@bongos/core 1.19.1026 → 1.19.1027

package/tests/guilds_db.mjs

@@ -0,0 +1,343 @@
+// tests/guilds_db.mjs — guild CRUD, membership and visibility against REAL SQL
+// (task 1002300, R24; ADR 0336 D1–D4 + D6, ADR 0337 D4.4).
+//
+// Why a real database: the rules that matter here live in the schema and in
+// single statements a fake pool cannot execute — the one-owner PARTIAL unique
+// index, the open-request partial index, the expiry CTE that must be drained
+// before its INSERT, the FK cascade on dissolve, the two-statement transfer, and
+// an accept that resolves a row and inserts a membership in one statement. The
+// DB-free sibling, tests/guilds_api.mjs, covers the route layer.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it. Fixture ids are
+// high-numbered and every guild slug starts r24-, so a shared DB is safe; all
+// fixtures are deleted before and after.
+//
+// Run:  DATABASE_URL=... node tests/guilds_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`guilds_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const guilds = require('../modules/platform-identity/guilds.js');
+
+const OWNER = 9002300001;   // public, active — creates the guilds
+const ALICE = 9002300002;   // public, active
+const PRIV = 9002300003;    // private, active, NOT connected to OWNER
+const PRIVC = 9002300004;   // private, active, connected to OWNER
+const PROV = 9002300005;    // provisional — can take part in nothing
+const BOB = 9002300006;     // public, active
+const CARL = 9002300007;    // public, active
+const PRIV2 = 9002300008;   // private, active, connected to OWNER only
+const ALL_IDS = [OWNER, ALICE, PRIV, PRIVC, PROV, BOB, CARL, PRIV2];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_guilds WHERE slug LIKE 'r24-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_connections
+            WHERE requester_github_id = ANY($1::bigint[]) OR addressee_github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+async function rejects(promise, code, msg) {
+  let caught = null;
+  try { await promise; } catch (e) { caught = e; }
+  ok(caught && caught.code === code, `${msg} (expected ${code}, got ${caught ? caught.code : 'no error'})`);
+}
+const memberRow = async (slug, gid) => (await q(
+  `SELECT m.* FROM platform_identity_guild_members m JOIN platform_identity_guilds g ON g.id = m.guild_id
+    WHERE g.slug = $1 AND m.github_id = $2`, [slug, gid])).rows[0] || null;
+const guildId = async (slug) => (await q(`SELECT id FROM platform_identity_guilds WHERE slug = $1`, [slug])).rows[0]?.id;
+const openRows = async (slug, gid) => (await q(
+  `SELECT r.* FROM platform_identity_guild_requests r JOIN platform_identity_guilds g ON g.id = r.guild_id
+    WHERE g.slug = $1 AND r.github_id = $2 ORDER BY r.id`, [slug, gid])).rows;
+const pendingId = async (slug, gid) => (await openRows(slug, gid)).find((r) => r.status === 'pending')?.id;
+
+try {
+  // The migrations this domain reads, all idempotent: accounts + consent,
+  // handles, privacy, terms, connections (addressing), and guilds.
