feat: say why the posts are invisible, without ever deciding they are (387 C5)

A3 made a tier-gated source say "47 posts you can't see". The roster turns that into a reason: the membership ended, or the tier doesn't reach these posts, or it's a free follow. Rendered under A3's count in the health tooltip, quieter than the count it explains.

FREE is a fourth case the step didn't enumerate, and it earns its own sentence. has_paid_access collapses "former patron" and "current free follower" to the same False, so deriving the reason from that boolean would tell a free follower "you're not a patron any more" - a false statement about a state they were never in. gated_reason reads the status axis first, calling has_paid_access with is_free_member forced off, then splits on the free flag.

Silence is the default, and there are four ways into it: campaign absent from the roster, roster stale, platform never swept, status word not yet characterised. All four send null and the count stands alone. The frontend has no fallback sentence either - a default would turn "we don't know why" into a reason, which is the one thing this step must not do.

The line that must not be crossed is pinned structurally rather than by inspection: test_no_fetch_path_can_read_the_roster walks the transitive first-party imports from the fetch roots and asserts the roster is unreachable. FC runs no local verification (rule 85), so a guard cannot be falsified by hand before it lands - it carries two positive controls instead, proving the walker finds roster imports that ARE there, one direct and one through a hop, so the real assertion can never pass merely because the walk resolved nothing.

C4's identity loop moved to membership_roster.pair_sources_with_memberships when C5 became its second caller; two copies would let the Subscriptions row and the reconciliation card disagree about which creator a source IS. Three test files were each building PlatformMembership rows with their own drifting helper - consolidated into tests/roster_builders.py, same family as issue 3109.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

backend/app/services/source_service.py

@@ -19,6 +19,7 @@ from ..models import (
 )
 from .db_helpers import failing_sources_clause
 from .gallery_dl import ErrorType
+from .membership_roster import gated_reasons_for_sources
 from .platforms import known_platform_keys
 from .scheduler_service import compute_next_check_at
 
@@ -92,6 +93,12 @@ class SourceRecord:
     # source, so it is joined in by `list()` only — None everywhere else, which
     # the UI renders as the bare no-access state with no fabricated number.
     tier_gated_count: int | None = None
+    # Milestone #387 C5: WHY those posts are out of reach, when the learned
+    # roster can say — "lapsed" / "tier" / "free", or None for "no words beyond
+    # the count". Joined in by `list()` beside the count, and for the same
+    # reason: it annotates a gated state rather than producing one. Nothing on
+    # a fetch path may read it (see `membership_roster.gated_reason`).
+    gated_reason: str | None = None
 
     def to_dict(self) -> dict:
         return {
@@ -116,6 +123,7 @@ class SourceRecord:
             "backfill_recapture": self.backfill_recapture,
             "backfill_posts": self.backfill_posts,
             "tier_gated_count": self.tier_gated_count,
+            "gated_reason": self.gated_reason,
         }
 
 
@@ -243,6 +251,7 @@ class SourceService:
     def _build_record(
         self, source: Source, artist: Artist, settings: ImportSettings,
         gated_counts: dict[int, int] | None = None,
+        gated_reasons: dict[int, str] | None = None,
     ) -> SourceRecord:
         nxt = compute_next_check_at(source, artist, settings)
         co = source.config_overrides or {}
@@ -268,6 +277,7 @@ class SourceService:
             backfill_recapture=bool(co.get("_backfill_recapture")),
             backfill_posts=int(co.get("_backfill_posts", 0)),
             tier_gated_count=(gated_counts or {}).get(source.id),
+            gated_reason=(gated_reasons or {}).get(source.id),
         )
 
     async def _row_to_record(self, source: Source) -> SourceRecord:
@@ -302,12 +312,15 @@ class SourceService:
             stmt = stmt.order_by(Artist.name.asc(), Source.id.asc())
         rows = (await self.session.execute(stmt)).all()
         settings = await self._load_settings()
-        # Only tier-gated rows need the join — on a healthy library that is an
-        # empty list and _tier_gated_counts short-circuits without a query.
-        gated_counts = await self._tier_gated_counts(
-            [s.id for s, _a in rows if s.error_type == ErrorType.TIER_LIMITED]
-        )
-        return [self._build_record(s, a, settings, gated_counts) for s, a in rows]
+        # Only tier-gated rows need either join — on a healthy library that is
+        # an empty list and both helpers short-circuit without a query.
+        gated = [s for s, _a in rows if s.error_type == ErrorType.TIER_LIMITED]
+        gated_counts = await self._tier_gated_counts([s.id for s in gated])
+        gated_reasons = await gated_reasons_for_sources(self.session, gated)
+        return [
+            self._build_record(s, a, settings, gated_counts, gated_reasons)
+            for s, a in rows
+        ]
 
     async def get(self, source_id: int) -> SourceRecord | None:
         source = (await self.session.execute(