoch: None, observed_at: None,
            rumor_id: [id; 32],
            entry: guestbook::GuestbookEntry::Kick { actor: o, target: m, citation: None, at_ms: at },
        };

        // An authorized kick after their join stands.
        crate::db::community::set_guestbook(&cid_hex, &[join(1_000, 1), kick(2_000, 2)], 2).unwrap();
        assert!(stored_kick_verdict(&community, &m), "an authorized kick after the join is honored");

        // A rejoin supersedes it — latest entry wins (CORD-02 §5).
        crate::db::community::set_guestbook(&cid_hex, &[join(1_000, 1), kick(2_000, 2), join(3_000, 3)], 3).unwrap();
        assert!(!stored_kick_verdict(&community, &m), "a Join newer than the kick clears the verdict");

        // The catch-up window itself: nothing folded yet decides nothing.
        crate::db::community::set_guestbook(&cid_hex, &[], 0).unwrap();
        assert!(!stored_kick_verdict(&community, &m), "an empty store is not an eviction");

        // And the memberlist is NOT a substitute: with the store empty it excludes them,
        // which is exactly the false positive this verdict replaced.
        assert!(
            !stored_memberlist(&community).unwrap().contains(&m),
            "the memberlist excludes an un-caught-up member — why it can't gate a kick"
        );
    }

    /// Seed a roster the way production does: `follow_control` writes the roster
    /// AND the folded edition heads in one pass, so a citation against a grant is
    /// resolvable. Seeding the roster alone yields a client that can never satisfy
    /// any `vac` — a shape no v2 production path produces.
    fn seed_roster_with_heads(community: &CommunityV2, roster: &crate::community::roles::CommunityRoles, at: i64) {
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::set_community_roles(&cid_hex, roster, at).unwrap();
        for g in &roster.grants {
            let Some(m) = crate::simd::hex::hex_to_bytes_32_checked(&g.member) else { continue };
            let eid = super::super::derive::grant_locator(community.id(), &m);
            let entity_hex = crate::simd::hex::bytes_to_hex_32(&eid);
            crate::db::community::set_edition_head_at_epoch(&cid_hex, &entity_hex, 1, &[0xA1; 32], &[0xA2; 32], community.root_epoch.0).unwrap();
        }
    }

    /// Publish an edition CITING a specific grant version (CORD-04 §5's `vac`).
    async fn publish_grant_citing(
        relay: &MemoryRelay,
        community: &CommunityV2,
        signer: &Keys,
        member: &PublicKey,
        role_ids: Vec<String>,
        version: u64,
        citation: Option<&crate::community::edition::AuthorityCitation>,
    ) {
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let eid = crate::community::v2::derive::grant_locator(community.id(), &member.to_bytes());
        let prev = head_hash_on_relay(relay, community, &eid).await;
        let grant = MemberGrant { member: member.to_hex(), role_ids };
        let content = crate::community::v2::roles::grant_content_json(&grant).unwrap();
        let rumor = control::build_edition_rumor(signer.public_key(), vsk::GRANT, &eid, version, prev.as_ref(), &content, 1_000, citation);
        let (wrap, _) = control::seal_control_edition(&rumor, &group, signer, Timestamp::from_secs(1_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();
    }

    #[tokio::test]
    async fn an_uncited_edition_cannot_self_promote_or_outlive_a_demotion() {
        // The two ways an ADD could escalate if the citation were the thing holding
        // the line. It is not — rank is — and rank is resolved against the CURRENT
        // roster, which is precisely what the spec says the verifier must do.
        let (bed, owner, admin) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoEscalate", bed.relays.clone(), None).await.unwrap();
        let admin_pk = admin.keys.public_key();

        // An admin at position 3, and a role ABOVE them at position 1.
        let mid = "d1".repeat(32);
        let mut mid_role = admin_role(&mid, Permissions::admin().0);
        mid_role.position = 3;
        publish_role(&bed.relay, &community, &owner.keys, &mid_role, 1).await;
        let high = "d2".repeat(32);
        let mut high_role = admin_role(&high, Permissions::admin().0);
        high_role.position = 1;
        publish_role(&bed.relay, &community, &owner.keys, &high_role, 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin_pk, vec![mid.clone()], 1).await;

        // 1. SELF-PROMOTION, uncited: the admin grants THEMSELVES the higher role.
        publish_grant_citing(&bed.relay, &community, &admin.keys, &admin_pk, vec![high.clone(), mid.clone()], 2, None).await;
        // Assert the PROPERTY, not the shape: the role must not be held, whether the
        // forged edition was refused outright or folded back to the owner's version.
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(
            !view.roles.grants.iter().any(|g| g.member == admin_pk.to_hex() && g.role_ids.contains(&high)),
            "an uncited edition must not let an author grant themselves a role they do not \
             outrank — you cannot act at or above your own rank, citation or not",
        );

        // 2. OUTLIVING A DEMOTION, uncited: the owner demotes the admin to nothing,
        //    and the admin's uncited grant to a bystander must stop being honored the
        //    moment this client folds the demotion.
        let bystander = Keys::generate().public_key();
        publish_grant_citing(&bed.relay, &community, &admin.keys, &bystander, vec![mid.clone()], 1, None).await;
        let before = fetch_authority(&bed.relay, &community).await;
        assert!(
            !before.roles.grants.iter().any(|g| g.member == bystander.to_hex()),
            "an admin at position 3 cannot grant position 3 — equal cannot act on equal",
        );

        publish_grant(&bed.relay, &community, &owner.keys, &admin_pk, vec![], 3).await;
        let after = fetch_authority(&bed.relay, &community).await;
        assert!(
            !after.roles.is_admin(&admin_pk.to_hex()),
            "the owner's demotion folds",
        );
        assert!(
            !after.roles.grants.iter().any(|g| g.member == bystander.to_hex()),
            "and nothing the demoted author wrote is honored afterwards — authority is \
             resolved against the CURRENT roster, which is what the citation was only ever \
             a scheduling hint for",
        );
    }