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_015_connections.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_025_guilds.sql',
+  ]) await q(migrationSql(f));
+  await q(migrationSql('platform_identity_025_guilds.sql')); // re-runnable
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, handle, display_name, profile_state, terms_accepted_at, account_visibility)
+     VALUES ($1, 'r24own', 'r24own', 'Owner', 'active', now(), 'public'),
+            ($2, 'r24alice', 'r24alice', 'Alice', 'active', now(), 'public'),
+            ($3, 'r24priv', 'r24priv', 'Priv', 'active', now(), 'private'),
+            ($4, 'r24privc', 'r24privc', 'PrivC', 'active', now(), 'private'),
+            ($5, 'r24prov', 'r24prov', 'Prov', 'provisional', NULL, 'public'),
+            ($6, 'r24bob', 'r24bob', 'Bob', 'active', now(), 'public'),
+            ($7, 'r24carl', 'r24carl', 'Carl', 'active', now(), 'public'),
+            ($8, 'r24priv2', 'r24priv2', 'Priv2', 'active', now(), 'private')`,
+    ALL_IDS,
+  );
+  await q(`INSERT INTO platform_identity_connections (requester_github_id, addressee_github_id, status, resolved_at)
+           VALUES ($1, $2, 'accepted', now()), ($1, $3, 'accepted', now())`, [OWNER, PRIVC, PRIV2]);
+
+  // --- 1. the schema holds its own rules (ADR 0336 D1) ---------------------
+  await rejects(q(`INSERT INTO platform_identity_guilds (slug, name) VALUES ('r24-nodefault', 'x')`),
+    '23502', 'visibility has NO default — the creator must choose');
+  await rejects(q(`INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ('r24-bad', 'x', 'private')`),
+    '23514', 'visibility is public or unlisted, nothing else');
+  await rejects(q(`INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ('R24-Upper', 'x', 'public')`),
+    '23514', 'the slug is stored in canonical lowercase form only');
+  const cols = (await q(
+    `SELECT column_name, column_default, is_nullable FROM information_schema.columns
+      WHERE table_name = 'platform_identity_guild_members'`)).rows;
+  const col = (n) => cols.find((c) => c.column_name === n);
+  ok(col('shown_publicly').is_nullable === 'NO' && col('shown_publicly').column_default === null,
+    'shown_publicly is NOT NULL with no default — every join must say what its card showed');
+  ok(col('counted_in_totals').is_nullable === 'NO' && col('counted_in_totals').column_default === 'true',
+    'counted_in_totals is NOT NULL DEFAULT true (ADR 0337 D4.4)');
+  ok(!col('role') && !!col('membership_kind'), 'membership_kind, never role (ADR 0174)');
+
+  // --- 2. create ------------------------------------------------------------
+  const pub = await guilds.createGuild({ githubId: OWNER, slug: 'r24-pub', name: 'Public Guild', visibility: 'public' }, { pool });
+  ok(pub.guild && pub.guild.slug === 'r24-pub' && pub.guild.id === undefined, 'createGuild returns the guild without its row id');
+  const ownerPub = await memberRow('r24-pub', OWNER);
+  ok(ownerPub.membership_kind === 'owner' && ownerPub.shown_publicly === true && ownerPub.counted_in_totals === true,
+    'the creator is the one owner, shown on a public guild, counted by default');
+  const unl = await guilds.createGuild({ githubId: OWNER, slug: 'r24-unl', name: 'Quiet Guild', visibility: 'unlisted' }, { pool });
+  ok(unl.guild.visibility === 'unlisted' && (await memberRow('r24-unl', OWNER)).shown_publicly === false,
+    'creating an unlisted guild leaves its owner unshown');
+  ok((await guilds.createGuild({ githubId: ALICE, slug: 'r24-pub', name: 'Dup', visibility: 'public' }, { pool })).taken === true,
+    'a taken slug is refused');
+  await rejects(q(`INSERT INTO platform_identity_guild_members (guild_id, github_id, membership_kind, shown_publicly)
+                   VALUES ($1, $2, 'owner', true)`, [await guildId('r24-pub'), ALICE]),
+    '23505', 'the database refuses a second owner');
+
+  // --- 3. the public read (D4) ------------------------------------------------
+  ok((await guilds.getPublicGuild('r24-unl', { pool })) === null, 'an unlisted guild has no public existence');
+  ok((await guilds.getPublicGuild('r24-nope', { pool })) === null, '…the same null as a guild that does not exist');
+
+  // --- 4. join requests: public only, two consents, silent decline -----------
+  ok((await guilds.requestToJoin({ slug: 'r24-unl', githubId: ALICE }, { pool })).outcome === 'not_found',
+    'an unlisted guild takes no requests, and says so as not_found');
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: ALICE, countedInTotals: false }, { pool })).outcome === 'created',
+    'a builder may ask a public guild');
+  ok(!(await memberRow('r24-pub', ALICE)), 'asking is not joining — no self-join');
