@bongos/core 1.19.1026 → 1.19.1027

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1026",
+  "version": "1.19.1027",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1026",
+      "version": "1.19.1027",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1026",
+  "version": "1.19.1027",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -152,6 +152,11 @@ const INTEGRATION = new Set([
   // the --integration lane never saw them either, because it runs only this set. A
   // test that cannot fail in either lane is a file that looks like a gate.
   'handle_machinery', 'hub_profile_leak', 'profile_fields',
+  // task 1002300 (R24): guilds against real SQL. The DB-free sibling
+  // (guilds_api) pins the route layer and statement shapes; only a real engine
+  // proves the one-owner partial index, the expiry CTE drained before its insert,
+  // the cascade on dissolve and the two-statement transfer.
+  'guilds_db',
   // task 1003935: 'linkify_refs' was swept in with the three above without the
   // no-DB check they were being fixed for. It touches no Postgres at all — pure
   // string work plus a filesystem walk — so the DB-free lane skipped it and the

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1026'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1027'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/guilds_api.mjs

@@ -0,0 +1,521 @@
+// tests/guilds_api.mjs — the guild API's route layer and statement shapes,
+// DB-free (task 1002300, R24; ADR 0336 D1–D4 + D6, ADR 0337 D4.4).
+//
+// WHAT THIS PINS, each a rule rather than a behaviour:
+//
+//   1. THE STORED SHAPE — no visibility default, no `role`, shown_publicly with
+//      no default, counted_in_totals DEFAULT true, one owner held by the database.
+//   2. OWN SCOPE — the acting github_id bound into every statement is the
+//      SESSION's; a body naming another account is refused by the strict schema.
+//   3. THE PUBLIC READ — 404 for an unlisted guild is byte-identical to an
+//      unknown slug, needs no session, is no-store, and its roster statement
+//      carries shown_publicly AND the shared existence predicate.
+//   4. SILENCE — a request written and one swallowed by a decline cooldown
+//      answer identically; a decline is an empty 204.
+//   5. THE CARD — an invite accept must echo the visibility its card showed,
+//      and a mismatch is a 409 naming the current one (D4 §3).
+//   6. TRANSFER — two statements, demote then promote, on one client inside
+//      BEGIN/COMMIT, and a failed promote rolls the demotion back (D2).
+//   7. NOTHING HERE IS AUTHORITY, and every count is the length of its array.
+//
+// Real-SQL semantics (the indexes, cascades, expiry CTE) are proved against
+// Postgres by tests/guilds_db.mjs in the integration lane.
+//
+// Run:  node tests/guilds_api.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const read = (p) => readFileSync(join(ROOT, p), 'utf8').replace(/\r\n/g, '\n');
+const MIGRATION = read('modules/platform-identity/migrations/platform_identity_025_guilds.sql');
+const DOMAIN_SRC = read('modules/platform-identity/guilds.js');
+const ROUTE_SRC = read('modules/platform-identity/routes/guilds.js');
+const PUBLIC_SRC = read('modules/platform-identity/routes/guilds-public.js');
+
+// ---- a fake pool that answers by statement ---------------------------------
+//
+// `answer(text, params)` is set per test and returns a { rows, rowCount } (or
+// throws). Every call is recorded, which is the evidence the bound-parameter
+// assertions read. Transactions go through connect(), same recording.
+let calls = [];
+let answer = () => result();
+const result = (rows = [], rowCount = null) => ({ rows, rowCount: rowCount ?? rows.length });
+async function run(text, params) {
+  calls.push({ text: String(text), params: params || [] });
+  return answer(String(text), params || []);
+}
+const pool = {
+  query: run,
+  connect: async () => ({ query: run, release() {} }),
+};
+function on(fn) { calls = []; answer = fn; }
+
+// ---- the routers over the real domain, with core pinned --------------------
+
+const ME = 4242;
+let session = { github_id: ME, github_login: 'octo' };
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    parsePagination: helpers.parsePagination,
+    logger: () => ({ error() {}, warn() {}, info() {} }),
+    requireBuilder: (req, _res, next) => { req.builder = { ...session }; next(); },
+    // The kernel withTx contract: BEGIN, fn(client), COMMIT — ROLLBACK + rethrow.