    #[tokio::test]
    async fn an_uncited_edition_folds_on_rank_alone_and_never_escalates() {
        // CORD-04 §5 calls the `vac` a SYNC FLOOR, not the verdict: a verifier waits
        // until it has synced the cited Grant, then resolves rank against its CURRENT
        // roster. Refusing an edition that cites NOTHING promoted that sync aid into an
        // authority requirement — and pre-citation clients emitted no `vac` at all, so
        // whole live rosters folded to nothing while a lenient implementation read the
        // same plane fine.
        //
        // What actually prevents escalation is rank, and rank is unchanged. This pins
        // both halves: a genuine in-rank edition folds without a citation, and an
        // out-of-rank one does not, cited or otherwise.
        let (bed, owner, admin) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Uncited", bed.relays.clone(), None).await.unwrap();
        let admin_pk = admin.keys.public_key();
        let rid = "c3".repeat(32);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::admin().0), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &admin_pk, vec![rid.clone()], 1).await;

        // A role BENEATH the admin (they sit at position 1).
        let low_rid = "c4".repeat(32);
        let mut low = admin_role(&low_rid, Permissions::admin().0);
        low.position = 5;
        publish_role(&bed.relay, &community, &owner.keys, &low, 1).await;

        // 1. GENUINE and in-rank, citing nothing → folds.
        let bystander = Keys::generate().public_key();
        publish_grant_citing(&bed.relay, &community, &admin.keys, &bystander, vec![low_rid.clone()], 1, None).await;
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(
            view.roles.grants.iter().any(|g| g.member == bystander.to_hex()),
            "an uncited edition from an author the roster DOES authorize, acting beneath \
             their own rank, is genuine and must fold",
        );
        assert!(view.roles.is_admin(&admin_pk.to_hex()), "the owner-authored grant still folds");

        // 2. ESCALATION, uncited: a stranger the roster authorizes for nothing.
        let stranger = Keys::generate();
        let victim = Keys::generate().public_key();
        publish_grant_citing(&bed.relay, &community, &stranger, &victim, vec![low_rid.clone()], 1, None).await;
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(
            !view.roles.grants.iter().any(|g| g.member == victim.to_hex()),
            "an uncited edition from an UNAUTHORIZED author must never fold — dropping the \
             citation requirement must not become a way in",
        );

        // 3. ESCALATION, uncited, by a real admin acting AT their own rank: equal
        //    cannot act on equal, citation or not.
        let peer = Keys::generate().public_key();
        publish_grant_citing(&bed.relay, &community, &admin.keys, &peer, vec![rid.clone()], 1, None).await;
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(
            !view.roles.grants.iter().any(|g| g.member == peer.to_hex()),
            "an authorized author still cannot grant AT their own rank — rank is what \
             stops escalation, and it is untouched",
        );

        // 4. ESCALATION, uncited REVOCATION — the case that makes the citation
        //    load-bearing. A strip names no roles, so the rank gate has no position to
        //    check and passes vacuously; the citation is the only thing standing there.
        //    An uncited edition may ADD authority, never remove it.
        publish_grant_citing(&bed.relay, &community, &stranger, &bystander, vec![], 9, None).await;
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(
            view.roles.grants.iter().any(|g| g.member == bystander.to_hex()),
            "an uncited empty grant must NOT strip a member — a revocation's rank check is \
             vacuous, so tolerating it uncited hands any stranger a demotion primitive",
        );
    }

    #[tokio::test]
    async fn a_join_landing_inside_the_ban_window_survives_the_unban() {
        // The invite is deliberately ungated, so a fresh Join can arrive seconds
        // BEFORE the unban edition. It must reach the store (banned = a fold
        // verdict, not a storage verdict) so the unban resurrects the member —
        // dropped at ingest, they stayed invisible forever.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Window", bed.relays.clone(), None).await.unwrap();
        let member_pk = member.keys.public_key();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);

        // Locally banned (edition folded at t=1000s), with the outliving mark.
        crate::db::community::set_community_banlist(&cid_hex, &[member_pk.to_hex()], 1_000).unwrap();
        crate::db::community::merge_community_ban_marks(&cid_hex, &[(member_pk.to_hex(), 1_000u64)].into_iter().collect()).unwrap();

        // Their Join lands 60s after the ban mark, while the banlist still says banned.
        let join = guestbook::GuestbookEvent { epoch: None, observed_at: None,
            rumor_id: [9u8; 32],
            entry: guestbook::GuestbookEntry::Join { member: member_pk, invited_by: None, at_ms: 1_060_000 },
        };
        assert!(ingest_guestbook_event(&community, join, 1_060).unwrap(), "stored while banned");
        assert!(
            !stored_memberlist(&community).unwrap().contains(&member_pk),
            "while banned, the fold keeps them out"
        );

        // The unban folds: same store, no refetch needed — the Join resurrects them.
        crate::db::community::set_community_banlist(&cid_hex, &[], 2_000).unwrap();
        assert!(
            stored_memberlist(&community).unwrap().contains(&member_pk),
            "after the unban the raced Join makes them a member again"
        );
    }

    #[tokio::test]
    async fn a_stale_root_admin_write_is_refused_not_misdirected() {
        // The ban→unban race: a Ban's refound buries the old root over several
        // publishes while a concurrently-issued command still holds the
        // pre-commit struct. That unban used to land on the buried control
        // plane — "succeeding" while no reader would ever fold it — and a
        // concurrently-minted invite stranded its joiner on the dead epoch.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Race", bed.relays.clone(), None).await.unwrap();
        let member_pk = member.keys.public_key();

        set_banlist(&bed.relay, &community, &[member_pk.to_hex()]).await.unwrap();
        let _rotated = refound_community(&bed.relay, &community, &[member_pk]).await.unwrap();

        // The stale-struct unban is REFUSED (retryable), never misdirected.
        let err = set_banlist(&bed.relay, &community, &[]).await.unwrap_err();
        assert!(err.contains("re-founded"), "unban: {err}");
        // A stale invite must not mint dead-epoch key material.
        let err = send_direct_invite(&bed.relay, &community, &member_pk, None, None).await.unwrap_err();
        assert!(err.contains("re-founded"), "invite: {err}");
        // Neither is a kick allowed to ride the buried guestbook.
        let err = kick_member(&bed.relay, &community, &member_pk).await.unwrap_err();
        assert!(err.contains("re-founded"), "kick: {err}");

        // The retry path: a fresh load lands the unban on the LIVING plane.
        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        set_banlist(&bed.relay, &fresh, &[]).await.unwrap();
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert!(view.banned.is_empty(), "the retried unban actually unbans");
    }

