fix(rereview): close export-flip race + queue-dedup reload regression

Adversarial re-review of the persona-audit + audit-followup rounds (6411747..)
found one HIGH and one MED regression plus LOW gaps. All fixed with coverage.

HIGH — export stale-keepsake resurrected by an open_event race
  A reopen landing in the window between a *current* export worker's finalize_job
  and its ready-flag flip cleared export_released_at + the ready flags but left the
  export_job row `done` at the same release_seq. The seq-guarded flip then still
  matched and re-set export_{zip,html}_ready=TRUE on a pre-reopen snapshot; the next
  re-release read that stale TRUE and skipped regeneration (`if ready { continue }`),
  serving a keepsake missing every upload from the reopen window — the exact data
  loss migration 012 exists to prevent. Both ready-flip UPDATEs are now additionally
  anchored on `export_released_at IS NOT NULL`, so a landed reopen makes the flip a
  no-op and the re-release regenerates cleanly.

MED — queue dedup broke for reloaded items
  loadQueue rebuilt QueueItems from IndexedDB without copying lastModified, which the
  new addToQueue dedup keys on. A file re-selected after a page reload / PWA relaunch
  missed the duplicate check and uploaded twice. Rehydration now carries lastModified
  (extracted to a pure, tested entryToQueueItem helper).

LOW
  - diashow: clear the upload-processed debounce timer in onDestroy (no stray
    post-unmount /feed fetch).
  - USER_JOURNEYS §9.5: document the reconnect-delta ban replay (hidden_user_ids /
    uploads_hidden_at, migration 013), not just the live user-hidden SSE.
  - e2e api-client: drop the misleading hide_uploads param from banUser — the backend
    takes no body and always hides; strip the dead boolean at all call sites.

Tests
  - Extract isReversibleLock (the terminal-403 KEEP-vs-PURGE-blob discriminator) into a
    pure exported helper + unit tests, so the data-loss-critical branch is covered
    without an XHR harness.
  - entryToQueueItem unit tests lock the lastModified-carry regression.
  - Document the export flip-race guard in the reopen/re-release spec (the sub-ms
    finalize↔flip interleave isn't deterministically forceable with fast fixtures;
    covered by the SQL guard + the end-to-end completeness test).

Verified: backend 40 tests, frontend 44 unit tests, svelte-check 0 errors,
e2e 156 passed / 1 skipped on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/fixtures/api-client.ts

@@ -109,10 +109,11 @@ export class ApiClient {
     });
   }
 
-  async banUser(token: string, userId: string, hideUploads = false) {
+  // A ban ALWAYS hides the user's uploads — the backend takes no body and ignores any
+  // `hide_uploads` flag (the old opt-out was removed). No per-request options.
+  async banUser(token: string, userId: string) {
     return this.request<void>('POST', `/host/users/${userId}/ban`, {
       token,
-      body: { hide_uploads: hideUploads },
       expectedStatus: [200, 204],
     });
   }

e2e/specs/04-host/moderation.spec.ts

@@ -9,7 +9,7 @@ import { seedUpload, seedComment } from '../../helpers/seed';
 test.describe('Host — moderation API', () => {
   test('ban with hide_uploads=true sets the right flags', async ({ api, host, guest }) => {
     const target = await guest('Banned1');
-    await api.banUser(host.jwt, target.userId, true);
+    await api.banUser(host.jwt, target.userId);
     const users = await api.listUsers(host.jwt);
     const row = users.find((u: any) => u.id === target.userId);
     expect(row?.is_banned).toBe(true);
@@ -20,7 +20,7 @@ test.describe('Host — moderation API', () => {
     // Ban is now unconditionally a hide: even asking NOT to hide still hides, because a
     // banned user's content is "gone" everywhere. The legacy hide_uploads arg is ignored.
     const target = await guest('Banned2');
-    await api.banUser(host.jwt, target.userId, false);
+    await api.banUser(host.jwt, target.userId);
     const users = await api.listUsers(host.jwt);
     const row = users.find((u: any) => u.id === target.userId);
     expect(row?.is_banned).toBe(true);
@@ -29,7 +29,7 @@ test.describe('Host — moderation API', () => {
 
   test('banned user cannot call /upload', async ({ api, host, guest }) => {
     const target = await guest('Banned3');
-    await api.banUser(host.jwt, target.userId, false);
+    await api.banUser(host.jwt, target.userId);
 
     // Direct fetch — multipart body shape is just a marker; the auth middleware should reject before parsing.
     const res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/upload', {
@@ -88,14 +88,14 @@ test.describe('Host — live role/ban revocation (H1)', () => {
     // Sanity: host token works.
     await api.listUsers(host.jwt);
 
-    await api.banUser(adminToken, host.userId, false);
+    await api.banUser(adminToken, host.userId);
 
