@volter/twin-linkedin 0.1.0

package/dist/src/linkedin-capabilities.js

@@ -0,0 +1,1027 @@
+// THE LINKEDIN PACK'S CAPABILITY MANIFEST — the real vendor surface as the DENOMINATOR, not a list
+// of what got built. The denominator is LinkedIn's Community Management API as an ORGANIZATION uses
+// it to publish (learn.microsoft.com/linkedin, Marketing li-lms-2026-09): the Posts API with its
+// content kinds, the Images, Videos and Documents APIs, the organization's access control, lookup and
+// follower count, the social surfaces around a post (comments, reactions, social metadata), the
+// page and share statistics, and the OpenID userinfo a sign-in reads. The Ads (Campaign Manager)
+// APIs, Lead Sync, Events, Talent and the member-profile surfaces are other LinkedIn products this
+// manifest deliberately does NOT enumerate; claiming them here would inflate a denominator nothing
+// here measures.
+//
+// Every `done` below drives the handler the fetch adapter wraps (`handleLinkedinTwinRequest`) on a
+// fresh root with a pinned instant, and asserts VALUES and the vendor's refusals — never a status
+// alone. The mirror's `done`s render the mirror's OWN components over what the handler served.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { checkCapabilities, verifyBoundary } from '@volter/world-tooling';
+import { observeResource, pendingActions, performEntries, wholeLog, writeBranchMeta, writeRoot } from '@volter/world-core';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { handleLinkedinTwinRequest } from "./linkedin-twin.js";
+import { budgetedLinkedinExecute, performLinkedinAction as performServed, performLinkedinActionWithin, processingPollWait, syncLinkedinFromRemote, untemplateHashtags } from "./linkedin-connector.js";
+import { LINKEDIN_CALL_WEIGHTS, LINKEDIN_RATE_BUDGET, LinkedinBudget, LinkedinBudgetError, linkedinCallWeight } from "./linkedin-budget.js";
+import { commentarySegments, createLinkedinMirrorServer, followerLine, orgFromReads, relativeTime } from "./linkedin-mirror-ui.js";
+import { assetIsOwn, readAsset, signUpload, writeAsset } from "./linkedin-media.js";
+import { CompanyHeader, PostCard } from "../client/linkedin-mirror.js";
+const ORG = 'urn:li:organization:2414183';
+const OTHER_ORG = 'urn:li:organization:5515715';
+const TOKEN = 'org-admin-token-0001';
+const SCOPES = ['w_organization_social', 'r_organization_social', 'rw_organization_admin', 'openid', 'profile', 'email'];
+const API = { authorization: `Bearer ${TOKEN}`, 'linkedin-version': '202609', 'x-restli-protocol-version': '2.0.0' };
+const AT = '2026-09-26T12:00:00.000Z';
+/** Ten seconds before AT: an upload finalized then has finished processing (PROCESSING_MS) by AT. */
+const EARLY = '2026-09-26T11:59:50.000Z';
+const LATER = (ms) => new Date(Date.parse(AT) + ms).toISOString();
+function handleFor(root, at = AT) {
+    return (step) => handleLinkedinTwinRequest({
+        method: step.m, path: step.p, root, occurredAt: step.at ?? at, readOnly: step.readOnly,
+        headers: step.headers ?? API,
+        ...(step.b === undefined ? {} : { body: JSON.stringify(step.b) }),
+        ...(step.bytes ? { bytes: step.bytes } : {}),
+        ...(step.base ? { publicBase: step.base } : {}),
+    });
+}
+async function seed(h, opts = {}) {
+    const member = opts.member ?? 'orgAdmin';
+    await h({ m: 'POST', p: '/_twin/organizations', b: { id: '2414183', localizedName: 'Volter', vanityName: 'volter', localizedWebsite: 'https://volter.ai', localizedDescription: 'Twins for every SaaS.', followerCount: 12480 }, headers: {} });
+    await h({ m: 'POST', p: '/_twin/organizations', b: { id: '5515715', localizedName: 'Other Co', vanityName: 'other-co' }, headers: {} });
+    await h({ m: 'POST', p: '/_twin/members', b: { id: member, localizedFirstName: 'Aaron', localizedLastName: 'Admin', email: opts.email ?? 'admin@volter.ai' }, headers: {} });
+    await h({ m: 'POST', p: '/_twin/organizationAcls', b: { organization: ORG, roleAssignee: `urn:li:person:${member}`, role: opts.role ?? 'ADMINISTRATOR', state: 'APPROVED' }, headers: {} });
+    await h({ m: 'POST', p: '/_twin/tokens', b: { token: opts.token ?? TOKEN, member: `urn:li:person:${member}`, scopes: opts.scopes ?? SCOPES }, headers: {} });
+}
+/** A throwaway world with the page, its admin, the admin role and the token the OAuth leg would have minted. */
+async function withWorld(fn, opts = {}) {
+    const root = mkdtempSync(join(tmpdir(), 'linkedin-cap-'));
+    const h = handleFor(root);
+    try {
+        return await verifyBoundary('linkedin.withWorld', async () => { await seed(h, opts); return fn(h, root); });
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+const textPost = (commentary, extra = {}) => ({
+    author: ORG, commentary, visibility: 'PUBLIC',
+    distribution: { feedDistribution: 'MAIN_FEED', targetEntities: [], thirdPartyDistributionChannels: [] },
+    lifecycleState: 'PUBLISHED', isReshareDisabledByAuthor: false, ...extra,
+});
+async function createPost(h, body) {
+    const r = await h({ m: 'POST', p: '/rest/posts', b: body });
+    if (r.status !== 201)
+        throw new Error(`create answered ${r.status}: ${JSON.stringify(r.body)}`);
+    return String(r.headers?.['x-restli-id']);
+}
+const enc = (urn) => encodeURIComponent(urn);
+// ── media fixtures: the smallest bytes the twin reads as an image and as a video ─────────────
+function box(type, payload) {
+    const out = new Uint8Array(8 + payload.length);
+    new DataView(out.buffer).setUint32(0, out.length);
+    out.set(new TextEncoder().encode(type), 4);
+    out.set(payload, 8);
+    return out;
+}
+const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const p of parts) {
+        out.set(p, at);
+        at += p.length;
+    }
+    return out;
+};
+/** A PNG header naming a 64x48 image (the twin reads type and size from the header, as LinkedIn does). */
+function tinyPng() {
+    const ihdr = new Uint8Array(13);
+    new DataView(ihdr.buffer).setUint32(0, 64);
+    new DataView(ihdr.buffer).setUint32(4, 48);
+    ihdr.set([8, 2, 0, 0, 0], 8);
+    return concat(new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), box('IHDR', ihdr), new Uint8Array(4));
+}
+/** An MP4's boxes for a video of `ms` at 1280x720, with `pad` bytes of mdat (the feed's floor is 75 KB). */
+function mp4(ms = 3000, pad = 80 * 1024) {
+    const mvhd = new Uint8Array(100);
+    new DataView(mvhd.buffer).setUint32(12, 1000);
+    new DataView(mvhd.buffer).setUint32(16, ms);
+    const tkhd = new Uint8Array(84);
+    new DataView(tkhd.buffer).setUint32(76, 1280 << 16);
+    new DataView(tkhd.buffer).setUint32(80, 720 << 16);
+    const fill = new Uint8Array(pad);
+    for (let i = 0; i < pad; i += 1)
+        fill[i] = (i * 31 + 7) % 251;
+    return concat(box('ftyp', new TextEncoder().encode('isom\0\0\x02\0isom')), box('mdat', fill), box('moov', concat(box('mvhd', mvhd), box('trak', box('tkhd', tkhd)))));
+}
+const pathOf = (url) => { const u = new URL(url); return u.pathname + u.search; };
+/** The same upload URL with its signature's first hex digit changed — always a different signature. */
+const forge = (path) => path.replace(/ut=([0-9a-f])/, (_m, c) => `ut=${c === '0' ? '1' : '0'}`);
+/** Upload an image through initializeUpload and the bearer-carrying PUT; returns its URN. */
+async function uploadImage(h, bytes = tinyPng(), owner = ORG) {
+    const init = (await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner } } })).body;
+    const put = await h({ m: 'PUT', p: pathOf(init.value.uploadUrl), bytes, headers: { authorization: API.authorization } });
+    if (put.status !== 201)
+        throw new Error(`image PUT answered ${put.status}`);
+    return String(init.value.image);
+}
+/** A video through initialize, the part PUTs (no bearer) and finalize — done ten seconds before AT, so
+ *  by AT it has finished processing; `processing: true` does it at AT, so at AT it is still PROCESSING. */
+async function uploadVideo(h, bytes = mp4(), opts = {}) {
+    const at = opts.processing ? AT : EARLY;
+    const init = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', at, b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: bytes.length, uploadCaptions: false, uploadThumbnail: opts.thumbnail !== undefined } } })).body;
+    const etags = [];
+    for (const part of init.value.uploadInstructions) {
+        const put = await h({ m: 'PUT', p: pathOf(part.uploadUrl), at, bytes: bytes.subarray(part.firstByte, part.lastByte + 1), headers: {} });
+        etags.push(String(put.headers?.etag));
+    }
+    if (opts.thumbnail)
+        await h({ m: 'PUT', p: pathOf(init.value.thumbnailUploadUrl), at, bytes: opts.thumbnail, headers: {} });
+    await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', at, b: { finalizeUploadRequest: { video: init.value.video, uploadToken: '', uploadedPartIds: etags } } });
+    return { urn: String(init.value.video), init, etags };
+}
+/** An in-process VENDOR: the kernel executor's shape, answered by a second LinkedIn twin on its own
+ *  root. A presigned request carries the absolute upload URL the vendor twin minted. */
+function vendorExecutor(vendorRoot, calls) {
+    // the vendor's clock moves 3 s per call, so a video it finalized is AVAILABLE by the next status read
+    let clock = Date.parse('2026-09-26T13:00:00.000Z');
+    return async (request) => {
+        clock += 3_000;
+        const presigned = request.presigned === true;
+        const path = presigned ? pathOf(request.path) : request.path;
+        const headers = { ...(request.headers ?? {}), ...(presigned ? {} : { authorization: 'Bearer vendor-token-0002' }) };
+        calls.push({ method: request.method, path, presigned, auth: 'authorization' in headers });
+        const body = request.body;
+        const res = await handleLinkedinTwinRequest({
+            method: request.method, path, headers, root: vendorRoot, occurredAt: new Date(clock).toISOString(), publicBase: 'https://www.linkedin.com',
+            ...(body instanceof Uint8Array ? { bytes: body } : body !== undefined ? { body } : {}),
+        });
+        return { status: res.status, headers: res.headers ?? {}, body: res.body === null || res.body === undefined || res.body === '' ? '' : JSON.stringify(res.body) };
+    };
+}
+async function withVendor(fn) {
+    const localRoot = mkdtempSync(join(tmpdir(), 'linkedin-cap-local-'));
+    const vendorRoot = mkdtempSync(join(tmpdir(), 'linkedin-cap-vendor-'));
+    try {
+        return await verifyBoundary('linkedin.withVendor', async () => {
+            const local = handleFor(localRoot);
+            await seed(local);
+            await seed(handleFor(vendorRoot), { member: 'vendorAdmin', token: 'vendor-token-0002', email: 'vendor@volter.ai' });
+            return fn(local, localRoot, vendorRoot);
+        });
+    }
+    finally {
+        rmSync(localRoot, { recursive: true, force: true });
+        rmSync(vendorRoot, { recursive: true, force: true });
+    }
+}
+const entryFor = (root, subjectId, operation) => pendingActions('linkedin', root).find((a) => a.subject?.id === subjectId && a.operation === operation);
+const ctxFor = (root) => ({ resolve: (_t, id) => id, root, service: 'linkedin' });
+/** A throwaway ledger per verify: a verify never spends the operator's LinkedIn allowance. */
+const scratchBudget = () => new LinkedinBudget({ path: join(mkdtempSync(join(tmpdir(), 'linkedin-budget-')), 'ledger.json') });
+const noWait = async () => undefined;
+const performLinkedinAction = (execute, action, ctx) => performLinkedinActionWithin(scratchBudget(), execute, action, ctx, noWait);
+const done = (id, area, title, dimension, tier, verify) => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id, area, title, dimension, tier) => ({ id, area, title, dimension, tier, expected: 'todo' });
+export const LINKEDIN_AREAS = ['versioning', 'auth', 'organizations', 'posts', 'images', 'videos', 'documents', 'social', 'statistics', 'errors', 'twin_control', 'connector', 'rate_limit', 'mirror'];
+export const LINKEDIN_CAPABILITIES = [
+    // ── versioning (Versioning; Error Responses examples 4 and 5) ────────────────────────────────