+    withTx: async (fn, { pool: p }) => {
+      const client = await p.connect();
+      try {
+        await client.query('BEGIN');
+        const out = await fn(client);
+        await client.query('COMMIT');
+        return out;
+      } catch (err) {
+        await client.query('ROLLBACK');
+        throw err;
+      } finally { client.release(); }
+    },
+  },
+};
+const guilds = require('../modules/platform-identity/guilds.js');
+const buildGuildRoutes = require('../modules/platform-identity/routes/guilds.js');
+const buildPublicRoutes = require('../modules/platform-identity/routes/guilds-public.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildGuildRoutes());
+app.use('/api/bongos', buildPublicRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const { port } = server.address();
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* empty or non-JSON */ }
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// Statement matchers, so each test answers exactly the statements it expects.
+const IS = {
+  myAccount: (t) => /FROM platform_identity_accounts WHERE github_id = \$1/.test(t),
+  membership: (t) => /JOIN platform_identity_guild_members m ON m\.guild_id = g\.id AND m\.github_id = \$2::bigint/.test(t),
+  publicGuild: (t) => /FROM platform_identity_guilds\s+WHERE lower\(slug\) = \$1 AND visibility = 'public'/.test(t) && /created_at/.test(t),
+  joinableGuild: (t) => /^SELECT id FROM platform_identity_guilds WHERE lower\(slug\) = \$1 AND visibility = 'public'$/.test(t.trim()),
+  isMember: (t) => /^SELECT 1 FROM platform_identity_guild_members WHERE guild_id = \$1/.test(t.trim()),
+  openRequest: (t) => /INSERT INTO platform_identity_guild_requests/.test(t),
+};
+const ACTIVE = { github_id: String(ME), profile_state: 'active', terms_accepted_at: '2026-08-29T00:00:00Z', account_visibility: 'public', handle: 'octo' };
+const MEMBERSHIP = (kind = 'owner', visibility = 'unlisted') => ({
+  id: '7', slug: 'guild-a', name: 'Guild A', description: null, visibility,
+  membership_kind: kind, shown_publicly: false, counted_in_totals: true,
+});
+// A base answerer: my own account is active; anything else is empty.
+const base = (extra = () => null) => (t, p) => {
+  if (IS.myAccount(t)) return result([ACTIVE]);
+  return extra(t, p) || result();
+};
+
+// ===========================================================================
+// 1. The stored shape
+// ===========================================================================
+
+test('migration 025: visibility has no default, and membership_kind is never role', () => {
+  const guildsTable = MIGRATION.match(/CREATE TABLE IF NOT EXISTS platform_identity_guilds \(([\s\S]*?)\n\);/)[1];
+  assert.match(guildsTable, /visibility\s+text NOT NULL CHECK \(visibility IN \('public', 'unlisted'\)\),/,
+    'the creator chooses — a silent default would decide a privacy question for them (ADR 0336 D1)');
+  assert.doesNotMatch(guildsTable, /created_by|creator/, 'no creator column: the owner row is the authority');
+  assert.doesNotMatch(MIGRATION.replace(/^--.*$/gm, ''), /\brole\b/, 'ADR 0174 reserves `role` for the crafts');
+  const inSql = guildsTable.match(/CHECK \(visibility IN \(([^)]*)\)\)/)[1].split(',').map((s) => s.trim().replace(/'/g, ''));
+  assert.deepEqual(inSql, guilds.GUILD_VISIBILITIES, 'the CHECK and the exported vocabulary cannot drift');
+});
+
+test('migration 025: shown_publicly has NO default, counted_in_totals DEFAULTS true (ADR 0337 D4.4)', () => {
+  assert.match(MIGRATION, /shown_publicly\s+boolean NOT NULL,/, 'every join must say what its card showed');
+  assert.match(MIGRATION, /counted_in_totals boolean NOT NULL DEFAULT true,\n\s+joined_at/,
+    'guild_members carries the per-guild switch, on by default');
