Fix the cross-cutting clan defects the whole-branch review found

Render an explicit "no pending invites" embed when a clan is stored but has
none. An empty payload means "leave the previous message on screen" to both
the reconciler and ServerInfoRefresher, so the pinned invites embed listed
resolved invitations forever. The two paths that must stay empty — no server
id, and no clan stored — are unchanged, since a non-empty payload on a
clanless server would trigger a full reconcile on every refresh tick.

Isolate each clan state change in its own try/catch inside the consumer loop.
The broad catch sat outside the await foreach, so one transient store failure
or Discord 5xx ended the loop for the life of the process, after which the
clan channels were never created and, worse, never torn down again.

Harvest member names from the live team snapshot on the HasClan path, the
second of the two name sources the design calls for. Without it a fresh
install renders every roster entry, leader, creator and feed line as a bare
Steam profile link until that member happens to speak in clan chat. It is
best-effort: a disconnected socket or a failure never blocks persistence,
the reconcile or the feed.

Refuse to build a WorkspaceRegistry whose channel specs name a capability no
provider answers for. The reconciler reads "no provider" as "unavailable",
and unavailable deletes the channel and its history, so a host composing
AddWorkspace() without AddClans() would silently destroy every guild's
#clanchat and #claninfo on its first heal. It must fail to start instead.

Budget the roster embed's total text. Per-field 1024 truncation left the
6000-char whole-embed cap unguarded, and EmbedBuilder.Build() throws rather
than trimming; six role groups at their ceiling breach it. Groups are now
added while a running total fits, and a localized notice names how many were
omitted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: HandyS11

src/RustPlusBot.Features.Clans/Hosting/ClansHostedService.cs

@@ -58,7 +58,25 @@ private async Task ConsumeClanStateAsync(CancellationToken cancellationToken)
             await foreach (var evt in eventBus.SubscribeAsync<ClanStateChangedEvent>(cancellationToken)
                                .ConfigureAwait(false))
             {
-                await stateService.ApplyAsync(evt, cancellationToken).ConfigureAwait(false);
+                // Per-item isolation: a transient store failure, a Discord 5xx during the transition
+                // reconcile or an embed validation throw must cost one event, not the loop. Losing
+                // the loop would also strand the teardown path, leaving the clan channels behind
+                // for a player who has already left their clan.
+                try
+                {
+                    await stateService.ApplyAsync(evt, cancellationToken).ConfigureAwait(false);
+                }
+                catch (OperationCanceledException)
+                {
+                    // Shutting down: let the outer handler end the loop quietly.
+                    throw;
+                }
+#pragma warning disable CA1031 // Broad catch: one faulted clan state change must not end the loop.
+                catch (Exception ex)
+#pragma warning restore CA1031
+                {
+                    LogStateChangeFailed(logger, evt.GuildId, evt.ServerId, ex);
+                }
             }
         }
         catch (OperationCanceledException)
@@ -75,4 +93,11 @@ private async Task ConsumeClanStateAsync(CancellationToken cancellationToken)
 
     [LoggerMessage(Level = LogLevel.Error, Message = "Clan state loop faulted.")]
     private static partial void LogStateLoopFaulted(ILogger logger, Exception exception);
+
+    [LoggerMessage(Level = LogLevel.Error,
+        Message = "Applying a clan state change for guild {GuildId} server {ServerId} failed.")]
+    private static partial void LogStateChangeFailed(ILogger logger,
+        ulong guildId,
+        Guid serverId,
+        Exception exception);
 }

src/RustPlusBot.Features.Clans/Messages/ClanInvitesMessageRenderer.cs

@@ -10,8 +10,8 @@
 namespace RustPlusBot.Features.Clans.Messages;
 