    /// [`MemoryRelay`] with a cooperative yield before every call, so two units
    /// driven by one `join!` genuinely interleave at each network boundary — on
    /// the single-threaded test runtime the bare relay resolves without yielding,
    /// the first unit runs to completion, and the race never happens.
    struct YieldyRelay<'a>(&'a MemoryRelay);
    #[async_trait::async_trait]
    impl Transport for YieldyRelay<'_> {
        async fn publish(&self, event: &Event, relays: &[String]) -> Result<(), String> {
            crate::rt::yield_now().await;
            self.0.publish(event, relays).await
        }
        async fn fetch(&self, query: &Query, relays: &[String]) -> Result<Vec<Event>, String> {
            crate::rt::yield_now().await;
            self.0.fetch(query, relays).await
        }
        async fn fetch_plane(&self, plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> {
            crate::rt::yield_now().await;
            self.0.fetch_plane(plane, query, relays).await
        }
        async fn publish_durable(&self, event: &Event, relays: &[String]) -> Result<(), String> {
            crate::rt::yield_now().await;
            self.0.publish_durable(event, relays).await
        }
    }

    #[tokio::test]
    async fn concurrent_bans_compose_instead_of_erasing_each_other() {
        // The SDK spawns a handler task per message, so a spam wave runs N ban
        // units concurrently. Unserialized, both read the pre-sibling banlist,
        // the second head erases the first target at every reader, and the
        // refound compacts that erasure into the new epoch permanently.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Wave", bed.relays.clone(), None).await.unwrap();
        let a = Keys::generate().public_key();
        let b = Keys::generate().public_key();

        let yieldy = YieldyRelay(&bed.relay);
        let (wave_a, wave_b) = ([a], [b]);
        let (ra, rb) = tokio::join!(
            set_members_banned(&yieldy, community.id(), &wave_a, true),
            set_members_banned(&yieldy, community.id(), &wave_b, true),
        );
        ra.unwrap();
        rb.unwrap();

        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(2), "each single ban still performed its own read cut");
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert!(
            view.banned.contains(&a.to_hex()) && view.banned.contains(&b.to_hex()),
            "both racing bans landed: {:?}",
            view.banned
        );
    }

    #[tokio::test]
    async fn bans_stacked_behind_a_rotation_coalesce_into_one_read_cut() {
        // Human-speed serial bans: the leader's read cut holds the lock for a
        // whole rotation, so bans arriving meanwhile deposit intents. The next
        // lock holder drains ALL of them — one edition, one rotation, however
        // many stacked. Worst case for a burst of N is 2 rotations, never N.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Stack", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let banlist_hex = crate::simd::hex::bytes_to_hex_32(&super::super::derive::banlist_locator(community.id()));
        let (a, b, c, d) = (
            Keys::generate().public_key(),
            Keys::generate().public_key(),
            Keys::generate().public_key(),
            Keys::generate().public_key(),
        );

        let yieldy = YieldyRelay(&bed.relay);
        let (wa, wb, wc, wd) = ([a], [b], [c], [d]);
        // The first future drains itself and rotates; the other three stack
        // behind that rotation and coalesce under the next leader.
        let (ra, rb, rc, rd) = tokio::join!(
            set_members_banned(&yieldy, community.id(), &wa, true),
            set_members_banned(&yieldy, community.id(), &wb, true),
            set_members_banned(&yieldy, community.id(), &wc, true),
            set_members_banned(&yieldy, community.id(), &wd, true),
        );
        ra.unwrap();
        rb.unwrap();
        rc.unwrap();
        rd.unwrap();

        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(2), "leader rotation + ONE coalesced rotation, never four");
        let (version, _) = crate::db::community::get_edition_head(&cid_hex, &banlist_hex).unwrap().unwrap();
        assert_eq!(version, 2, "two editions total: the leader's and the coalesced drain's");
        let view = fetch_authority(&bed.relay, &fresh).await;
        for pk in [a, b, c, d] {
            assert!(view.banned.contains(&pk.to_hex()), "{} missing from the fold", pk.to_hex());
        }
    }

    #[tokio::test]
    async fn a_stacked_ban_and_unban_coalesce_in_arrival_order() {
        // The drain applies intents in arrival order over the evolving list, so
        // ban(X) … unban(X) stacked behind one rotation nets X out entirely and
        // only the net newly-banned member costs a read cut.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Net", bed.relays.clone(), None).await.unwrap();
        let x = Keys::generate().public_key();
        let y = Keys::generate().public_key();

        let yieldy = YieldyRelay(&bed.relay);
        let (wx, wy) = ([x], [y]);
        let (rx1, ry, rx2) = tokio::join!(
            set_members_banned(&yieldy, community.id(), &wx, true),  // leader: rotates on X
            set_members_banned(&yieldy, community.id(), &wy, true),  // stacked
            set_members_banned(&yieldy, community.id(), &wx, false), // stacked: nets X back out
        );
        rx1.unwrap();
        ry.unwrap();
        rx2.unwrap();

        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(2), "X's rotation + one coalesced rotation for Y");
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert!(!view.banned.contains(&x.to_hex()), "the stacked unban netted X out");
        assert!(view.banned.contains(&y.to_hex()), "Y's stacked ban landed");
    }

    #[tokio::test]
    async fn a_second_member_folds_every_stacked_ban() {
        // Derek's observer divergence, inverted: the whole point of composing the
        // batch correctly is that an INDEPENDENT reader folding the same plane
        // agrees. A fresh joiner (separate account DB, post-rotation bundle) must
        // see every stacked ban — not just the leader's own echo.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Agree", bed.relays.clone(), None).await.unwrap();
        let a = Keys::generate().public_key();
        let b = Keys::generate().public_key();

        let yieldy = YieldyRelay(&bed.relay);
        let (wa, wb) = ([a], [b]);
        let (ra, rb) = tokio::join!(
            set_members_banned(&yieldy, community.id(), &wa, true),
            set_members_banned(&yieldy, community.id(), &wb, true),
        );
        ra.unwrap();
        rb.unwrap();

        // Post-rotation bundle, exactly what a live link would serve now.
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let bundle = bundle_of(&held, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();

        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        let _ = follow_control(&bed.relay, &joined).await;
        let view = fetch_authority(&bed.relay, &joined).await;
        assert!(
            view.banned.contains(&a.to_hex()) && view.banned.contains(&b.to_hex()),
            "an independent reader folds BOTH stacked bans: {:?}",
            view.banned
        );
    }