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: ALICE }, { pool })).outcome === 'already_open',
+    'a second open request for the pair is refused by the open-row index');
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: OWNER }, { pool })).outcome === 'already_member',
+    'a member cannot ask to join');
+
+  const aliceReq = await pendingId('r24-pub', ALICE);
+  ok((await guilds.acceptRequest({ id: aliceReq, githubId: BOB }, { pool })).outcome === 'not_found',
+    'only the owner may accept a request — anyone else is not_found');
+  ok((await guilds.acceptRequest({ id: aliceReq, githubId: OWNER, countedInTotals: true }, { pool })).outcome === 'accepted',
+    'the owner accepts the request');
+  const alicePub = await memberRow('r24-pub', ALICE);
+  ok(alicePub && alicePub.membership_kind === 'member' && alicePub.shown_publicly === true,
+    'a request to a public guild joins shown');
+  ok(alicePub.counted_in_totals === false,
+    'the requester\'s own counted_in_totals choice rides the request — the owner cannot override it');
+
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'created', 'Bob asks');
+  ok(await guilds.declineRequest({ id: await pendingId('r24-pub', BOB), githubId: OWNER }, { pool }), 'the owner declines');
+  const before = (await openRows('r24-pub', BOB)).length;
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'swallowed',
+    'a re-ask inside the cooldown is swallowed…');
+  ok((await openRows('r24-pub', BOB)).length === before, '…and writes nothing');
+
+  // --- 5. invites: addressing, batch, the card (D3/D4) ------------------------
+  const unlId = await guildId('r24-unl');
+  const res = await guilds.inviteHandles({
+    guildId: unlId, ownerGithubId: OWNER,
+    handles: ['r24alice', 'R24PRIV', 'r24privc', 'r24prov', 'r24own', 'r24-ghost', 'r24alice'],
+  }, { pool });
+  const outcome = (h) => res.find((r) => r.handle === h)?.outcome;
+  ok(outcome('r24alice') === 'invited', 'a public account is invitable into an unlisted guild');
+  ok(outcome('r24priv') === 'not_found', 'a private stranger is not_found');
+  ok(outcome('r24privc') === 'invited', 'a private account the owner is connected to is invitable (ADR 0202 D4 §2)');
+  ok(outcome('r24prov') === 'not_found', 'a provisional account cannot be invited');
+  ok(outcome('r24own') === 'already_member', 'the owner is already a member');
+  ok(outcome('r24-ghost') === 'not_found', 'an unknown handle is not_found — one answer with private and provisional');
+  ok(res.filter((r) => r.handle === 'r24alice').length === 1, 'a repeated handle in one batch is invited once');
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: ALICE, handles: ['r24bob'] }, { pool });
+  ok((await openRows('r24-unl', BOB)).length === 0,
+    'a non-owner invite writes nothing (the owner gate is in the statement, not only the route)');
+  ok((await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24priv2'] }, { pool }))[0].outcome === 'invited',
+    'the owner invites a second private account they are connected to');
+
+  const aliceInv = await pendingId('r24-unl', ALICE);
+  ok((await guilds.acceptRequest({ id: aliceInv, githubId: ALICE }, { pool })).outcome === 'card_required',
+    'an invite accept must carry the visibility its card showed');
+  const changed = await guilds.acceptRequest({ id: aliceInv, githubId: ALICE, cardVisibility: 'public' }, { pool });
+  ok(changed.outcome === 'visibility_changed' && changed.visibility === 'unlisted',
+    'a card that does not match the guild is refused, naming the current visibility');
+  ok((await guilds.acceptRequest({ id: aliceInv, githubId: OWNER, cardVisibility: 'unlisted' }, { pool })).outcome === 'not_found',
+    'only the invitee may accept an invite');
+  ok((await guilds.acceptRequest({ id: aliceInv, githubId: ALICE, cardVisibility: 'unlisted', countedInTotals: false }, { pool })).outcome === 'accepted',
+    'the invitee accepts with the card they saw');
+  const aliceUnl = await memberRow('r24-unl', ALICE);
+  ok(aliceUnl.shown_publicly === false && aliceUnl.counted_in_totals === false,
+    'joining an unlisted guild leaves the member unshown; the card switch is honoured');
+
+  const privcInv = await pendingId('r24-unl', PRIVC);
+  ok((await guilds.acceptRequest({ id: privcInv, githubId: PRIVC, cardVisibility: 'unlisted' }, { pool })).outcome === 'accepted',
+    'a private account can join');
+  ok((await guilds.acceptRequest({ id: privcInv, githubId: PRIVC, cardVisibility: 'unlisted' }, { pool })).outcome === 'not_found',
+    'an accepted row cannot be accepted twice');
+
+  // Decline cooldown on invites, and the owner's queue.
