The compensating control's own hardening pass — two live read-path leaks plus fold-ins, against RED's ebd581f pins. - P1 (getComments removed-legacy leak): the thread-header gate no longer infers visibility from collection (which served a moderator-REMOVED legacy community.post to anonymous callers — a legacy row CAN carry a removed admission). It now consults a REAL admission lookup via the new viewer-aware postgresPostRepo.VisibleHeaderView, reached through an optional type assertion so unit-test fakes degrade to the soft-delete gate. Removed legacy/postv2 and soft-deleted legacy → ErrRootNotFound; accepted served; author sees own pending. - P2 (§5.5 accepted-CID read leak): visiblePostsJoin's accepted branch now ANDs a.accepted_cid = p.cid, so an edited-past-the-acceptance post is hidden on every feed + post.get during the pre-reacceptance window instead of rendering un-attested content under a stale acceptance. - P5 (dropped hydration): the served getComments header is the admission- hydrated view VisibleHeaderView returns (status/acceptanceUri survive), not a second view rebuilt from the raw Post. - P6 (fold-ins, no pins): user post_count + countAcceptedPostsForCommunity honor the pinned CID and share posts.PostV2Collection (killed the raw literal); removedMarkers gained a soft-delete guard (deleted+removed → notFound, not #removedPost) and a single batched GetByPostURIs lookup replacing the per-URI admissions N+1. - P3/P4 already passed as regression guards — untouched. make ci: 5157 passed, 0 failed, 0 skipped. No test files modified. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>