    #[tokio::test]
    async fn a_net_zero_batch_publishes_no_edition() {
        // ban(X) + unban(X) stacked in one drain nets to the original list — the
        // batch must not spend an edition (or a rotation) publishing a no-op.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Noop", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let banlist_hex = crate::simd::hex::bytes_to_hex_32(&super::super::derive::banlist_locator(community.id()));
        let x = Keys::generate().public_key();

        // The leader's slot is taken by a harmless real ban so X's ban+unban land
        // in ONE coalesced drain together.
        let decoy = Keys::generate().public_key();
        let yieldy = YieldyRelay(&bed.relay);
        let (wd, wx) = ([decoy], [x]);
        let (rd, r1, r2) = tokio::join!(
            set_members_banned(&yieldy, community.id(), &wd, true),
            set_members_banned(&yieldy, community.id(), &wx, true),
            set_members_banned(&yieldy, community.id(), &wx, false),
        );
        rd.unwrap();
        r1.unwrap();
        r2.unwrap();

        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(1), "only the decoy's rotation — the net-zero drain rotated nothing");
        let (version, _) = crate::db::community::get_edition_head(&cid_hex, &banlist_hex).unwrap().unwrap();
        assert_eq!(version, 1, "only the decoy's edition — the net-zero drain published nothing");
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert!(!view.banned.contains(&x.to_hex()));
        assert!(view.banned.contains(&decoy.to_hex()));
    }

    /// Fetches fine, refuses every publish — the dead-network shape.
    struct BrokenPublish<'a>(&'a MemoryRelay);
    #[async_trait::async_trait]
    impl Transport for BrokenPublish<'_> {
        async fn publish(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
            crate::rt::yield_now().await;
            Err("relay refused".to_string())
        }
        async fn fetch(&self, query: &Query, relays: &[String]) -> Result<Vec<Event>, String> {
            crate::rt::yield_now().await;
            self.0.fetch(query, relays).await
        }
        async fn fetch_plane(&self, plane: &Keys, query: &Query, relays: &[String]) -> Result<crate::community::transport::PlaneFetch, String> {
            crate::rt::yield_now().await;
            self.0.fetch_plane(plane, query, relays).await
        }
        async fn publish_durable(&self, _e: &Event, _r: &[String]) -> Result<(), String> {
            crate::rt::yield_now().await;
            Err("relay refused".to_string())
        }
    }

    #[tokio::test]
    async fn a_failed_publish_answers_every_stacked_caller_and_never_hangs() {
        // The batch's shared fate: when the edition can't land, every stacked
        // intent must resolve with the error — a waiter left parked on a dead
        // oneshot would hang a moderation bot forever.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Dead", bed.relays.clone(), None).await.unwrap();
        let a = Keys::generate().public_key();
        let b = Keys::generate().public_key();

        let broken = BrokenPublish(&bed.relay);
        let (wa, wb) = ([a], [b]);
        let (ra, rb) = crate::rt::time::timeout(
            std::time::Duration::from_secs(30),
            async {
                tokio::join!(
                    set_members_banned(&broken, community.id(), &wa, true),
                    set_members_banned(&broken, community.id(), &wb, true),
                )
            },
        )
        .await
        .expect("stacked callers must resolve, never hang");
        assert!(ra.is_err(), "the leader surfaced the publish failure");
        assert!(rb.is_err(), "the stacked caller surfaced it too");

        // Nothing landed: a later fold shows no bans.
        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert!(view.banned.is_empty(), "no half-published state: {:?}", view.banned);
        assert_eq!(fresh.root_epoch, Epoch(0), "no rotation on a failed edition");
    }

    #[tokio::test]
    async fn a_poison_intent_fails_alone_not_its_batchmates() {
        // Per-intent verdicts: an add that busts the 500 ceiling answers ITS
        // caller with the refusal while its batch-mates publish normally.
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Poison", bed.relays.clone(), None).await.unwrap();
        // Pre-fill to 498 so the leader lands 499, the first stacked ban lands
        // exactly 500, and the second stacked ban would be 501.
        let filler: Vec<String> = (0..498).map(|i| format!("{i:064x}")).collect();
        let held = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        set_banlist(&bed.relay, &held, &filler).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        crate::db::community::set_community_banlist(&cid_hex, &filler, 1).unwrap();

        let (a, x, y) = (Keys::generate().public_key(), Keys::generate().public_key(), Keys::generate().public_key());
        let yieldy = YieldyRelay(&bed.relay);
        let (wa, wx, wy) = ([a], [x], [y]);
        let (ra, rx, ry) = tokio::join!(
            set_members_banned(&yieldy, community.id(), &wa, true),
            set_members_banned(&yieldy, community.id(), &wx, true),
            set_members_banned(&yieldy, community.id(), &wy, true),
        );
        ra.unwrap();
        rx.unwrap();
        let err = ry.unwrap_err();
        assert!(err.contains("ceiling"), "the over-cap intent failed alone: {err}");

        let list = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        assert_eq!(list.len(), 500, "the batch published up to the ceiling");
        assert!(list.contains(&x.to_hex()) && !list.contains(&y.to_hex()));
    }

    #[tokio::test]
    async fn ban_many_is_one_edition_one_refound_for_the_whole_wave() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Purge", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let banlist_hex = crate::simd::hex::bytes_to_hex_32(&super::super::derive::banlist_locator(community.id()));
        let wave: Vec<PublicKey> = (0..3).map(|_| Keys::generate().public_key()).collect();

        set_members_banned(&bed.relay, community.id(), &wave, true).await.unwrap();

        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(1), "one refound for the whole wave, not one per target");
        let (version, _) = crate::db::community::get_edition_head(&cid_hex, &banlist_hex).unwrap().unwrap();
        assert_eq!(version, 1, "one banlist edition carried the whole wave");
        let view = fetch_authority(&bed.relay, &fresh).await;
        for pk in &wave {
            assert!(view.banned.contains(&pk.to_hex()), "{} missing from the fold", pk.to_hex());
        }

        // The reductive mirror: unban two of three in one edition, no read cut.
        set_members_banned(&bed.relay, community.id(), &wave[..2], false).await.unwrap();
        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(1), "an unban rotates nothing");
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert_eq!(view.banned.len(), 1, "reductive: exactly the un-unbanned target remains");
        assert!(view.banned.contains(&wave[2].to_hex()));
    }

    #[tokio::test]
    async fn a_batch_past_the_banlist_cap_refuses_before_publishing() {
        let (bed, owner, _member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Cap", bed.relays.clone(), None).await.unwrap();
        let wave: Vec<PublicKey> = (0..=crate::community::v2::roles::MAX_BANLIST).map(|_| Keys::generate().public_key()).collect();

        let err = set_members_banned(&bed.relay, community.id(), &wave, true).await.unwrap_err();
        assert!(err.contains("ceiling"), "refused at the cap: {err}");
        let fresh = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        assert_eq!(fresh.root_epoch, Epoch(0), "nothing rotated");
        let view = fetch_authority(&bed.relay, &fresh).await;
        assert!(view.banned.is_empty(), "nothing published");
    }

    #[tokio::test]
    async fn an_uncited_kick_from_an_admin_is_not_honored() {
        // CORD-04 §5: a non-owner authority action must name the Grant it acts
        // under, and the reader refuses until it holds that Grant. Emitting the
        // `vac` without checking it buys nothing — a demoted admin's kick would
        // still land on any client that hadn't synced the demotion.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Uncited", bed.relays.clone(), None).await.unwrap();
        let admin = Keys::generate();
        let member_pk = member.keys.public_key();
        grant_admin(&bed.relay, &community, &admin.public_key()).await.unwrap();

        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let view = fetch_authority(&bed.relay, &community).await;
        crate::db::community::set_community_roles(&cid_hex, &view.roles, 1_000).unwrap();

        let entity_id = super::super::derive::grant_locator(community.id(), &admin.public_key().to_bytes());
        let entity_hex = crate::simd::hex::bytes_to_hex_32(&entity_id);
        let (version, edition_hash) = crate::db::community::get_edition_head(&cid_hex, &entity_hex).unwrap().unwrap();
        let cite = crate::community::edition::AuthorityCitation { entity_id, version, edition_hash };

        let joined = guestbook::GuestbookEvent { epoch: None, observed_at: None,
            rumor_id: [1u8; 32],
            entry: guestbook::GuestbookEntry::Join { member: member_pk, invited_by: None, at_ms: 1_000 },
        };
        let kick = |citation, id: u8, at| guestbook::GuestbookEvent { epoch: None, observed_at: None,
            rumor_id: [id; 32],
            entry: guestbook::GuestbookEntry::Kick { actor: admin.public_key(), target: member_pk, citation, at_ms: at },
        };
        let roles = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let empty_bans = std::collections::BTreeSet::new();
        let empty_marks = std::collections::BTreeMap::new();
        let fold = |evs: &[guestbook::GuestbookEvent]| {
            fold_members(&community, evs, Default::default(), &roles, &empty_bans, &empty_marks).unwrap()
        };

        assert!(
            fold(&[joined.clone(), kick(None, 2, 2_000)]).contains(&member_pk),
            "an uncited kick from an admin is not honored"
        );
        assert!(
            !fold(&[joined, kick(Some(cite), 3, 3_000)]).contains(&member_pk),
            "the same kick WITH its synced citation removes them"
        );
    }

    #[tokio::test]
    async fn kicking_an_admin_strips_their_roles_first() {
        // CORD-04 §6 composition: Role Removal THEN the directive. Kicking without the
        // strip leaves the target out of the memberlist but still holding every
        // management bit, so every client keeps honoring their control editions.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Compose", bed.relays.clone(), None).await.unwrap();
        let member_pk = member.keys.public_key();
        let member_hex = member_pk.to_hex();
        let owner_hex = owner.keys.public_key().to_hex();

        grant_admin(&bed.relay, &community, &member_pk).await.unwrap();
        assert!(fetch_authority(&bed.relay, &community).await.roles.is_admin(&member_hex));

        kick_member(&bed.relay, &community, &member_pk).await.unwrap();

        let view = fetch_authority(&bed.relay, &community).await;
        assert!(!view.roles.is_admin(&member_hex), "the kick stripped their rank");
        assert!(
            !view.roles.is_authorized(&member_hex, Some(&owner_hex), Permissions::MANAGE_ROLES),
            "a kicked admin holds no bit"
        );
        assert!(
            !memberlist(&bed.relay, &community).await.unwrap().contains(&member_pk),
            "and the directive still removed them"
        );
    }

    #[tokio::test]
    async fn grant_admin_mints_one_deterministic_role_and_revoke_strips_it() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Adm", bed.relays.clone(), None).await.unwrap();
        let member_pk = member.keys.public_key();
        let member_hex = member_pk.to_hex();
        let owner_hex = owner.keys.public_key().to_hex();

        grant_admin(&bed.relay, &community, &member_pk).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(view.roles.is_admin(&member_hex), "the grant folds as admin");
        assert!(view.roles.is_authorized(&member_hex, Some(&owner_hex), Permissions::MANAGE_ROLES));

        // A second grant (any device) converges on the SAME role entity — and a
        // repeat is a no-op, not a version bump.
        let second = Keys::generate().public_key();
        grant_admin(&bed.relay, &community, &second).await.unwrap();
        grant_admin(&bed.relay, &community, &member_pk).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        assert_eq!(view.roles.roles.len(), 1, "one Admin role, never a fork");
        assert!(view.roles.is_admin(&member_hex) && view.roles.is_admin(&second.to_hex()));
        let grant = view.roles.grants.iter().find(|g| g.member == member_hex).unwrap();
        assert_eq!(grant.role_ids.len(), 1, "no duplicate role id in the grant");

        // Revoke strips ONLY the admin role and de-authorizes.
        revoke_admin(&bed.relay, &community, &member_pk).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(!view.roles.is_admin(&member_hex), "revoked");
        assert!(view.roles.is_admin(&second.to_hex()), "the other admin is untouched");
        assert!(!view.roles.is_authorized(&member_hex, Some(&owner_hex), Permissions::KICK));
    }

    #[tokio::test]
    async fn follow_control_persists_the_roster_for_sync_local_reads() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Persist", bed.relays.clone(), None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let member_hex = member.keys.public_key().to_hex();
        grant_admin(&bed.relay, &community, &member.keys.public_key()).await.unwrap();

        // The passive follow folds + persists; the read is then LOCAL (v1 parity).
        follow_control(&bed.relay, &community).await.unwrap().updated;
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(roster.is_admin(&member_hex), "the persisted roster reads back without a fetch");

        // A withholding relay serves nothing — an empty fold raises no gap flag, and
        // the stored roster must be RETAINED, never wiped.
        let withholding = MemoryRelay::new();
        let _ = follow_control(&withholding, &community).await;
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(roster.is_admin(&member_hex), "withholding never shrinks standing");

