From 95fd01035f08065bd9d4e3a09c318298c7ed5db5 Mon Sep 17 00:00:00 2001
From: spaced4ndy <spaced4ndy@users.noreply.github.com>
Date: Mon, 22 Jun 2026 10:17:35 +0000
Subject: [PATCH] deploy: 0e09b38ea6834ae31a0e6af5700a9c869c5bb5d8

---
 docs/protocol/channels-overview.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/protocol/channels-overview.html b/docs/protocol/channels-overview.html
index fe22daee93..2c9f41266a 100644
--- a/docs/protocol/channels-overview.html
+++ b/docs/protocol/channels-overview.html
@@ -1030,7 +1030,7 @@ window.addEventListener('click',(e)=>{
 <p><strong>Subscribers</strong> connect to relays and receive content. They cannot send messages by default, but can be given posting rights.</p>
 </li>
 </ul>
-<p>Additional roles (moderator, admin, member, author) exist in the hierarchy and are inherited from the group protocol.</p>
+<p>Additional roles (moderator, admin, member, author) exist in the hierarchy and are inherited from the group protocol. The owner-signed roster tracks the promoted set - members, moderators, and admins; subscribers are observers until an owner promotes them.</p>
 <p>For protocol-level detail - wire formats, message types, signing and verification mechanics, delivery pipeline - see <a href="/docs/protocol/channels-protocol.html">SimpleX Channels Protocol</a>.</p>
 <h2 id="cryptographic-primitives" tabindex="-1">Cryptographic primitives</h2>
 <ul>
@@ -1084,6 +1084,7 @@ window.addEventListener('click',(e)=>{
 <li>Undetectably substitute content - subscribers on honest relays receive the original.</li>
 <li>Alter the channel's authoritative state on the owner's device.</li>
 <li>Substitute the channel profile or impersonate an owner - these require valid signatures.</li>
+<li>Replay an old roster or role change to re-elevate a removed or demoted member for existing subscribers - they reject anything older than the roster version they applied (a new joiner with no prior roster can still be served an old one, until it syncs from another relay).</li>
 <li>Redirect subscribers to a different channel - the entity ID is validated across link and profile.</li>
 <li>Determine subscriber identity or network address - inherited from SMP transport.</li>
 <li>Correlate subscriber participation across channels - each connection uses independent SMP queues. The subscriber chooses their SMP router independently, so collusion between a relay and the relay's SMP router does not compromise connections through a different router.</li>