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24bob', 'r24carl'] }, { pool });
+  const q1 = await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: OWNER }, { pool });
+  ok(q1.outgoing.length === 3 && q1.outgoing.some((r) => r.handle === 'r24priv2') && q1.outgoing.every((r) => !('seen_at' in r) && r.handle && !('github_id' in r)),
+    'the owner sees invites still out — named by handle, never github_id, never the invitee\'s seen_at');
+  ok((await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: ALICE }, { pool })).outgoing.length === 0,
+    'a non-owner reads an empty queue (the owner gate is in the statement)');
+  const bobQ = await guilds.listMyRequests({ githubId: BOB }, { pool });
+  ok(bobQ.incoming.length === 1 && bobQ.incoming[0].visibility === 'unlisted' && bobQ.incoming[0].slug === 'r24-unl',
+    'the invitee\'s queue carries the card: slug and current visibility');
+  ok((await openRows('r24-unl', BOB))[0].seen_at !== null, 'reading the queue stamps seen_at on the invite');
+  ok(await guilds.declineRequest({ id: await pendingId('r24-unl', BOB), githubId: BOB }, { pool }), 'Bob declines — silently');
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24bob'] }, { pool });
+  ok((await openRows('r24-unl', BOB)).length === 1, 'a re-invite inside the cooldown is swallowed: no new row');
+
+  // Cancel: the opener only.
+  const carlInv = await pendingId('r24-unl', CARL);
+  ok(!(await guilds.cancelRequest({ id: carlInv, githubId: CARL }, { pool })), 'an invitee cannot cancel an invite (that is a decline)');
+  ok(await guilds.cancelRequest({ id: carlInv, githubId: OWNER }, { pool }), 'the owner cancels an invite');
+
+  // Expiry is read-time, and the next write resolves the stale row in the same statement.
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24carl'] }, { pool });
+  await q(`UPDATE platform_identity_guild_requests SET created_at = now() - interval '31 days'
+            WHERE github_id = $1 AND status = 'pending'`, [CARL]);
+  const stale = await pendingId('r24-unl', CARL);
+  ok((await guilds.acceptRequest({ id: stale, githubId: CARL, cardVisibility: 'unlisted' }, { pool })).outcome === 'not_found',
+    'an invite older than the expiry cannot be accepted');
+  const again = await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24carl'] }, { pool });
+  ok(again[0].outcome === 'invited' && (await openRows('r24-unl', CARL)).some((r) => r.status === 'expired'),
+    'a fresh invite resolves the stale row as expired in the same statement, instead of hitting the open-row index');
+
+  // --- 6. visibility changes flip only the owner (D4 §3) ---------------------
+  const flipped = await guilds.updateGuild({ guildId: unlId, githubId: OWNER, visibility: 'public' }, { pool });
+  ok(flipped && flipped.visibility === 'public', 'the owner makes the guild public');
+  ok((await memberRow('r24-unl', OWNER)).shown_publicly === true, 'the owner who flipped it is now shown');
+  ok((await memberRow('r24-unl', ALICE)).shown_publicly === false, 'a member who joined it unlisted is NOT shown until they agree');
+  ok(!(await guilds.updateGuild({ guildId: unlId, githubId: ALICE, name: 'Hijack' }, { pool })), 'a non-owner cannot edit the guild');
+  const carlCard = await guilds.acceptRequest({ id: await pendingId('r24-unl', CARL), githubId: CARL, cardVisibility: 'unlisted' }, { pool });
+  ok(carlCard.outcome === 'visibility_changed', 'an invite accepted from a card that predates the flip is refused');
+
+  let page = await guilds.getPublicGuild('r24-unl', { pool });
+  ok(page && page.members.map((m) => m.handle).join(',') === 'r24own' && page.size === 1,
+    'the public roster shows only members who agreed to be shown; size is its length');
+  ok(page.members.every((m) => !('github_id' in m)), 'the public roster never carries github_id');
+
+  ok((await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: ALICE, shownPublicly: true }, { pool })).shown_publicly === true,
+    'a member agrees to be shown');
+  await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: PRIVC, shownPublicly: true }, { pool });
+  page = await guilds.getPublicGuild('r24-unl', { pool });
+  ok(page.members.map((m) => m.handle).sort().join(',') === 'r24alice,r24own' && page.size === 2,
+    'a private account is never on a public roster, whatever its flag');
+  ok(page.members[0].handle === 'r24own', 'the owner leads; the rest are ordered by handle, a published field');
+  const roster = await guilds.listMemberRoster({ guildId: unlId }, { pool });
+  ok(roster.some((m) => m.handle === 'r24privc'), 'fellow members still see the private member in the own-scope roster');
+  ok((await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: ALICE, countedInTotals: true }, { pool })).counted_in_totals === true,
+    'a member flips their own counted_in_totals');
+  ok((await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: BOB, countedInTotals: false }, { pool })) === null,
+    'a non-member has no switch to flip');
+  ok((await guilds.listMyGuilds({ githubId: ALICE }, { pool })).length === 2, 'my guilds lists both memberships');
+
+  // --- 7. transfer, remove, leave, dissolve (D2) -----------------------------
+  ok(await guilds.transferOwnership({ guildId: unlId, ownerGithubId: ALICE, handle: 'r24privc' }, { pool }) === 'not_owner',
+    'a member cannot transfer ownership');
+  ok((await memberRow('r24-unl', ALICE)).membership_kind === 'member', '…and the refused attempt changed nothing');
+  ok(await guilds.transferOwnership({ guildId: unlId, ownerGithubId: OWNER, handle: 'r24bob' }, { pool }) === 'not_member',
+    'ownership goes only to an existing member');
+  ok(await guilds.transferOwnership({ guildId: unlId, ownerGithubId: OWNER, handle: 'r24alice' }, { pool }) === 'transferred',
+    'the owner transfers to a member');
+  ok((await memberRow('r24-unl', ALICE)).membership_kind === 'owner' && (await memberRow('r24-unl', OWNER)).membership_kind === 'member',
+    'demote then promote: exactly one owner, and it is the new one');
+  const newOwnerQ = await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: ALICE }, { pool });
+  ok(newOwnerQ.outgoing.some((r) => r.handle === 'r24carl') && !newOwnerQ.outgoing.some((r) => r.handle === 'r24priv2'),
+    'after a transfer, the new owner sees public invitees but not a private one the previous owner invited');
+  ok((await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: OWNER }, { pool })).outgoing.length === 0,
+    'and the previous owner no longer reads the queue at all');
+
+  ok(!(await guilds.removeMember({ guildId: unlId, ownerGithubId: OWNER, handle: 'r24privc' }, { pool })),
+    'the former owner can no longer remove members');
+  ok(await guilds.removeMember({ guildId: unlId, ownerGithubId: ALICE, handle: 'r24privc' }, { pool }),
+    'the owner removes a member');
+  ok(!(await memberRow('r24-unl', PRIVC)), 'removal is a hard delete');
+  ok(!(await openRows('r24-unl', PRIVC)).some((r) => r.status === 'accepted'),
+    'removal also deletes the accepted invite that admitted them — no record they were ever here');
+  ok(!(await guilds.removeMember({ guildId: unlId, ownerGithubId: ALICE, handle: 'r24alice' }, { pool })),
+    'the owner cannot remove themselves');
+
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: ALICE }, { pool }) === 'must_transfer',
+    'an owner with members must transfer before leaving');
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: OWNER }, { pool }) === 'left', 'a member leaves');
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: OWNER }, { pool }) === null, 'a non-member cannot leave');
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: ALICE }, { pool }) === 'dissolved',
+    'the last member leaving dissolves the guild');
+  ok(!(await guildId('r24-unl')) && (await openRows('r24-unl', CARL)).length === 0,
+    'dissolving hard-deletes the guild and cascades to its open requests');
+
+  const pubId = await guildId('r24-pub');
+
+  // A leave racing a transfer that promotes the leaver. The transfer holds the
+  // leaver's row locked; the leave must wait, then see 'owner', and refuse —
+  // never delete the new owner from a stale snapshot and orphan the guild.