+});
+
+test('migration 025: one owner per guild and one open row per pair are DATABASE rules', () => {
+  assert.match(MIGRATION, /CREATE UNIQUE INDEX IF NOT EXISTS uniq_platform_identity_guild_owner\s+ON platform_identity_guild_members \(guild_id\) WHERE membership_kind = 'owner';/);
+  assert.match(MIGRATION, /CREATE UNIQUE INDEX IF NOT EXISTS uniq_platform_identity_guild_requests_open\s+ON platform_identity_guild_requests \(guild_id, github_id\) WHERE status = 'pending';/);
+  assert.match(MIGRATION, /CREATE UNIQUE INDEX IF NOT EXISTS uniq_platform_identity_guilds_slug\s+ON platform_identity_guilds \(lower\(slug\)\);/);
+  assert.equal((MIGRATION.match(/ON DELETE CASCADE/g) || []).length, 2, 'dissolving cascades to members and requests');
+  assert.doesNotMatch(MIGRATION, /\bDROP\b|ALTER TABLE/i, 'additive only (ADR 0083 §5)');
+});
+
+test('the caps in the migration and the domain are one number', () => {
+  assert.match(MIGRATION, new RegExp(`length\\(name\\) BETWEEN 1 AND ${guilds.NAME_MAX_CHARS}\\)`));
+  assert.match(MIGRATION, new RegExp(`length\\(description\\) <= ${guilds.DESCRIPTION_MAX_CHARS}\\)`));
+  assert.equal(guilds.INVITE_BATCH_MAX, 25, 'ADR 0336 D3: a batch is at most 25');
+});
+
+// ===========================================================================
+// 2. Create — own scope and the slug rules (D6)
+// ===========================================================================
+
+test('create: the owner row is keyed on the SESSION, and a body naming an account is refused', async () => {
+  on(base((t) => (/INSERT INTO platform_identity_guilds/.test(t)
+    ? result([{ slug: 'guild-a', name: 'Guild A', description: null, visibility: 'public', created_at: 'x' }]) : null)));
+  const res = await call('POST', '/api/bongos/guilds', { slug: 'Guild-A', name: ' Guild A ', visibility: 'public' });
+  assert.equal(res.status, 201);
+  assert.equal(res.json.guild.slug, 'guild-a');
+  const write = calls.find((c) => /INSERT INTO platform_identity_guilds/.test(c.text));
+  assert.deepEqual(write.params, ['guild-a', 'Guild A', null, 'public', ME], 'slug canonical, name trimmed, owner = session');
+  assert.match(write.text, /'owner', g\.visibility = 'public'/, 'the owner is shown exactly when they chose public');
+
+  on(base());
+  const smuggled = await call('POST', '/api/bongos/guilds', { slug: 'guild-b', name: 'B', visibility: 'public', github_id: 9001 });
+  assert.equal(smuggled.status, 400, 'the strict schema refuses an undeclared field — there is no way to create for someone else');
+  assert.equal(calls.length, 0, 'and nothing reached the database');
+});
+
+test('create: visibility is required, the slug is canonical, reserved words and taken slugs are refused', async () => {
+  on(base());
+  assert.equal((await call('POST', '/api/bongos/guilds', { slug: 'guild-a', name: 'A' })).status, 400, 'no visibility, no guild');
+  assert.equal((await call('POST', '/api/bongos/guilds', { slug: 'guild-a', name: 'A', visibility: 'private' })).status, 400);
+  const short = await call('POST', '/api/bongos/guilds', { slug: 'a', name: 'A', visibility: 'public' });
+  assert.equal(short.json.error.code, 'guild_slug_invalid', 'the two-character floor');
+  const bad = await call('POST', '/api/bongos/guilds', { slug: '-bad-', name: 'A', visibility: 'public' });
+  assert.equal(bad.json.error.code, 'guild_slug_invalid', 'no leading or trailing hyphen');
+  for (const word of ['me', 'new', 'edit', 'settings', 'admin', 'api']) {
+    const r = await call('POST', '/api/bongos/guilds', { slug: word, name: 'A', visibility: 'public' });
+    assert.equal(r.json.error.code, 'guild_slug_reserved', `"${word}" is a /g namespace word`);
+  }