 /// <summary>
-///     Renders the anchored #claninfo pending-invites embed. Renders empty when there are no pending
-///     invites so the reconciler never posts the message at all.
+///     Renders the anchored #claninfo pending-invites embed. Renders empty only where there is no
+///     clan to describe, so the reconciler never posts the message at all on a clanless server.
 /// </summary>
 /// <param name="store">Supplies the stored clan snapshot.</param>
 /// <param name="names">Resolves invitee and recruiter Steam ids to display names.</param>
@@ -38,14 +38,20 @@ public async ValueTask<MessagePayload> RenderAsync(MessageRenderContext context,
         }
 
         var clan = await store.GetAsync(context.GuildId, serverId, cancellationToken).ConfigureAwait(false);
-        if (clan is null || clan.Invites.Count == 0)
+        if (clan is null)
         {
-            // See ClanOverviewMessageRenderer: an empty payload keeps this key inert, both on clanless
-            // servers and when there is simply nothing pending.
+            // See ClanOverviewMessageRenderer: an empty payload keeps this key inert on clanless
+            // servers, where the channel this message would live in does not exist either.
             return new MessagePayload(null, null, null);
         }
 
         var culture = context.Culture;
+        if (clan.Invites.Count == 0)
+        {
+            // Honest over stale: an empty payload means "leave the previous message on screen", so
+            // returning one here would keep a since-resolved invite list pinned forever.
+            return new MessagePayload(null, EmptyState(culture), null);
+        }
 
         // One batched call covering both sides of every invite.
         var ids = new HashSet<ulong>();
@@ -78,6 +84,16 @@ public async ValueTask<MessagePayload> RenderAsync(MessageRenderContext context,
         return new MessagePayload(null, embed, null);
     }
 
+    /// <summary>Builds the "nothing pending" embed shown while a clan is stored but has no invites.</summary>
+    /// <param name="culture">The guild culture.</param>
+    /// <returns>The empty-state embed.</returns>
+    private Embed EmptyState(string culture) =>
+        new EmbedBuilder()
+            .WithTitle(localizer.Get("clan.invites.title", culture, "0"))
+            .WithColor(Color.Gold)
+            .WithDescription(localizer.Get("clan.invites.none", culture))
+            .Build();
+
     private static string Name(IReadOnlyDictionary<ulong, string> resolved, ulong steamId) =>
         resolved.TryGetValue(steamId, out var name)
             ? name

src/RustPlusBot.Features.Clans/Messages/ClanRosterMessageRenderer.cs

@@ -27,6 +27,13 @@ public sealed class ClanRosterMessageRenderer(
     /// <summary>Discord's hard cap on the length of an embed field value.</summary>
     private const int FieldValueLimit = 1024;
 
+    /// <summary>
+    ///     Budget for the whole embed's text. Discord's hard cap is 6000 and
+    ///     <see cref="EmbedBuilder.Build" /> throws above it; the margin leaves room for the title and
+    ///     the omission notice, both of which are added after the budget is spent.
+    /// </summary>
+    private const int EmbedTextBudget = 5200;
+
     /// <inheritdoc />
     public string MessageKey => Key;
 
@@ -66,6 +73,7 @@ public async ValueTask<MessagePayload> RenderAsync(MessageRenderContext context,
             .ConfigureAwait(false);
 
         var roles = clan.Roles.ToDictionary(r => r.RoleId);
+        var groups = new List<(string Name, string Value)>();
         foreach (var role in clan.Roles.OrderBy(r => r.Rank).ThenBy(r => r.RoleId))
         {
             var members = Ordered(clan.Members.Where(m => m.RoleId == role.RoleId)).ToList();
@@ -74,13 +82,36 @@ public async ValueTask<MessagePayload> RenderAsync(MessageRenderContext context,
                 continue;
             }
 
-            embed.AddField(Header(role, culture), Body(members, resolved, culture));
+            groups.Add((Header(role, culture), Body(members, resolved, culture)));
         }
 