        // A real revocation (a NEWER grant edition) does replace it.
        revoke_admin(&bed.relay, &community, &member.keys.public_key()).await.unwrap();
        follow_control(&bed.relay, &community).await.unwrap().updated;
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        assert!(!roster.is_admin(&member_hex), "the revoke folds + persists");
    }

    #[tokio::test]
    async fn grant_admin_is_refused_for_a_non_owner_and_publishes_nothing() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "NoSquat", bed.relays.clone(), None).await.unwrap();

        bed.swap_to(&member);
        let err = grant_admin(&bed.relay, &community, &member.keys.public_key()).await.unwrap_err();
        assert!(err.contains("owner"), "refused before any publish: {err}");

        // The deterministic admin-role entity stays unsquatted — the owner's later
        // legitimate mint is version 1 and folds cleanly.
        bed.swap_to(&owner);
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(view.roles.roles.is_empty(), "no role edition landed");
        grant_admin(&bed.relay, &community, &member.keys.public_key()).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        assert!(view.roles.is_admin(&member.keys.public_key().to_hex()));
    }

    #[tokio::test]
    async fn grant_admin_merges_other_roles_and_refuses_a_withheld_grant() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Merge", bed.relays.clone(), None).await.unwrap();
        let member_pk = member.keys.public_key();

        // The member already holds a Mod role, granted through the real send path
        // (so this device's floors track both entities).
        let mod_rid = crate::simd::hex::bytes_to_hex_32(&[0x66; 32]);
        set_role(&bed.relay, &community, &admin_role(&mod_rid, Permissions::BAN)).await.unwrap();
        grant_roles(&bed.relay, &community, &member_pk, vec![mod_rid.clone()]).await.unwrap();

        // A relay that withholds the control plane must refuse the merge — a blind
        // push would erase the Mod role at a higher version.
        let withholding = MemoryRelay::new();
        let err = grant_admin(&withholding, &community, &member_pk).await.unwrap_err();
        assert!(err.contains("could not be fetched"), "withheld grant refused: {err}");

        // Against the full relay the merge preserves the Mod role.
        grant_admin(&bed.relay, &community, &member_pk).await.unwrap();
        let view = fetch_authority(&bed.relay, &community).await;
        let grant = view.roles.grants.iter().find(|g| g.member == member_pk.to_hex()).unwrap();
        assert_eq!(grant.role_ids.len(), 2, "admin ADDED to the existing grant, not replacing it");
        assert!(grant.role_ids.contains(&mod_rid));
    }

    #[tokio::test]
    async fn fetch_authority_reflects_a_granted_admin() {
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "Auth", bed.relays.clone(), None).await.unwrap();
        let rid = crate::simd::hex::bytes_to_hex_32(&[0x5a; 32]);
        publish_role(&bed.relay, &community, &owner.keys, &admin_role(&rid, Permissions::ADMIN_ALL), 1).await;
        publish_grant(&bed.relay, &community, &owner.keys, &member.keys.public_key(), vec![rid], 1).await;

        let view = fetch_authority(&bed.relay, &community).await;
        let member_hex = member.keys.public_key().to_hex();
        assert!(view.roles.is_admin(&member_hex), "the granted member folds as admin");
        assert!(
            view.roles.is_authorized(&member_hex, Some(&owner.keys.public_key().to_hex()), Permissions::KICK),
            "an ADMIN_ALL grant carries KICK"
        );
        assert!(view.banned.is_empty());
    }

    // ── Pins (CORD-04 §7) — fold, authority, and the silent Admin widening ──

    /// The full wire round trip: a real message pinned into a published
    /// edition, folded by the control follow, persisted, and read back proven.
    #[tokio::test]
    async fn a_pin_edition_folds_persists_and_reads_back() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Pinsville", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&general.0);

        send_message(&relay, &community, &general, "pin-worthy").await.unwrap();
        let page = fetch_channel(&relay, &community, &general, 10).await.unwrap();
        let opened = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Message { opened, .. } => Some(opened.clone()),
                _ => None,
            })
            .expect("the sent message reads back");

        let ch = community.channels[0].clone();
        let conv = channel_conv_key_at(&community, &ch, 0).expect("owner holds the public plane key");
        let entry = crate::community::v2::pins::build_pin_entry(&opened, &conv, &ch_hex).unwrap();
        let content = crate::community::v2::pins::serialize_public_pin_list(&[entry]).unwrap();

        let eid = crate::community::v2::derive::pins_locator(community.id(), &general);
        publish_control_edition(&relay, &community, vsk::PINS, &eid, &content).await.unwrap();
        follow_control(&relay, &community).await.unwrap().updated;

        let read = read_channel_pins(&community, &general).unwrap();
        assert!(!read.sealed);
        assert!(read.version >= 1, "the folded head persisted");
        assert_eq!(read.pins.len(), 1);
        assert_eq!(read.pins[0].content, "pin-worthy");
        assert_eq!(read.pins[0].rumor_id, opened.rumor_id.to_hex());
    }

    #[tokio::test]
    async fn a_fresh_join_sees_pins_and_the_banlist_without_waiting_for_a_follow() {
        // The join's verification walk already folds the control plane, so pins and
        // the banlist must persist FROM THE JOIN — deferring them to the follow
        // worker's queued re-walk left a fresh member pins-blind (and rendering a
        // banned author) for the whole queue delay.
        let (bed, owner, member) = TestBed::new();
        bed.swap_to(&owner);
        let community = create_community(&bed.relay, "PinJoin", bed.relays.clone(), None).await.unwrap();
        let general = community.channels[0].id;
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&general.0);

        send_message(&bed.relay, &community, &general, "pin-worthy").await.unwrap();
        let page = fetch_channel(&bed.relay, &community, &general, 10).await.unwrap();
        let opened = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Message { opened, .. } => Some(opened.clone()),
                _ => None,
            })
            .expect("the sent message reads back");
        let ch = community.channels[0].clone();
        let conv = channel_conv_key_at(&community, &ch, 0).unwrap();
        let entry = crate::community::v2::pins::build_pin_entry(&opened, &conv, &ch_hex).unwrap();
        let content = crate::community::v2::pins::serialize_public_pin_list(&[entry]).unwrap();
        let eid = crate::community::v2::derive::pins_locator(community.id(), &general);
        publish_control_edition(&bed.relay, &community, vsk::PINS, &eid, &content).await.unwrap();
        let spammer = Keys::generate().public_key().to_hex();
        set_banlist(&bed.relay, &community, std::slice::from_ref(&spammer)).await.unwrap();
        let bundle = bundle_of(&community, BundleAudience::Link, Some(owner.keys.public_key()), None, None);
        let bundle_json = serde_json::to_string(&bundle).unwrap();

        bed.swap_to(&member);
        let joined = accept_parked_invite(&bed.relay, &bundle_json, None).await.unwrap();
        // Deliberately NO follow_control here — the join alone must suffice.
        let read = read_channel_pins(&joined, &general).unwrap();
        assert!(!read.sealed);
        assert_eq!(read.pins.len(), 1, "pins visible the instant the join returns");
        assert_eq!(read.pins[0].content, "pin-worthy");
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&joined.id().0);
        let banlist = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        assert!(banlist.contains(&spammer), "the banlist is enforced from the join, not the first follow");
    }

