fix(sync): reconcile invitations with existing repositories

An invitee can already own the same repository identifier with an older, conflicting state and default branch. A unilateral invitation must leave that repository untouched, while reciprocal acceptance must make the newer owner state authoritative across the combined maintainer set.

Route maintainer-changing replacements through purgatory, overlay them on served coordinates during authorization, and make direct promotions retry rejected owner announcements and states. The three-server integration proves the pre-acceptance isolation and post-acceptance event, ref, HEAD, and no-push convergence.

CHANGELOG.md

@@ -35,6 +35,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fix invitation acceptance on a shared GRASP server by reapplying an existing
   owner state event to the invitee's newly created repository, so GRASP-02 can
   align it without an invitee state event or Git push.
+- Fix invitation acceptance when the invitee already owns the same repository
+  identifier by routing maintainer-changing replacements through purgatory and
+  reprocessing the owner dependencies that align the existing Git repository.
 - Sideband-aware Git clients now receive periodic progress while GRASP performs post-push purgatory promotion and cross-owner repository alignment, preventing the client I/O timeout from expiring during unusually complex finalization.
 - Smart HTTP pushes now expose the terminal receive-pack flush only after GRASP has finished promoting the matching repository announcement and state from purgatory. Git progress remains streamed while large packs are resolved and checked, but an immediately following clone or proposal push can now rely on a completed push being queryable on the relay.
 - Batch the one-time deletion-request lifecycle migration so large production databases do not remain unavailable while LMDB commits every historical request in separate transactions.

src/git/authorization.rs

@@ -280,7 +280,14 @@ pub async fn fetch_repository_data_with_purgatory(
 
     for entry in purgatory_announcements {
         if let Ok(announcement) = RepositoryAnnouncement::from_event(entry.event) {
-            repo_data.announcements.push(announcement);
+            if let Some(current) = repo_data.announcements.iter_mut().find(|current| {
+                current.event.pubkey == announcement.event.pubkey
+                    && current.identifier == announcement.identifier
+            }) {
+                *current = announcement;
+            } else {
+                repo_data.announcements.push(announcement);
+            }
         }
     }
 

src/git/sync.rs

@@ -981,17 +981,18 @@ pub async fn process_newly_available_git_data(
     Ok(result)
 }
 
-/// Process purgatory promotions for owner repos populated by state-event OID copies.
+/// Process purgatory promotions for owner repos aligned by state processing.
 ///
 /// [`crate::git::process::process_state_with_git_data`] copies OIDs from the
 /// source repo to other authorized owner repos for the same identifier. Those
 /// target repos may now satisfy purgatory announcements even though no direct
-/// push or fetch happened for the target repo path. This helper runs the normal
-/// newly-available-git-data pipeline only for target repos authorized by the
-/// preferred state and containing every required OID, so an unrelated or failed
-/// copy cannot promote an empty announcement.
+/// push or fetch happened for the target repo path. The source repo can also
+/// have a maintainer-topology replacement waiting in purgatory while its
+/// existing Git data is re-evaluated. This helper runs the normal
+/// newly-available-git-data pipeline only for repos authorized by the preferred
+/// state and containing every required OID, so an unrelated or failed copy
+/// cannot promote an empty announcement.
 pub async fn process_repos_populated_by_state_copy(
-    source_repo_path: &Path,
     state: &RepositoryState,
     repo_data: &RepositoryData,
     database: &SharedDatabase,
@@ -1006,9 +1007,6 @@ pub async fn process_repos_populated_by_state_copy(
 
     for announcement in &repo_data.announcements {
         let target_repo_path = git_data_path.join(announcement.repo_path());
-        if target_repo_path == source_repo_path {
-            continue;
-        }
 
         let owner = announcement.event.pubkey.to_hex();
         let Some(maintainers) = maintainers_by_owner.get(&owner) else {

src/nostr/builder.rs

@@ -7,7 +7,7 @@
 use std::net::SocketAddr;
 use std::num::NonZeroUsize;
 use std::path::Path;
-use std::sync::Arc;
+use std::sync::{Arc, RwLock};
 
 use anyhow::Result;
 use nostr::nips::nip19::ToBech32;
@@ -29,6 +29,7 @@ use crate::nostr::policy::{
 };
 use crate::nostr::SharedDatabase;
 use crate::purgatory::promotion_hooks::NostrPurgatoryPromotionHooks;
+use crate::sync::rejected_index::RejectedEventsIndex;
 
