fix(dm/private-rooms): auto-scroll, sync-window UX, banned-state, processed-invite gate, same-second revive

[sanity]

Problem

Five user-impacting UI issues in the DM / private-room surfaces. All UI-only, no contract or delegate WASM changes, no migration entry required.

• fix(dm): auto-scroll in DM thread modal no longer fires after PR #278's Codex round-1 fix #283 — Auto-scroll in the DM thread modal stopped working after PR feat(dm): structured invite DM variant + in-app accept + auto-scroll #278's Codex round-1 fix removed the only reactive read inside use_effect. New messages no longer scrolled the viewport.
• fix(private-rooms): replace alarming "secret v0 not available" placeholder during invite-acceptance sync window #284 — A newly-invited member of a private room briefly saw the alarming [Encrypted message - secret vN not available (have: [])] placeholder for every message until the owner's delegate published the back-fill ciphertext.
• bug(dm): same-second inbound DM stays hidden after hide cutoff #267 — When the user hid a DM thread and a new DM landed in the same unix-second (or with clock skew putting its timestamp at hidden_at_ts), the rail filter's strict-<= rule kept the thread hidden. Same-second outbound-send was already handled by an explicit unhide_dm_thread call; inbound wasn't.
• fix(invite): in-app accept re-shows full nickname flow for previously-accepted-then-left rooms #279 — The PRESENT_INVITATION_REQUEST bridge effect in app.rs didn't gate on is_invitation_processed. Clicking Accept on a stale invite card for a previously-LeaveRoom'd room re-presented the full nickname-prompt flow.
• fix(invite-card): show 'banned from this room' state instead of enabled Accept #280 — already_member = can_participate().is_ok() collapsed Banned and NotMember to the same false. Banned users saw an ENABLED "Accept invitation" button that would silently fail on submit.

Approach

Per-issue:

• fix(dm): auto-scroll in DM thread modal no longer fires after PR #278's Codex round-1 fix #283 — Mirror the conversation.rs pattern. Added last_dm_bubble: Signal<Option<Rc<MountedData>>>. The LAST bubble's onmounted writes through a new last_bubble_sink prop on DmBubble. The auto-scroll use_effect reads last_dm_bubble() as a subscribing call so it re-fires whenever a new bubble mounts. OUTBOUND_SEND_COUNTER.peek() stays non-reactive (re-entrancy-safe); the bubble mount provides the trigger.
• fix(private-rooms): replace alarming "secret v0 not available" placeholder during invite-acceptance sync window #284 — Branch the placeholder by secrets.is_empty():
  • empty secrets → "Decrypting your invitation — this should only take a moment..." (sync-window UX);
  • non-empty but missing version → neutral "[Encrypted message - secret vN unavailable]" (rotated-past case);
  • dropped the (have: [...]) diagnostic dump entirely from user-facing copy.
• bug(dm): same-second inbound DM stays hidden after hide cutoff #267 — In apply_delta_inner, collect the senders of any inbound DMs from delta.direct_messages.new_messages, then after the merge lands call unhide_dm_thread(owner_vk, sender) per unique non-self peer. Pairs with the existing outbound-send unhide so both directions revive symmetrically. The strict-<= filter rule itself stays unchanged (the existing is_thread_hidden_equal_timestamp_stays_hidden test depends on it for the hide-then-look case).
• fix(invite): in-app accept re-shows full nickname flow for previously-accepted-then-left rooms #279 — Gate the bridge effect on is_invitation_processed(&inv.to_encoded_string()). If already processed, silently no-op (the rail already shows the room if the user is still a member; the click-interceptor uses the same handling).
• fix(invite-card): show 'banned from this room' state instead of enabled Accept #280 — Replaced the already_member: bool field on InviteCardData with a three-way InviteCardState::{Joinable, AlreadyMember, Banned} enum, populated via a new classify_invite_card_state(Option<Result<(), SendMessageError>>) pure helper. The Banned variant renders a destructive-tinted disabled button reading "You're banned from this room".

Testing

cargo test -p river-ui --features example-data,no-sync — 165 passing (10 new tests).

New regression tests:

• auto_scroll_effect_subscribes_to_last_dm_bubble_signal + dm_bubble_exposes_last_bubble_sink_prop — source-text pins for fix(dm): auto-scroll in DM thread modal no longer fires after PR #278's Codex round-1 fix #283's wiring so a future cleanup of the unused-looking signal can't silently re-break it.
• invite_card_state_classifies_already_member / …_classifies_banned / …_classifies_not_member_as_joinable / …_classifies_room_not_loaded_as_joinable / invite_card_state_distinguishes_banned_from_not_a_member — pure-function pins for the new classifier.
• decrypt_placeholder_for_empty_secrets_is_friendly + decrypt_placeholder_for_missing_version_is_neutral_not_alarming — pin both fix(private-rooms): replace alarming "secret v0 not available" placeholder during invite-acceptance sync window #284 placeholder branches.
• apply_delta_inner_revives_hidden_thread_for_inbound_dm_sender — source-text pin for the bug(dm): same-second inbound DM stays hidden after hide cutoff #267 wiring in apply_delta_inner.
• dm_accept_bridge_gates_on_is_invitation_processed — source-text pin for the fix(invite): in-app accept re-shows full nickname flow for previously-accepted-then-left rooms #279 gate.

Also verified:

• cargo check -p river-ui --target wasm32-unknown-unknown --features no-sync clean.
• cargo clippy --workspace no new warnings introduced.
• cargo fmt --check clean.
• DM thread modal Playwright tests (3) still pass against the new build.

Test plan

• CI green on the exact HEAD SHA being merged
• Manual: open a DM thread with messages, send a new DM — viewport scrolls to bottom (fix(dm): auto-scroll in DM thread modal no longer fires after PR #278's Codex round-1 fix #283)
• Manual: accept a private-room invitation from a 2nd browser — placeholder reads "Decrypting your invitation…" not the diagnostic dump (fix(private-rooms): replace alarming "secret v0 not available" placeholder during invite-acceptance sync window #284)
• Manual: hide a DM thread, peer sends a new DM — thread reappears in the rail even if same-second (bug(dm): same-second inbound DM stays hidden after hide cutoff #267)
• Manual: accept an invite card in DM, then LeaveRoom, then accept the same card again — silent no-op, no nickname-prompt modal (fix(invite): in-app accept re-shows full nickname flow for previously-accepted-then-left rooms #279)
• Manual: get banned from a room, receive a fresh invite card in DM — Accept button reads "You're banned from this room" and is disabled with destructive styling (fix(invite-card): show 'banned from this room' state instead of enabled Accept #280)

Closes #267 #279 #280 #283 #284

[AI-assisted - Claude]