         var orphans = Ordered(clan.Members.Where(m => !roles.ContainsKey(m.RoleId))).ToList();
         if (orphans.Count > 0)
         {
-            embed.AddField(localizer.Get("clan.roster.unknownrole", culture), Body(orphans, resolved, culture));
+            groups.Add((localizer.Get("clan.roster.unknownrole", culture),
+                Body(orphans, resolved, culture)));
+        }
+
+        // Per-field truncation alone is not enough: enough role groups at their 1024-char ceiling
+        // breach Discord's 6000-char whole-embed cap, and Build() throws rather than trimming.
+        var spent = 0;
+        var added = 0;
+        foreach (var (name, value) in groups)
+        {
+            if (spent + name.Length + value.Length > EmbedTextBudget)
+            {
+                break;
+            }
+
+            embed.AddField(name, value);
+            spent += name.Length + value.Length;
+            added++;
+        }
+
+        if (added < groups.Count)
+        {
+            embed.WithDescription(localizer.Get("clan.roster.omitted", culture,
+                (groups.Count - added).ToString(CultureInfo.InvariantCulture)));
         }
 
         return new MessagePayload(null, embed.Build(), null);

src/RustPlusBot.Features.Clans/State/ClanStateService.cs

@@ -119,6 +119,9 @@ private async Task ApplyHasClanAsync(
         var previous = await store.GetAsync(evt.GuildId, evt.ServerId, cancellationToken).ConfigureAwait(false);
         await store.SaveAsync(evt.GuildId, evt.ServerId, snapshot, cancellationToken).ConfigureAwait(false);
 
+        // Harvest before rendering so the feed lines below can already use the learned names.
+        await RecordTeamNamesAsync(services, store, evt, snapshot, cancellationToken).ConfigureAwait(false);
+
         var changes = ClanSnapshotDiffer.Diff(previous, snapshot);
         await PostChangesAsync(services, evt, changes, snapshot, cancellationToken).ConfigureAwait(false);
 
@@ -131,6 +134,67 @@ private async Task ApplyHasClanAsync(
         }
     }
 
+    /// <summary>
+    /// Populates the SteamId → Name cache from the live team snapshot, the second of the two name
+    /// sources (clan chat senders being the first). Without it a fresh install renders every roster
+    /// entry as a bare profile link until that member happens to speak in clan chat.
+    /// </summary>
+    /// <param name="services">The per-call scope's services.</param>
+    /// <param name="store">The scoped clan store.</param>
+    /// <param name="evt">The change being applied (identifies the server).</param>
+    /// <param name="snapshot">The clan snapshot whose roster bounds what is worth recording.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A task that completes once any learned names have been recorded.</returns>
+    private async Task RecordTeamNamesAsync(
+        IServiceProvider services,
+        IClanStore store,
+        ClanStateChangedEvent evt,
+        ClanSnapshot snapshot,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            var query = services.GetRequiredService<IRustServerQuery>();
+            var team = await query.GetTeamInfoAsync(evt.GuildId, evt.ServerId, cancellationToken)
+                .ConfigureAwait(false);
+            if (team is null)
+            {
+                // Disconnected: names stay as they are, which is exactly the pre-existing behaviour.
+                return;
+            }
+
+            var roster = snapshot.Members.Select(m => m.SteamId).ToHashSet();
+            var candidates = team.Members
+                .Where(m => roster.Contains(m.SteamId) && !string.IsNullOrWhiteSpace(m.Name))
+                .ToList();
+            if (candidates.Count == 0)
+            {
+                return;
+            }
+
+            var known = await store
+                .GetNamesAsync(evt.GuildId, evt.ServerId, candidates.ConvertAll(m => m.SteamId), cancellationToken)
+                .ConfigureAwait(false);
+
+            foreach (var member in candidates.Where(m => !known.ContainsKey(m.SteamId)))
+            {
+                await store.RecordNameAsync(evt.GuildId, evt.ServerId, member.SteamId, member.Name,
+                    cancellationToken).ConfigureAwait(false);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // Shutting down: the caller's own awaits will observe this too.
+            throw;
+        }
+#pragma warning disable CA1031 // Broad catch: name harvesting is cosmetic and must never block persistence.
+        catch (Exception ex)
+#pragma warning restore CA1031
+        {
+            LogNameHarvestFailed(logger, evt.GuildId, evt.ServerId, ex);
+        }
+    }
+
     private async Task ReconcileAsync(
         IServiceProvider services,
         ClanStateChangedEvent evt,
@@ -240,4 +304,11 @@ private List<ClanChange> ApplyScoreThrottle(ClanStateChangedEvent evt, IReadOnly
     [LoggerMessage(Level = LogLevel.Warning,
         Message = "A HasClan clan state change for guild {GuildId} server {ServerId} carried no snapshot.")]
     private static partial void LogMissingSnapshot(ILogger logger, ulong guildId, Guid serverId);
+
+    [LoggerMessage(Level = LogLevel.Debug,
+        Message = "Harvesting clan member names from the team snapshot for guild {GuildId} server {ServerId} failed.")]
+    private static partial void LogNameHarvestFailed(ILogger logger,
+        ulong guildId,
+        Guid serverId,
+        Exception exception);
 }