+  const tx = await pool.connect();
+  let raced;
+  try {
+    await tx.query('BEGIN');
+    await tx.query(`SELECT 1 FROM platform_identity_guild_members WHERE guild_id = $1 AND github_id = $2 FOR UPDATE`, [pubId, ALICE]);
+    await tx.query(`UPDATE platform_identity_guild_members SET membership_kind = 'member' WHERE guild_id = $1 AND github_id = $2`, [pubId, OWNER]);
+    await tx.query(`UPDATE platform_identity_guild_members SET membership_kind = 'owner' WHERE guild_id = $1 AND github_id = $2`, [pubId, ALICE]);
+    raced = guilds.leaveGuild({ guildId: pubId, githubId: ALICE }, { pool });
+    let waiting = false;
+    for (let i = 0; i < 50 && !waiting; i++) {
+      await new Promise((r) => setTimeout(r, 50));
+      const { rows } = await q(`SELECT 1 FROM pg_stat_activity WHERE wait_event_type = 'Lock' AND query LIKE '%WITH mine AS%'`);
+      waiting = rows.length > 0;
+    }
+    ok(waiting, 'the racing leave is blocked on the transfer\'s row lock');
+    await tx.query('COMMIT');
+  } finally { tx.release(); }
+  ok(await raced === 'must_transfer', 'once the transfer commits, the leave re-reads the row as owner and refuses');
+  ok((await memberRow('r24-pub', ALICE)).membership_kind === 'owner', 'the guild still has its (new) owner');
+
+  ok(await guilds.transferOwnership({ guildId: pubId, ownerGithubId: ALICE, handle: 'r24own' }, { pool }) === 'transferred',
+    'ownership is handed back');
+  ok(await guilds.leaveGuild({ guildId: pubId, githubId: ALICE }, { pool }) === 'left', 'the member leaves');
+  ok(!(await openRows('r24-pub', ALICE)).some((r) => r.status === 'accepted'),
+    'leaving deletes the accepted request that admitted them');
+  ok(!(await guilds.dissolveGuild({ guildId: pubId, githubId: ALICE }, { pool })), 'a non-owner cannot dissolve');
+  ok(await guilds.dissolveGuild({ guildId: pubId, githubId: OWNER }, { pool }), 'the owner dissolves');
+  ok((await q(`SELECT count(*)::int AS n FROM platform_identity_guild_members WHERE guild_id = $1`, [pubId])).rows[0].n === 0,
+    'dissolving cascades to every membership');
+
+  console.log(`\nguilds_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/own_scope_guard.mjs

@@ -123,6 +123,11 @@ const OWN_SCOPED_SURFACES = [
     why: 'the connection graph (ADR 0202, task 1002295). The ACTING account is always the session; a counterparty is named by public handle or by the connection row id, never by an account identifier — and the degree label is a viewer-relative own-scope read (D4 §4).',
     crossOwner: [],
   },
+  {
+    file: 'modules/platform-identity/routes/guilds.js',
+    why: 'guilds (ADR 0336, task 1002300). The ACTING account is always the session: a guild is named by slug, a person by public handle, an invite or request by its row id, and owner-only acts are re-asserted against the session inside each statement. The one public read, GET /guilds/:slug, is deliberately in routes/guilds-public.js so this whole file can be held to the rule.',
+    crossOwner: [],
+  },
   {
     file: 'modules/platform-identity/routes/my-projects.js',
     why: "the caller's OWN cross-project memberships, invitations, applications and leave (ADR 0141 §3; the application echo, ADR 0201 D1.3, task 1002284) — every route keyed on req.builder.github_id / github_login. The only path param is :clientId, which names a PROJECT and never a builder: a project is the resource being acted on, and the actor is always the session, which is why join can relay an application for nobody but the caller.",

package/tests/terms_acceptance.mjs

@@ -1,10 +1,12 @@
 // tests/terms_acceptance.mjs
 //
-// THE PLATFORM T&C ACCEPTANCE RECORD — "the hub's own sign-in is the only thing
-// that can say a human accepted the platform terms, it says so once, and nothing
-// publishes without it" (ADR 0213, task 1002913; the artifact ADR 0141 §4
-// deferred cross-project-aggregation consent to and ADR 0171 D3 reserved a place
-// for).