+  const blank = await call('POST', '/api/bongos/guilds', { slug: 'guild-a', name: '   ', visibility: 'public' });
+  assert.equal(blank.json.error.code, 'guild_name_required');
+
+  on(base((t) => { if (/INSERT INTO platform_identity_guilds/.test(t)) throw Object.assign(new Error('dup'), { code: '23505' }); }));
+  const taken = await call('POST', '/api/bongos/guilds', { slug: 'guild-a', name: 'A', visibility: 'public' });
+  assert.equal(taken.status, 409);
+  assert.equal(taken.json.error.code, 'guild_slug_taken');
+});
+
+test('a provisional account can take part in nothing, and a non-numeric principal is refused cleanly', async () => {
+  on((t) => (IS.myAccount(t) ? result([{ ...ACTIVE, profile_state: 'provisional', terms_accepted_at: null }]) : result()));
+  const prov = await call('POST', '/api/bongos/guilds', { slug: 'guild-a', name: 'A', visibility: 'public' });
+  assert.equal(prov.status, 403);
+  assert.ok(!calls.some((c) => /platform_identity_guild/.test(c.text)), 'no guild statement ran');
+
+  session = { github_id: 'system:bfg' };
+  try {
+    on(base());
+    assert.equal((await call('GET', '/api/bongos/me/guilds')).status, 400);
+  } finally { session = { github_id: ME, github_login: 'octo' }; }
+});
+
+// ===========================================================================
+// 3. The public read (D4)
+// ===========================================================================
+
+test('public read: an unlisted guild and an unknown slug are the SAME 404, with no session and no-store', async () => {
+  on(() => result()); // nothing public matches either slug
+  session = null; // the public read must not need one
+  try {
+    const unlisted = await call('GET', '/api/bongos/guilds/quiet-guild');
+    const unknown = await call('GET', '/api/bongos/guilds/no-such-guild');
+    assert.equal(unlisted.status, 404);
+    assert.equal(unlisted.text, unknown.text, 'byte-identical — an unlisted guild has no public existence');
+    assert.equal(unlisted.headers['cache-control'], 'no-store');
+    assert.ok(calls.every((c) => !IS.myAccount(c.text)), 'the public read never reads the viewer');
+    assert.match(calls[0].text, /visibility = 'public'/, 'the guild must be public to be read at all');
+  } finally { session = { github_id: ME, github_login: 'octo' }; }
+});
+
+test('public read: the roster is shown_publicly AND the shared existence predicate, ordered by what it publishes', async () => {
+  on((t) => {
+    if (IS.publicGuild(t)) return result([{ id: '7', slug: 'guild-a', name: 'Guild A', description: 'd', created_at: 'x' }]);
+    if (/FROM platform_identity_guild_members m\s+JOIN platform_identity_accounts pa/.test(t)) {
+      return result([
+        { handle: 'octo', display_name: 'Octo', avatar_url: null, membership_kind: 'owner' },
+        { handle: 'ada', display_name: 'Ada', avatar_url: null, membership_kind: 'member' },
+      ]);
+    }
+    return result();
+  });
+  const res = await call('GET', '/api/bongos/guilds/Guild-A');
+  assert.equal(res.status, 200);
+  assert.deepEqual(Object.keys(res.json).sort(), ['guild', 'members', 'size']);
+  assert.equal(res.json.size, 2);
+  assert.equal(res.json.members.length, 2);
+  assert.ok(!('id' in res.json.guild), 'the row id stays internal');
+  assert.ok(!/github_id|github_login/.test(res.text), 'no account id or login crosses');
+  const roster = calls.find((c) => /JOIN platform_identity_accounts pa/.test(c.text)).text;
+  assert.match(roster, /m\.shown_publicly AND \(\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\) AND pa\.account_visibility = 'public'\)/,
+    'shown_publicly AND accountVisibleSql(pa) — a private account is never on a public roster');
