feat: say why the posts are invisible, without ever deciding they are (387 C5)

A3 made a tier-gated source say "47 posts you can't see". The roster turns that into a reason: the membership ended, or the tier doesn't reach these posts, or it's a free follow. Rendered under A3's count in the health tooltip, quieter than the count it explains.

FREE is a fourth case the step didn't enumerate, and it earns its own sentence. has_paid_access collapses "former patron" and "current free follower" to the same False, so deriving the reason from that boolean would tell a free follower "you're not a patron any more" - a false statement about a state they were never in. gated_reason reads the status axis first, calling has_paid_access with is_free_member forced off, then splits on the free flag.

Silence is the default, and there are four ways into it: campaign absent from the roster, roster stale, platform never swept, status word not yet characterised. All four send null and the count stands alone. The frontend has no fallback sentence either - a default would turn "we don't know why" into a reason, which is the one thing this step must not do.

The line that must not be crossed is pinned structurally rather than by inspection: test_no_fetch_path_can_read_the_roster walks the transitive first-party imports from the fetch roots and asserts the roster is unreachable. FC runs no local verification (rule 85), so a guard cannot be falsified by hand before it lands - it carries two positive controls instead, proving the walker finds roster imports that ARE there, one direct and one through a hop, so the real assertion can never pass merely because the walk resolved nothing.

C4's identity loop moved to membership_roster.pair_sources_with_memberships when C5 became its second caller; two copies would let the Subscriptions row and the reconciliation card disagree about which creator a source IS. Three test files were each building PlatformMembership rows with their own drifting helper - consolidated into tests/roster_builders.py, same family as issue 3109.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

backend/app/services/membership_reconcile.py

@@ -49,7 +49,7 @@ from .membership_roster import (
     get_sync_state,
     has_paid_access,
     identity_keys_for_source,
-    match_kind,
+    pair_sources_with_memberships,
     roster_is_fresh,
     url_tail,
 )
@@ -113,20 +113,12 @@ async def reconcile(
         .where(Source.platform == platform)
     )).all()
 
-    # Nested loop rather than a SQL join: the match is a predicate over a JSON
-    # blob and a derived URL handle, neither of which is indexable, and both
-    # sides are tens of rows on any real library. Keeping it in Python means ONE
-    # definition of identity (`match_kind`) instead of a second one in SQL that
-    # could drift from it.
-    pairs: dict[int, tuple[PlatformMembership, str]] = {}
-    matched_membership_ids: set[int] = set()
-    for source, _artist in rows:
-        for m in memberships:
-            kind = match_kind(source, m)
-            if kind:
-                pairs[source.id] = (m, kind)
-                matched_membership_ids.add(m.id)
-                break
+    # The join itself lives in `membership_roster` beside `match_kind`, so C5's
+    # gated-reason annotation pairs sources with memberships by exactly the same
+    # rule this card sorts them by. Two copies would let the Subscriptions row
+    # and this card disagree about which creator a source IS.
+    pairs = pair_sources_with_memberships([s for s, _a in rows], memberships)
+    matched_membership_ids = {m.id for m, _kind in pairs.values()}
 
     subscribed_not_tracked = []
     for m in memberships: