Pre-push review: T-2291

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swiftindex 4941a08..1bc142e 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift@@ -82,10 +82,6 @@ extension LibraryRepository {         return try await withLockedContext(mode: .exclusive, operation: "committing composed teaching") { context in             let hostname = contract.basis.hostname -            // What this hostname was already diagnosed with, read before any-            // mutation. Step 7 rolls back only when the commit *changes* it.-            let priorDiagnosis = self.quarantineReason(hostname: hostname)-             // 1. Refetch basis and re-project.             let currentBasis: ComposedTeachingBasis             do { currentBasis = try self.buildComposedTeachingBasis(hostname: hostname, context: context) }@@ -226,16 +222,24 @@ extension LibraryRepository {             // `quarantineMap` is the projection this guard has always compared             // against — an illegal tuple, or now a second Site row.             //-            // **The comparison is against `priorDiagnosis`, not against nil**-            // (Req 3.2, 3.3, Decision 8). This guard used to roll back whenever-            // the hostname carried any diagnosis afterwards, which made a-            // diagnosed hostname impossible to re-teach: the app reported+            // **The comparison is against the hostname's prior diagnosis, not+            // against nil** (Req 3.2, 3.3, Decision 8). This guard used to roll+            // back whenever the hostname carried any diagnosis afterwards, which+            // made a diagnosed hostname impossible to re-teach: the app reported             // something wrong and then refused the only action that would fix             // it. Equality is the comparison, not a severity order —             // `LibraryValidationError` has no ordering that would not be invented —             // so an unchanged diagnosis commits and a changed one rolls back.             // Clearing is `diagnoses[hostname] == nil`, which is never a             // difference worth rolling back for.+            //+            // T-2291: through `introducedDiagnosis(across:in:)`, like every other+            // commit gate. The rule was spelled inline here and in+            // `commitRecalculation` below, which is a second place it can drift+            // from the shared helper. The helper reads the quarantine latch+            // itself — untouched until this commit publishes — so reading it+            // here, after the mutation and before the save, is still reading the+            // pre-write answer.             let diagnoses: [String: LibraryValidationError]             do {                 diagnoses = try LibraryValidator.validate(context: context).quarantineMap()@@ -243,11 +247,11 @@ extension LibraryRepository {                 context.rollback()                 return .invalidated(reason: "composed teaching produced an invalid library: \(error)")             }-            if let diagnosis = diagnoses[hostname], diagnosis != priorDiagnosis {+            if let introduced = self.introducedDiagnosis(across: [hostname], in: diagnoses) {                 context.rollback()                 return .invalidated(                     reason: "composed teaching would introduce a new diagnosis on Site "-                        + "'\(hostname)': \(diagnosis)")+                        + "'\(hostname)': \(introduced.diagnosis)")             }              do { try self.saveStrategy.save(context) }@@ -298,7 +302,6 @@ extension LibraryRepository {     ) async throws -> ComposedRecalculationOutcome {         try await withLockedContext(mode: .exclusive, operation: "committing recalculation") { context in             let hostname = contract.basis.hostname-            let priorDiagnosis = self.quarantineReason(hostname: hostname)              let currentBasis: ComposedTeachingBasis             do { currentBasis = try self.buildComposedTeachingBasis(hostname: hostname, context: context) }@@ -359,14 +362,14 @@ extension LibraryRepository {                 context.rollback()                 return .invalidated(reason: "recalculation produced an invalid library: \(error)")             }-            // The same comparison as the composed commit, for the same reason:-            // roll back only when the recalculation changed the hostname's-            // diagnosis (Req 3.2, 3.3, Decision 8).-            if let diagnosis = diagnoses[hostname], diagnosis != priorDiagnosis {+            // The same comparison as the composed commit, through the same+            // helper, for the same reason: roll back only for a diagnosis the+            // recalculation itself introduced (Req 3.2, 3.3, Decision 8).