+    done('linkedin.versioning.header_required', 'versioning', 'A /rest call without Linkedin-Version is the 400 VERSION_MISSING body the docs quote', 'api', 'core', () => withWorld(async (h) => {
+        const r = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}`, headers: { authorization: API.authorization } });
+        const ok = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` });
+        return r.status === 400 && JSON.stringify(r.body) === JSON.stringify({ status: 400, code: 'VERSION_MISSING', message: 'A version must be present. Please specify a version by adding the Linkedin-Version header.' }) && ok.status === 200;
+    })),
+    done('linkedin.versioning.inactive_version_refused', 'versioning', 'A sunset or unknown version is 426 NONEXISTENT_VERSION; every active one (202510…202609, no 202512) is served', 'api', 'core', () => withWorld(async (h) => {
+        const get = (v) => h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}`, headers: { ...API, 'linkedin-version': v } });
+        const old = await get('202401');
+        const gap = await get('202512');
+        const actives = await Promise.all(['202510', '202511', '202601', '202605', '202609'].map(get));
+        return old.status === 426 && old.body.code === 'NONEXISTENT_VERSION' && old.body.message === 'Requested version 202401 is not active'
+            && gap.status === 426 && actives.every((r) => r.status === 200);
+    })),
+    // ── auth ────────────────────────────────────────────────────────────────────────────────────
+    done('linkedin.auth.bearer_required', 'auth', 'No bearer is 401 EMPTY_ACCESS_TOKEN; an unknown bearer is 401 INVALID_ACCESS_TOKEN', 'api', 'core', () => withWorld(async (h) => {
+        const none = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}`, headers: { 'linkedin-version': '202609' } });
+        const bad = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}`, headers: { ...API, authorization: 'Bearer nobody-issued-this' } });
+        return none.status === 401 && none.body.code === 'EMPTY_ACCESS_TOKEN' && bad.status === 401 && bad.body.code === 'INVALID_ACCESS_TOKEN';
+    })),
+    done('linkedin.auth.w_organization_social_gate', 'auth', 'Creating a post needs w_organization_social; a token without it is 403 ACCESS_DENIED and nothing lands', 'api', 'core', () => withWorld(async (h, root) => {
+        const r = await h({ m: 'POST', p: '/rest/posts', b: textPost('no scope') });
+        return r.status === 403 && r.body.code === 'ACCESS_DENIED' && pendingActions('linkedin', root).every((a) => a.operation !== 'linkedin.post.create');
+    }, { scopes: ['r_organization_social', 'rw_organization_admin'] })),
+    done('linkedin.auth.r_organization_social_gate', 'auth', "Reading an organization's posts needs r_organization_social", 'api', 'core', () => withWorld(async (h) => {
+        const r = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` });
+        return r.status === 403 && r.body.code === 'ACCESS_DENIED' && String(r.body.message).includes('r_organization_social');
+    }, { scopes: ['w_organization_social'] })),
+    done('linkedin.auth.page_role_gate', 'auth', 'Posting as a page needs an APPROVED ADMINISTRATOR, DIRECT_SPONSORED_CONTENT_POSTER or CONTENT_ADMINISTRATOR role on it; ANALYST is refused, and so is another org', 'api', 'core', async () => (await withWorld(async (h) => {
+        const own = await h({ m: 'POST', p: '/rest/posts', b: textPost('as a content admin') });
+        const other = await h({ m: 'POST', p: '/rest/posts', b: textPost('as someone else', { author: OTHER_ORG }) });
+        return own.status === 201 && other.status === 403;
+    }, { role: 'CONTENT_ADMINISTRATOR' }))
+        && (await withWorld(async (h) => (await h({ m: 'POST', p: '/rest/posts', b: textPost('analyst') })).status === 403, { role: 'ANALYST' }))),
+    // ── the member (OpenID userinfo) ─────────────────────────────────────────────────────────────
+    done('linkedin.userinfo.get', 'auth', "GET /v2/userinfo answers the token's member (sub, name, email) under the openid/profile/email scopes, with no version header", 'api', 'core', () => withWorld(async (h) => {
+        const r = await h({ m: 'GET', p: '/v2/userinfo', headers: { authorization: API.authorization } });
+        const b = r.body;
+        return r.status === 200 && b.sub === 'orgAdmin' && b.name === 'Aaron Admin' && b.given_name === 'Aaron' && b.family_name === 'Admin' && b.email === 'admin@volter.ai' && b.email_verified === true;
+    })),
+    done('linkedin.userinfo.openid_scope', 'auth', 'userinfo refuses a token without openid, and omits email without the email scope', 'api', 'common', async () => (await withWorld(async (h) => (await h({ m: 'GET', p: '/v2/userinfo', headers: { authorization: API.authorization } })).status === 403, { scopes: ['w_organization_social'] }))
+        && (await withWorld(async (h) => {
+            const b = (await h({ m: 'GET', p: '/v2/userinfo', headers: { authorization: API.authorization } })).body;
+            return b.sub === 'orgAdmin' && b.name === 'Aaron Admin' && b.email === undefined;
+        }, { scopes: ['openid', 'profile'] }))),
+    // ── organizations (Organization Access Control by Role; Organization Lookup) ─────────────────
+    done('linkedin.organizations.acls_by_role_assignee', 'organizations', "organizationAcls?q=roleAssignee lists the member's own roles, filtered by role and state", 'api', 'core', () => withWorld(async (h) => {
+        await h({ m: 'POST', p: '/_twin/organizationAcls', b: { organization: OTHER_ORG, roleAssignee: 'urn:li:person:orgAdmin', role: 'ANALYST', state: 'REQUESTED' }, headers: {} });
+        const all = (await h({ m: 'GET', p: '/rest/organizationAcls?q=roleAssignee' })).body;
+        const admin = (await h({ m: 'GET', p: '/rest/organizationAcls?q=roleAssignee&role=ADMINISTRATOR&state=APPROVED' })).body;
+        return all.elements?.length === 2 && admin.elements?.length === 1
+            && JSON.stringify(admin.elements[0]) === JSON.stringify({ role: 'ADMINISTRATOR', organization: ORG, roleAssignee: 'urn:li:person:orgAdmin', state: 'APPROVED' })
+            && admin.paging?.start === 0 && admin.paging?.count === 10;
+    })),
+    done('linkedin.organizations.acls_by_organization', 'organizations', "organizationAcls?q=organization lists a page's roles for its ADMINISTRATOR (organizationTarget), and refuses anyone else", 'api', 'common', () => withWorld(async (h) => {
+        const r = (await h({ m: 'GET', p: `/rest/organizationAcls?q=organization&organization=${enc(ORG)}` })).body;
+        const other = await h({ m: 'GET', p: `/rest/organizationAcls?q=organization&organization=${enc(OTHER_ORG)}` });
+        return r.elements?.[0]?.organizationTarget === ORG && r.elements[0].roleAssignee === 'urn:li:person:orgAdmin' && other.status === 403;
+    })),
+    done('linkedin.organizations.get_administered', 'organizations', 'GET /rest/organizations/{id} answers the administered page (name, vanityName, description, website, $URN); a non-admin is 403 and an unknown id 404', 'api', 'core', () => withWorld(async (h) => {
+        const r = await h({ m: 'GET', p: '/rest/organizations/2414183' });
+        const b = r.body;
+        const other = await h({ m: 'GET', p: '/rest/organizations/5515715' });
+        const none = await h({ m: 'GET', p: '/rest/organizations/999' });
+        return r.status === 200 && b.id === 2414183 && b.localizedName === 'Volter' && b.vanityName === 'volter' && b.localizedDescription === 'Twins for every SaaS.'
+            && b.name?.localized?.en_US === 'Volter' && b.$URN === ORG && other.status === 403 && none.status === 404;
+    })),
+    done('linkedin.organizations.find_by_vanity_name', 'organizations', 'organizations?q=vanityName answers only the non-admin fields, case-insensitively', 'api', 'common', () => withWorld(async (h) => {
+        const b = (await h({ m: 'GET', p: '/rest/organizations?q=vanityName&vanityName=VOLTER' })).body;
+        const e = b.elements?.[0];
+        return b.elements?.length === 1 && e.id === 2414183 && e.vanityName === 'volter' && e.localizedWebsite === 'https://volter.ai' && e.localizedDescription === undefined && e.primaryOrganizationType === 'NONE';
+    })),
+    done('linkedin.organizations.follower_count', 'organizations', 'networkSizes/{org}?edgeType=COMPANY_FOLLOWED_BY_MEMBER answers the follower count; the pre-202305 edge type is refused', 'api', 'common', () => withWorld(async (h) => {
+        const r = await h({ m: 'GET', p: `/rest/networkSizes/${enc(ORG)}?edgeType=COMPANY_FOLLOWED_BY_MEMBER` });
+        const old = await h({ m: 'GET', p: `/rest/networkSizes/${enc(ORG)}?edgeType=CompanyFollowedByMember` });
+        return r.status === 200 && r.body.firstDegreeSize === 12480 && old.status === 400;
+    })),
+    done('linkedin.organizations.logo', 'organizations', "A page's logoV2 names an image it uploaded; the image answers a downloadUrl", 'api', 'common', () => withWorld(async (h) => {
+        const image = await uploadImage(h);
+        await h({ m: 'POST', p: '/_twin/organizations', b: { id: '2414183', localizedName: 'Volter', vanityName: 'volter', logo: image }, headers: {} });
+        const org = (await h({ m: 'GET', p: '/rest/organizations?q=vanityName&vanityName=volter' })).body;
+        const img = (await h({ m: 'GET', p: `/rest/images/${enc(image)}` })).body;
+        return org.elements[0].logoV2?.original === image && img.status === 'AVAILABLE' && /\/dms\/image\/[^/]+\/image-shrink_1280\/0\/[0-9a-f]{64}/.test(img.downloadUrl);
+    })),
+    todo('linkedin.organizations.batch_get', 'organizations', 'Batch get administered organizations (GET /rest/organizations?ids=List(...)) with per-id statuses', 'api', 'common'),
+    done('linkedin.organizations.lookup_non_admin', 'organizations', 'organizationsLookup?ids=List(...) answers pages the member does not administer, with only the non-admin fields, per id', 'api', 'common', () => withWorld(async (h) => {
+        const b = (await h({ m: 'GET', p: '/rest/organizationsLookup?ids=List(5515715,2414183,404)' })).body;
+        return b.results?.['5515715']?.localizedName === 'Other Co' && b.results['5515715'].vanityName === 'other-co' && b.results['2414183']?.localizedDescription === undefined
+            && b.statuses?.['404'] === 404 && b.errors?.['404']?.code === 'NOT_FOUND' && b.statuses['5515715'] === 200;
+    })),
+    todo('linkedin.organizations.parent_finder', 'organizations', 'organizations?q=parentOrganization (brands under a parent)', 'api', 'niche'),
+    todo('linkedin.organizations.request_role', 'organizations', 'PUT /rest/organizationAcls/(…) to request the DIRECT_SPONSORED_CONTENT_POSTER role', 'api', 'niche'),
+    // ── posts (Posts API, Post Schema) ───────────────────────────────────────────────────────────
+    done('linkedin.posts.create_text', 'posts', 'POST /rest/posts creates a text post: 201, the URN in x-restli-id, no body', 'api', 'core', () => withWorld(async (h) => {
+        const r = await h({ m: 'POST', p: '/rest/posts', b: textPost('Sample text Post') });
+        return r.status === 201 && /^urn:li:share:\d{19}$/.test(String(r.headers?.['x-restli-id'])) && r.body === null;
+    })),
+    done('linkedin.posts.get', 'posts', 'GET /rest/posts/{encoded urn} answers the Post schema: author, commentary, visibility, distribution, lifecycleState PUBLISHED, lifecycleStateInfo, createdAt/publishedAt/lastModifiedAt in ms, no bookkeeping', 'api', 'core', () => withWorld(async (h) => {
+        const urn = await createPost(h, textPost('read me back'));
+        const b = (await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` })).body;
+        const raw = (await h({ m: 'GET', p: `/rest/posts/${urn}` })).body;
+        return b.id === urn && b.author === ORG && b.commentary === 'read me back' && b.visibility === 'PUBLIC' && b.distribution?.feedDistribution === 'MAIN_FEED'
+            && b.lifecycleState === 'PUBLISHED' && b.lifecycleStateInfo?.isEditedByAuthor === false && b.createdAt === Date.parse(AT) && b.publishedAt === b.createdAt && b.lastModifiedAt === b.createdAt
+            && Object.keys(b).every((k) => !k.startsWith('_')) && raw.id === urn;