+  assert.match(roster, /ORDER BY \(m\.membership_kind = 'owner'\) DESC, lower\(pa\.handle\)/,
+    'ordered only by published fields (ADR 0255) — never joined_at, which the roster does not carry');
+  assert.equal(calls[0].params[0], 'guild-a', 'the slug is looked up in canonical form');
+});
+
+// ===========================================================================
+// 4. Join requests and silence (D3)
+// ===========================================================================
+
+test('join request: written and swallowed answer IDENTICALLY; unlisted is the unknown-slug 404', async () => {
+  const joinable = (insertRows) => base((t) => {
+    if (IS.joinableGuild(t)) return result([{ id: '7' }]);
+    if (IS.openRequest(t)) return result(insertRows);
+    return null;
+  });
+  on(joinable([{ id: '99' }]));
+  const created = await call('POST', '/api/bongos/guilds/guild-a/requests', {});
+  const write = calls.find((c) => IS.openRequest(c.text));
+  assert.deepEqual(write.params, ['7', ME, 'request', 30, 90, true],
+    'the requester is the SESSION; expiry and cooldown are the connections constants, bound');
+  on(joinable([]));
+  const swallowed = await call('POST', '/api/bongos/guilds/guild-a/requests', {});
+  assert.equal(created.status, 201);
+  assert.equal(created.text, swallowed.text, 'a swallowed re-ask is byte-identical to a real one');
+
+  on(base());
+  const unlisted = await call('POST', '/api/bongos/guilds/quiet-guild/requests', {});
+  const unknown = await call('POST', '/api/bongos/guilds/nope-guild/requests', {});
+  assert.equal(unlisted.status, 404);
+  assert.equal(unlisted.text, unknown.text);
+
+  on(base((t) => (IS.joinableGuild(t) ? result([{ id: '7' }]) : IS.isMember(t) ? result([{}]) : null)));
+  assert.equal((await call('POST', '/api/bongos/guilds/guild-a/requests', {})).json.error.code, 'guild_already_member');
+  assert.ok(!calls.some((c) => IS.openRequest(c.text)), 'a member never opens a request');
+});
+
+test('join request: the counted_in_totals choice rides the row; the request never inserts a membership', async () => {
+  on(base((t) => (IS.joinableGuild(t) ? result([{ id: '7' }]) : IS.openRequest(t) ? result([{ id: '1' }]) : null)));
+  await call('POST', '/api/bongos/guilds/guild-a/requests', { counted_in_totals: false });
+  const write = calls.find((c) => IS.openRequest(c.text));
+  assert.equal(write.params[5], false);
+  assert.ok(!calls.some((c) => /INSERT INTO platform_identity_guild_members/.test(c.text)), 'no self-join');
+  assert.match(write.text, /WITH expired AS \([\s\S]*?guard AS \(SELECT count\(\*\)::int AS expired_count FROM expired\)[\s\S]*?FROM guard/,
+    'the expiry CTE is referenced through guard, so it is drained BEFORE the insert');
+});
+
+// ===========================================================================
+// 5. Owner-only acts, invites and the card
+// ===========================================================================
+
+test('owner-only acts: a member is told plainly, a stranger gets the unlisted-safe 404', async () => {
+  on(base((t) => (IS.membership(t) ? result([MEMBERSHIP('member')]) : null)));
+  const member = await call('POST', '/api/bongos/guilds/guild-a/invites', { handles: ['ada'] });
+  assert.equal(member.status, 403);
+  assert.equal(member.json.error.code, 'guild_owner_only');
+
+  on(base());
+  const stranger = await call('POST', '/api/bongos/guilds/guild-a/invites', { handles: ['ada'] });
+  const unknown = await call('POST', '/api/bongos/guilds/nope-guild/invites', { handles: ['ada'] });
+  assert.equal(stranger.status, 404);
+  assert.equal(stranger.text, unknown.text, 'a non-member cannot learn an unlisted guild exists');
+  const membershipRead = calls.find((c) => IS.membership(c.text));