+            if let introduced = self.introducedDiagnosis(across: [hostname], in: diagnoses) {                 context.rollback()                 return .invalidated(                     reason: "recalculation would introduce a new diagnosis on Site "-                        + "'\(hostname)': \(diagnosis)")+                        + "'\(hostname)': \(introduced.diagnosis)")             }              do { try self.saveStrategy.save(context) }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swiftindex ad143b6..661107a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift@@ -798,9 +798,12 @@ extension LibraryRepository {     private func commitResolution(         context: ModelContext, hostnames: [String], operation: String     ) throws -> DuplicateResolutionOutcome? {+        // T-2291: scoped to `hostnames` — every site the resolution wrote to,+        // which is already the set the gate and the publication below read. The+        // whole-library pass was deriving diagnoses neither of them consults.         let diagnoses: [String: LibraryValidationError]         do {-            diagnoses = try LibraryValidator.validate(context: context).quarantineMap()+            diagnoses = try LibraryValidator.validate(hostnames: hostnames, context: context)         } catch {             context.rollback()             _ = try? context.fetch(FetchDescriptor<Entry>())

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swiftindex eef8ff2..bcadbe2 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift@@ -185,6 +185,18 @@ extension LibraryRepository {                     operation: "removing a site membership",                     reason: String(describing: error))             }+            // T-2291: publish what this commit's own validation left behind, for+            // every hostname it wrote to — the step the deletion commit and the+            // teaching commits take, and the one this path was missing.+            //+            // A removal is the repair for exactly the diagnosis the removed row+            // caused, so without this the hostname stays quarantined until the+            // next launch: the foreground refresh carries the tuple set forward+            // (`LibraryDiagnostics.union`) rather than re-deriving it, so a stale+            // entry never falls out on its own. A diagnosis the removal left+            // standing is re-recorded unchanged, so nothing it did not repair is+            // cleared.+            self.publishPostCommitDiagnoses(across: hostnames, in: diagnoses)         }     } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkDeletion.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkDeletion.swiftindex dbd2a46..8e6885a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkDeletion.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkDeletion.swift@@ -213,8 +213,11 @@ extension LibraryRepository {             // relationship graph the way Merge does, so it takes Merge's             // validator discipline (Q21) — but compared against the *prior*             // diagnosis rather than against nil, or a hostname that was already-            // diagnosed would have undeletable works (Decision 8 of-            // `specs/title-teaching-retroactive-parsing`).+            // diagnosed would have undeletable works (Q67 of+            // `specs/multi-site-works`, which extends Decision 8 of+            // `specs/library-integrity-tolerance` to this gate; the citation+            // here used to name `specs/title-teaching-retroactive-parsing`,+            // whose Decision 8 is about backup V2 support).             let diagnoses: [String: LibraryValidationError]             do {                 diagnoses = try LibraryValidator.validate(

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swiftindex ad0b45f..feae8bc 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift@@ -115,11 +115,20 @@ extension LibraryRepository {                 row.modifiedAt = urlTimestamp             } -            // Validate the complete prospective graph (V4), then save once. An-            // invalid result on the affected Site rolls back and reports.+            // Validate the prospective graph, then save once. An invalid result+            // on the affected Site rolls back and reports.+            //+            // T-2291: **scoped to the hostname this commit wrote to.** A Work URL+            // lands on one membership, and the gate below and the publication+            // after the save both read that hostname alone — so validating the+            // whole library replayed every rule against every Entry to answer a+            // question about one site. The scoped overload gives a hostname the+            // answer a whole-graph validation would give it (and, like+            // `quarantineMap()`, reports the tuple class alone).             let diagnoses: [String: LibraryValidationError]             do {-                diagnoses = try LibraryValidator.validate(context: context).quarantineMap()+                diagnoses = try LibraryValidator.validate(+                    hostnames: [hostname], context: context)             } catch {                 context.rollback()                 workMergeLogger.error(@@ -457,12 +466,18 @@ extension LibraryRepository {             // partial merge the old refusal was avoiding.             