[Birfy]

Written-by: Dev

Fixes #899

A Bot that used a face-to-face room keeps a room-only Bot Social identity. mintRoomInvite and claimTicket (core/src/host/room-membership.js) asked for an identity only when a Bot had no handle, so a room-only one stayed as it was:

• guest: the claim landed at Bot Social, then the knock failed in sendTicketShare (needs an active member): Chief has no Bot Social identity yet;
• host: the link's Bot stayed room-only, pollOnce polls only active members, so the knock was never read and nobody was seated;
• the dialog (plugins/social/client.js previewLocal) then said You already joined this group with that link for any claimed.

Fix: a room-only identity counts as none for a link (activeHandleOf), so identify promotes it at mint and at Join; serveInvites runs rt.identifyInviteBots once so links minted earlier on a room-only Bot are read after an update. room-invite-preview adds joined (the room that ticket seated is here); the dialog says "already joined" only then, otherwise Waiting for to let you in… with the card kept, so Join claims again (same Bots = idempotent on Bot Social) and knocks again.

Reproduced on main 9f4aa52 + Bot Social 929d390 (byte-identical to what prod serves) with two fresh homes: both failures above.

Verification at 6ae149150f36e5557f05b239c88de1a7348ff628

• core: node --test test/room-ticket-seat.test.js test/remote-room.test.js test/room-membership.test.js test/authz.test.js → 99/99.
• plugins/social: TZ=UTC npm test → 395/395.
• Red at base: the two new #899 tests in core/test/room-ticket-seat.test.js and the updated dialog test in plugins/social/test/social.test.js fail with the base sources (fail 2 / fail 1), pass here.
• ARCH_DOCS_BASE=origin/main npm run lint (core) → arch-docs OK, 43 warnings (same as base); node scripts/lint-plugins.mjs ok; build-client --check ok; ds-bot-patches check ok; changelog.mjs check ok.

Not run: full npm run verify (CI runs it), smoke bench, Desktop.

[Birfy]

Verdict: PASS at 6ae1491
Written-by: Reviewer

Ran:

• git worktree add rv900 6ae149150f36e5557f05b239c88de1a7348ff628, then in core/: node --import ./test/harness-resolve.mjs --test test/room-ticket-seat.test.js test/remote-room.test.js test/room-membership.test.js test/authz.test.js → pass 99, fail 0
• cd plugins/social && TZ=UTC npm test → pass 395, fail 0
• cd core && ARCH_DOCS_BASE=origin/main npm run lint → arch-docs OK (12 changed files), 43 warnings as on base
• node scripts/ds-bot-patches.mjs check → ok; node core/scripts/build-client.mjs --check → exit 0
• Red at base: git checkout 9f4aa524 -- core/src plugins/social/client.js with this tip's tests → --test-name-pattern="#899" test/room-ticket-seat.test.js fail 2, --test-name-pattern="each refusal of a group link" test/social.test.js fail 1; pass at the tip
• Live, two fresh homes on this tip + Bot Social 929d390 (what prod serves), both Chiefs room-only from a face room: mint → Join with Chief → host seats @chief.ben.home (ticket), guest has "Trip plan"; re-paste → claimed: true, joined: true. Homes from main 9f4aa52 with a stuck claim, upgraded to this tip: host Chief promoted at start, guest preview claimed: true, joined: false, Join again → seated.
• gh pr checks 900 → tests-ok and every Test job green at this head

Not run: full npm run verify locally (CI ran it), smoke bench, Desktop, a real model.

Findings: no actionable findings.

• A room-only identity now counts as none for a link (activeHandleOf), so identify → plugin register(forInvite) promotes it (existing Promoting a room-only Bot Social identity drops the stored owner name and home that the share envelope needs #863 path, no new server call). That is the documented link consent ("a link's own Bots get a full identity"), not a new grant: reach() still decides every send.
• rt.identifyInviteBots runs once when serveInvites registers; a failure only warns. Withdrawn links that seated nobody wake nothing (tested).
• joined is computed from local state only (an inbound-share room with that ticket and a local Bot seated); no peer-controlled text added to model-visible or trusted headers. The dialog's owner name is the already-cleaned preview owner.
• Retry with other Bots still answers Bot Social's already_claimed sentence; acceptable, out of scope.

Disclosure: the same executor session that wrote this PR ran this review (owner asked for one focused review, speed first; Birfy is in selfReview). This is not merge authority by itself; the merge goes through enqueue-guard and the queue.