Let a team change hands, and be joined by somebody with no account yet

M3 built teams and stopped short of the two operations that decide who
controls one. Both were written down as refusals rather than omissions:
ADR 0009 listed ownership transfer under "deliberately not built", and
design-import-gaps said an invitation needed "a token with a lifetime and an
outbound mail path". One of those reasons had expired and the other never
applied — an invitation does not need a token if it is not a thing anybody
presents.

Handing a team over is one write. The member you name becomes owner and you
become an admin, in a single transaction, because ownership is sole: promoting
first leaves the team owned twice, demoting first leaves it owned by nobody,
and there is nobody left with the authority to finish a transfer that stopped
in the middle. That is also why it is not two calls to the role endpoint, which
refuses Owner outright. The outgoing owner is demoted rather than removed —
removing them would revoke their vault key grants and flag every team vault for
rekey, which is a far larger act than the one asked for, and somebody handing
over a team is usually staying in it. It unblocks the thing that was impossible
before: an owner can now leave, by handing the team on first.

An invitation is a standing instruction rather than a message. This server has
no outbound mail path, so nothing is sent and there is nothing for the invitee
to present. The row says the next account signing in with that address joins
this team at this role, and telling them to sign in is the caller's job over a
channel this server does not carry. A link nobody can deliver would be worse
than none. It lives in its own table rather than becoming a membership with
MembershipStatus.Invited, and that member stays unwritten for the reason it
always was: team_membership.user_id is not nullable and carries a foreign key,
so somebody who has never signed in has nothing for that row to point at.
Widening it would make the unique index on (team, user) meaningless, because
PostgreSQL counts every NULL as distinct.

Verification is the security boundary, and nothing in this server read it
before. A claim requires the access token to assert email_verified. An
invitation decides what the server will serve, so one claimable by anybody able
to obtain a token carrying somebody else's address is a way into a team — which
is precisely the attack OidcOptions.AllowEmailLinking exists to refuse, and it
would have been reintroduced by the back door. There is deliberately no setting
that relaxes it: a flag that exists is one somebody turns on for the afternoon
their provider is misconfigured. Absence is refused rather than trusted, and
logged, because a provider that never sends the claim otherwise leaves every
invitation pending with nothing anywhere saying why.

Claiming happens at just-in-time provisioning and again on an hourly sweep. The
sweep is what makes it recoverable rather than one-shot — an invitation issued
between an account being created and that person next signing in would
otherwise be stranded for ever — and it shares its rate with the last-seen
write because both are housekeeping nobody is waiting on.

Archiving is refused while a team owns a vault, and that refusal is the end of
the road rather than a step on it. A team vault is readable because of
membership, so archiving one that still owned vaults would take them away from
everybody holding a key, including the caller, quietly and all at once. Nothing
in this product deletes a vault, so no order of operations gets past it today —
which is stated with a count of what is in the way, for the reason the SFTP
layer refuses a recursive delete: a refusal is visible and a quiet removal is
not. It is owner-only, as handing over is; renaming is not, because a rename is
visible to everybody and reversible by anybody who can do it. The slug is not
renameable at all: it is unique only among live teams, so a rename could take
one an archived team is still holding, and that team could then never be
restored.

LAST ACTIVE is real and coarse on purpose. UserAccount.LastSeenAtUtc is
refreshed on ordinary authenticated requests, at most once per account per
hour, through ExecuteUpdateAsync — user_account carries the xmin concurrency
token, so a read-then-write on the hot path would start losing races between
one user's own overlapping requests. An hour is the granularity the question is
actually asked at, and the interface draws it to the day rather than the minute
so it does not read as a precision that is not there. The remarks in Contracts
and in the view model that argued at length for the column's absence are
rewritten rather than extended; both had become false.

Two endpoints already existed and nothing called them. ChangeTeamMemberRole and
ListVaultGrants have been reachable since M3. The role picker refuses Owner
itself rather than letting the server do it, since the interface already knew
the rule; the key-holder list sits under the vault rather than beside the
member, because a grant is per vault and a count on a member row would imply
per-item sharing, which is M5. It lists withdrawn and stale grants and says
which they are — a list that dropped them would show a departed colleague as
merely absent rather than as somebody whose key was taken away — and staleness
is decided by comparing generations, since a grant can be Active and still open
nothing.

ADD MEMBER stopped being a dead end. An address the directory did not know used
to end at a sentence telling the user their colleague had to sign in first. It
invites them instead, from the same button, because which of the two applies is
a fact about the server's account table rather than about what the user is
doing; which one happened is reported afterwards, because that decides what
they do next. An address that merely has an account is invited rather than
refused: refusing would have made the endpoint an oracle for which addresses
have accounts here, answerable by anybody willing to create a team first.