for row in sourceGroup.rows { context.delete(row) } -            // Validate the complete prospective graph, then save once. Merge is-            // the highest-risk mutation (Work deletion plus bulk reassignment);-            // an invalid result rolls back and reports instead of persisting damage.+            // Validate the prospective graph, then save once. Merge is the+            // highest-risk mutation (Work deletion plus bulk reassignment); an+            // invalid result rolls back and reports instead of persisting damage.+            //+            // T-2291: scoped to `mergeHostnames` — every site of both Works, and+            // therefore every site this merge wrote to. That is already the set+            // the gate and the publication read, so the whole-library pass was+            // deriving diagnoses for hostnames neither of them would consult.             let diagnoses: [String: LibraryValidationError]             do {-                diagnoses = try LibraryValidator.validate(context: context).quarantineMap()+                diagnoses = try LibraryValidator.validate(+                    hostnames: Array(mergeHostnames), context: context)             } catch {                 context.rollback()                 workMergeLogger.error(

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/MembershipRemovalDiagnosisTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/MembershipRemovalDiagnosisTests.swiftnew file mode 100644index 0000000..fc8497d--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/MembershipRemovalDiagnosisTests.swift@@ -0,0 +1,161 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++/// T-2291: `removeSiteMembership` validated and gated on the introduced+/// diagnosis, saved, and then returned without ever publishing what it left+/// behind. A removal that *repaired* a hostname — dropping the very membership+/// row whose malformed tuple diagnosed it — left the hostname quarantined until+/// the next launch, because the foreground refresh carries the tuple set+/// forward rather than re-deriving it.+///+/// This is the T-2289 defect on the one write path T-2289 missed. The sibling+/// `LibraryRepository+WorkDeletion.swift` gates *and* publishes; so does every+/// teaching commit, and since T-2289 so do the Work URL, Merge and+/// duplicate-resolution commits.+@Suite("Membership removal post-commit diagnosis", .serialized)+struct MembershipRemovalDiagnosisTests {+    private let kept = "membership-kept.example"+    private let dropped = "membership-dropped.example"++    @Test("Removing the membership that diagnosed a hostname clears its quarantine")+    func clearsRepairedQuarantine() async throws {+        let fixture = try MembershipRemovalDiagnosisFixture()+        let workID = UUID()+        try fixture.seed { context in+            // Two legal taught sites: `.taught` wants exactly one active title+            // rule, so a bare row would diagnose the hostname for a reason the+            // removal cannot repair and the test would prove nothing.+            for (index, hostname) in [self.kept, self.dropped].enumerated() {+                let site = Site(hostname: hostname)+                site.mode = .taught+                context.insert(site)+                context.insert(try TitlePattern(+                    version: 1, isActive: true,+                    createdAt: Date(timeIntervalSince1970: TimeInterval(index + 1)),+                    definition: .wholeTitle, site: site))+            }+            let work = Work.create(+                in: context, id: workID, title: "A Work", hostname: self.kept,+                timestamp: Date(timeIntervalSince1970: 3))+            work.lastParsedTitle = "A Work"+            work.titleProvenanceRaw = TitleProvenance.parsed.rawValue++            // The membership that diagnoses `dropped`: an identity state spelling+            // nothing in the closed set. Record-local damage no pass repairs —+            // exactly the class that quarantines a hostname — and removing the+            // row is what repairs it.+            let membership = WorkSiteMembership(+                hostname: self.dropped, createdAt: Date(timeIntervalSince1970: 4),+                workID: workID, work: work,+                site: try LibraryRepository.fetchSites(+                    hostname: self.dropped, context: context).first)+            membership.urlIdentityStateRaw = "not-a-state"+            context.insert(membership)+        }+        let repository = try fixture.diagnosedRepository()+        #expect(await repository.quarantineReason(hostname: dropped) != nil)++        try await repository.removeSiteMembership(workID: workID, hostname: dropped)++        // The row is gone…+        let context = fixture.freshContext()+        #expect(+            try context.fetch(FetchDescriptor<WorkSiteMembership>())+                .map(\.hostname).sorted() == [kept])+        // …and the quarantine the row caused went with it, without waiting for+        // the next launch.+        #expect(await repository.quarantineReason(hostname: dropped) == nil)+        // The tuple set the next foreground refresh unions against moved too,+        // or the refresh would re-quarantine the hostname this removal repaired.