+    })),
+    done('linkedin.posts.hashtag_template', 'posts', 'A #hashtag in commentary is stored and answered as the little-format template {hashtag|\\#|tag}', 'api', 'common', () => withWorld(async (h) => {
+        const urn = await createPost(h, textPost('Follow best practices #coding (and #TypeScript), not me#this'));
+        const b = (await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` })).body;
+        return b.commentary === 'Follow best practices {hashtag|\\#|coding} (and {hashtag|\\#|TypeScript}), not me#this';
+    })),
+    done('linkedin.posts.create_requires_fields', 'posts', 'A create missing author, commentary, visibility, distribution or lifecycleState is 400 MISSING_FIELD naming it', 'api', 'core', () => withWorld(async (h) => {
+        for (const field of ['author', 'commentary', 'visibility', 'distribution', 'lifecycleState']) {
+            const body = textPost('x');
+            delete body[field];
+            const r = await h({ m: 'POST', p: '/rest/posts', b: body });
+            if (r.status !== 400 || r.body.code !== 'MISSING_FIELD' || !String(r.body.message).startsWith(field))
+                return false;
+        }
+        return true;
+    })),
+    done('linkedin.posts.create_enum_values', 'posts', 'visibility, feedDistribution and lifecycleState outside their documented sets (and lifecycleState other than PUBLISHED on create) are 400 INVALID_VALUE_FOR_FIELD', 'api', 'core', () => withWorld(async (h) => {
+        const bad = [
+            textPost('x', { visibility: 'EVERYONE' }),
+            textPost('x', { distribution: { feedDistribution: 'SIDEBAR' } }),
+            textPost('x', { lifecycleState: 'DRAFT' }),
+        ];
+        for (const b of bad) {
+            const r = await h({ m: 'POST', p: '/rest/posts', b });
+            if (r.status !== 400 || r.body.code !== 'INVALID_VALUE_FOR_FIELD')
+                return false;
+        }
+        return (await h({ m: 'POST', p: '/rest/posts', b: textPost('dark', { distribution: { feedDistribution: 'NONE' } }) })).status === 201;
+    })),
+    done('linkedin.posts.author_urn_type', 'posts', 'An author that is not an organization or person URN is 400 INVALID_URN_TYPE', 'api', 'common', () => withWorld(async (h) => {
+        const r = await h({ m: 'POST', p: '/rest/posts', b: textPost('x', { author: 'urn:li:company:1' }) });
+        return r.status === 400 && r.body.code === 'INVALID_URN_TYPE';
+    })),
+    done('linkedin.posts.find_by_author', 'posts', 'posts?q=author&author= lists the organization\'s posts newest first as {paging, elements}, excluding deleted ones and other authors', 'api', 'core', () => withWorld(async (h) => {
+        const first = await createPost(h, textPost('first'));
+        const second = await createPost(h, textPost('second'));
+        const gone = await createPost(h, textPost('gone'));
+        await h({ m: 'DELETE', p: `/rest/posts/${enc(gone)}` });
+        const b = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&sortBy=CREATED` })).body;
+        const ids = b.elements.map((e) => e.id);
+        return ids.length === 2 && ids[0] === second && ids[1] === first && b.paging?.start === 0 && b.paging?.count === 10 && Array.isArray(b.paging?.links);
+    })),
+    done('linkedin.posts.find_by_author_paging', 'posts', 'The finder pages by start/count (default 10, max 100) and links the next page', 'api', 'common', () => withWorld(async (h) => {
+        for (let i = 0; i < 3; i += 1)
+            await createPost(h, textPost(`p${i}`));
+        const p1 = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&count=2` })).body;
+        const p2 = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&count=2&start=2` })).body;
+        const tooMany = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&count=101` });
+        return p1.elements.length === 2 && p1.paging.links[0]?.rel === 'next' && /start=2/.test(p1.paging.links[0].href)
+            && p2.elements.length === 1 && p2.paging.links.length === 0 && tooMany.status === 400;
+    })),
+    done('linkedin.posts.find_by_author_sort', 'posts', 'sortBy=CREATED and LAST_MODIFIED (the default) order descending; another value is 400', 'api', 'common', () => withWorld(async (h, root) => {
+        const hLater = handleFor(root, '2026-09-26T12:05:00.000Z');
+        const a = await createPost(h, textPost('earlier'));
+        const b = await createPost(hLater, textPost('later'));
+        const created = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&sortBy=CREATED` })).body;
+        const bad = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&sortBy=RANDOM` });
+        return created.elements[0].id === b && created.elements[1].id === a && bad.status === 400;
+    })),
+    done('linkedin.posts.urn_after_landing', 'posts', "After a deploy lands a post under the vendor's URN, its local URN still reads it, and the next create never reissues that local URN", 'api', 'core', () => withWorld(async (h, root) => {
+        const local = await createPost(h, textPost('to be landed'));
+        writeRoot('linkedin', { url: 'https://api.linkedin.com', deploy: 'gated', credential: join(root, 'unsealed.json') }, root);
+        const vendorUrn = 'urn:li:share:7300000000000000042';
+        const fake = async () => ({ status: 500, headers: {}, body: '' });
+        const report = await performEntries({
+            service: 'linkedin', root, execute: fake, checks: [],
+            actionIds: [entryFor(root, local, 'linkedin.post.create').id],
+            adapters: { perform: async (_e, action) => ({ externalId: action.subject?.id === local ? vendorUrn : String(action.subject?.id) }) },
+        });
+        const next = await createPost(h, textPost('after the landing'));
+        const byLocal = (await h({ m: 'GET', p: `/rest/posts/${enc(local)}` })).body;
+        return report.deployed.length === 1 && next !== local && byLocal.commentary === 'to be landed';
+    })),
+    done('linkedin.posts.kernel_tombstone', 'posts', 'A post the kernel tombstones (an observed `deleted`) is gone from GET and the author finder', 'api', 'common', () => withWorld(async (h, root) => {
+        const urn = 'urn:li:share:7300000000000000077';
+        const fieldsOf = { author: ORG, commentary: 'pulled', visibility: 'PUBLIC', distribution: { feedDistribution: 'MAIN_FEED', thirdPartyDistributionChannels: [] }, lifecycleState: 'PUBLISHED', createdAt: 1, lastModifiedAt: 1 };
+        observeResource('linkedin', { type: 'post', id: urn, fields: fieldsOf }, { root, at: '2026-09-26T11:00:00.000Z' });
+        const before = await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` });
+        observeResource('linkedin', { type: 'post', id: urn, fields: { ...fieldsOf, deleted: true } }, { root, at: '2026-09-26T11:30:00.000Z' });
+        const after = await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` });
+        const listed = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` })).body.elements;
+        return before.status === 200 && after.status === 404 && !listed.some((p) => p.id === urn);
+    })),
+    done('linkedin.posts.batch_get', 'posts', 'posts?ids=List(...) answers {results, statuses, errors}: a live post in results, a missing one a 404 in statuses and errors', 'api', 'common', () => withWorld(async (h) => {
+        const urn = await createPost(h, textPost('batch me'));
+        const missing = 'urn:li:share:9000000000000000999';
+        const b = (await h({ m: 'GET', p: `/rest/posts?ids=List(${enc(urn)},${enc(missing)})`, headers: { ...API, 'x-restli-method': 'BATCH_GET' } })).body;
+        return b.results?.[urn]?.commentary === 'batch me' && b.statuses?.[urn] === 200 && b.statuses?.[missing] === 404 && b.errors?.[missing]?.code === 'NOT_FOUND';
+    })),
+    done('linkedin.posts.delete', 'posts', 'DELETE /rest/posts/{urn} answers 204, the post is gone from GET and the finder, and a second delete is again 204 with no second write', 'api', 'core', () => withWorld(async (h, root) => {
+        const urn = await createPost(h, textPost('delete me'));
+        const d1 = await h({ m: 'DELETE', p: `/rest/posts/${enc(urn)}` });
+        const d2 = await h({ m: 'DELETE', p: `/rest/posts/${enc(urn)}` });
+        const get = await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` });
+        const deletes = pendingActions('linkedin', root).filter((a) => a.operation === 'linkedin.post.delete').length;
+        return d1.status === 204 && d2.status === 204 && get.status === 404 && deletes === 1;
+    })),
+    done('linkedin.posts.delete_unknown_and_foreign', 'posts', 'Deleting a post nobody made is 404; deleting another page\'s post is 403', 'api', 'common', () => withWorld(async (h, root) => {
+        const unknown = await h({ m: 'DELETE', p: `/rest/posts/${enc('urn:li:share:9000000000000000777')}` });
+        // another page's admin posts; this admin may not delete it
+        await h({ m: 'POST', p: '/_twin/members', b: { id: 'otherAdmin', localizedFirstName: 'O', localizedLastName: 'A', email: 'o@other.co' }, headers: {} });
+        await h({ m: 'POST', p: '/_twin/organizationAcls', b: { organization: OTHER_ORG, roleAssignee: 'urn:li:person:otherAdmin', role: 'ADMINISTRATOR' }, headers: {} });
+        await h({ m: 'POST', p: '/_twin/tokens', b: { token: 'other-admin-token', member: 'urn:li:person:otherAdmin', scopes: SCOPES }, headers: {} });
+        const theirs = String((await handleFor(root)({ m: 'POST', p: '/rest/posts', b: textPost('theirs', { author: OTHER_ORG }), headers: { ...API, authorization: 'Bearer other-admin-token' } })).headers?.['x-restli-id']);
+        const foreign = await h({ m: 'DELETE', p: `/rest/posts/${enc(theirs)}` });
+        return unknown.status === 404 && foreign.status === 403 && (await h({ m: 'GET', p: `/rest/posts/${enc(theirs)}`, headers: { ...API, authorization: 'Bearer other-admin-token' } })).status === 200;
+    })),
+    done('linkedin.posts.ids_minted_from_state', 'posts', 'Post URNs are a digest of the write above the real id space and never match a held or re-keyed id: a delete-then-create never reissues a URN, and concurrent creates never share one', 'api', 'core', () => withWorld(async (h) => {
+        const a = await createPost(h, textPost('a'));
+        await h({ m: 'DELETE', p: `/rest/posts/${enc(a)}` });
+        const b = await createPost(h, textPost('b'));
+        const n = (u) => BigInt(u.split(':').pop());
+        // three MEDIA posts at once: each awaits its asset before minting, so the mint must be inside the append
+        const images = [await uploadImage(h), await uploadImage(h), await uploadImage(h)];
+        const together = await Promise.all(images.map((id, i) => createPost(h, textPost(`together ${i}`, { content: { media: { id } } }))));
+        const listed = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` })).body.elements;
+        return a !== b && [a, b, ...together].every((u) => n(u) >= 9000000000000000000n && n(u) < 9200000000000000000n) && new Set(together).size === 3 && listed.length === 4;
+    })),
+    done('linkedin.posts.media_video', 'posts', 'A post whose content.media names an AVAILABLE video the page owns is created and read back with content.media {title, id}', 'api', 'core', () => withWorld(async (h) => {
+        const { urn: video } = await uploadVideo(h);
+        const urn = await createPost(h, textPost('with a video', { content: { media: { title: 'tour', id: video } } }));
+        const b = (await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` })).body;
+        return b.content?.media?.id === video && b.content.media.title === 'tour';
+    })),
+    done('linkedin.posts.media_image', 'posts', 'A post whose content.media names an AVAILABLE image (with altText) is created and read back', 'api', 'core', () => withWorld(async (h) => {
+        const image = await uploadImage(h);
+        const urn = await createPost(h, textPost('with an image', { content: { media: { altText: 'a chart', id: image } } }));
+        const b = (await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` })).body;
+        return b.content?.media?.id === image && b.content.media.altText === 'a chart';