+  assert.deepEqual(membershipRead.params, ['guild-a', ME], 'membership is always the SESSION\'s');
+});
+
+test('invites: the batch is capped at 25, and each entry is an ordinary invite gated on ownership', async () => {
+  on(base());
+  const tooMany = Array.from({ length: 26 }, (_, i) => `b${i}`);
+  assert.equal((await call('POST', '/api/bongos/guilds/guild-a/invites', { handles: tooMany })).status, 400);
+  assert.equal((await call('POST', '/api/bongos/guilds/guild-a/invites', { handles: [] })).status, 400);
+
+  on(base((t) => {
+    if (IS.membership(t)) return result([MEMBERSHIP('owner')]);
+    if (/WHERE lower\(handle\) = \$1 OR lower\(previous_handle\) = \$1/.test(t)) {
+      return result([{ github_id: '9001', handle: 'ada', profile_state: 'active', terms_accepted_at: 'x', account_visibility: 'public' }]);
+    }
+    if (IS.openRequest(t)) return result([{ id: '5' }]);
+    return null;
+  }));
+  const res = await call('POST', '/api/bongos/guilds/guild-a/invites', { handles: ['Ada'] });
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json, { results: [{ handle: 'ada', outcome: 'invited' }], count: 1 }, 'count is the array\'s length');
+  const write = calls.find((c) => IS.openRequest(c.text));
+  assert.deepEqual(write.params, ['7', '9001', 'invite', 30, 90, true, ME]);
+  assert.match(write.text, /o\.guild_id = \$1 AND o\.github_id = \$7::bigint\s+AND o\.membership_kind = 'owner'/,
+    'the owner gate is re-asserted in the insert itself, keyed on the session');
+});
+
+test('accept: an invite accept must echo its card; a changed guild is a 409 naming the current visibility', async () => {
+  const pending = (kind, who) => base((t) => (/SELECT r\.kind, r\.github_id::text AS github_id/.test(t)
+    ? result([{ kind, github_id: String(who), visibility: 'public', actor_is_owner: false }]) : null));
+  on(pending('invite', ME));
+  const missing = await call('POST', '/api/bongos/guild-requests/12/accept', {});
+  assert.equal(missing.status, 400);
+  assert.equal(missing.json.error.code, 'guild_card_visibility_required');
+
+  on(pending('invite', ME));
+  const stale = await call('POST', '/api/bongos/guild-requests/12/accept', { visibility: 'unlisted' });
+  assert.equal(stale.status, 409);
+  assert.equal(stale.json.error.code, 'guild_visibility_changed');
+  assert.equal(stale.json.error.details.visibility, 'public', 'the card re-renders from this');
+  assert.ok(!calls.some((c) => /INSERT INTO platform_identity_guild_members/.test(c.text)), 'nothing joined');
+
+  on(pending('invite', 9001));
+  assert.equal((await call('POST', '/api/bongos/guild-requests/12/accept', { visibility: 'public' })).status, 404,
+    'someone else\'s invite is 404');
+});
+
+test('accept: resolving the row and inserting the membership is ONE statement; the owner cannot set a requester\'s switch', async () => {
+  on(base((t) => {
+    if (/SELECT r\.kind, r\.github_id::text AS github_id/.test(t)) return result([{ kind: 'request', github_id: '9001', visibility: 'public', actor_is_owner: true }]);
+    if (/WITH acc AS/.test(t)) return result([{ accepted: 1 }]);
+    return null;
+  }));
+  const res = await call('POST', '/api/bongos/guild-requests/12/accept', { counted_in_totals: false, visibility: 'public' });
+  assert.equal(res.status, 200);
+  const acc = calls.find((c) => /WITH acc AS/.test(c.text));
+  assert.match(acc.text, /UPDATE platform_identity_guild_requests r[\s\S]*?INSERT INTO platform_identity_guild_members/,
+    'accept resolves and joins in the same statement (ADR 0336 D3)');
+  assert.match(acc.text, /visibility = 'public',/, 'shown_publicly is the guild\'s visibility at the moment of joining');
+  assert.deepEqual(acc.params, ['12', ME, 30, null, null],