     // Banned users are rejected with 403 by the auth extractor before any handler runs.
     await expect(api.listUsers(host.jwt)).rejects.toThrow(/→ 403/);
   });
 
   test('a banned host cannot unban themselves', async ({ api, adminToken, host }) => {
-    await api.banUser(adminToken, host.userId, false);
+    await api.banUser(adminToken, host.userId);
     await expect(
       api.unbanUser(host.jwt, host.userId, { expectedStatus: [204] })
     ).rejects.toThrow(/→ 403/);
@@ -114,7 +114,7 @@ test.describe('Host — live role/ban revocation (H1)', () => {
     const ownUpload = await seedUpload(target.jwt, { caption: 'mine' });
     const ownComment = await seedComment(target.jwt, ownUpload, 'my comment');
 
-    await api.banUser(host.jwt, target.userId, false);
+    await api.banUser(host.jwt, target.userId);
 
     // Reads still succeed.
     const read = await fetch(base + '/api/v1/me/context', { headers: auth(target.jwt) });

e2e/specs/04-host/sse-eviction.spec.ts

@@ -41,7 +41,7 @@ test.describe('Host — live SSE eviction (H3)', () => {
     const sse = new SseListener();
     await sse.start(host.jwt);
 
-    await api.banUser(host.jwt, target.userId, true);
+    await api.banUser(host.jwt, target.userId);
 
     await sse.waitForEvent(
       'user-hidden',
@@ -69,7 +69,7 @@ test.describe('Host — live SSE eviction (H3)', () => {
     await expect(page.getByText('evict-me-live-xyz').first()).toBeVisible();
 
     // Host hides the target — the viewer's feed must drop the card via SSE, no reload.
-    await api.banUser(host.jwt, target.userId, true);
+    await api.banUser(host.jwt, target.userId);
     await expect(page.getByText('evict-me-live-xyz')).toHaveCount(0, { timeout: 15_000 });
   });
 });

e2e/specs/07-adversarial/authorization-deep.spec.ts

@@ -82,7 +82,7 @@ test.describe('Adversarial — deep authorization', () => {
 
   test('banned user cannot toggle a like', async ({ api, host, guest }) => {
     const target = await guest('BannedLike');
-    await api.banUser(host.jwt, target.userId, false);
+    await api.banUser(host.jwt, target.userId);
 
     const res = await fetch(`${BASE}/api/v1/upload/00000000-0000-0000-0000-000000000000/like`, {
       method: 'POST',
@@ -93,7 +93,7 @@ test.describe('Adversarial — deep authorization', () => {
 
   test('banned user cannot post a comment', async ({ api, host, guest }) => {
     const target = await guest('BannedComment');
-    await api.banUser(host.jwt, target.userId, false);
+    await api.banUser(host.jwt, target.userId);
 
     const res = await fetch(`${BASE}/api/v1/upload/00000000-0000-0000-0000-000000000000/comments`, {
       method: 'POST',
@@ -105,7 +105,7 @@ test.describe('Adversarial — deep authorization', () => {
 
   test('banned user can still read the feed (read-only access preserved)', async ({ api, host, guest }) => {
     const target = await guest('BannedRead');
-    await api.banUser(host.jwt, target.userId, false);
+    await api.banUser(host.jwt, target.userId);
 
     const res = await fetch(`${BASE}/api/v1/feed`, {
       headers: { Authorization: `Bearer ${target.jwt}` },

e2e/specs/10-flow-review/export-reopen-rerelease.spec.ts

@@ -17,6 +17,18 @@
  * superseded worker discards its output instead of resurrecting a stale keepsake. The
  * download follows the current `done` row's `file_path`, never a fixed name.
  *
+ * A second, narrower window on the SAME class of bug (fixed alongside): a reopen (`open_event`)
+ * landing between a *current* worker's `finalize_job` and its ready-flag flip. `open_event`
+ * clears `export_released_at` + both ready flags but leaves the `export_job` row `done` at the
+ * current seq — so the seq-guarded flip would still match and resurrect `export_zip_ready=TRUE`
+ * on a pre-reopen snapshot, and the next re-release would `if ready { continue }` and skip
+ * regeneration. The flip UPDATEs are therefore additionally anchored on
+ * `export_released_at IS NOT NULL`, making them a no-op once a reopen has landed. The
+ * "completeness" test below exercises the real reopen→re-release worker path end-to-end; the
+ * sub-millisecond finalize↔flip interleave itself isn't deterministically forceable with the
+ * fast fixtures, so that exact window is covered by the SQL guard + code review rather than a
+ * timing-dependent assertion.
+ *
  * Coverage:
  *  - churn integrity: rapid reopen→re-release yields exactly one INTACT ZIP, no stuck jobs.
  *  - completeness: an upload added during the reopen window IS present in the re-released