+    })),
+    done('linkedin.posts.media_refusals', 'posts', "Media that is not uploaded, failed processing, still processing, another owner's, or an unknown URN is refused with the vendor's code, and nothing lands", 'api', 'core', () => withWorld(async (h, root) => {
+        const waiting = (await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG } } })).body.value.image;
+        const failed = (await uploadVideo(h, mp4(1500))).urn; // under the feed's three seconds
+        const processing = (await uploadVideo(h, mp4(), { processing: true })).urn;
+        const codes = [];
+        for (const id of [waiting, failed, processing, 'urn:li:image:C5T10AQ999999999999', 'urn:li:share:1']) {
+            codes.push((await h({ m: 'POST', p: '/rest/posts', b: textPost('x', { content: { media: { id } } }) })).body.code);
+        }
+        const creates = pendingActions('linkedin', root).filter((a) => a.operation === 'linkedin.post.create').length;
+        return JSON.stringify(codes) === JSON.stringify(['MEDIA_ASSET_WAITING_UPLOAD', 'MEDIA_ASSET_PROCESSING_FAILED', 'UNPROCESSABLE_ENTITY', 'INVALID_URN_ID', 'INVALID_URN_TYPE']) && creates === 0;
+    })),
+    done('linkedin.posts.article', 'posts', 'An article post carries source, title, description and an optional thumbnail image the page owns', 'api', 'common', () => withWorld(async (h) => {
+        const thumb = await uploadImage(h);
+        const urn = await createPost(h, textPost('read this', { content: { article: { source: 'https://volter.ai/blog/worlds', thumbnail: thumb, title: 'Worlds', description: 'How it works' } } }));
+        const b = (await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` })).body;
+        const noSource = await h({ m: 'POST', p: '/rest/posts', b: textPost('x', { content: { article: { title: 'no source' } } }) });
+        return b.content?.article?.source === 'https://volter.ai/blog/worlds' && b.content.article.thumbnail === thumb && b.content.article.title === 'Worlds' && noSource.status === 400;
+    })),
+    done('linkedin.posts.unmodelled_content_refused', 'posts', 'Content kinds and fields the twin does not model (poll, multiImage, reshareContext, targetEntities, a person author) are refused by name, never stored', 'api', 'common', () => withWorld(async (h, root) => {
+        const bodies = [
+            textPost('x', { content: { poll: { question: 'q' } } }),
+            textPost('x', { content: { multiImage: { images: [] } } }),
+            textPost('x', { reshareContext: { parent: 'urn:li:share:1' } }),
+            textPost('x', { distribution: { feedDistribution: 'MAIN_FEED', targetEntities: [{ seniorities: ['urn:li:seniority:3'] }] } }),
+            textPost('x', { author: 'urn:li:person:orgAdmin' }),
+        ];
+        for (const b of bodies) {
+            const r = await h({ m: 'POST', p: '/rest/posts', b });
+            if (r.status !== 422 || !String(r.body.message).startsWith('[twin gap]'))
+                return false;
+        }
+        return pendingActions('linkedin', root).every((a) => a.operation !== 'linkedin.post.create');
+    })),
+    todo('linkedin.posts.partial_update', 'posts', 'Update a post (POST /rest/posts/{urn}, X-RestLi-Method PARTIAL_UPDATE: commentary, CTA, landing page, lifecycleState)', 'api', 'common'),
+    todo('linkedin.posts.reshare', 'posts', 'Reshare a post (reshareContext.parent, with the derived root)', 'api', 'common'),
+    todo('linkedin.posts.targeted', 'posts', 'Targeted organic posts (distribution.targetEntities, the 300-member audience floor)', 'api', 'niche'),
+    todo('linkedin.posts.dark_posts', 'posts', 'Dark posts and Direct Sponsored Content (adContext, feedDistribution NONE for ads, the dscAdAccount finder)', 'api', 'niche'),
+    todo('linkedin.posts.cta_landing_page', 'posts', 'contentCallToActionLabel and contentLandingPage on a post', 'api', 'niche'),
+    todo('linkedin.posts.celebration', 'posts', 'Celebration posts (the Celebration content kind, organic only)', 'api', 'niche'),
+    todo('linkedin.posts.container', 'posts', 'Posts in a container (container URN, CONTAINER visibility delegated to its owner)', 'api', 'niche'),
+    todo('linkedin.posts.poll', 'posts', 'Poll posts (the Poll API content kind)', 'api', 'common'),
+    todo('linkedin.posts.multi_image', 'posts', 'Multi-image posts (the MultiImage API content kind)', 'api', 'common'),
+    todo('linkedin.posts.member_author', 'posts', "Posting as a member (a person author under w_member_social), and the finder over a person's posts (r_member_social)", 'api', 'common'),
+    todo('linkedin.posts.publish_requested', 'posts', "The PUBLISH_REQUESTED / PUBLISH_FAILED lifecycle of a post naming a video still processing (the twin refuses it instead)", 'api', 'common'),
+    todo('linkedin.posts.mention_annotations', 'posts', 'Mention annotations @[Name](urn) resolved against the named entity (case-sensitive name match) rather than stored as sent', 'api', 'common'),
+    todo('linkedin.posts.little_escaping', 'posts', "The little text format's reserved characters: unescaped ( ) [ ] { } < > @ | ~ _ * truncating or failing as LinkedIn does", 'api', 'common'),
+    todo('linkedin.posts.commentary_length_limit', 'posts', "The commentary length ceiling (FIELD_LENGTH_TOO_LONG) — the docs this build read give no number", 'api', 'common'),
+    todo('linkedin.posts.view_context_author', 'posts', 'viewContext=AUTHOR answering DRAFT and PROCESSING versions (the twin has no drafts, so both views are the published post)', 'api', 'niche'),
+    todo('linkedin.posts.query_tunneling', 'posts', 'Query tunneling (POST with X-HTTP-Method-Override for a long GET)', 'api', 'niche'),
+    // ── images (Images API) ─────────────────────────────────────────────────────────────────────
+    done('linkedin.images.initialize_upload', 'images', 'images?action=initializeUpload answers {value:{uploadUrlExpiresAt, uploadUrl, image}}: a signed /dms-uploads URL, an image URN, WAITING_UPLOAD until the bytes arrive', 'api', 'core', () => withWorld(async (h) => {
+        const v = (await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG } } })).body.value;
+        const status = (await h({ m: 'GET', p: `/rest/images/${enc(v.image)}` })).body.status;
+        return /^urn:li:image:C5T10AQ\d{12}$/.test(v.image) && v.uploadUrlExpiresAt === Date.parse(AT) + 30 * 86_400_000
+            && /^https:\/\/www\.linkedin\.com\/dms-uploads\/[^/]+\/uploaded-image\/0\?.*ut=[0-9a-f]{64}$/.test(v.uploadUrl) && status === 'WAITING_UPLOAD';
+    })),
+    done('linkedin.images.upload_needs_token_and_signature', 'images', "The image PUT needs both the signed URL and the member token: a forged signature is 401, a URL validly signed for another expiry is 401, no bearer is 401, both is 201 and AVAILABLE with its size from the bytes", 'api', 'core', () => withWorld(async (h, root) => {
+        const v = (await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG } } })).body.value;
+        const url = pathOf(v.uploadUrl);
+        const forged = await h({ m: 'PUT', p: forge(url), bytes: tinyPng(), headers: { authorization: API.authorization } });
+        // a URL SIGNED for another expiry: only the expiry-must-be-the-asset's-own rule refuses it
+        const assetId = String(v.image).split(':').pop();
+        const expiry = Number(/e=(\d+)/.exec(url)[1]) + 1;
+        const resigned = url.replace(/e=\d+/, `e=${expiry}`).replace(/ut=[0-9a-f]+/, `ut=${await signUpload((await readAsset(assetId, root)), 'uploaded-image/0', expiry)}`);
+        const otherExpiry = await h({ m: 'PUT', p: resigned, bytes: tinyPng(), headers: { authorization: API.authorization } });
+        const noBearer = await h({ m: 'PUT', p: url, bytes: tinyPng(), headers: {} });
+        const ok = await h({ m: 'PUT', p: url, bytes: tinyPng(), headers: { authorization: API.authorization } });
+        const img = (await h({ m: 'GET', p: `/rest/images/${enc(v.image)}` })).body;
+        return forged.status === 401 && otherExpiry.status === 401 && noBearer.status === 401 && ok.status === 201 && img.status === 'AVAILABLE' && img.aspectRatioWidth === 4 && img.aspectRatioHeight === 3 && img.owner === ORG;
+    })),
+    done('linkedin.images.unsupported_format_fails_processing', 'images', 'Bytes that are not JPG, GIF or PNG leave the image PROCESSING_FAILED', 'api', 'common', () => withWorld(async (h) => {
+        const v = (await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG } } })).body.value;
+        await h({ m: 'PUT', p: pathOf(v.uploadUrl), bytes: new TextEncoder().encode('not an image'), headers: { authorization: API.authorization } });
+        return (await h({ m: 'GET', p: `/rest/images/${enc(v.image)}` })).body.status === 'PROCESSING_FAILED';
+    })),
+    done('linkedin.images.owner_permission', 'images', "Uploading for a page needs ADMIN or DSC on it: another page is 403, and so is a CONTENT_ADMINISTRATOR (who may still post text)", 'api', 'core', async () => (await withWorld(async (h) => {
+        const other = await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: OTHER_ORG } } });
+        const own = await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG } } });
+        return other.status === 403 && other.body.code === 'ACCESS_DENIED' && own.status === 200;
+    }))
+        && (await withWorld(async (h) => {
+            const img = await h({ m: 'POST', p: '/rest/images?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG } } });
+            const vid = await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 100_000 } } });
+            const text = await h({ m: 'POST', p: '/rest/posts', b: textPost('text only') });
+            return img.status === 403 && vid.status === 403 && text.status === 201;
+        }, { role: 'CONTENT_ADMINISTRATOR' }))),
+    todo('linkedin.images.batch_get', 'images', 'Batch get images (GET /rest/images?ids=List(...))', 'api', 'common'),
+    todo('linkedin.images.media_library', 'images', 'The media library: mediaLibraryMetadata on initialize, PARTIAL_UPDATE of assetName/status, the associatedAccount finder', 'api', 'niche'),
+    // ── videos (Videos API) ─────────────────────────────────────────────────────────────────────
+    done('linkedin.videos.initialize_upload', 'videos', 'videos?action=initializeUpload splits fileSizeBytes into 4 MB byte-range upload instructions on signed /dms-uploads URLs, with uploadToken "" and a thumbnailUploadUrl when asked', 'api', 'core', () => withWorld(async (h) => {
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 9_000_000, uploadCaptions: false, uploadThumbnail: true } } })).body.value;
+        const i = v.uploadInstructions;
+        return /^urn:li:video:/.test(v.video) && i.length === 3 && i[0].firstByte === 0 && i[0].lastByte === 4194303 && i[1].firstByte === 4194304 && i[1].lastByte === 8388607
+            && i[2].firstByte === 8388608 && i[2].lastByte === 8999999 && /\/dms-uploads\/[^/]+\/uploadedVideo\/2\?/.test(i[2].uploadUrl) && v.uploadToken === ''
+            && /\/ads-video-userUploadedThumbnail\/0\?/.test(v.thumbnailUploadUrl);
+    })),
+    done('linkedin.videos.asset_ids_unique', 'videos', 'Concurrent first uploads on a fresh root mint distinct asset ids and URLs that all verify; a video over the feed\'s 500 MB is refused by name before any byte arrives', 'api', 'common', () => withWorld(async (h) => {
+        const inits = await Promise.all([1, 2, 3, 4].map(() => h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 100_000 } } })));
+        const ids = inits.map((r) => r.body.value?.video);
+        // four first uploads on a fresh root raced the signing key: every URL they were answered still verifies
+        const puts = await Promise.all(inits.map((r) => h({ m: 'PUT', p: pathOf(r.body.value.uploadInstructions[0].uploadUrl), bytes: new Uint8Array(100_000), headers: {} })));
+        const huge = await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 600 * 1024 * 1024 } } });
+        return ids.every((id) => /^urn:li:video:C5T10AQ\d{12}$/.test(String(id))) && new Set(ids).size === 4 && puts.every((p) => p.status === 200) && huge.status === 422 && /500 MB/.test(String(huge.body.message));