src/RustPlusBot.Features.Workspace/Registry/WorkspaceRegistry.cs

@@ -1,19 +1,50 @@
 namespace RustPlusBot.Features.Workspace.Registry;
 
 /// <summary>Aggregates contributed spec providers into ordered, scope-filtered views.</summary>
-/// <param name="channelProviders">All channel spec providers.</param>
-/// <param name="messageProviders">All message spec providers.</param>
-/// <param name="capabilityProviders">All capability providers, indexed by capability name.</param>
-internal sealed class WorkspaceRegistry(
-    IEnumerable<IChannelSpecProvider> channelProviders,
-    IEnumerable<IMessageSpecProvider> messageProviders,
-    IEnumerable<IWorkspaceCapabilityProvider> capabilityProviders) : IWorkspaceRegistry
+internal sealed class WorkspaceRegistry : IWorkspaceRegistry
 {
-    private readonly Dictionary<string, IWorkspaceCapabilityProvider> _capabilities =
-        capabilityProviders.ToDictionary(p => p.Capability, StringComparer.Ordinal);
+    private readonly Dictionary<string, IWorkspaceCapabilityProvider> _capabilities;
+    private readonly List<ChannelSpec> _channels;
+    private readonly List<MessageSpec> _messages;
 
-    private readonly List<ChannelSpec> _channels = [.. channelProviders.SelectMany(p => p.GetChannelSpecs())];
-    private readonly List<MessageSpec> _messages = [.. messageProviders.SelectMany(p => p.GetMessageSpecs())];
+    /// <summary>Initializes the registry and validates that every gated channel has a provider.</summary>
+    /// <param name="channelProviders">All channel spec providers.</param>
+    /// <param name="messageProviders">All message spec providers.</param>
+    /// <param name="capabilityProviders">All capability providers, indexed by capability name.</param>
+    /// <exception cref="InvalidOperationException">
+    ///     A channel spec names a capability that no registered provider answers for.
+    /// </exception>
+    public WorkspaceRegistry(
+        IEnumerable<IChannelSpecProvider> channelProviders,
+        IEnumerable<IMessageSpecProvider> messageProviders,
+        IEnumerable<IWorkspaceCapabilityProvider> capabilityProviders)
+    {
+        _capabilities = capabilityProviders.ToDictionary(p => p.Capability, StringComparer.Ordinal);
+        _channels = [.. channelProviders.SelectMany(p => p.GetChannelSpecs())];
+        _messages = [.. messageProviders.SelectMany(p => p.GetMessageSpecs())];
+
+        // Fail the host rather than the guild's data: the reconciler reads "no provider" as "capability
+        // unavailable", and unavailable means it DELETES the gated channel and everything in it. A host
+        // that composes AddWorkspace() without the module owning a capability would silently destroy
+        // those channels on its first heal, so refuse to start instead.
+        var missing = new SortedSet<string>(StringComparer.Ordinal);
+        foreach (var spec in _channels)
+        {
+            if (spec.Capability is { } capability && !_capabilities.ContainsKey(capability))
+            {
+                missing.Add(capability);
+            }
+        }
+
+        if (missing.Count > 0)
+        {
+            throw new InvalidOperationException(
+                "No IWorkspaceCapabilityProvider is registered for workspace channel capability(ies): " +
+                string.Join(", ", missing) +
+                ". The host must compose the feature module that provides them; without it the reconciler " +
+                "would treat the gated channels as unavailable and delete them along with their history.");
+        }
+    }
 
