Accepting an invite briefly publishes the joiner's (unshared) Bot on the inviter's home: dead 'no longer shared with you' chat opens on load; friend invisible in Social #303

Summary

After B accepts A's per-Bot invite, A's home briefly publishes B's Chief (the joiner's talk-through Bot, which is not shared back) as a friend's Bot. That creates a 1:1 chat record on A. Seconds later the grant re-filter marks it gone + hidden. On the next load A opened that dead chat and showed: "Chief (@chief.selfb1622.home) is no longer shared with you, so messages to it cannot be delivered… Ask its owner for a new invite." A never had B's Chief. Meanwhile A's sidebar Social section is empty although A and B are friends.

Environment

FlyBot main a003044, dsh 0.2.0-rc.2, Node 24. Fresh A :3090 (SelfA1622) / B :3091 (SelfB1622) on one box, Bot Social prod (1870786). Self-test 2026-10-18 16:24–16:33 Asia/Shanghai.

Repro

1. Fresh A and B. A: Chief → Sharing → Invite to this Bot. B: Add friend → paste the link → talk through Chief. (Here via the local API social/create-invite / social/join-invite at 16:25:19.)
2. Wait about 30 s, then reload A's tab.

Actual

• A's state gets a remote chat record session-6db076fb-… for @chief.selfb1622.home, created 16:25:53, 34 s after the join. Its Session holds only setup events (title Chief, model flybot-remote/@chief.selfb1622.home), with no messages. Now it is remote.gone: true, hidden: true.
• On load A's main pane opened that chat with the "no longer shared with you" bubble. Screenshot: A's main pane titled "SelfB1622's Chief" with that single grey bubble.
• A's sidebar Social section is empty. social/remote-bots on A returns home SelfB1622 with bots: [], and social/friends returns []. So the friendship exists but is invisible. B's sidebar lists SelfA1622's Chief as expected.
• Right after the invite, flybot/social/status listed A's Chief granted: false while flybot/social/access said granted: true (grant grt_01M571V0VBVN3WZJ2A9208Q6JY). Rechecked at 16:36 and both now say granted: true, so this was a transient stale status during the same grant sync.

Hunch (code read on a003044; mechanism matches the timestamps, not stepped in a debugger)

• remoteBots() (plugins/social/src/social.js L767–821) publishes the unfiltered roster first (applyRemoteRoster(unfiltered), L816) and re-filters only after syncOutgoingGrants() resolves (L810–815).
• keepGrantedRemote() (L692–704) drops "the Bot that joined our invite" only via outgoingPeerHandles(). That set is still empty on the first pass, so @chief.selfb1622.home passes. remote.chats then creates a chat for it. The re-filter makes it gone/hidden (core/src/host/remote-chat.js L216–222), but the record and Session stay and can be opened on load.
• The same "briefly listed, then gone/hidden" flip is a candidate for A friend chat sometimes jumps back to Chief's chat on its own (not reproduced) #261, where a friend chat jumps back to Chief.

Expected

• Per-Bot grants, default deny (Per-Bot grants leak: accepting a Helper invite exposes the joiner's Chief; face-room Chief shows in Friends' Bots; Manage access wrong/raw #138/Regression of #138: joining a friend's invite still puts the joiner's Chief on the inviter's main list #161): the inviter's home never gets a chat for the joiner's talk-through Bot. No record is created before the grant filter is known (wait for the grant sync, or filter reverse-friends of our own invites from the relationship's via before publishing).
• Load never opens a hidden/gone chat; it falls back to the Main Bot.
• Suggestion (design call for the maintainer): a friend with no Bots shared with me still appears once in Social as the person (for example SelfB1622 · no Bots shared), so a new friendship is not invisible. If the design is "Social lists only Bots granted to me", the empty section should at least say so.
• social/status and social/access agree on granted at all times.