+    })),
+    done('linkedin.videos.part_upload_etag', 'videos', 'Each part PUT (no bearer) answers 200 with an ETag; a part of the wrong length or a forged signature is refused', 'api', 'core', () => withWorld(async (h) => {
+        const bytes = mp4();
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: bytes.length } } })).body.value;
+        const url = pathOf(v.uploadInstructions[0].uploadUrl);
+        const short = await h({ m: 'PUT', p: url, bytes: bytes.subarray(1), headers: {} });
+        const forged = await h({ m: 'PUT', p: forge(url), bytes, headers: {} });
+        const post = await h({ m: 'POST', p: url, bytes, headers: {} });
+        const ok = await h({ m: 'PUT', p: url, bytes, headers: {} });
+        return short.status === 400 && forged.status === 401 && post.status === 404 && ok.status === 200 && /^\/ambry-video\/signedId\/[0-9a-f]{64}\.bin$/.test(String(ok.headers?.etag));
+    })),
+    done('linkedin.videos.finalize_checks_part_ids', 'videos', 'finalizeUpload takes the ETags in upload-instruction order; a wrong or missing one is refused and the video stays WAITING_UPLOAD', 'api', 'core', () => withWorld(async (h) => {
+        const bytes = mp4(3000, 4_300_000);
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: bytes.length } } })).body.value;
+        const etags = [];
+        for (const part of v.uploadInstructions)
+            etags.push(String((await h({ m: 'PUT', p: pathOf(part.uploadUrl), bytes: bytes.subarray(part.firstByte, part.lastByte + 1), headers: {} })).headers?.etag));
+        const swapped = await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: [...etags].reverse() } } });
+        const short = await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: [etags[0]] } } });
+        const still = (await h({ m: 'GET', p: `/rest/videos/${enc(v.video)}` })).body.status;
+        const ok = await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: etags } } });
+        return etags.length === 2 && swapped.status === 400 && short.status === 400 && still === 'WAITING_UPLOAD' && ok.status === 200;
+    })),
+    done('linkedin.videos.processing_to_available', 'videos', 'After finalize a video reads PROCESSING until two seconds of world time have passed, then AVAILABLE with duration, aspect ratio, downloadUrl and thumbnail; reading never moves it', 'api', 'core', () => withWorld(async (h) => {
+        const { urn } = await uploadVideo(h, mp4(), { processing: true });
+        // any number of reads at the finalize instant leave it PROCESSING: a read is not a step
+        const reads = [];
+        for (let i = 0; i < 4; i += 1)
+            reads.push((await h({ m: 'GET', p: `/rest/videos/${enc(urn)}` })).body.status);
+        const first = (await h({ m: 'GET', p: `/rest/videos/${enc(urn)}`, at: LATER(1_999) })).body;
+        const second = (await h({ m: 'GET', p: `/rest/videos/${enc(urn)}`, at: LATER(2_000) })).body;
+        return reads.every((r) => r === 'PROCESSING') && first.status === 'PROCESSING' && first.downloadUrl === undefined && second.status === 'AVAILABLE' && second.duration === 3000
+            && second.aspectRatioWidth === 16 && second.aspectRatioHeight === 9 && /\/playlist\/[^/]+\/mp4-720p-30fp-crf28\/0\/[0-9a-f]{64}/.test(second.downloadUrl)
+            && /\/ads-video-thumbnail_720_1280\/0\/system/.test(second.thumbnail);
+    })),
+    done('linkedin.videos.bounds_fail_processing', 'videos', "A video outside the feed's bounds (under three seconds, under 75 KB) or not an MP4 fails processing with processingFailureReason", 'api', 'common', () => withWorld(async (h) => {
+        const short = (await h({ m: 'GET', p: `/rest/videos/${enc((await uploadVideo(h, mp4(2000))).urn)}` })).body;
+        const small = (await h({ m: 'GET', p: `/rest/videos/${enc((await uploadVideo(h, mp4(3000, 1000))).urn)}` })).body;
+        const junk = (await h({ m: 'GET', p: `/rest/videos/${enc((await uploadVideo(h, new Uint8Array(90_000).fill(7))).urn)}` })).body;
+        return [short, small, junk].every((v) => v.status === 'PROCESSING_FAILED' && typeof v.processingFailureReason === 'string') && /three seconds/.test(short.processingFailureReason);
+    })),
+    done('linkedin.videos.concurrent_parts', 'videos', "Two part PUTs at once keep both ETags and finalize succeeds; a part arriving after finalize is refused and the video stays PROCESSING", 'api', 'core', () => withWorld(async (h) => {
+        const bytes = mp4(3000, 4_300_000);
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: bytes.length } } })).body.value;
+        const parts = v.uploadInstructions;
+        // both parts in flight together: each read-modify-write of the record runs in the asset's chain
+        const puts = await Promise.all(parts.map((part) => h({ m: 'PUT', p: pathOf(part.uploadUrl), bytes: bytes.subarray(part.firstByte, part.lastByte + 1), headers: {} })));
+        const etags = puts.map((r) => String(r.headers?.etag));
+        const fin = await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: etags } } });
+        const late = await h({ m: 'PUT', p: pathOf(parts[0].uploadUrl), bytes: bytes.subarray(parts[0].firstByte, parts[0].lastByte + 1), headers: {} });
+        const status = (await h({ m: 'GET', p: `/rest/videos/${enc(v.video)}` })).body.status;
+        return parts.length === 2 && puts.every((r) => r.status === 200) && new Set(etags).size === 2 && fin.status === 200 && late.status === 400 && status === 'PROCESSING';
+    })),
+    done('linkedin.videos.inherited_upload_refused', 'videos', "A World writes only the uploads it started: a part PUT or finalize for an asset its origin initialized is refused (409, 'finish it there') and writes nothing, while reads of it still work", 'api', 'core', () => withWorld(async (h, root) => {
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 100_000 } } })).body.value;
+        const child = mkdtempSync(join(tmpdir(), 'linkedin-cap-branch-'));
+        try {
+            writeBranchMeta('linkedin', { parent: { at: root, position: wholeLog('linkedin', root).length } }, child);
+            const c = handleFor(child);
+            const id = String(v.video).split(':').pop();
+            const put = await c({ m: 'PUT', p: pathOf(v.uploadInstructions[0].uploadUrl), bytes: new Uint8Array(100_000), headers: {} });
+            const fin = await c({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: ['x'] } } });
+            const read = await c({ m: 'GET', p: `/rest/videos/${enc(v.video)}` });
+            const atOrigin = await h({ m: 'PUT', p: pathOf(v.uploadInstructions[0].uploadUrl), bytes: new Uint8Array(100_000), headers: {} });
+            return put.status === 409 && put.body.code === 'CONFLICT' && /finish it there/.test(String(put.body.message)) && fin.status === 409
+                && !(await assetIsOwn(id, child)) && read.status === 200 && read.body.status === 'WAITING_UPLOAD' && atOrigin.status === 200;
+        }
+        finally {
+            rmSync(child, { recursive: true, force: true });
+        }
+    })),
+    done('linkedin.videos.unsigned_record_refused', 'videos', 'An upload whose record predates per-asset secrets is refused with a clear 400, never signed with an empty key', 'api', 'common', () => withWorld(async (h, root) => {
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 100_000 } } })).body.value;
+        const id = String(v.video).split(':').pop();
+        const { upload_secret: _gone, ...legacy } = (await readAsset(id, root));
+        await writeAsset(legacy, root);
+        const put = await h({ m: 'PUT', p: pathOf(v.uploadInstructions[0].uploadUrl), bytes: new Uint8Array(100_000), headers: {} });
+        return put.status === 400 && put.body.code === 'INVALID_UPLOAD_URL' && /initialize a new upload/.test(String(put.body.message));
+    })),
+    done('linkedin.videos.thumbnail_upload', 'videos', 'uploadThumbnail: the thumbnail PUT is stored and the video answers it as its thumbnail; finalize refuses until it arrives', 'api', 'common', () => withWorld(async (h) => {
+        const bytes = mp4();
+        const v = (await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: bytes.length, uploadThumbnail: true } } })).body.value;
+        const etag = String((await h({ m: 'PUT', p: pathOf(v.uploadInstructions[0].uploadUrl), bytes, headers: {} })).headers?.etag);
+        const early = await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: [etag] } } });
+        await h({ m: 'PUT', p: pathOf(v.thumbnailUploadUrl), bytes: tinyPng(), headers: {} });
+        const ok = await h({ m: 'POST', p: '/rest/videos?action=finalizeUpload', b: { finalizeUploadRequest: { video: v.video, uploadToken: '', uploadedPartIds: [etag] } } });
+        const got = (await h({ m: 'GET', p: `/rest/videos/${enc(v.video)}`, at: LATER(5_000) })).body;
+        return early.status === 400 && ok.status === 200 && /\/ads-video-thumbnail_720_1280\/0\/[0-9a-f]{64}/.test(got.thumbnail);
+    })),
+    done('linkedin.videos.bytes_served_with_range', 'videos', "The video's downloadUrl serves the uploaded bytes on the twin's own base: whole files and long ranges streamed, an open range capped at 8 MiB, suffix ranges, 206 and 416", 'api', 'core', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'linkedin-cap-bytes-'));
+        const { createLinkedinTwinFetch } = await import("./linkedin-server.js");
+        const fetcher = createLinkedinTwinFetch({ root });
+        const call = async (method, path, init = {}) => fetcher(new Request(`http://twin.test${path}`, { method, ...init }));
+        try {
+            const json = { 'content-type': 'application/json' };
+            await call('POST', '/_twin/organizations', { headers: json, body: JSON.stringify({ id: '2414183', localizedName: 'Volter' }) });
+            await call('POST', '/_twin/members', { headers: json, body: JSON.stringify({ id: 'orgAdmin', localizedFirstName: 'A', localizedLastName: 'B', email: 'a@volter.ai' }) });
+            await call('POST', '/_twin/organizationAcls', { headers: json, body: JSON.stringify({ organization: ORG, roleAssignee: 'urn:li:person:orgAdmin', role: 'ADMINISTRATOR' }) });
+            await call('POST', '/_twin/tokens', { headers: json, body: JSON.stringify({ token: TOKEN, member: 'urn:li:person:orgAdmin', scopes: SCOPES }) });
+            const bytes = mp4(3000, 9 * 1024 * 1024);
+            const v = await (await call('POST', '/rest/videos?action=initializeUpload', { headers: { ...json, ...API }, body: JSON.stringify({ initializeUploadRequest: { owner: ORG, fileSizeBytes: bytes.length } }) })).json();
+            const etags = [];
+            for (const part of v.value.uploadInstructions) {
+                const put = await call('PUT', pathOf(part.uploadUrl), { body: new Blob([new Uint8Array(bytes.subarray(part.firstByte, part.lastByte + 1))]) });
+                etags.push(String(put.headers.get('etag')));
+            }
+            await call('POST', '/rest/videos?action=finalizeUpload', { headers: { ...json, ...API }, body: JSON.stringify({ finalizeUploadRequest: { video: v.value.video, uploadToken: '', uploadedPartIds: etags } }) });
+            // the fetch adapter reads the world clock: processing ends two seconds after finalize
+            await new Promise((r) => setTimeout(r, 2_100));
+            const got = await (await call('GET', `/rest/videos/${enc(v.value.video)}`, { headers: API })).json();
+            const url = new URL(got.downloadUrl);
+            const whole = new Uint8Array(await (await call('GET', url.pathname)).arrayBuffer());
+            const part = await call('GET', url.pathname, { headers: { range: 'bytes=100-199' } });
+            const partBytes = new Uint8Array(await part.arrayBuffer());
+            const beyond = await call('GET', url.pathname, { headers: { range: `bytes=${bytes.length + 10}-` } });
+            const open = await call('GET', url.pathname, { headers: { range: 'bytes=0-' } });
+            const openLen = (await open.arrayBuffer()).byteLength;
+            const suffix = new Uint8Array(await (await call('GET', url.pathname, { headers: { range: 'bytes=-50' } })).arrayBuffer());
