Circle chat is the one feature on this site whose gate was written before the feature. This is what it refuses, who gets which refusal, and why a stranger is told the room does not exist rather than that they are not allowed in.
Without a plan: none
Chat needs an assured circle. A circle with no under-16s is assured by definition.
The rule, in one sentence
That sentence is written in one file and both the live read and the catch-up read call it, so the two cannot drift apart. There is also a test that scans the chat endpoints for the wrong check and fails if it ever reappears — which is the only reliable way to keep a rule like this true a year later.
Two different refusals
Being turned away is not one outcome. Which one you get depends on whether you are in the room, and the difference is the whole point.
| Who is asking | What they get | Why |
|---|---|---|
| Not a member — signed out, or signed in but not in this circle | Not found | A refusal that says "you are not allowed" has confirmed the room exists. For a room that may contain children, the existence of the room is itself information, so it is withheld. |
| A member, circle not assured | Refused, with the reason | They already know the room exists; they are in it. The useful thing to tell them is which of the five assurance gaps is missing, so somebody can clear it. |
| A member, circle assured | The chat | Both conditions met. |
The check it deliberately does not use
The obvious implementation would have copied the file next door, which asks whether the viewer "can view" the circle. That check treats an unlisted circle the same as a public one — which is correct for a timeline somebody chose to share by link, and catastrophic for chat: a signed-out stranger holding a guessed id would read a children’s room.
So chat asks whether the viewer is a member, and nothing else counts. A room name is not a credential.
Why assurance gates reading, not just writing
A circle stops being assured the moment a child joins who was not covered by the last confirmation. The safe direction for a room that has just acquired an unwarranted child is closed, not read-only.
Nothing is stranded by that. A room that falls out of assurance is warranted again in one click, and the messages are still there afterwards.
What happens when moderation cannot run
Where a circle has under-16s in it, chat fails closed: if the moderation check cannot complete, the message does not post. That costs an adult a few minutes of conversation during an outage, which is the right trade against the alternative.
The posture is read off the same assurance answer the gate already fetched, so it is the wider definition of "a child is present" — including a declared date of birth under 16, not only a guardian-managed account. Being narrower here would contradict the gate one line above it, which already counts that learner as a child when deciding whether the room may have chat at all.
Who can take a message down
The circle’s teacher, and an enrolled moderator. Taking one message out of a room is the moderation power that role exists for.
It is deliberately not the same test as removing or muting a member — those stay with the circle’s owner. Moderating a message and moderating a person are different amounts of authority.
Common questions
Because "not allowed" would confirm the room exists. For a room that may contain children, that is information worth withholding from somebody who is only guessing.