Module dissolution 

Dissolution — CORD-02 §9.

A Community ends by one owner-signed tombstone at a coordinate derived from the community_id ALONE (super::derive::dissolved_group_key) — no key, no epoch — so every member past or present resolves the same address and a Refounding can never strand the grave. The tombstone is terminal and CHAINLESS: no version to race, nothing to edit; the presence of one valid owner-signed edition at the coordinate IS the state.

The tombstone is authority-bearing state anyone holding only the community_id must be able to verify, and its content is empty, so Vector seals it with the plaintext seal form (kind 20014, like the Control Plane) rather than the double-encrypted form — nothing here is secret. On read the check is lenient about the seal form but strict about who signed it: only the owner the community_id commits to (§1) counts. An impostor’s event at the (findable-by-anyone) address is noise — fail-closed, an unverifiable-or-foreign tombstone is NOT death.

Two caller responsibilities this module deliberately does NOT implement:

• On a verified tombstone the client seals the Community read-only: subscriptions halted, held keys still open history but nothing new is honored. Death wins every race — once a valid tombstone exists no epoch advance past it is honored, so a Refounding racing a dissolution loses (the caller enforces this at epoch-advance, not here).
• The one carve-out is a member’s own kind-5 self-delete of their own past message, honored even post-seal (a self-scrub injects no content, so read-only isn’t violated). That lives on the message plane, not here.

Structs

DissolvedTombstone

A verified dissolution tombstone: it carries only its proven owner (the seal signer). Everything else is fixed by the protocol.

Enums

DissolveError

Errors from opening a tombstone wrap.

Functions

dissolved_tombstone_rumor

Build the owner-dissolution tombstone rumor: kind 3308, empty content, ["vsk","10"] + ["eid", <community_id>], and CHAINLESS — no ev, ep, or vac.

open_dissolved

Open + structurally verify a wrap at the dissolved address into its signer. This proves the seal signature and the tombstone shape but NOT the owner — verify_dissolved is the fail-closed authority gate.

seal_dissolved

Sign (plaintext seal) + wrap the tombstone rumor at the community’s dissolved address. Local-keys convenience; a bunker signs the seal itself via stream::seal_content + stream::wrap_seal for identical wire output.

verify_dissolved

Whether wrap is a valid owner-signed dissolution for identity. Valid ONLY if the identity self-certifies AND the tombstone’s seal signer is the exact owner the community_id commits to. Fail-closed: a foreign-signed or unverifiable tombstone is NOT death.