 /// NIP-34 Write Policy — admission and routing for GRASP-01 events
 ///
@@ -53,6 +54,7 @@ pub struct Nip34WritePolicy {
     pr_event_policy: PrEventPolicy,
     related_event_policy: RelatedEventPolicy,
     deletion: DeletionService,
+    rejected_events_index: Arc<RwLock<Option<Arc<RejectedEventsIndex>>>>,
 }
 
 impl std::fmt::Debug for Nip34WritePolicy {
@@ -100,6 +102,7 @@ impl Nip34WritePolicy {
             pr_event_policy: PrEventPolicy::new(ctx.clone(), repo_init_locks),
             related_event_policy: RelatedEventPolicy::new(ctx.clone()),
             deletion: DeletionService::new(deletion_ctx),
+            rejected_events_index: Arc::new(RwLock::new(None)),
             ctx,
         }
     }
@@ -144,6 +147,26 @@ impl Nip34WritePolicy {
         self.ctx.set_local_relay(relay);
     }
 
+    /// Make sync's rejected-event dependencies available to direct-write
+    /// purgatory promotions.
+    pub fn set_rejected_events_index(&self, index: Arc<RejectedEventsIndex>) {
+        *self
+            .rejected_events_index
+            .write()
+            .expect("rejected events index lock poisoned") = Some(index);
+    }
+
+    pub(crate) fn rejected_events_index(&self) -> Option<Arc<RejectedEventsIndex>> {
+        self.rejected_events_index
+            .read()
+            .expect("rejected events index lock poisoned")
+            .clone()
+    }
+
+    pub(crate) fn local_relay(&self) -> Option<nostr_relay_builder::LocalRelay> {
+        self.ctx.get_local_relay()
+    }
+
     /// Access the deletion subsystem directly.
     ///
     /// Exposes startup passes and recovery without requiring delegation wrappers

src/nostr/policy/announcement.rs

@@ -78,16 +78,28 @@ impl AnnouncementPolicy {
 
                         // Owner de-list replacement for an already served repo:
                         // do NOT allow maintainer-exception acceptance to bypass
-                        // de-list enforcement. Let the caller treat this as a
-                        // reject path so runtime deletion parity can run.
+                        // de-list enforcement when the previous announcement
+                        // actually listed this service. An external maintainer
+                        // announcement never listed this service, so its
+                        // replacement must remain eligible for the maintainer
+                        // exception instead of being mistaken for a de-list.
                         let lists_service = announcement.lists_service(&self.config.domain);
                         if !lists_service {
                             match self
-                                .has_db_announcement(&event.pubkey, &announcement.identifier)
+                                .db_announcement(&event.pubkey, &announcement.identifier)
                                 .await
                             {
-                                Ok(true) => return AnnouncementResult::Reject(reason),
-                                Ok(false) => {}
+                                Ok(Some(current_event)) => {
+                                    let current =
+                                        match RepositoryAnnouncement::from_event(current_event) {
+                                            Ok(current) => current,
+                                            Err(_) => return AnnouncementResult::Reject(reason),
+                                        };
+                                    if current.lists_service(&self.config.domain) {
+                                        return AnnouncementResult::Reject(reason);
+                                    }
+                                }
+                                Ok(None) => {}
                                 Err(_) => return AnnouncementResult::Reject(reason),
                             }
                         }
@@ -114,11 +126,11 @@ impl AnnouncementPolicy {
                 // Parse announcement to check for existing active announcement
                 match RepositoryAnnouncement::from_event(event.clone()) {
                     Ok(announcement) => {
-                        let in_db = match self
-                            .has_db_announcement(&event.pubkey, &announcement.identifier)
+                        let db_announcement = match self
+                            .db_announcement(&event.pubkey, &announcement.identifier)
                             .await
                         {
-                            Ok(v) => v,
+                            Ok(event) => event,
                             Err(e) => {
                                 tracing::warn!(
                                     error = %e,
@@ -131,7 +143,30 @@ impl AnnouncementPolicy {
                             }
                         };
 
-                        if in_db {
+                        if let Some(current_event) = db_announcement {
+                            let current = match RepositoryAnnouncement::from_event(current_event) {
+                                Ok(current) => current,
+                                Err(e) => {
+                                    return AnnouncementResult::Reject(format!(
+                                        "Failed to parse stored announcement: {e}"
+                                    ))
+                                }
+                            };
+                            let current_maintainers: HashSet<&str> =
+                                current.maintainers.iter().map(String::as_str).collect();
+                            let incoming_maintainers: HashSet<&str> = announcement
+                                .maintainers
+                                .iter()
+                                .map(String::as_str)
+                                .collect();
+                            if current_maintainers != incoming_maintainers {
+                                tracing::debug!(
+                                    identifier = %announcement.identifier,
+                                    "Replacement announcement changes maintainers - routing through purgatory"
+                                );
+                                return AnnouncementResult::AcceptPurgatory;
+                            }
+
                             // Replacement announcement with DB entry - accept immediately
                             tracing::debug!(
                                 identifier = %announcement.identifier,
@@ -272,15 +307,12 @@ impl AnnouncementPolicy {
         );
     }
 
-    /// Check if there's an announcement in the database for this (pubkey, identifier).
-    ///
-    /// Only checks the database (promoted announcements). For purgatory checks use
-    /// `purgatory.has_purgatory_announcement()` directly.
-    async fn has_db_announcement(
+    /// Return the NIP-01-preferred served announcement for this coordinate.
+    async fn db_announcement(
         &self,
         pubkey: &PublicKey,
         identifier: &str,
-    ) -> Result<bool, String> {
+    ) -> Result<Option<Event>, String> {
         let filter = Filter::new()
             .kind(Kind::GitRepoAnnouncement)
             .author(*pubkey)
@@ -294,7 +326,11 @@ impl AnnouncementPolicy {
             Err(e) => return Err(format!("Database query failed: {}", e)),
         };
 
-        Ok(!events.is_empty())
+        Ok(events.into_iter().max_by(|left, right| {
+            left.created_at
+                .cmp(&right.created_at)
+                .then_with(|| right.id.cmp(&left.id))
+        }))
     }
 
     /// Add an announcement to purgatory

src/nostr/policy/state.rs

@@ -241,7 +241,6 @@ impl StatePolicy {
             // for repos that became populated by the copy.
             let local_relay = self.ctx.get_local_relay();
             let promotion_result = crate::git::sync::process_repos_populated_by_state_copy(
-                &repo_with_git_data,
                 &state,
                 &db_repo_data,
                 &self.ctx.database,

src/purgatory/promotion_hooks.rs

@@ -29,13 +29,13 @@ pub struct NostrPurgatoryPromotionHooks {
 }
 
 impl NostrPurgatoryPromotionHooks {
-    /// Run deletion recovery and accepted-event persistence hooks only.
+    /// Run deletion recovery and any configured rejected-event dependency hooks.
     pub fn recovery_only(write_policy: &Nip34WritePolicy) -> Self {
         Self {
             deletion: write_policy.deletion().clone(),
             write_policy: Some(Arc::new(write_policy.clone())),
-            rejected_events_index: None,
-            local_relay: None,
+            rejected_events_index: write_policy.rejected_events_index(),
+            local_relay: write_policy.local_relay(),
         }
     }
 
@@ -52,6 +52,68 @@ impl NostrPurgatoryPromotionHooks {
             local_relay,
         }
     }
+
+    async fn reprocess_state_dependencies(
+        &self,
+        write_policy: &Nip34WritePolicy,
+        rejected_events_index: &RejectedEventsIndex,
+        relay: &LocalRelay,
+        author: &PublicKey,
+        identifier: &str,
+    ) {
+        let (event_ids, hot_events) =
+            rejected_events_index.dependency_candidates(author, identifier, Some(EventType::State));
+        if !event_ids.is_empty() {
+            info!(
+                pubkey = %author,
+                identifier = %identifier,
+                dependency_event_count = event_ids.len(),
+                hot_cache_events = hot_events.len(),
+                "Found rejected state dependencies after purgatory announcement promotion"
+            );
+        }
+
+        let dummy_addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
+        for state in hot_events {
+            info!(
+                event_id = %state.id,
+                pubkey = %author,
+                identifier = %identifier,
+                "Re-processing state event after purgatory announcement promotion"
+            );
+
+            match write_policy.admit_event(&state, &dummy_addr).await {
+                WritePolicyResult::Accept => {
+                    match write_policy
+                        .save_accepted_event(&state, SaveContext::HotCacheReprocess)
+                        .await
+                    {
+                        Ok(_) => {
+                            rejected_events_index.remove(&state.id);
+                            relay.notify_event(state.clone());
+                        }
+                        Err(e) => {
+                            warn!(
+                                event_id = %state.id,
+                                error = %e,
+                                "Failed to save re-processed state event"
+                            );
+                        }
+                    }
+                }
+                WritePolicyResult::Reject { status: true, .. } => {
+                    rejected_events_index.remove(&state.id);
+                    write_policy.purgatory().enqueue_sync_immediate(identifier);
+                }
+                _ => {
+                    warn!(
+                        event_id = %state.id,
+                        "State event still rejected after announcement promotion"
+                    );
+                }
+            }
+        }
+    }
 }
 