+            const CAP = 8 * 1024 * 1024;
+            // an open-ended range is capped at 8 MiB; a whole-file answer and a long closed range stream every byte
+            const closed = await call('GET', url.pathname, { headers: { range: `bytes=1-${bytes.length - 1}` } });
+            // streamed, not held: the first chunk of a long answer is one capped read
+            const reader = closed.body.getReader();
+            const chunks = [];
+            for (;;) {
+                const r = await reader.read();
+                if (r.done)
+                    break;
+                chunks.push(r.value);
+            }
+            const closedBytes = concat(...chunks);
+            const firstChunk = chunks[0]?.length ?? 0;
+            return url.origin === 'http://twin.test' && bytes.length > CAP && whole.length === bytes.length && whole.every((b, i) => b === bytes[i])
+                && part.status === 206 && part.headers.get('content-range') === `bytes 100-199/${bytes.length}` && partBytes.every((b, i) => b === bytes[100 + i]) && beyond.status === 416
+                && open.status === 206 && open.headers.get('content-range') === `bytes 0-${CAP - 1}/${bytes.length}` && openLen === CAP
+                && suffix.length === 50 && suffix.every((b, i) => b === bytes[bytes.length - 50 + i])
+                && closed.status === 206 && closedBytes.length === bytes.length - 1 && closedBytes.every((b, i) => b === bytes[i + 1]) && firstChunk > 0 && firstChunk <= CAP && chunks.length >= 2;
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    }),
+    todo('linkedin.videos.captions', 'videos', 'Caption upload (uploadCaptions, the captionsUploadUrl multipart with SRT metadata) and the captions field', 'api', 'common'),
+    todo('linkedin.videos.batch_get', 'videos', 'Batch get videos (GET /rest/videos?ids=List(...)) with per-id statuses', 'api', 'common'),
+    todo('linkedin.videos.media_library', 'videos', 'The media library for videos: mediaLibraryMetadata, PARTIAL_UPDATE, the associatedAccount finder', 'api', 'niche'),
+    todo('linkedin.videos.attribution', 'videos', 'templateName / linkbackContext media attribution (202602+)', 'api', 'niche'),
+    todo('linkedin.videos.system_thumbnail', 'videos', "A real frame as the system thumbnail (the twin decodes nothing and serves a stand-in poster)", 'api', 'niche'),
+    // ── the rest of the posting surface this pack does not model ────────────────────────────────
+    todo('linkedin.documents.upload', 'documents', 'The Documents API (initializeUpload, PUT, document URNs on a post)', 'api', 'common'),
+    todo('linkedin.social.comments', 'social', 'Comments on a post (socialActions/{urn}/comments, the Comments API): create, list, delete', 'api', 'core'),
+    todo('linkedin.social.reactions', 'social', 'Reactions (the Reactions API): react, list, delete', 'api', 'common'),
+    todo('linkedin.social.metadata', 'social', 'Social metadata: comment and reaction counts, enabling or disabling comments on a post', 'api', 'common'),
+    todo('linkedin.social.org_notifications', 'social', 'Organizational entity notifications (mentions of the page, shares of its posts)', 'api', 'niche'),
+    todo('linkedin.statistics.share_statistics', 'statistics', 'organizationalEntityShareStatistics — impressions, clicks, engagement per post or page', 'api', 'common'),
+    todo('linkedin.statistics.follower_statistics', 'statistics', 'organizationalEntityFollowerStatistics — followers by facet and over time', 'api', 'common'),
+    todo('linkedin.statistics.page_statistics', 'statistics', 'organizationPageStatistics — page views by section and over time', 'api', 'niche'),
+    todo('linkedin.statistics.video_analytics', 'statistics', 'videoAnalytics — views and watch time of a video post', 'api', 'niche'),
+    // ── errors ──────────────────────────────────────────────────────────────────────────────────
+    done('linkedin.errors.unmodelled_route_404', 'errors', "A /rest resource or method the twin does not serve is the vendor's 404 NOT_FOUND, never a success", 'api', 'core', () => withWorld(async (h) => {
+        const a = await h({ m: 'GET', p: '/rest/adAccounts' });
+        const b = await h({ m: 'PATCH', p: '/rest/posts' });
+        const c = await h({ m: 'GET', p: '/v2/me' });
+        return [a, b, c].every((r) => r.status === 404 && r.body.code === 'NOT_FOUND');
+    })),
+    done('linkedin.errors.envelope_shape', 'errors', 'Every refusal is {status, code, message} with status equal to the HTTP status', 'api', 'common', () => withWorld(async (h) => {
+        const rs = [await h({ m: 'POST', p: '/rest/posts', b: {} }), await h({ m: 'GET', p: `/rest/posts/${enc('urn:li:share:9000000000000000555')}` }), await h({ m: 'POST', p: '/rest/posts', b: textPost('x'), headers: { ...API, authorization: 'Bearer nope-nope-nope' } })];
+        return rs.every((r) => { const b = r.body; return Object.keys(b).sort().join(',') === 'code,message,status' && b.status === r.status && typeof b.code === 'string'; });
+    })),
+    done('linkedin.errors.malformed_body', 'errors', 'A body that is not a JSON object is a 400, and nothing lands', 'api', 'common', () => withWorld(async (h, root) => {
+        const r = await handleLinkedinTwinRequest({ method: 'POST', path: '/rest/posts', body: '{not json', headers: API, root, occurredAt: AT });
+        return r.status === 400 && pendingActions('linkedin', root).every((a) => a.operation !== 'linkedin.post.create');
+    })),
+    done('linkedin.errors.read_only', 'errors', 'A read-only twin refuses every write (a post, an upload, a seed) with 405 and still serves reads', 'api', 'common', () => withWorld(async (h) => {
+        const post = await h({ m: 'POST', p: '/rest/posts', b: textPost('x'), readOnly: true });
+        const init = await h({ m: 'POST', p: '/rest/videos?action=initializeUpload', b: { initializeUploadRequest: { owner: ORG, fileSizeBytes: 1 } }, readOnly: true });
+        const seedR = await h({ m: 'POST', p: '/_twin/members', b: { id: 'x' }, headers: {}, readOnly: true });
+        const read = await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}`, readOnly: true });
+        return post.status === 405 && init.status === 405 && seedR.status === 405 && read.status === 200;
+    })),
+    todo('linkedin.errors.service_error_codes', 'errors', 'serviceErrorCode on each refusal (the docs this build read give no numbers for these)', 'api', 'common'),
+    todo('linkedin.errors.message_wording', 'errors', "LinkedIn's exact message wording beyond the two quoted version samples", 'api', 'niche'),
+    todo('linkedin.errors.rate_limited_429', 'errors', 'The daily application and member limits answered as 429 TOO_MANY_REQUESTS in the twin', 'api', 'common'),
+    // ── the twin control plane ──────────────────────────────────────────────────────────────────
+    done('linkedin.twin_control.seed_and_validate', 'twin_control', 'A world seeds a page, a member, a role and a token; malformed seeds (bad id, unknown member, undocumented scope or role) are refused', 'api', 'core', () => withWorld(async (h) => {
+        const badOrg = await h({ m: 'POST', p: '/_twin/organizations', b: { id: 'abc', localizedName: 'x' }, headers: {} });
+        const badAcl = await h({ m: 'POST', p: '/_twin/organizationAcls', b: { organization: ORG, roleAssignee: 'urn:li:person:ghost', role: 'ADMINISTRATOR' }, headers: {} });
+        const badRole = await h({ m: 'POST', p: '/_twin/organizationAcls', b: { organization: ORG, roleAssignee: 'urn:li:person:orgAdmin', role: 'OWNER' }, headers: {} });
+        const badScope = await h({ m: 'POST', p: '/_twin/tokens', b: { token: 'token-with-bad-scope', member: 'urn:li:person:orgAdmin', scopes: ['w_everything'] }, headers: {} });
+        const unknown = await h({ m: 'POST', p: '/_twin/nothing', b: {}, headers: {} });
+        return [badOrg, badAcl, badRole, badScope].every((r) => r.status === 400) && unknown.status === 404;
+    })),
+    done('linkedin.twin_control.logo_must_be_owned', 'twin_control', "A seeded logo must be an AVAILABLE image the page itself owns", 'api', 'common', () => withWorld(async (h) => {
+        const r = await h({ m: 'POST', p: '/_twin/organizations', b: { id: '5515715', localizedName: 'Other Co', logo: await uploadImage(h) }, headers: {} });
+        return r.status === 400;
+    })),
+    // ── connector (the real state system, over an in-process vendor) ─────────────────────────────
+    done('linkedin.connector.perform_video_post', 'connector', 'performLinkedinAction uploads a video post\'s bytes (initialize, presigned part PUTs with no credential, finalize, the bounded status wait) and creates the post with the vendor\'s video URN', 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const bytes = mp4(3000, 4_400_000);
+        const { urn: video } = await uploadVideo(local, bytes, { thumbnail: tinyPng() });
+        const post = await createPost(local, textPost('release #video', { content: { media: { title: 'tour', id: video } } }));
+        const entry = entryFor(localRoot, post, 'linkedin.post.create');
+        const calls = [];
+        const out = await performLinkedinAction(vendorExecutor(vendorRoot, calls), entry, ctxFor(localRoot));
+        // read the vendor after its clock (which moved 3 s per call from 13:00)
+        const vendor = handleFor(vendorRoot, '2026-09-26T14:00:00.000Z');
+        const vApi = { ...API, authorization: 'Bearer vendor-token-0002' };
+        const got = (await vendor({ m: 'GET', p: `/rest/posts/${enc(out.externalId)}`, headers: vApi })).body;
+        const vVideo = (await vendor({ m: 'GET', p: `/rest/videos/${enc(String(got.content?.media?.id))}`, headers: vApi })).body;
+        const parts = calls.filter((c) => c.presigned && /uploadedVideo/.test(c.path));
+        const { readLinkedinBlob } = await import("./linkedin-media.js");
+        const sha = /\/0\/([0-9a-f]{64})/.exec(String(vVideo.downloadUrl))?.[1] ?? '';
+        const vendorBytes = await readLinkedinBlob(sha, vendorRoot);
+        return /^urn:li:share:/.test(out.externalId) && out.url === `https://www.linkedin.com/feed/update/${out.externalId}/`
+            && got.commentary === 'release {hashtag|\\#|video}' && got.content.media.title === 'tour' && vVideo.status === 'AVAILABLE'
+            && parts.length === 2 && parts.every((c) => !c.auth) && calls.some((c) => c.presigned && /userUploadedThumbnail/.test(c.path))
+            && calls.filter((c) => !c.presigned).every((c) => c.auth)
+            && vendorBytes !== null && vendorBytes.length === bytes.length && vendorBytes.every((b, i) => b === bytes[i]);
+    })),
+    done('linkedin.connector.perform_retry_keeps_the_video', 'connector', "A perform that finalized the video and then failed to post keeps the vendor's video URN; its retry posts that video with no second upload", 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const { urn: video } = await uploadVideo(local);
+        const post = await createPost(local, textPost('retry me', { content: { media: { id: video } } }));
+        const entry = entryFor(localRoot, post, 'linkedin.post.create');
+        const calls = [];
+        const inner = vendorExecutor(vendorRoot, calls);
+        let failPost = true;
+        const flaky = async (request) => {
+            if (request.method === 'POST' && request.path === '/rest/posts' && failPost) {
+                failPost = false;
+                return { status: 500, headers: {}, body: '{"status":500,"code":"INTERNAL_SERVER_ERROR","message":"x"}' };
+            }
+            return inner(request);
+        };
+        let first = '';
+        try {
+            await performLinkedinAction(flaky, entry, ctxFor(localRoot));
+        }
+        catch (e) {
+            first = String(e.message);
+        }
+        const initsBefore = calls.filter((c) => c.path.includes('action=initializeUpload')).length;
+        // a kept video whose status read is not JSON fails the retry loudly — no parse crash, no second upload
+        const garbled = async (request) => (request.method === 'GET' && request.path.startsWith('/rest/videos/') ? { status: 200, headers: {}, body: '<html>' } : flaky(request));