    /// CORD-04 §5: a pins edition from an author holding no PIN_MESSAGES never
    /// becomes the head — the fold's authority gate covers the new entity.
    #[tokio::test]
    async fn an_unauthorized_pin_edition_never_folds() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Gated", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;

        let rogue = Keys::generate();
        let group = control::ControlPlane::of(&community).write_group().unwrap();
        let eid = crate::community::v2::derive::pins_locator(community.id(), &general);
        let rumor = control::build_edition_rumor(rogue.public_key(), vsk::PINS, &eid, 1, None, r#"{"entries":[]}"#, 2_000, None);
        let (wrap, _) = control::seal_control_edition(&rumor, &group, &rogue, Timestamp::from_secs(2_000)).unwrap();
        relay.publish(&wrap, &community.relays).await.unwrap();

        follow_control(&relay, &community).await.unwrap().updated;
        let read = read_channel_pins(&community, &general).unwrap();
        assert_eq!(read.version, 0, "an unauthorized edition never persists a head");
        assert!(read.pins.is_empty());
    }

    /// The silent owner-side widening: a pre-pins Admin role (founding mask)
    /// gains PIN_MESSAGES as one edition of the same entity; idempotent after.
    #[tokio::test]
    async fn owner_silently_widens_a_legacy_admin_role() {
        let (_tmp, _guard, owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Legacy", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let rid = crate::simd::hex::bytes_to_hex_32(&[0x5d; 32]);

        // An Admin role exactly as a pre-pins build published it.
        let legacy = Role {
            role_id: rid.clone(),
            name: "Admin".into(),
            position: 1,
            permissions: Permissions(Permissions::ADMIN_FOUNDING_MASK),
            scope: RoleScope::Server,
            color: 0, extra: Default::default(),
        };
        publish_role(&relay, &community, &owner, &legacy, 1).await;
        follow_control(&relay, &community).await.unwrap().updated;

        assert!(upgrade_admin_role_pin_bit(&relay, &community).await.unwrap(), "the widening publishes");
        follow_control(&relay, &community).await.unwrap().updated;
        let roles = crate::db::community::get_community_roles(&cid_hex).unwrap();
        let widened = roles.roles.iter().find(|r| r.role_id == rid).expect("same entity");
        assert!(widened.permissions.contains(Permissions::PIN_MESSAGES), "bit 11 landed");
        assert!(widened.permissions.contains(Permissions::ADMIN_FOUNDING_MASK), "nothing stripped");

        // Second call: nothing left to widen.
        assert!(!upgrade_admin_role_pin_bit(&relay, &community).await.unwrap());
    }

    /// §7 deletion duty: the author-curator's own deleted message leaves the
    /// list as an immediate omitting edition.
    #[tokio::test]
    async fn the_deletion_duty_omits_a_pinned_message() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Duties", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&general.0);

        let rumor_id = send_message(&relay, &community, &general, "soon deleted").await.unwrap();
        let page = fetch_channel(&relay, &community, &general, 10).await.unwrap();
        let opened = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Message { opened, .. } => (opened.rumor_id.to_hex() == rumor_id).then(|| opened.clone()),
                _ => None,
            })
            .unwrap();
        let ch = community.channels[0].clone();
        let conv = channel_conv_key_at(&community, &ch, 0).unwrap();
        let entry = crate::community::v2::pins::build_pin_entry(&opened, &conv, &ch_hex).unwrap();
        publish_pin_list(&relay, &community, &ch, &[entry]).await.unwrap();
        assert_eq!(read_channel_pins(&community, &general).unwrap().pins.len(), 1);

        // The author holds the bit (owner) → the duty publishes the omission at once.
        run_pin_duty(&relay, &ch_hex, &rumor_id, None).await.unwrap();
        let after = read_channel_pins(&community, &general).unwrap();
        assert!(after.pins.is_empty(), "the omitting edition landed");
        assert!(after.version >= 2, "a NEW edition, not a local erase");
    }

    /// §7 edit duty: an edited pinned message gets its proof bundle refreshed,
    /// so keyless readers see the revision — and the duty is idempotent.
    #[tokio::test]
    async fn the_edit_duty_refreshes_a_pinned_proof() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Edits", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&general.0);

        let rumor_id = send_message(&relay, &community, &general, "first words").await.unwrap();
        let page = fetch_channel(&relay, &community, &general, 10).await.unwrap();
        let opened = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Message { opened, .. } => (opened.rumor_id.to_hex() == rumor_id).then(|| opened.clone()),
                _ => None,
            })
            .unwrap();
        let ch = community.channels[0].clone();
        let conv = channel_conv_key_at(&community, &ch, 0).unwrap();
        let entry = crate::community::v2::pins::build_pin_entry(&opened, &conv, &ch_hex).unwrap();
        publish_pin_list(&relay, &community, &ch, &[entry]).await.unwrap();

        send_edit(&relay, &community, &general, &rumor_id, "second thoughts", &[]).await.unwrap();
        let page = fetch_channel(&relay, &community, &general, 10).await.unwrap();
        let edit_opened = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Edit { opened, .. } => Some(opened.clone()),
                _ => None,
            })
            .expect("the edit reads back");

        run_pin_duty(&relay, &ch_hex, &rumor_id, Some(edit_opened.clone())).await.unwrap();
        let after = read_channel_pins(&community, &general).unwrap();
        assert_eq!(after.pins.len(), 1);
        assert_eq!(
            after.pins[0].content, "second thoughts",
            "the refreshed bundle proves the revision"
        );
        let v = after.version;