+// THE PLATFORM T&C ACCEPTANCE RECORD — "a sign-in the hub itself witnessed is the
+// only thing that can say a human accepted the platform terms, it says so once,
+// and nothing publishes without it" (ADR 0213, task 1002913; the artifact ADR
+// 0141 §4 deferred cross-project-aggregation consent to and ADR 0171 D3 reserved
+// a place for). That sign-in is GET /sso/authorize — a builder using their
+// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
+// nothing yet (blocker 1000124); task 1003361 adds it as a second capture point.
 //
 // WHY THIS EXISTS. An acceptance record is only worth the evidence behind it. If
 // a caller can assert one — a body field, a query param, a header — then the
@@ -111,24 +113,44 @@ t('the terms page states what crosses between projects', () => {
 t('the acceptance the page promises is the one the code actually keeps', () => {
   assert.match(termsHtml, /stores the date you accepted these terms/i,
     'the page must tell the reader an acceptance record is kept');
-  assert.match(termsHtml, /signing in again does not change the original date/i,
+  assert.match(termsHtml, /signing in again does not change the date you accepted/i,
     'and that it is written once — the property the COALESCE below actually provides');
 });
 
+// The capture point is GET /sso/authorize — reached when a builder uses their
+// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
+// nothing (blocker 1000124, task 1003353), so the page must not say "here".
+// Task 1003361 adds the hub's own sign-in as a second capture point; when it
+// lands, this wording and §3 below change together.
+t('the page names the sign-in the code actually watches — a project sign-in, not "here" (blocker 1000124)', () => {
+  const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
+  assert.doesNotMatch(section, /sign(?:ed|ing)? in here/i,
+    'the page promises that signing in to this site records acceptance — the code never stamps that sign-in');
+  assert.match(section, /Once you have signed in to a project with your platform account and accepted these terms/,
+    'what makes a profile public must name the moment the code captures');
+  assert.match(section, /never signed in to a project that way stays provisional/,
+    'and the provisional case must be the same moment, negated');
+  assert.match(section, /written when you sign in to a project with your platform account, and only once/,
+    'the acceptance paragraph must name the same capture point');
+});
+
 t('the page says which acceptances were given on a builder’s behalf, and that the record marks them (task 1003360)', () => {
   assert.match(termsHtml, /accepted it on your behalf/i,
     'the owner chose to grandfather AND to say so on the page — the page must tell a pre-existing builder what was recorded for them');
   assert.match(termsHtml, /marks that acceptance as grandfathered/i,
     'and that the record keeps it distinguishable from one they gave');
-  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in/i,
+  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project/i,
     'and what happens when they do sign in — the conflict branch below really does replace it');
   assert.doesNotMatch(termsHtml, /written only by signing in/i,
     'the page still says acceptance is written ONLY by signing in, which is false for every grandfathered account');
-  assert.doesNotMatch(stripApexOnly(termsHtml), /grandfathered/i, 'a claim about the platform record survived into a child project page');
+  assert.doesNotMatch(stripApexOnly(termsHtml, false), /grandfathered/i, 'a claim about the platform record survived into a child project page');
 });
 
 t('the cross-project claim is apex-only — it never ships in a child project page', () => {
-  const stripped = stripApexOnly(termsHtml);
+  // The hub flag is passed explicitly: its default reads config/modules.json, so
+  // an implicit call passes or fails with whatever this checkout has enabled.