+        #expect(await repository.diagnostics.tupleDiagnoses[dropped] == nil)+    }++    @Test("A diagnosis the removal did not repair survives it")+    func keepsUnrepairedQuarantine() async throws {+        let fixture = try MembershipRemovalDiagnosisFixture()+        let workID = UUID()+        try fixture.seed { context in+            let keptSite = Site(hostname: self.kept)+            keptSite.mode = .taught+            context.insert(keptSite)+            // An illegal taught tuple on the site the Work stays on — two active+            // title patterns — which dropping the other site's membership+            // neither causes nor can repair.+            context.insert(try TitlePattern(+                version: 1, isActive: true, createdAt: Date(timeIntervalSince1970: 1),+                definition: .wholeTitle, site: keptSite))+            context.insert(try TitlePattern(+                version: 2, isActive: true, createdAt: Date(timeIntervalSince1970: 2),+                definition: .wholeTitle, site: keptSite))++            // Legal, so the only diagnosis in play is the one on `kept`.+            let droppedSite = Site(hostname: self.dropped)+            droppedSite.mode = .taught+            context.insert(droppedSite)+            context.insert(try TitlePattern(+                version: 1, isActive: true, createdAt: Date(timeIntervalSince1970: 3),+                definition: .wholeTitle, site: droppedSite))++            let work = Work.create(+                in: context, id: workID, title: "A Work", hostname: self.kept,+                timestamp: Date(timeIntervalSince1970: 4))+            work.lastParsedTitle = "A Work"+            work.titleProvenanceRaw = TitleProvenance.parsed.rawValue+            context.insert(WorkSiteMembership(+                hostname: self.dropped, createdAt: Date(timeIntervalSince1970: 5),+                workID: workID, work: work, site: droppedSite))+        }+        let repository = try fixture.diagnosedRepository()+        let before = try #require(await repository.quarantineReason(hostname: kept))++        try await repository.removeSiteMembership(workID: workID, hostname: dropped)++        // The removal landed over a hostname it did not introduce a diagnosis+        // on (Q67), and the diagnosis it repaired nothing of is still recorded.+        #expect(await repository.quarantineReason(hostname: kept) == before)+    }+}++// MARK: - Fixture++/// The shape `WorkURLDiagnosisFixture` uses, scoped to membership removal: raw+/// SwiftData seeding, then a repository whose quarantine map and diagnostics+/// come from one full validation — what the bootstrap does.+private struct MembershipRemovalDiagnosisFixture {+    let directory: URL+    let configuration: LibraryConfiguration+    let container: ModelContainer+    private let clock: FixedRepositoryClock++    init() throws {+        directory = FileManager.default.temporaryDirectory+            .appending(+                path: "AsterismMembershipRemovalDiagnosisTests-\(UUID())",+                directoryHint: .isDirectory)+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)+        configuration = LibraryConfiguration(rootDirectory: directory)+        try FileManager.default.createDirectory(+            at: configuration.storeURL.deletingLastPathComponent(),+            withIntermediateDirectories: true)+        container = try LibraryRepository.openContainer(at: configuration.storeURL)+        clock = FixedRepositoryClock(Date(timeIntervalSince1970: 1_800_000_000))+    }++    func freshContext() -> ModelContext { ModelContext(container) }++    func seed(_ mutate: (ModelContext) throws -> Void) throws {+        let context = ModelContext(container)+        try mutate(context)+        try context.save()+    }++    func diagnosedRepository() throws -> LibraryRepository {+        let diagnostics = try LibraryValidator.validate(context: freshContext())+        return LibraryRepository.makeRepository(+            configuration, container, .m4, clock, ModelContextSaveStrategy(),+            quarantined: diagnostics.quarantineMap(), diagnostics: diagnostics)+    }+}

diff --git a/specs/bugfixes/membership-removal-never-refreshes-quarantine/report.md b/specs/bugfixes/membership-removal-never-refreshes-quarantine/report.mdnew file mode 100644index 0000000..ad1f044--- /dev/null+++ b/specs/bugfixes/membership-removal-never-refreshes-quarantine/report.md@@ -0,0 +1,208 @@+# Bugfix Report: removeSiteMembership never refreshes the cached quarantine++**Date:** 2026-09-05+**Status:** Fixed++## Description of the Issue++`LibraryRepository.removeSiteMembership(workID:hostname:)` validates the+prospective graph, gates on `introducedDiagnosis(across:in:)`, saves — and+returns. It never calls `recordPostCommitDiagnosis` /+`publishPostCommitDiagnoses`.++A removal that *repairs* a hostname — dropping the very membership row whose+malformed tuple diagnosed it — therefore leaves the hostname quarantined in the+repository's in-memory map until the next launch. The foreground refresh cannot+recover: `LibraryDiagnostics.union` carries the tuple set forward from the last+full derivation rather than re-deriving it, so a stale entry survives every+refresh.