        // Same revision again → monotonic guard, no new edition.
        run_pin_duty(&relay, &ch_hex, &rumor_id, Some(edit_opened)).await.unwrap();
        assert_eq!(read_channel_pins(&community, &general).unwrap().version, v, "idempotent");
    }

    /// §7 author-side trigger: an own edit's relay echo is a dedup'd duplicate
    /// at ingest, so publish_chat's SEND echo must decide the duty itself —
    /// otherwise the author's own pin lags behind their message while every
    /// other client's follows ("the affected author acts at once").
    #[tokio::test]
    async fn an_own_edit_echo_carries_the_pin_duty_trigger() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "OwnEdit", vec!["wss://r".into()], None).await.unwrap();
        let general = community.channels[0].id;

        let rumor_id = send_message(&relay, &community, &general, "before").await.unwrap();
        send_edit(&relay, &community, &general, &rumor_id, "after", &[]).await.unwrap();
        let page = fetch_channel(&relay, &community, &general, 10).await.unwrap();
        let edit_event = &page.iter().find(|f| matches!(&f.event, ChatEvent::Edit { .. })).expect("the edit reads back").event;
        let msg_event = &page.iter().find(|f| matches!(&f.event, ChatEvent::Message { .. })).expect("the message reads back").event;

        let updated = crate::community::v2::inbound::ChatPersist::Updated {
            message: crate::types::Message::default(),
            edit_event: None,
        };
        let (target_hex, opened) = own_echo_pin_duty(&updated, edit_event).expect("an applied own edit fires the duty");
        assert_eq!(target_hex, rumor_id, "the duty targets the EDITED message, not the edit rumor");
        assert_ne!(opened.rumor_id.to_hex(), rumor_id, "and carries the edit's own opened stream for the bundle");

        // A fresh message echo is not a duty…
        let new = crate::community::v2::inbound::ChatPersist::New(crate::types::Message::default());
        assert!(own_echo_pin_duty(&new, msg_event).is_none());
        // …and neither is a reaction-shaped Updated on a non-edit event.
        assert!(own_echo_pin_duty(&updated, msg_event).is_none());
    }

    /// §7 Rotator duty: a private-channel rotation republishes the Pin List
    /// sealed under the NEW epoch — a member who joins after the rotation
    /// (holding only the new key) must not read the channel's pins as dark.
    #[tokio::test]
    async fn a_rotation_reseals_the_pin_list_under_the_new_epoch() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Reseal", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let chan = create_private_channel(&relay, &community, "vault").await.unwrap();
        let community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let ch_hex = crate::simd::hex::bytes_to_hex_32(&chan.0);

        let rumor_id = send_message(&relay, &community, &chan, "sealed wisdom").await.unwrap();
        let page = fetch_channel(&relay, &community, &chan, 10).await.unwrap();
        let opened = page
            .iter()
            .find_map(|f| match &f.event {
                ChatEvent::Message { opened, .. } => (opened.rumor_id.to_hex() == rumor_id).then(|| opened.clone()),
                _ => None,
            })
            .unwrap();
        let ch = community.channel(&chan).unwrap().clone();
        let old_epoch = ch.epoch.0;
        let conv = channel_conv_key_at(&community, &ch, old_epoch).unwrap();
        let entry = crate::community::v2::pins::build_pin_entry(&opened, &conv, &ch_hex).unwrap();
        publish_pin_list(&relay, &community, &ch, &[entry]).await.unwrap();
        let (_, v_before) = crate::db::community::get_community_pins(&cid_hex, &ch_hex).unwrap().unwrap();

        // Rotate the channel away from a (never-granted) member.
        let roster = crate::db::community::get_community_roles(&cid_hex).unwrap();
        rekey_channel_excluding(&relay, &community, &chan, &roster, &[], &[Keys::generate().public_key()])
            .await
            .unwrap();

        // The stored head is a NEW edition, sealed under the NEW epoch.
        let (content, version) = crate::db::community::get_community_pins(&cid_hex, &ch_hex).unwrap().unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&content).unwrap();
        assert_eq!(
            parsed["epoch"].as_str().unwrap(),
            (old_epoch + 1).to_string(),
            "the reseal names the rotated epoch"
        );
        assert!(version > v_before, "a real edition, not a local rewrite");

        // The rotator's own post-rotation view still verifies the pin.
        let community = crate::db::community::load_community_v2(community.id()).unwrap().unwrap();
        let read = read_channel_pins(&community, &chan).unwrap();
        assert!(!read.sealed);
        assert_eq!(read.pins.len(), 1);
        assert_eq!(read.pins[0].content, "sealed wisdom");
    }

    /// The production ban-eraser: set_banlist must ECHO its published list
    /// into the local cache immediately. Before this, the cache moved only on
    /// a successful control fold — and a composing caller (ban = banlist →
    /// grant strip → refound) whose refound tripped re-read the stale list,
    /// so each of 19 real bans erased its predecessors.
    #[tokio::test]
    async fn a_published_banlist_echoes_locally_before_any_fold() {
        let (_tmp, _guard, _owner) = init_test_db();
        let relay = MemoryRelay::new();
        let community = create_community(&relay, "Modtown", vec!["wss://r".into()], None).await.unwrap();
        let cid_hex = crate::simd::hex::bytes_to_hex_32(&community.id().0);
        let spammer_a = "aa".repeat(32);
        let spammer_b = "bb".repeat(32);

        // Ban A. NO fold runs — the cache must hold the publish regardless.
        set_banlist(&relay, &community, &[spammer_a.clone()]).await.unwrap();
        assert_eq!(
            crate::db::community::get_community_banlist(&cid_hex).unwrap(),
            vec![spammer_a.clone()],
            "the publish echoes without waiting for a fold"
        );

        // Ban B composes from the cache, exactly as the SDK does.
        let mut list = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        list.push(spammer_b.clone());
        set_banlist(&relay, &community, &list).await.unwrap();
        let held = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        assert!(
            held.contains(&spammer_a) && held.contains(&spammer_b),
            "sequential bans UNION; the second must not erase the first: {held:?}"
        );

        // The wire agrees: a real fold confirms rather than regresses.
        follow_control(&relay, &community).await.unwrap().updated;
        let folded = crate::db::community::get_community_banlist(&cid_hex).unwrap();
        assert!(folded.contains(&spammer_a) && folded.contains(&spammer_b));
    }
}