+        let garbledMessage = '';
+        try {
+            await performLinkedinAction(garbled, entry, ctxFor(localRoot));
+        }
+        catch (e) {
+            garbledMessage = String(e.message);
+        }
+        const out = await performLinkedinAction(flaky, entry, ctxFor(localRoot));
+        const initsAfter = calls.filter((c) => c.path.includes('action=initializeUpload')).length;
+        const got = (await handleFor(vendorRoot, '2026-09-26T14:00:00.000Z')({ m: 'GET', p: `/rest/posts/${enc(out.externalId)}`, headers: { ...API, authorization: 'Bearer vendor-token-0002' } })).body;
+        return /HTTP 500/.test(first) && /not JSON/.test(garbledMessage) && initsBefore === 1 && initsAfter === 1 && got.content?.media?.id === out.data?.video && /^urn:li:video:/.test(String(got.content?.media?.id));
+    })),
+    done('linkedin.connector.budget_keyed_by_credential', 'connector', "The served perform charges one ledger per sealed credential: two World roots with one credential spend one allowance", 'connector', 'core', async () => {
+        const credential = `verify-${crypto.randomUUID()}`;
+        const roots = [mkdtempSync(join(tmpdir(), 'linkedin-cap-cred-a-')), mkdtempSync(join(tmpdir(), 'linkedin-cap-cred-b-'))];
+        try {
+            const answering = async () => ({ status: 201, headers: { 'x-restli-id': 'urn:li:share:7300000000000000001' }, body: '' });
+            for (const root of roots) {
+                const h = handleFor(root);
+                await seed(h);
+                const post = await createPost(h, textPost('one allowance'));
+                await performServed(answering, entryFor(root, post, 'linkedin.post.create'), { ...ctxFor(root), credential });
+            }
+            // both posts (5 units each) are on the credential's ledger, and on neither root's
+            return new LinkedinBudget({ token: credential }).spend() === 10 && new LinkedinBudget({ root: roots[0] }).spend() === 0;
+        }
+        finally {
+            for (const r of roots)
+                rmSync(r, { recursive: true, force: true });
+        }
+    }),
+    done('linkedin.connector.perform_text_and_article', 'connector', 'A text post and an article post cross as POST /rest/posts with the commentary untemplated back to #tags', 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const post = await createPost(local, textPost('shipping #today', { content: { article: { source: 'https://volter.ai/x', title: 'X' } } }));
+        const calls = [];
+        const out = await performLinkedinAction(vendorExecutor(vendorRoot, calls), entryFor(localRoot, post, 'linkedin.post.create'), ctxFor(localRoot));
+        const got = (await handleFor(vendorRoot)({ m: 'GET', p: `/rest/posts/${enc(out.externalId)}`, headers: { ...API, authorization: 'Bearer vendor-token-0002' } })).body;
+        return calls.length === 1 && calls[0].method === 'POST' && calls[0].path === '/rest/posts' && got.commentary === 'shipping {hashtag|\\#|today}'
+            && got.content?.article?.source === 'https://volter.ai/x' && untemplateHashtags('a {hashtag|\\#|b}') === 'a #b';
+    })),
+    done('linkedin.connector.perform_image_refused', 'connector', "A post with an image fails its perform loudly, naming why (the image PUT needs the token; a presigned upload carries none), and calls nothing", 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const image = await uploadImage(local);
+        const post = await createPost(local, textPost('image', { content: { media: { id: image } } }));
+        const calls = [];
+        let message = '';
+        try {
+            await performLinkedinAction(vendorExecutor(vendorRoot, calls), entryFor(localRoot, post, 'linkedin.post.create'), ctxFor(localRoot));
+        }
+        catch (e) {
+            message = String(e.message);
+        }
+        return calls.length === 0 && message.includes('presigned upload carries no credential') && message.includes('linkedin.connector.perform_image_upload');
+    })),
+    done('linkedin.connector.perform_delete', 'connector', 'A landed delete crosses as DELETE /rest/posts/{urn} against the resolved vendor URN', 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const post = await createPost(local, textPost('to retract'));
+        const calls = [];
+        const exec = vendorExecutor(vendorRoot, calls);
+        const created = await performLinkedinAction(exec, entryFor(localRoot, post, 'linkedin.post.create'), ctxFor(localRoot));
+        await local({ m: 'DELETE', p: `/rest/posts/${enc(post)}` });
+        const del = entryFor(localRoot, post, 'linkedin.post.delete');
+        const out = await performLinkedinAction(exec, del, { ...ctxFor(localRoot), resolve: (_t, id) => (id === post ? created.externalId : id) });
+        const gone = await handleFor(vendorRoot)({ m: 'GET', p: `/rest/posts/${enc(created.externalId)}`, headers: { ...API, authorization: 'Bearer vendor-token-0002' } });
+        return out.externalId === created.externalId && calls.at(-1)?.method === 'DELETE' && calls.at(-1)?.path === `/rest/posts/${enc(created.externalId)}` && gone.status === 404;
+    })),
+    done('linkedin.connector.perform_twin_records_cross_nothing', 'connector', "A seeded page, member, role or token is the twin's own record and performs as nothing", 'connector', 'common', () => withVendor(async (_local, localRoot, vendorRoot) => {
+        const calls = [];
+        const seeds = pendingActions('linkedin', localRoot).filter((a) => String(a.operation).startsWith('linkedin.twin.'));
+        for (const s of seeds) {
+            const out = await performLinkedinAction(vendorExecutor(vendorRoot, calls), s, ctxFor(localRoot));
+            if (out.data?.performed !== false)
+                return false;
+        }
+        return seeds.length >= 4 && calls.length === 0;
+    })),
+    done('linkedin.connector.refresh_observes_pages_and_posts', 'connector', "syncLinkedinFromRemote observes the pages the member administers (with their follower count) and each one's posts; a second refresh leaves one copy of each", 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const vendor = handleFor(vendorRoot);
+        const vApi = { ...API, authorization: 'Bearer vendor-token-0002' };
+        const made = String((await vendor({ m: 'POST', p: '/rest/posts', b: textPost('said on linkedin.com'), headers: vApi })).headers?.['x-restli-id']);
+        const exec = vendorExecutor(vendorRoot, []);
+        // a second page only the vendor holds: what the twin knows of it is what the refresh observed
+        await vendor({ m: 'POST', p: '/_twin/organizations', b: { id: '7777777', localizedName: 'Volter Labs', vanityName: 'volter-labs', followerCount: 99 }, headers: {} });
+        await vendor({ m: 'POST', p: '/_twin/organizationAcls', b: { organization: 'urn:li:organization:7777777', roleAssignee: 'urn:li:person:vendorAdmin', role: 'ADMINISTRATOR' }, headers: {} });
+        const r1 = await syncLinkedinFromRemote(exec, { root: localRoot, occurredAt: '2026-09-26T14:00:00.000Z', budget: scratchBudget() });
+        const r2 = await syncLinkedinFromRemote(exec, { root: localRoot, occurredAt: '2026-09-26T14:10:00.000Z', budget: scratchBudget() });
+        const got = (await local({ m: 'GET', p: `/rest/posts/${enc(made)}` })).body;
+        const org = (await local({ m: 'GET', p: '/rest/organizations?q=vanityName&vanityName=volter-labs' })).body.elements?.[0] ?? {};
+        const size = (await local({ m: 'GET', p: `/rest/networkSizes/${enc('urn:li:organization:7777777')}?edgeType=COMPANY_FOLLOWED_BY_MEMBER` })).body;
+        const listed = (await local({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` })).body.elements;
+        return r1.organizations === 2 && r1.posts === 1 && r2.posts === 1 && got.commentary === 'said on linkedin.com' && got.id === made
+            && org.localizedName === 'Volter Labs' && size.firstDegreeSize === 99 && listed.filter((p) => p.id === made).length === 1;
+    })),
+    done('linkedin.connector.refresh_refusal_throws', 'connector', 'A refused refresh read throws rather than folding an empty account', 'connector', 'core', async () => {
+        const refusing = async () => ({ status: 401, headers: {}, body: JSON.stringify({ status: 401, code: 'INVALID_ACCESS_TOKEN', message: 'Invalid access token' }) });
+        const emptyBody = async () => ({ status: 200, headers: {}, body: '{}' });
+        const root = mkdtempSync(join(tmpdir(), 'linkedin-cap-refuse-'));
+        try {
+            const messages = [];
+            for (const exec of [refusing, emptyBody]) {
+                try {
+                    await syncLinkedinFromRemote(exec, { root, budget: scratchBudget() });
+                    messages.push('no throw');
+                }
+                catch (e) {
+                    messages.push(String(e.message));
+                }
+            }
+            return /refused organizationAcls .*HTTP 401/.test(messages[0]) && /with no elements/.test(messages[1]);
+        }
+        finally {
+            rmSync(root, { recursive: true, force: true });
+        }
+    }),
+    done('linkedin.connector.perform_video_waits_on_the_schedule', 'connector', "A perform waiting on a video the vendor is still processing waits 2 s, 4 s, 8 s, 15 s … between status reads (the loop's own waits, recorded)", 'connector', 'core', () => withVendor(async (local, localRoot, vendorRoot) => {
+        const { urn: video } = await uploadVideo(local);
+        const post = await createPost(local, textPost('slow processing', { content: { media: { id: video } } }));
+        const inner = vendorExecutor(vendorRoot, []);
+        let statusReads = 0;
+        // the vendor reports PROCESSING for its first five status reads
+        const slow = async (request) => {
+            const res = await inner(request);
+            if (request.method === 'GET' && request.path.startsWith('/rest/videos/') && (statusReads += 1) <= 5)
+                return { ...res, body: JSON.stringify({ ...JSON.parse(res.body), status: 'PROCESSING' }) };
+            return res;
+        };
+        const waits = [];
+        const out = await performLinkedinActionWithin(scratchBudget(), slow, entryFor(localRoot, post, 'linkedin.post.create'), ctxFor(localRoot), async (ms) => { waits.push(ms); });
+        return /^urn:li:share:/.test(out.externalId) && statusReads === 6 && JSON.stringify(waits) === JSON.stringify([2000, 4000, 8000, 15000, 15000]);
+    })),
+    done('linkedin.connector.perform_video_wait_within_budget', 'connector', "The perform's wait for a processing video backs off (2 s doubling to 15 s), so its status reads never spend the 30-unit burst the post after it needs", 'connector', 'core', () => {
+        // every 60 s window of the schedule over the 10-minute bound holds at most 8 reads (plus initialize,
+        // finalize and the post: 2 + 2 + 5), well under the 30-unit burst
+        const reads = [];
+        for (let n = 0, t = 0; t < 600_000; n += 1) {
+            reads.push(t);
+            t += processingPollWait(n);
+        }
+        const worst = Math.max(...reads.map((t) => reads.filter((u) => u >= t && u < t + 60_000).length));
+        return processingPollWait(0) === 2_000 && processingPollWait(1) === 4_000 && processingPollWait(10) === 15_000 && worst + 2 + 2 + 5 <= 30 && worst <= 8;
+    }),
+    todo('linkedin.connector.refresh_deletions', 'connector', 'A refresh that tombstones posts deleted on linkedin.com (the author finder read in full as a complete scope)', 'connector', 'common'),
+    todo('linkedin.connector.perform_image_upload', 'connector', "Perform a post with an image: LinkedIn's image PUT to www.linkedin.com/dms-uploads needs the API token in Authorization, which a presigned upload does not carry and the executor sends only to the root's origin", 'connector', 'core'),
+    todo('linkedin.connector.refresh_assets', 'connector', "Refresh the images and videos a pulled post names (their status and downloadUrl), so a pulled media post previews locally", 'connector', 'common'),