The phone has a TEAMS screen, behind MORE, and it is the reverse of every other
row in design-import-gaps: a shipped screen the design had no slot for. It is
there because an invitation is claimed by signing in, so somebody told they are
now in a team is at least as likely to be holding a phone — and a membership
visible only on a head they never installed is one they cannot see. It draws
SHARE KEY and nothing that takes something away: wrapping a key is the one act
on that screen a server cannot perform at all, and the desktop guards its
revocations with a tooltip, which is a control a touch screen cannot show.

Two defects were found by an adversarial pass and both were green against the
whole suite at the time. The owner-only check on archiving and handing over had
been weakened to the admin check while their messages and comments still said
owner — and since nothing behind the archive endpoint re-checks it, an admin
the owner had promoted could have archived the team out from under them. And
the rename endpoint built its response with a hardcoded Owner role, so an admin
who renamed a team was handed a summary claiming they owned it, and a client
trusting that instead of re-listing would have offered them the two owner-only
buttons the server then refuses.

The new table gets its constraints tested rather than merely migrated: live
uniqueness per (team, address), the citext proof that an address typed by a
person matches one cased by a provider, and reissue after both revocation and
acceptance. The teams screen gets its first entries in the layout suite, at the
minimum window with every list populated and with each of the two states that
cover half of it — it had none, and it just grew four sections and a second
line in the member row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/manual-checks.md

