feat(federation): quarantine real accounts on reset heal (freeze + free-handle)

packages/server/src/utils/federationReset.ts

@@ -270,7 +270,6 @@ export function healResetIncarnation(origin: string, newEpoch: string, reason: P
   // Clear the heal flag on exactly the stubs we healed, keyed by id.
   // `tombstoneUser` has already randomized their `password_hash`, so re-querying
   // by the stub sentinel would miss them — the id list is the reliable key.
-  // Real accounts keep `federation_heal_pending = 1` for Phase 2.
   if (stubs.length > 0) {
     db.update(schema.users)
       .set({ federationHealPending: 0 })
@@ -278,8 +277,75 @@ export function healResetIncarnation(origin: string, newEpoch: string, reason: P
       .run();
   }
 
+  // Quarantine the flagged REAL accounts (freeze + free-handle / surface). §6.3b.
+  const orphanedCount = quarantineOrphanedAccounts(origin);
+
+  // Resolve the journal and refresh the orphaned-account count to the frozen set.
   db.update(schema.federationResetEvents)
-    .set({ newEpoch, resolvedAt: Date.now() })
+    .set({ newEpoch, resolvedAt: Date.now(), orphanedAccountCount: orphanedCount })
     .where(eq(schema.federationResetEvents.origin, origin))
     .run();
 }
+
+/**
+ * Post-heal quarantine of the dead incarnation's REAL federated accounts (design
+ * §6.3b). Called from `healResetIncarnation`'s genuine-reset branch AFTER the stub
+ * soft-tombstone loop. Real accounts carry non-re-syncable local content and are
+ * NEVER auto-deleted — they are FROZEN and surfaced to the admin.
+ *
+ * For every flagged real account (`federation_heal_pending = 1`,
+ * `passwordHash != REPLICATED_STUB_SENTINEL`, `isDeleted = 0`) for this origin:
+ *  - Set `federation_home_orphaned = 1` (FREEZE). This is universal — it is what
+ *    closes the post-re-peer hijack (the Task-2 epoch guard passes once the
+ *    baseline is updated to the new epoch, so the freeze is the only remaining
+ *    barrier). The direct-login freeze (auth.ts) enforces it.
+ *  - If the account OWNS local spaces: do NOT rename it. Space ownership must be
+ *    resolved by a human (admin Remove → transfer/delete first). Renaming an owner
+ *    would orphan the ownerId reference into a `!orphaned:` handle, confusing to
+ *    members. It stays frozen + surfaced.
+ *  - Otherwise: rename `username → !orphaned:{uid}@{domain}` to FREE the handle so
+ *    a returning same-name user re-registers into a clean fresh account instead of
+ *    colliding (defends BOTH login uniqueness AND the registration tier-2
+ *    stub-resolution upgrade path — see the plan's collision analysis).
+ *  - Clear `federation_heal_pending` (processed).
+ *
+ * Content (space messages, memberships, reactions) is preserved in all cases.
+ *
+ * @returns the number of accounts quarantined (frozen) — used to refresh the
+ *          journal's `orphaned_account_count`.
+ */
+export function quarantineOrphanedAccounts(origin: string): number {
+  const db = getDb();
+  const domain = extractDomain(origin);
+
+  const accounts = db
+    .select({ id: schema.users.id })
+    .from(schema.users)
+    .where(and(
+      eq(schema.users.federationHealPending, 1),
+      eq(schema.users.isDeleted, 0),
+      sql`${schema.users.passwordHash} != ${REPLICATED_STUB_SENTINEL}`,
+      homeInstanceMatch(origin),
+    ))
+    .all();
+
+  for (const acct of accounts) {
+    const ownsSpace = db
+      .select({ id: schema.spaces.id })
+      .from(schema.spaces)
+      .where(eq(schema.spaces.ownerId, acct.id))
+      .get();
+
+    const updates: Record<string, string | number> = {
+      federationHomeOrphaned: 1,
+      federationHealPending: 0,
+    };
+    if (!ownsSpace) {
+      // Free the handle only for non-owners.
+      updates.username = `!orphaned:${acct.id}@${domain}`;
+    }
+    db.update(schema.users).set(updates).where(eq(schema.users.id, acct.id)).run();
+  }
+
+  return accounts.length;
+}