+    todo('linkedin.connector.ingest_webhooks', 'connector', 'Ingest LinkedIn webhooks (organization social action notifications) through a signed ingest door', 'connector', 'niche'),
+    // ── the rate budget (the fail-closed backstop on the perform and refresh paths) ──────────────
+    done('linkedin.rate_limit.budget_fails_closed', 'rate_limit', 'The budgeted executor refuses BEFORE calling once the declared burst is spent, with the fake\'s call count unchanged', 'connector', 'core', async () => {
+        let calls = 0;
+        const fake = async () => { calls += 1; return { status: 201, headers: { 'x-restli-id': 'urn:li:share:1' }, body: '' }; };
+        const exec = budgetedLinkedinExecute(fake, new LinkedinBudget({ path: join(mkdtempSync(join(tmpdir(), 'linkedin-budget-')), 'ledger.json') }));
+        let refusedAt = -1;
+        for (let i = 0; i < 20; i += 1) {
+            try {
+                await exec({ method: 'POST', path: '/rest/posts', body: '{}' });
+            }
+            catch (error) {
+                if (error instanceof LinkedinBudgetError) {
+                    refusedAt = i;
+                    break;
+                }
+                throw error;
+            }
+        }
+        // a post costs 5 and the burst is 30 units a minute: the seventh is refused, the fake saw six
+        return refusedAt === 6 && calls === 6;
+    }),
+    done('linkedin.rate_limit.prices_writes_above_reads', 'rate_limit', 'A post or delete costs more than a read, an upload control call sits between, and a presigned upload is not charged', 'connector', 'core', async () => {
+        let calls = 0;
+        const fake = async () => { calls += 1; return { status: 200, headers: { etag: 'x' }, body: '' }; };
+        const exec = budgetedLinkedinExecute(fake, new LinkedinBudget({ path: join(mkdtempSync(join(tmpdir(), 'linkedin-budget-')), 'ledger.json') }));
+        // forty presigned PUTs would spend more than the 30-unit burst if they were charged
+        for (let i = 0; i < 40; i += 1)
+            await exec({ method: 'PUT', path: `https://www.linkedin.com/dms-uploads/A/uploadedVideo/${i}`, presigned: true, body: new Uint8Array(1) });
+        return calls === 40
+            && linkedinCallWeight('POST', '/rest/posts') === 5 && linkedinCallWeight('delete', `/rest/posts/${enc('urn:li:share:1')}`) === 5
+            && linkedinCallWeight('POST', '/rest/videos?action=finalizeUpload') === 2 && linkedinCallWeight('GET', '/rest/videos/urn%3Ali%3Avideo%3AX') === 1
+            && linkedinCallWeight('GET', '/rest/posts?q=author') === 1 && LINKEDIN_CALL_WEIGHTS.write > LINKEDIN_CALL_WEIGHTS.read;
+    }),
+    done('linkedin.rate_limit.declaration_is_the_descriptor', 'rate_limit', 'The pack descriptor arms the SAME declaration the adapters charge, at or under the kernel fallback', 'connector', 'common', async () => {
+        const { pack } = await import("./index.js");
+        return pack.rateBudget === LINKEDIN_RATE_BUDGET && LINKEDIN_RATE_BUDGET.burstCeiling === 30 && LINKEDIN_RATE_BUDGET.windowMs === 3_600_000;
+    }),
+    todo('linkedin.rate_limit.published_figures', 'rate_limit', "Pin the budget to an app's real daily figures (LinkedIn publishes none; each app reads its own in the Developer Portal)", 'connector', 'common'),
+    // ══ MIRROR (dimension 'ui' — each DATA-COUPLED: seed through the handler, read the SAME route
+    // the screen reads, render the mirror's OWN component over it) ═════════════════════════════════
+    done('linkedin.mirror.company_header', 'mirror', "The company header renders the page the lookup and networkSizes routes serve: name, description, website and follower line", 'ui', 'core', () => withWorld(async (h) => {
+        const pub = (await h({ m: 'GET', p: '/rest/organizations?q=vanityName&vanityName=volter' })).body.elements[0];
+        const admin = (await h({ m: 'GET', p: `/rest/organizations/${pub.id}` })).body;
+        const size = (await h({ m: 'GET', p: `/rest/networkSizes/${enc(ORG)}?edgeType=COMPANY_FOLLOWED_BY_MEMBER` })).body;
+        const org = orgFromReads(pub, admin, size, null);
+        const html = renderToStaticMarkup(createElement(CompanyHeader, { org }));
+        return html.includes('>Volter</h1>') && html.includes('Twins for every SaaS.') && html.includes('12,480 followers') && html.includes('volter.ai') && html.includes('company-tab active');
+    })),
+    done('linkedin.mirror.post_card_video', 'mirror', 'A post card renders the commentary (hashtags as links) and the video the post names as a player with its poster and downloadUrl', 'ui', 'core', () => withWorld(async (h) => {
+        const { urn: video } = await uploadVideo(h, mp4(), { thumbnail: tinyPng() });
+        const urn = await createPost(h, textPost('Out now #release', { content: { media: { title: 'tour', id: video } } }));
+        const post = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` })).body.elements[0];
+        const asset = (await h({ m: 'GET', p: `/rest/videos/${enc(video)}` })).body;
+        const pub = (await h({ m: 'GET', p: '/rest/organizations?q=vanityName&vanityName=volter' })).body.elements[0];
+        const size = (await h({ m: 'GET', p: `/rest/networkSizes/${enc(ORG)}?edgeType=COMPANY_FOLLOWED_BY_MEMBER` })).body;
+        const org = orgFromReads(pub, null, size, null);
+        const html = renderToStaticMarkup(createElement(PostCard, { post, org, nowMs: Date.parse(AT) + 3 * 3600_000, resolved: { kind: 'video', asset } }));
+        return post.id === urn && html.includes(`data-post-urn="${urn}"`) && html.includes('Out now') && html.includes('li-hashtag">#release<')
+            && html.includes(`src="${asset.downloadUrl.replace(/&/g, '&amp;')}"`) && html.includes(`poster="${asset.thumbnail.replace(/&/g, '&amp;')}"`) && html.includes('aria-label="Play video"')
+            && html.includes('>3h<') && html.includes('12,480 followers');
+    })),
+    done('linkedin.mirror.post_card_image_and_article', 'mirror', 'An image post renders its downloadUrl; an article post renders its title and source host', 'ui', 'common', () => withWorld(async (h) => {
+        const image = await uploadImage(h);
+        await createPost(h, textPost('pic', { content: { media: { altText: 'chart', id: image } } }));
+        await createPost(h, textPost('read', { content: { article: { source: 'https://www.volter.ai/blog/worlds', title: 'Worlds' } } }));
+        const [article, pic] = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}&sortBy=CREATED` })).body.elements;
+        const asset = (await h({ m: 'GET', p: `/rest/images/${enc(image)}` })).body;
+        const org = { id: 2414183, urn: ORG, name: 'Volter', vanity: 'volter' };
+        const a = renderToStaticMarkup(createElement(PostCard, { post: article, org, nowMs: Date.parse(AT), resolved: { kind: 'article' } }));
+        const p = renderToStaticMarkup(createElement(PostCard, { post: pic, org, nowMs: Date.parse(AT), resolved: { kind: 'image', asset } }));
+        return a.includes('class="article-title">Worlds<') && a.includes('>volter.ai<') && p.includes(`src="${asset.downloadUrl.replace(/&/g, '&amp;')}"`) && p.includes('alt="chart"');
+    })),
+    done('linkedin.mirror.no_follower_line_without_a_count', 'mirror', "A page whose networkSizes read failed shows no follower line — never \"0 followers\"", 'ui', 'common', () => withWorld(async (h) => {
+        await createPost(h, textPost('no count'));
+        const pub = (await h({ m: 'GET', p: '/rest/organizations?q=vanityName&vanityName=volter' })).body.elements[0];
+        const failed = await h({ m: 'GET', p: `/rest/networkSizes/${enc(ORG)}?edgeType=CompanyFollowedByMember` });
+        const org = orgFromReads(pub, null, failed.status === 200 ? failed.body : null, null);
+        const post = (await h({ m: 'GET', p: `/rest/posts?q=author&author=${enc(ORG)}` })).body.elements[0];
+        const header = renderToStaticMarkup(createElement(CompanyHeader, { org }));
+        const card = renderToStaticMarkup(createElement(PostCard, { post, org, nowMs: Date.parse(AT), resolved: null }));
+        return failed.status === 400 && org.followers === undefined && !/follower/.test(header) && !/follower/.test(card) && header.includes('>Volter</h1>');
+    })),
+    done('linkedin.mirror.format_helpers', 'mirror', "The mirror's own formatters: linkedin.com timestamps, the follower line, and little-format commentary segments", 'ui', 'common', () => withWorld(async (h) => {
+        const urn = await createPost(h, textPost('Hi @[Devtestco](urn:li:organization:2414183) see https://volter.ai. #ship'));
+        const c = (await h({ m: 'GET', p: `/rest/posts/${enc(urn)}` })).body.commentary;
+        const segs = commentarySegments(c);
+        const now = Date.parse(AT);
+        return segs.some((s) => s.kind === 'mention' && s.value === 'Devtestco' && s.urn === 'urn:li:organization:2414183') && segs.some((s) => s.kind === 'url' && s.value === 'https://volter.ai')
+            && segs.some((s) => s.kind === 'hashtag' && s.value === '#ship') && relativeTime(now - 90_000, now) === '1m' && relativeTime(now - 2 * 86_400_000, now) === '2d'
+            && relativeTime(now - 21 * 86_400_000, now) === '3w' && followerLine(1) === '1 follower' && followerLine(12480) === '12,480 followers';
+    })),
+    done('linkedin.mirror.serves_the_vendor_api_on_its_own_origin', 'mirror', 'The mirror origin serves the REAL LinkedIn handler — one serving code path — with its shell and the version-gated API', 'ui', 'core', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'linkedin-cap-mirror-'));
+        const server = await createLinkedinMirrorServer({ root, port: 0 });
+        try {
+            const json = { 'content-type': 'application/json' };
+            await fetch(`${server.url}/_twin/organizations`, { method: 'POST', headers: json, body: JSON.stringify({ id: '2414183', localizedName: 'Volter', vanityName: 'volter' }) });
+            await fetch(`${server.url}/_twin/members`, { method: 'POST', headers: json, body: JSON.stringify({ id: 'orgAdmin', localizedFirstName: 'A', localizedLastName: 'B', email: 'admin@volter.ai' }) });
+            await fetch(`${server.url}/_twin/organizationAcls`, { method: 'POST', headers: json, body: JSON.stringify({ organization: ORG, roleAssignee: 'urn:li:person:orgAdmin', role: 'ADMINISTRATOR' }) });
+            await fetch(`${server.url}/_twin/tokens`, { method: 'POST', headers: json, body: JSON.stringify({ token: TOKEN, member: 'urn:li:person:orgAdmin', scopes: SCOPES }) });
+            const posted = await fetch(`${server.url}/rest/posts`, { method: 'POST', headers: { ...json, ...API }, body: JSON.stringify(textPost('through the mirror origin')) });
+            const urn = posted.headers.get('x-restli-id') ?? '';
+            const direct = await handleLinkedinTwinRequest({ method: 'GET', path: `/rest/posts/${enc(urn)}`, headers: API, root });
+            const me = await (await fetch(`${server.url}/v2/userinfo`, { headers: { authorization: API.authorization } })).json();
+            const anon = await fetch(`${server.url}/rest/posts?q=author&author=${enc(ORG)}`, { headers: { 'linkedin-version': '202609' } });
+            const shell = await (await fetch(`${server.url}/`)).text();
+            return posted.status === 201 && direct.body.commentary === 'through the mirror origin' && me.email === 'admin@volter.ai' && anon.status === 401
+                && shell.includes('<div id="root">') && shell.includes('<base href="/">') && shell.includes('href="assets/styles.css"');
+        }
+        finally {
+            server.stop();
+            rmSync(root, { recursive: true, force: true });
+        }
+    }),
+    todo('linkedin.mirror.compose', 'mirror', "The page admin's 'Start a post' composer (commentary plus media) writing through POST /rest/posts", 'ui', 'common'),
+    todo('linkedin.mirror.social_counts', 'mirror', 'Reaction, comment and repost counts under a post card (needs the social surfaces)', 'ui', 'common'),
+    todo('linkedin.mirror.about_tab', 'mirror', "The About tab (overview, website, industry, company size, headquarters)", 'ui', 'niche'),
+];
+export async function linkedinCapabilities() {
+    return checkCapabilities('linkedin', LINKEDIN_CAPABILITIES);
+}