@@ -834,3 +834,144 @@ nothing else about them changes. Neither host is queued for push.
 On the phone's host editor with several tags: the chips are at least 36 tall, spaced enough that a miss
 lands between them rather than on the wrong tag, and the new-tag box and ADD sit on one row without either
 being squeezed to nothing.
+
+## Phase 10 — Teams: the operations that span two accounts
+
+The server's own rules are covered by the endpoint suite: teams are renamed, an archive is refused while a
+vault is in the way, ownership changes hands, and every branch of the invitation claim is driven with
+tokens the test mints itself. That last freedom is exactly what puts this phase here. **A test can mint a
+token asserting anything it likes, so it can prove the server's rule and can say nothing whatever about
+whether *your* identity provider sends the claim that rule depends on** — and an invitation that never
+activates fails by sitting still, which is the failure mode nobody notices. What is left needs two real
+accounts, a real sign-in, and in two cases a clock.
+
+**Two accounts, and two profiles.** The dev realm ships `alice` and `bob`, both with verified addresses; a
+second DodoSSH profile means a second machine, a second OS user, or the same machine after signing out.
+Whichever account plays the invitee **must not have signed in to this deployment before** — most of what
+follows is about what happens the first time it does.
+
+### 10.1 An invitation becomes a membership at the invitee's first sign-in · **the one worth the most care**
+
+1. Sign in as `alice`, make a team, and open its invitations.
+2. Invite `bob@example.com` as a Member. **Nothing is sent, and nothing should look as though it was** —
+   no "invitation emailed", no link to copy, no token anywhere on the screen.
+3. **Pass:** the row appears as *pending*, carrying the address, the role and an expiry fourteen days out.
+   Bob is **not** in the members table, because he has no account here for a membership row to point at.
+4. Sign in as `bob` on the second profile and enroll.
+5. **Pass:** the team is in Bob's list the first time he looks, at Member, with nothing further pressed on
+   either side. Back on Alice's machine, refresh: the invitation reads *accepted* rather than vanishing,
+   and Bob is now in the members table.
+6. **Pass, and this is the half that is easiest to lose:** the team's vault is in Bob's list **saying it is
+   waiting for a key**, and nothing in it is readable. Have Alice press SHARE KEY and Bob sync; now it
+   opens.
+
+**Failure means:** step 5 failing with everything else passing is almost always the `email_verified` claim
+— go to 10.2 rather than reading the invitation code, because the server is doing exactly what it should.
+Step 6 opening the vault *without* Alice sharing a key would be the far more serious failure: nothing on
+the server can wrap a vault key, so an item that decrypts after a membership change alone means a key
+reached that machine by a route this architecture says does not exist.
+
+### 10.2 An unverified address claims nothing, and the log is the only place that says so
+
+In Keycloak's admin console, clear **Email verified** on the invitee *before* their first DodoSSH sign-in.
+Invite that address, then sign in as them.
+
+**Pass:** they get an account and a personal vault and no team at all. The invitation stays *pending* on
+the inviter's screen rather than turning into anything, and the API log carries a warning naming how many
+invitations it declined to claim. Now set **Email verified** back on. The claim happens on the next request
+that crosses the hourly last-seen window, so it is **not** immediate and restarting the client will not
+hurry it along — the account already exists, so there is no second first-sign-in to trigger it.
+
+**Failure means:** if the team appears while the address is unverified, the one security boundary
+invitations have is not being enforced, and anybody able to obtain a token asserting a colleague's address
+can walk into their team. Stop there. If it stays pending after verifying, the claim is not reaching the
+**access** token — check the provider's mappers, and set `Oidc:EmailVerifiedClaim` if it sends the claim
+under some other name.
+
+### 10.3 An invitation can be withdrawn until it is taken up
+
+Invite an address, then revoke it before anybody has signed in with it. Then sign in with that address.
+
+**Pass:** the row reads *revoked* and stays on the list rather than disappearing, and the sign-in produces
+an ordinary account in no team. Revoking one that has *already* been accepted answers that there was
+nothing to withdraw.
+
+**Failure means:** a revoked invitation that still lets somebody in is a removal that did not remove. An
+accepted one that could be unpicked here would be worse: it is a membership now, and removing a member
+revokes their vault key grants and flags every team vault for rekey, which is not what "revoke invitation"
+should quietly do.
+
+### 10.4 An address already in the team is refused; an address that merely has an account is not
+
+With Bob in the team, invite `bob@example.com` to it again.
+
+**Pass:** refused, with a sentence saying the address already belongs to a member and to change their role
+instead. Now make a **second** team and invite the same address there.
+
+**Pass:** accepted. Bob having an account is deliberately not a reason to refuse — it is claimed within the
+hour on his next request rather than at a sign-in, so give it that long before deciding it has not worked.
+
+**Failure means:** if the second invitation is refused because the address already has an account, this
+endpoint has become a way of asking the server which addresses have accounts on it, answerable by anybody
+willing to create a team first. See ADR 0009.
+
+### 10.5 LAST ACTIVE is a real time, and a coarse one · **needs a couple of hours**
+
+Use one account and leave the other idle for two or three hours, then read the members table.
+
+**Pass:** the account being used carries a recent time, the idle one does not move, and neither moves more
+than once an hour however much is done in it. It is shown as roughly-when, never to the minute.
+
+**Failure means:** a value that tracks every click means the hourly gate is gone and every authenticated
+request is writing to `user_account` — which carries the xmin concurrency token, so the next symptom is a
+user's own overlapping requests failing on a version that moved under them. A value frozen at enrollment
+means the refresh is not running on ordinary requests at all, which is the state that made this column
+impossible to offer honestly before.
+
+### 10.6 Ownership changes hands in one act
+
+As the owner, transfer ownership to another active member, then read both rows.
+
+**Pass:** they are Owner and you are **Admin** — not removed, not Member. Your vault key grants are intact
+and the team's vaults have not come back flagged for rekey. Then try to transfer to somebody who is not a
+member, and to yourself.
+
+**Pass:** both refused, and the message says which.
+
+**Failure means:** two owners, or none, is the state this being a single transaction exists to prevent, and
+either one leaves a team that no client can administer back into shape. If your grants were revoked or the
+vaults are now flagged for rekey, the transfer is removing the outgoing owner rather than demoting them.
+
+### 10.7 Archiving is refused while the team owns a vault
+
+With a team that owns at least one vault, try to archive it.
+
+**Pass:** refused, and the message counts the vaults in the way and says there is no way to delete a vault
+in this product. The team is still in everybody's list afterwards and its vaults still open.
+
+**Failure means:** an archive that succeeded here would have taken those vaults out of the list of
+everybody holding a key — including the person who pressed it, quietly, and with nothing in the product
+able to put them back.
+
+### 10.8 Archiving an empty team takes its memberships and its invitations with it · **needs two accounts**
+
+Make a team that owns no vaults, add the second account to it, invite a third address, and archive it.
+
+**Pass:** the team is gone from both accounts' lists. Sign in with the invited address afterwards and it
+joins nothing. A new team can be created under the archived one's slug.
+
+**Failure means:** the invited address turning up in a team nobody can see is exactly what revoking pending
+invitations inside the same transaction exists to prevent, and it would happen weeks later on a sign-in
+nobody is watching. Note that taking the freed slug is correct rather than a defect, and is also the reason
+an archived team is only restorable by an operator who checks that first.
+
+### 10.9 Renaming a team, and the slug that does not move
+
+Rename a team and change its description.
+
+**Pass:** the new name is on every screen that names the team, on both accounts after a refresh. The slug is
+unchanged and there is nowhere to change it. Nothing claims to know *when* it was renamed.
+
+**Failure means:** a rename that moved the slug could take one an archived team is still holding, and that
+archived team could then never be brought back. An "edited" timestamp anywhere on the screen is invented
+data — `team` has no updated-at column, so there is nothing behind it.