 #[async_trait]
@@ -88,15 +150,11 @@ impl PurgatoryPromotionHooks for NostrPurgatoryPromotionHooks {
             return;
         };
 
-        if announcement.maintainers.is_empty() {
-            return;
-        }
-
         debug!(
             identifier = %announcement.identifier,
             event_id = %event.id,
             maintainer_count = announcement.maintainers.len(),
-            "Owner announcement promoted via git push, checking hot cache for rejected maintainer announcements"
+            "Owner announcement promoted from purgatory, checking hot cache for rejected maintainer announcements"
         );
 
         for maintainer_hex in &announcement.maintainers {
@@ -114,7 +172,7 @@ impl PurgatoryPromotionHooks for NostrPurgatoryPromotionHooks {
                             identifier = %announcement.identifier,
                             dependency_event_count = event_ids.len(),
                             hot_cache_events = hot_events.len(),
-                            "Found rejected maintainer dependencies after git push promotion"
+                            "Found rejected maintainer dependencies after purgatory promotion"
                         );
                     }
 
@@ -124,7 +182,7 @@ impl PurgatoryPromotionHooks for NostrPurgatoryPromotionHooks {
                             event_id = %hot_event.id,
                             maintainer = %maintainer_hex,
                             identifier = %announcement.identifier,
-                            "Re-processing maintainer announcement from hot cache after git push promotion"
+                            "Re-processing maintainer announcement from hot cache after purgatory promotion"
                         );
 
                         match write_policy.admit_event(&hot_event, &dummy_addr).await {
@@ -136,6 +194,14 @@ impl PurgatoryPromotionHooks for NostrPurgatoryPromotionHooks {
                                     Ok(_) => {
                                         rejected_events_index.remove(&hot_event.id);
                                         relay.notify_event(hot_event.clone());
+                                        self.reprocess_state_dependencies(
+                                            write_policy,
+                                            rejected_events_index,
+                                            relay,
+                                            &hot_event.pubkey,
+                                            &announcement.identifier,
+                                        )
+                                        .await;
                                         info!(
                                             event_id = %hot_event.id,
                                             "Maintainer announcement accepted and saved on re-processing"
@@ -168,5 +234,14 @@ impl PurgatoryPromotionHooks for NostrPurgatoryPromotionHooks {
                 }
             }
         }
+
+        self.reprocess_state_dependencies(
+            write_policy,
+            rejected_events_index,
+            relay,
+            &event.pubkey,
+            &announcement.identifier,
+        )
+        .await;
     }
 }

src/server.rs

@@ -242,6 +242,9 @@ impl RelayServer {
         // Get a reference to the rejected events index for shutdown persistence
         // and for the HTTP server's git push path (hot-cache re-processing)
         let rejected_events_index = sync_manager.rejected_events_index();
+        relay_runtime
+            .write_policy
+            .set_rejected_events_index(rejected_events_index.clone());
 
         let mut background_tasks = Vec::new();
 

tests/sync/maintainer_reprocessing.rs

@@ -92,6 +92,25 @@ fn repository_announcement(
     EventBuilder::new(Kind::GitRepoAnnouncement, "Repository announcement").tags(tags)
 }
 
+fn repository_state_with_default_branch(
+    clone_urls: &[String],
+    relay_urls: &[String],
+    identifier: &str,
+    default_branch: &str,
+    commit: &str,
+) -> EventBuilder {
+    EventBuilder::new(Kind::RepoState, "").tags(vec![
+        Tag::identifier(identifier),
+        Tag::custom("clone", clone_urls.to_vec()),
+        Tag::custom("relays", relay_urls.to_vec()),
+        Tag::custom(
+            format!("refs/heads/{default_branch}"),
+            vec![commit.to_string()],
+        ),
+        Tag::custom("HEAD", vec![format!("refs/heads/{default_branch}")]),
+    ])
+}
+
 async fn assert_exact_event_served(relay: &TestRelay, event: &Event, description: &str) {
     let found = wait_for_event_on_relay(
         relay.url(),
@@ -183,6 +202,58 @@ async fn assert_remote_refs(
     }
 }
 
