named groups: concurrent self-leave of the last two members leaves a live zero-member group with no withdrawal tombstone

[dirvine]

Pre-existing race surfaced while reviewing PR #370 (#369 sole-member delete).

leave_disposition is evaluated once per daemon on its own roster snapshot. Two-admin (or admin+member) group, both DELETE /groups/:id inside the same window: each sees a 2-member roster → Proceed → emits MemberRemoved(self), does groups.remove(&id), stops its listener. The peer's MemberRemoved is rejected on arrival (group absent, named_groups.rs ~:6149); third parties see a PrevHashMismatch on one of the two. Nobody ever seals a withdrawn commit, so the public discovery card and relay caches keep advertising a live zero-member group with no anti-resurrection record.

Options: (a) the second-to-last leaver's MemberRemoved apply on a daemon that just left should still be able to seal a withdrawal for a now-empty roster; (b) a third party (relay/any member applying the commit log) that observes the roster reach zero seals the tombstone; (c) document as accepted and let discovery cards age out. ADR-0016's #369 amendment must describe the real behaviour, not a convergence guarantee the code doesn't provide.

🤖 Generated with Claude Code

[dirvine]

Triage against f3080c39b444b7ce44216c1811c472f3b4e938cb (v0.41.3), 2026-09-05: P2 — Keep open; concurrent terminal transition unresolved.

The leave path evaluates its local roster, emits self-removal, removes the local group and stops its listener. Two concurrent final leavers can each choose the non-terminal arm; the issue is not resolved by single-member delete handling.

Acceptance / next step: Test simultaneous last-two leave under both delivery orders and partitions, requiring a defined terminal tombstone/expiry result and no resurrection. Authority to seal an empty-group tombstone needs a protocol decision.

This is a source-and-evidence triage; platform/soak tests are credited only where explicitly stated.