     /// <inheritdoc />
     public ValueTask<bool> IsCapabilityAvailableAsync(string capability,

src/RustPlusBot.Localization/Strings.fr.resx

@@ -162,6 +162,9 @@
   <data name="clan.invites.line" xml:space="preserve">
     <value>{0} — invité par {1} · {2}</value>
   </data>
+  <data name="clan.invites.none" xml:space="preserve">
+    <value>Aucune invitation en attente.</value>
+  </data>
   <data name="clan.invites.title" xml:space="preserve">
     <value>📨 Invitations en attente ({0})</value>
   </data>
@@ -219,6 +222,9 @@
   <data name="clan.roster.notes" xml:space="preserve">
     <value>· {0}</value>
   </data>
+  <data name="clan.roster.omitted" xml:space="preserve">
+    <value>…et {0} groupe(s) de rôles omis pour respecter la limite de taille des embeds Discord</value>
+  </data>
   <data name="clan.roster.perm.accesslogs" xml:space="preserve">
     <value>Voir les journaux</value>
   </data>

src/RustPlusBot.Localization/Strings.resx

@@ -162,6 +162,9 @@
   <data name="clan.invites.line" xml:space="preserve">
     <value>{0} — invited by {1} · {2}</value>
   </data>
+  <data name="clan.invites.none" xml:space="preserve">
+    <value>No pending invites.</value>
+  </data>
   <data name="clan.invites.title" xml:space="preserve">
     <value>📨 Pending invites ({0})</value>
   </data>
@@ -219,6 +222,9 @@
   <data name="clan.roster.notes" xml:space="preserve">
     <value>· {0}</value>
   </data>
+  <data name="clan.roster.omitted" xml:space="preserve">
+    <value>…and {0} more role group(s) omitted to fit Discord's embed size limit</value>
+  </data>
   <data name="clan.roster.perm.accesslogs" xml:space="preserve">
     <value>View logs</value>
   </data>

tests/RustPlusBot.Features.Clans.Tests/ClansRegistrationTests.cs

@@ -13,9 +13,11 @@
 using RustPlusBot.Features.Clans.Posting;
 using RustPlusBot.Features.Clans.State;
 using RustPlusBot.Features.Clans.Writing;
+using RustPlusBot.Features.Workspace;
 using RustPlusBot.Features.Workspace.Locating;
 using RustPlusBot.Features.Workspace.Reconciler;
 using RustPlusBot.Features.Workspace.Registry;
+using RustPlusBot.Persistence;
 using RustPlusBot.Persistence.Clans;
 using RustPlusBot.Persistence.Connections;
 using RustPlusBot.Persistence.Workspace;
@@ -81,6 +83,31 @@ public async Task Registers_the_assembly_that_carries_the_clan_interaction_modul
             a => a.Assembly == typeof(ClanMotdModule).Assembly);
     }
 
+    [Fact]
+    public void The_composed_host_registry_covers_every_gated_channel_capability()
+    {
+        // WorkspaceRegistry refuses to build when a ChannelSpec names a capability no provider
+        // answers for, because the reconciler would otherwise delete the gated channels. The clan
+        // specs live in Features.Workspace and the provider in Features.Clans, so this pins that the
+        // real composition of the two satisfies the guard.
+        var services = new ServiceCollection();
+        services.AddSingleton(new DiscordSocketClient());
+        services.AddSingleton<IClock, SystemClock>();
+        services.AddSingleton<IEventBus, InMemoryEventBus>();
+        services.AddSingleton(Substitute.For<IRustServerQuery>());
+        services.AddLogging();
+        services.AddBotPersistence("DataSource=:memory:");
+        services.AddWorkspace();
+        services.AddClans();
+
+        using var provider = services.BuildServiceProvider(new ServiceProviderOptions
+        {
+            ValidateScopes = true
+        });
+
+        Assert.NotNull(provider.GetRequiredService<IWorkspaceRegistry>());
+    }
+
     [Fact]
     public void Does_not_register_a_second_chat_bridge()
     {