+fn rename_default_branch(repository: &Path, branch: &str) {
+    let output = Command::new("git")
+        .args(["branch", "-m", branch])
+        .current_dir(repository)
+        .output()
+        .expect("Failed to rename test repository default branch");
+    assert!(
+        output.status.success(),
+        "Failed to rename test repository default branch: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn remote_default_branch(clone_url: &str) -> Result<String, String> {
+    let output = Command::new("git")
+        .args(["ls-remote", "--symref", clone_url, "HEAD"])
+        .output()
+        .map_err(|error| format!("Failed to inspect HEAD from {clone_url}: {error}"))?;
+    if !output.status.success() {
+        return Err(format!(
+            "Failed to inspect HEAD from {clone_url}: {}",
+            String::from_utf8_lossy(&output.stderr)
+        ));
+    }
+
+    String::from_utf8(output.stdout)
+        .map_err(|error| format!("Invalid UTF-8 from {clone_url}: {error}"))?
+        .lines()
+        .find_map(|line| {
+            line.strip_prefix("ref: ")
+                .and_then(|line| line.strip_suffix("\tHEAD"))
+                .map(str::to_string)
+        })
+        .ok_or_else(|| format!("No symbolic HEAD returned by {clone_url}"))
+}
+
+async fn assert_remote_default_branch(clone_url: &str, expected: &str, timeout: Duration) {
+    let deadline = tokio::time::Instant::now() + timeout;
+    loop {
+        let actual = remote_default_branch(clone_url);
+        if actual.as_deref() == Ok(expected) {
+            return;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "Announced Git endpoint should use {expected} as its default branch: {clone_url}\n\
+             actual: {actual:?}"
+        );
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+}
+
 /// Exercise the production invitation flow for a repository that already has
 /// owner state and Git data.
 ///
@@ -240,13 +311,8 @@ async fn test_existing_repository_invitation_acceptance_syncs_without_invitee_pu
         send_to_relay(relay, &owner_state)
             .await
             .expect("Failed to publish owner state");
-        crate::common::push_to_relay(
-            owner_git.path(),
-            &relay.domain(),
-            &owner_npub,
-            identifier,
-        )
-        .expect("Failed to push existing owner repository");
+        crate::common::push_to_relay(owner_git.path(), &relay.domain(), &owner_npub, identifier)
+            .expect("Failed to push existing owner repository");
         assert_exact_event_served(relay, &initial_announcement, "Initial owner announcement").await;
         assert_exact_event_served(relay, &owner_state, "Owner state event").await;
         let owner_ref_aligned = crate::common::check_ref_at_commit(
@@ -336,9 +402,7 @@ async fn test_existing_repository_invitation_acceptance_syncs_without_invitee_pu
         "Invitation acceptance must not perform or attempt a client Git push"
     );
 
-    let expected_refs = BTreeMap::from([
-        ("refs/heads/main".to_string(), commit.clone()),
-    ]);
+    let expected_refs = BTreeMap::from([("refs/heads/main".to_string(), commit.clone())]);
     let announced_owner_clones = announcement_clone_urls(&invitation);
     let announced_invitee_clones = announcement_clone_urls(&acceptance);
     assert_eq!(announced_owner_clones, owner_clone_urls);
@@ -360,6 +424,244 @@ async fn test_existing_repository_invitation_acceptance_syncs_without_invitee_pu
     owner_relay.stop().await;
 }
 
