Design: account tiers, contribution policy disclosure, Telegram open-room access

docs/design/2026-10-12-collectives-architecture.md

@@ -14,6 +14,47 @@ toggle) with three paths:
 3. **Solo user** — account + onboarding room (channels + guide bot explains how to
    plug in); can join or start a collective later.
 
+## Account tiers, signup, membership (amended 2026-10-12)
+
+**Self-serve accounts are now part of the product.** The site lets anyone create
+an account without belonging to any collective. Posture reconciliation: the
+homeserver keeps registration token-gated; the **Hub mediates account creation**
+(the Hub holds the registration capability and provisions the Matrix account
+server-side after its own signup checks). Direct registration on
+chat.occupymedia.cc stays closed — the Hub is the only door, and it can add
+rate-limiting / verification later without touching the homeserver.
+
+- **Solo account**: gets the platform's storage (R2-backed files space) and
+  PeerTube access — the full media-maker toolkit, no collective.
+- **Membership is many-to-many**: one media maker can belong to several
+  collectives at once (`group_members` already models this); solo users can be
+  invited into collectives later, or request to join.
+- **Account is the unit of identity**; collective membership is a set, not a
+  home.
+
+## Contribution policy (per collective, disclosed at join time)
+
+Every collective defines what happens to members' contributions:
+
+- Default and stated plainly at join: **deleting your account does NOT delete
+  your contributions.** Content already submitted to a collective stays in its
+  library/archive, attributed, under the collective's retention rules.
+- Collectives may override (e.g., "contributions are removed on request",
+  "contributions are anonymized after 90 days") — the policy is a field on the
+  collective, shown on the join screen and in the collective's settings.
+- Enforcement is schema-level: contributions must not `ON DELETE CASCADE` from
+  the user row. User deletion detaches attribution per policy; it never
+  silently rips content out of a collective archive.
+
+## Telegram access to open rooms
+
+Open rooms bridge to Telegram (mautrix-telegram, already scaffolded in the
+chat CT's compose): a collective's open room can attach a Telegram group so
+outsiders participate from Telegram with no Matrix account at all — same bridge
+pattern as Matrix federation for open rooms, different door. Bridged rooms are
+verified for encryption state (never treated as plaintext by assumption);
+archiving follows the same open-room rules.
+
 ## Collective model (maps to what exists)
 
 A **collective is a group** in the Hub's group tree — `groups.parent_id` becomes