++This is exactly the T-2289 defect (`0c4f0e8`, PR #40) on the one write path+T-2289 missed. T-2289 added `publishPostCommitDiagnoses` and wired it into+`commitWorkURL`, `commitMerge` and `commitResolution`; the sibling+`LibraryRepository+WorkDeletion.swift` has gated *and* published since it was+written.++**Reproduction steps:**+1. Have a two-site Work whose membership on `b.example` carries a malformed+   tuple (for instance an unrecognised `urlIdentityStateRaw`), so `b.example`+   is quarantined at launch.+2. Remove that site from the Work (Work detail -> remove site).+3. The removal succeeds and the offending row is gone, but+   `quarantineReason(hostname: "b.example")` still reports the diagnosis, and+   every path gated on the quarantine stays disabled until the app is+   relaunched.++**Impact:** Medium. No data loss and no incorrect write — the library on disk is+correct. What is wrong is the cached diagnosis: rule application on capture+stays disabled for the repaired hostname, Check Library keeps reporting it, and+backup export stays gated, for the rest of the app session.++## Investigation Summary++- **Symptoms examined:** the quarantine latch surviving a repairing write, and+  the same three commits validating more of the graph than they write to.+- **Code inspected:**+  - `LibraryRepository+Sites.swift` — `removeSiteMembership`+  - `LibraryRepository.swift` — `introducedDiagnosis`,+    `publishPostCommitDiagnoses`, `recordPostCommitDiagnosis`+  - `LibraryRepository+WorkDeletion.swift` — the correct sibling+  - `LibraryRepository+WorkMerge.swift`, `+DuplicateResolution.swift` — the+    three commits still validating the whole graph+  - `LibraryValidator.swift` — `validate(context:)` vs+    `validate(hostnames:context:)`, and `LibraryDiagnostics.quarantineMap()`+- **Hypotheses tested:** whether the foreground refresh could recover the stale+  entry on its own — it cannot; `LibraryDiagnostics.union` documents exactly+  why (the scan produces no `.siteTuple`, so the tuple set has to be carried+  forward, and a stale carried-forward entry is never re-derived).++## Discovered Root Cause++**Defect type:** Missing state publication after a successful commit.++`removeSiteMembership` is a full commit gate — it validates, refuses an+introduced diagnosis, and saves — but it is the only such gate that does not+publish its own validation result. The in-memory quarantine map and the+`diagnostics` tuple set are therefore left holding the *pre-write* answer for a+hostname the write just changed.++**Why it occurred:** the publication step was added to the teaching commits+first and to the deletion commit when that was written; T-2289 swept the Work+URL, Merge and duplicate-resolution commits into line but did not include the+membership-removal path, which lives in a different file and was already using+the hostname-scoped validator (so it did not surface in the same grep).++**Contributing factors:** three of the four gates T-2289 touched still call the+full-library `LibraryValidator.validate(context:)`, which makes the shape of the+"validate, gate, publish" pattern harder to see as one thing across the files+that implement it.++## Resolution for the Issue++**Changes made:**++1. `LibraryRepository+Sites.swift` — `removeSiteMembership` now calls+   `publishPostCommitDiagnoses(across: hostnames, in: diagnoses)` after the+   save, over the same hostname set it validated and gated on (every hostname+   of the Work, not only the one being dropped). A hostname the removal+   repaired is un-quarantined immediately; a diagnosis it left standing is+   re-recorded unchanged, so nothing it did not repair is cleared.++2. `LibraryRepository+WorkMerge.swift`, `LibraryRepository+DuplicateResolution.swift`+   — `commitWorkURL`, `commitMerge` and `commitResolution` swapped+   `LibraryValidator.validate(context:).quarantineMap()` for the hostname-scoped+   `LibraryValidator.validate(hostnames:context:)`, over the hostname set each+   already gates and publishes on (`[hostname]`, `mergeHostnames`, `hostnames`).+   Behaviour is unchanged and the cost is not: the whole-library pass replayed+   every rule against every Entry in the library to answer a question about one+   or two sites, and every diagnosis it derived outside that set was discarded+   unread.++3. `LibraryRepository+ComposedTeaching.swift` — the two hand-rolled+   `diagnoses[hostname] != priorDiagnosis` comparisons (`commitComposedTeaching`,+   `commitRecalculation`) now go through `introducedDiagnosis(across:in:)` like+   every other commit gate; the now-unused `priorDiagnosis` locals are gone.+   Behaviourally identical for one hostname — the helper reads the same+   quarantine latch, which nothing touches between the capture point and the+   gate — but it is one rule in one place rather than three spellings of it.++4. `LibraryRepository+WorkDeletion.swift` — corrected a comment citation: the+   introduced-diagnosis rule is Q67 of `specs/multi-site-works` (extending+   Decision 8 of `specs/library-integrity-tolerance`), not Decision 8 of+   `specs/title-teaching-retroactive-parsing`, which is about backup V2 support.