+/// An invitation must not overwrite an invitee's unrelated repository merely
+/// because the inviter's state is newer.
+///
+/// Both users first create a repository with the same identifier but different
+/// default branches. The invitee's repository remains on its own state while
+/// the one-way invitation syncs. Once the invitee publishes a reciprocal
+/// announcement, the newer owner state becomes authoritative for the combined
+/// maintainer set and replaces the invitee repository's refs without a new push.
+#[tokio::test]
+async fn test_acceptance_replaces_existing_invitee_repository_with_newer_owner_state() {
+    use crate::common::{create_test_repo_with_commit, CommitVariant};
+
+    let owner_relay = TestRelay::start_with_sync(None).await;
+    let invitee_relay = TestRelay::start_with_sync(None).await;
+    let shared_relay = TestRelay::start_with_sync(None).await;
+    let owner_keys = Keys::generate();
+    let invitee_keys = Keys::generate();
+    let identifier = "existing-invitee-repository-acceptance";
+    let invitee_branch = "invitee-default";
+    let owner_branch = "owner-default";
+    let invitee_servers = [&invitee_relay, &shared_relay];
+    let owner_servers = [&owner_relay, &shared_relay];
+
+    let invitee_git = tempfile::tempdir().expect("Failed to create invitee repository directory");
+    let invitee_commit = create_test_repo_with_commit(invitee_git.path(), CommitVariant::StateTest)
+        .expect("Failed to create invitee repository commit");
+    rename_default_branch(invitee_git.path(), invitee_branch);
+    let invitee_npub = invitee_keys
+        .public_key()
+        .to_bech32()
+        .expect("Failed to encode invitee npub");
+    let (invitee_clone_urls, invitee_relay_urls) =
+        repository_urls(&invitee_keys, &invitee_servers, identifier);
+    let initial_invitee_announcement =
+        repository_announcement(&invitee_keys, &invitee_servers, &[], identifier)
+            .finalize(&invitee_keys)
+            .expect("Failed to create initial invitee announcement");
+    let invitee_state = repository_state_with_default_branch(
+        &invitee_clone_urls,
+        &invitee_relay_urls,
+        identifier,
+        invitee_branch,
+        &invitee_commit,
+    )
+    .finalize(&invitee_keys)
+    .expect("Failed to create invitee state");
+    let invitee_refs = BTreeMap::from([(
+        format!("refs/heads/{invitee_branch}"),
+        invitee_commit.clone(),
+    )]);
+
+    for relay in invitee_servers {
+        send_to_relay(relay, &initial_invitee_announcement)
+            .await
+            .expect("Failed to publish initial invitee announcement");
+        send_to_relay(relay, &invitee_state)
+            .await
+            .expect("Failed to publish invitee state");
+        crate::common::push_to_relay(
+            invitee_git.path(),
+            &relay.domain(),
+            &invitee_npub,
+            identifier,
+        )
+        .expect("Failed to push existing invitee repository");
+        assert_exact_event_served(
+            relay,
+            &initial_invitee_announcement,
+            "Initial invitee announcement",
+        )
+        .await;
+        assert_exact_event_served(relay, &invitee_state, "Invitee state event").await;
+    }
+    for clone_url in &invitee_clone_urls {
+        assert_remote_refs(clone_url, &invitee_refs, Duration::from_secs(20)).await;
+        assert_remote_default_branch(
+            clone_url,
+            &format!("refs/heads/{invitee_branch}"),
+            Duration::from_secs(20),
+        )
+        .await;
+    }
+
+    tokio::time::sleep(Duration::from_secs(1)).await;
+
+    let owner_git = tempfile::tempdir().expect("Failed to create owner repository directory");
+    let owner_commit = create_test_repo_with_commit(owner_git.path(), CommitVariant::PrTest)
+        .expect("Failed to create owner repository commit");
+    rename_default_branch(owner_git.path(), owner_branch);
+    let owner_npub = owner_keys
+        .public_key()
+        .to_bech32()
+        .expect("Failed to encode owner npub");
+    let (owner_clone_urls, owner_relay_urls) =
+        repository_urls(&owner_keys, &owner_servers, identifier);
+    let owner_created_at = Timestamp::from_secs(invitee_state.created_at.as_secs() + 1);
+    let initial_owner_announcement =
+        repository_announcement(&owner_keys, &owner_servers, &[], identifier)
+            .custom_created_at(owner_created_at)
+            .finalize(&owner_keys)
+            .expect("Failed to create initial owner announcement");
+    let owner_state = repository_state_with_default_branch(
+        &owner_clone_urls,
+        &owner_relay_urls,
+        identifier,
+        owner_branch,
+        &owner_commit,
+    )
+    .custom_created_at(owner_created_at)