+    'on the owner path the card and the switch are NOT the owner\'s to send — the request row carries the requester\'s');
+});
+
+test('decline is an empty 204; an id that could not be a row is 404 before any query', async () => {
+  on(base((t) => (/SET status = 'rejected'/.test(t) ? result([{ id: '12' }]) : null)));
+  const res = await call('POST', '/api/bongos/guild-requests/12/decline');
+  assert.equal(res.status, 204);
+  assert.equal(res.text, '', 'silent — nothing the other side could ever observe');
+
+  on(base());
+  const probe = await call('POST', '/api/bongos/guild-requests/1234567890123456789012345/decline');
+  assert.equal(probe.status, 404);
+  assert.equal(calls.length, 0, 'a 25-digit id never reaches Postgres as a 22003');
+});
+
+// ===========================================================================
+// 6. Membership switches, leave, transfer (D2)
+// ===========================================================================
+
+test('membership switches: at least one field, keyed on the session', async () => {
+  on(base());
+  assert.equal((await call('PATCH', '/api/bongos/guilds/guild-a/membership', {})).json.error.code, 'nothing_to_update');
+  on(base((t) => (/UPDATE platform_identity_guild_members m\s+SET shown_publicly/.test(t)
+    ? result([{ shown_publicly: false, counted_in_totals: false }]) : null)));
+  const res = await call('PATCH', '/api/bongos/guilds/guild-a/membership', { counted_in_totals: false });
+  assert.deepEqual(res.json, { shown_publicly: false, counted_in_totals: false });
+  const write = calls.find((c) => /SET shown_publicly = COALESCE/.test(c.text));
+  assert.deepEqual(write.params, ['guild-a', ME, null, false], 'only my own row, only the field I sent');
+});
+
+test('leave: an owner with members must transfer first (409)', async () => {
+  on(base((t) => {
+    if (IS.membership(t)) return result([MEMBERSHIP('owner')]);
+    if (/WITH mine AS/.test(t)) return result([{ outcome: 'must_transfer' }]);
+    return null;
+  }));
+  const res = await call('DELETE', '/api/bongos/guilds/guild-a/membership');
+  assert.equal(res.status, 409);
+  assert.equal(res.json.error.code, 'guild_owner_must_transfer');
+});
+
+test('transfer: demote then promote, two statements on ONE client inside BEGIN/COMMIT', async () => {
+  on(base((t) => {
+    if (IS.membership(t)) return result([MEMBERSHIP('owner')]);
+    if (/FOR UPDATE OF m/.test(t)) return result([{ github_id: '9001' }]);
+    if (/SET membership_kind = 'member'/.test(t) || /SET membership_kind = 'owner'/.test(t)) return result([{ github_id: 'x' }]);
+    return null;
+  }));
+  const res = await call('POST', '/api/bongos/guilds/guild-a/transfer', { handle: 'Ada' });
+  assert.equal(res.status, 200);
+  const seq = calls.map((c) => c.text.trim()).filter((t) => /^(BEGIN|COMMIT|ROLLBACK)$|membership_kind = '(member|owner)'\s+WHERE/.test(t))
+    .map((t) => (/^[A-Z]+$/.test(t) ? t : /SET membership_kind = 'member'/.test(t) ? 'demote' : 'promote'));
+  assert.deepEqual(seq, ['BEGIN', 'demote', 'promote', 'COMMIT'],
+    'the one-owner index is checked row by row, so the order is load-bearing (ADR 0336 D2)');
+  const demote = calls.find((c) => /SET membership_kind = 'member'/.test(c.text));
+  assert.deepEqual(demote.params, ['7', ME], 'the demoted owner is the session');
+});
+
+test('transfer: a promote that fails rolls the demotion back — a guild is never left ownerless', async () => {
+  on(base((t) => {
+    if (IS.membership(t)) return result([MEMBERSHIP('owner')]);
+    if (/FOR UPDATE OF m/.test(t)) return result([{ github_id: '9001' }]);
+    if (/SET membership_kind = 'member'/.test(t)) return result([{ github_id: 'x' }]);
+    return null; // the promote matches nothing