++**Approach rationale:** the publication step is what every other commit gate+already does; adding the missing call is the whole fix, and using the existing+`publishPostCommitDiagnoses` helper keeps the four gates spelled the same way.+The validator narrowing is safe because each gate only ever consulted its own+hostnames: the scoped overload answers a hostname exactly as a whole-graph+validation would (its own contract), and both passes divert the tolerated+wrong-host Work URL finding out of the tuple map, so `quarantineMap()` and the+scoped map agree per hostname.++**Alternatives considered:**+- Re-derive the quarantine on the next foreground refresh instead of publishing+  at the commit — rejected; `LibraryDiagnostics.union` documents why that cannot+  work (the scan produces no `.siteTuple`, so the tuple set is carried forward,+  never re-derived).+- Leave the three commits on the full validator — rejected; the ticket names it,+  and the narrowing is exactly the change `removeSiteMembership` and+  `deleteWork` already made.++## Regression Test++**Test file:**+`Packages/AsterismCore/Tests/AsterismCoreTests/MembershipRemovalDiagnosisTests.swift`+**Test names:** `clearsRepairedQuarantine`, `keepsUnrepairedQuarantine`++**What it verifies:**+- `clearsRepairedQuarantine`: a hostname quarantined by a malformed membership+  tuple has its quarantine — and its entry in the carried-forward tuple set —+  cleared by the removal that deletes the offending row.+- `keepsUnrepairedQuarantine`: a diagnosis on the hostname the Work stays on+  (two active title patterns) is untouched by the removal, so the publication+  does not over-clear.++**Run command:** `make test-core CORE_TEST='MembershipRemovalDiagnosisTests'`++## Affected Files++| File | Change |+|------|--------|+| `Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift` | `removeSiteMembership` publishes its post-commit diagnoses |+| `Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift` | `commitWorkURL` and `commitMerge` validate hostname-scoped |+| `Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift` | `commitResolution` validates hostname-scoped |+| `Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift` | both teaching gates go through `introducedDiagnosis(across:in:)` |+| `Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkDeletion.swift` | comment citation corrected |+| `Packages/AsterismCore/Tests/AsterismCoreTests/MembershipRemovalDiagnosisTests.swift` | new regression tests |++## Verification++**Automated:**+- [x] Regression tests fail before the fix and pass after it (verified by+      disabling the new `publishPostCommitDiagnoses` call and re-running)+- [x] `make test-core` — one clean full run, exit 0 (2026-09-05)+- [x] No new compiler warnings (no code-style linter is configured in this repo)++**Known flake seen during verification:** two further full runs each failed on a+different cell of the store-digest family+(`BootstrapActionTests` / `BootstrapClassifierTests`, `try root.digest() == before`).+A full run on the unmodified tree reproduced the same failures, and the suites+pass in isolation. This is the family already documented in+`docs/agent-notes/testing.md` ("Known flaky family: the store-digest+comparisons"), whose note says one green full run on the branch is what+separates the flake from a real failure — that green run is recorded above.++**Manual verification:**+- Not performed on device. To verify: on a site quarantined by a malformed+  membership row, remove that site from the Work; the site should stop being+  reported as quarantined without relaunching the app.++## Prevention++**Recommendations to avoid similar bugs:**+- The four commit gates are now spelled identically — validate scoped to the+  hostnames written, gate through `introducedDiagnosis(across:in:)`, save,+  publish through `publishPostCommitDiagnoses(across:in:)`. A new gate that+  omits a step is now visibly different from its siblings rather than merely+  shorter.+- A commit gate that validates is also a fresher answer than the quarantine+  latch. Any future gate that computes diagnoses must publish them; computing+  them and discarding them is the defect both T-2289 and T-2291 were.++## Deliberately not done++- **Q100 in `specs/multi-site-works/decision_log.md` was left as written.** Its+  wording ("the merge and duplicate-resolution gates change behaviour to match")+  omits `commitWorkURL`, which T-2289 later swept in, and now also the two+  teaching gates. It is a dated historical record of what was decided on+  2026-08-26; amending it to describe work done months later would make the log+  less accurate, not more. The current state of the rule is recorded here and in+  the code comments instead.++## Related++- T-2291 (this fix), T-2289 (`0c4f0e8`, PR #40)+- `specs/bugfixes/work-url-and-merge-commits-roll-back-on-any-diagnosis/report.md`+  — Follow-ups (a), (b), (c), (d)+- `specs/multi-site-works/decision_log.md` Q67, Q100