+    .finalize(&owner_keys)
+    .expect("Failed to create owner state");
+    assert!(
+        owner_state.created_at > invitee_state.created_at,
+        "Owner state must be newer than the invitee's existing state"
+    );
+
+    for relay in owner_servers {
+        send_to_relay(relay, &initial_owner_announcement)
+            .await
+            .expect("Failed to publish initial owner announcement");
+        send_to_relay(relay, &owner_state)
+            .await
+            .expect("Failed to publish owner state");
+        crate::common::push_to_relay(owner_git.path(), &relay.domain(), &owner_npub, identifier)
+            .expect("Failed to push owner repository");
+        assert_exact_event_served(
+            relay,
+            &initial_owner_announcement,
+            "Initial owner announcement",
+        )
+        .await;
+        assert_exact_event_served(relay, &owner_state, "Owner state event").await;
+    }
+
+    let invitation = repository_announcement(
+        &owner_keys,
+        &owner_servers,
+        &[invitee_keys.public_key()],
+        identifier,
+    )
+    .custom_created_at(Timestamp::from_secs(owner_created_at.as_secs() + 1))
+    .finalize(&owner_keys)
+    .expect("Failed to create owner invitation");
+    for relay in owner_servers {
+        send_to_relay(relay, &invitation)
+            .await
+            .expect("Failed to publish owner invitation");
+        assert_exact_event_served(relay, &invitation, "Owner invitation announcement").await;
+    }
+
+    let invitation_note = invitation
+        .id
+        .to_bech32()
+        .expect("Failed to encode owner invitation note ID");
+    assert!(
+        wait_for_log(
+            &invitee_relay.log_path(),
+            &invitation_note,
+            Duration::from_secs(20),
+        )
+        .await,
+        "Invitee-only server should process the unilateral invitation before acceptance"
+    );
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    for relay in invitee_servers {
+        assert_exact_event_served(relay, &invitee_state, "Invitee state before acceptance").await;
+    }
+    for clone_url in &invitee_clone_urls {
+        assert_remote_refs(clone_url, &invitee_refs, Duration::from_secs(5)).await;
+        assert_remote_default_branch(
+            clone_url,
+            &format!("refs/heads/{invitee_branch}"),
+            Duration::from_secs(5),
+        )
+        .await;
+    }
+
+    let pushes_before_acceptance = [
+        push_counts(&owner_relay).await,
+        push_counts(&invitee_relay).await,
+        push_counts(&shared_relay).await,
+    ];
+    let acceptance = repository_announcement(
+        &invitee_keys,
+        &invitee_servers,
+        &[owner_keys.public_key()],
+        identifier,
+    )
+    .custom_created_at(Timestamp::from_secs(owner_created_at.as_secs() + 2))
+    .finalize(&invitee_keys)
+    .expect("Failed to create invitee acceptance");
+    for relay in invitee_servers {
+        send_to_relay(relay, &acceptance)
+            .await
+            .expect("Failed to publish invitee acceptance");
+    }
+
+    for relay in [&owner_relay, &invitee_relay, &shared_relay] {
+        assert_exact_event_served(relay, &invitation, "Owner invitation announcement").await;
+        assert_exact_event_served(relay, &acceptance, "Invitee acceptance announcement").await;
+        assert_exact_event_served(relay, &owner_state, "Newer owner state event").await;
+    }
+
+    let owner_refs = BTreeMap::from([(format!("refs/heads/{owner_branch}"), owner_commit.clone())]);
+    for clone_url in &invitee_clone_urls {
+        assert_remote_refs(clone_url, &owner_refs, Duration::from_secs(20)).await;
+        assert_remote_default_branch(
+            clone_url,
+            &format!("refs/heads/{owner_branch}"),
+            Duration::from_secs(20),
+        )
+        .await;
+    }
+    for clone_url in &owner_clone_urls {
+        assert_remote_refs(clone_url, &owner_refs, Duration::from_secs(20)).await;
+        assert_remote_default_branch(
+            clone_url,
+            &format!("refs/heads/{owner_branch}"),
+            Duration::from_secs(20),
+        )
+        .await;
+    }
+
+    let pushes_after_acceptance = [
+        push_counts(&owner_relay).await,
+        push_counts(&invitee_relay).await,
+        push_counts(&shared_relay).await,
+    ];
+    assert_eq!(
+        pushes_after_acceptance, pushes_before_acceptance,
+        "Invitation acceptance must converge existing repositories without a client Git push"
+    );
+
+    shared_relay.stop().await;
+    invitee_relay.stop().await;
+    owner_relay.stop().await;
+}
+
 /// A reciprocal owner announcement in purgatory must be enough to unlock an
 /// earlier rejected maintainer announcement and use that maintainer's clone URL.
 ///