+  }));
+  const res = await call('POST', '/api/bongos/guilds/guild-a/transfer', { handle: 'ada' });
+  assert.equal(res.status, 404);
+  assert.ok(calls.some((c) => c.text === 'ROLLBACK') && !calls.some((c) => c.text === 'COMMIT'));
+});
+
+test('edit: null never 500s — a name cannot be cleared, a description can, a null visibility is no change', async () => {
+  on(base());
+  const nullName = await call('PATCH', '/api/bongos/guilds/guild-a', { name: null });
+  assert.equal(nullName.status, 400);
+  assert.equal(nullName.json.error.code, 'guild_name_required');
+  assert.equal((await call('PATCH', '/api/bongos/guilds/guild-a', { visibility: null })).json.error.code, 'nothing_to_update');
+
+  on(base((t) => {
+    if (IS.membership(t)) return result([MEMBERSHIP('owner')]);
+    if (/WITH own AS/.test(t)) return result([{ slug: 'guild-a', name: 'Guild A', description: null, visibility: 'unlisted' }]);
+    return null;
+  }));
+  const cleared = await call('PATCH', '/api/bongos/guilds/guild-a', { description: null });
+  assert.equal(cleared.status, 200);
+  const upd = calls.find((c) => /WITH own AS/.test(c.text));
+  assert.deepEqual(upd.params, ['7', ME, null, true, null, null], 'description cleared; name and visibility untouched');
+  assert.match(upd.text, /WHERE m\.guild_id = upd\.id AND m\.github_id = \$2::bigint\s+AND upd\.visibility <> upd\.old_visibility/,
+    'a visibility CHANGE flips only the acting owner\'s shown_publicly (ADR 0336 D4 §3)');
+
+  on(base((t) => (IS.membership(t) ? result([MEMBERSHIP('member')]) : null)));
+  assert.equal((await call('PATCH', '/api/bongos/guilds/guild-a', { name: 'Hijack' })).status, 403);
+});
+
+test('a request id past the bigint range is 404 before any query, not a 22003 500', async () => {
+  on(base());
+  const res = await call('POST', '/api/bongos/guild-requests/9999999999999999999/accept', { visibility: 'public' });
+  assert.equal(res.status, 404);
+  assert.equal(calls.length, 0);
+});
+
+test('the owner\'s invite list names only invitees THIS owner could address (a transfer reveals no private invitee)', () => {
+  const src = guilds.listGuildRequests.toString();
+  assert.match(src, /one\('invite', addressable\)/, 'the addressability floor applies to the invite leg');
+  assert.match(src, /accountVisibleSql\('pa'\)\} OR pa\.github_id IN \(\$\{conn\.neighboursSql\('\$2'\)\}\)/,
+    'public, or connected to the viewing owner — the addressableAccount rule, reusing the one symmetric-edge fragment');
+});
+
+// ===========================================================================
+// 7. Nothing here is authority; counts are lengths
+// ===========================================================================
+
+test('no rank, permission or credit symbol appears anywhere in the feature (ADR 0016)', () => {
+  const code = (s) => s.replace(/\/\/.*$/gm, '');
+  for (const [name, src] of [['guilds.js', DOMAIN_SRC], ['routes/guilds.js', ROUTE_SRC], ['routes/guilds-public.js', PUBLIC_SRC]]) {
+    assert.doesNotMatch(code(src), /requireRank|requirePermission|total_credits|\bkarma\b|builders\.rank|access_requests/,
+      `${name} must stay identity-only`);
+  }
+});
+
+test('every list response reports a count equal to the length of its array', async () => {
+  on(base((t) => (/FROM platform_identity_guild_members m\s+JOIN platform_identity_guilds g/.test(t)
+    ? result([{ slug: 'a' }, { slug: 'b' }]) : null)));
+  const mine = await call('GET', '/api/bongos/me/guilds');
+  assert.equal(mine.json.count, mine.json.guilds.length);
+  assert.equal(mine.headers['cache-control'], 'no-store');
+  assert.equal(calls.find((c) => /JOIN platform_identity_guilds g/.test(c.text)).params[0], ME);
+});