task 7: the read-path visibility predicate — the deploy-gate compensating control master
TDD run (2 cycles) + exhaustive read-surface inventory + MANDATED ten-stream security review + red-first fix batch. make ci green (5157/0/0). Ships: visiblePostsJoin (per-row (community_did,post_uri) admission join, collection-aware fail-closed — postv2-without-a-row hidden, legacy visible, accepted-branch honors the pinned CID) threaded into all 5 display sites; INNER→LEFT users join (unknown-author visibility, §5.3); #removedPost union + postView admission context; getComments header now admission+delete-aware; count predicates. Two LIVE content leaks the review caught + fixed: getComments served a moderator-removed LEGACY post to anonymous callers (collection inference → real admissions lookup); the accepted branch rendered edited-unaccepted content in the CID-transition window (§5.5 read-side → accepted_cid=p.cid). Security mandate: surface enumeration exhaustive, split_part discriminator cleared, actor.getComments confirmed reference-only. SECURITY SIGN-OFF: tasks 6+7 are now deploy-safe together — the read path gates every surface. PRD rev 2.8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>