+  assert.equal(stripApexOnly(termsHtml, true), termsHtml, 'the hub keeps every apex-only passage');
+  const stripped = stripApexOnly(termsHtml, false);
   assert.doesNotMatch(stripped, /Your work across projects/,
     'a claim about THE PLATFORM survived into a child project page (task 1002748)');
   // ...and the stripper did not simply eat the page.
@@ -165,7 +187,9 @@ t('the conflict fragment keeps the first acceptance, and replaces only a grandfa
 t('the insert fragment writes NULL for a caller the hub did not witness, and marks a witnessed one as a sign-in', () => {
   const values = acceptanceInsertValues('$5', '$6');
   assert.match(values, /CASE WHEN \$5::boolean THEN now\(\) ELSE NULL END/,
-    'a check-in / device-poll account has no acceptance — fail-closed');
+    'an account no sign-in witnessed has no acceptance — fail-closed');
+  assert.match(values, /CASE WHEN \$5::boolean THEN \$6::text ELSE NULL END/,
+    'and no version either: the pair is written together or not at all');
   assert.match(values, /CASE WHEN \$5::boolean THEN 'signin' ELSE NULL END/,
     'an acceptance written at sign-in must say so (task 1003360) — an unmarked one is indistinguishable from a grandfather');
   assert.equal(acceptanceInsertColumns(), ', terms_accepted_at, terms_version, terms_accepted_source');
@@ -199,8 +223,12 @@ function splitTopLevel(s) {
 // permissive `.*?` match: every shape this understands is spelled out, and an
 // unrecognised one THROWS. A SET list matched loosely is how a deleted audit
 // trail passes a test that looks like it is checking one.
-function evalAcceptance(expr, { col, activate, existing, oldRow = {}, params, now }) {
+function evalAcceptance(expr, { col, existing, oldRow = {}, params, now }) {
   const self = `platform_identity_accounts.${col}`;
+  // A boolean placeholder resolves by its OWN number, exactly as `$N::text` does
+  // below — so a fragment gated on the wrong parameter reads as never activating,
+  // rather than scoring as correct because the interpreter assumed which one it was.
+  const on = (n) => params[Number(n) - 1] === true;
   const src = (tok) => {
     if (/^now\(\)$/i.test(tok)) return now;
     if (tok === "'signin'") return 'signin';
@@ -216,24 +244,24 @@ function evalAcceptance(expr, { col, activate, existing, oldRow = {}, params, no
   // right-hand side against the row before the update.
   m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean AND platform_identity_accounts\\.terms_accepted_source = 'grandfathered' THEN (.+?) WHEN \\$(\\d+)::boolean THEN COALESCE\\(${esc}, (.+?)\\) ELSE ${esc} END$`, 'i').exec(expr);
   if (m) {
-    if (!activate) return existing;
-    if (oldRow.terms_accepted_source === 'grandfathered') return src(m[2]);
-    return existing != null ? existing : src(m[4]);
+    if (on(m[1]) && oldRow.terms_accepted_source === 'grandfathered') return src(m[2]);
+    if (on(m[3])) return existing != null ? existing : src(m[4]);
+    return existing;
   }
 
   // The ADR 0213 shape: activate ? (existing ?? src) : existing. Recognised so a
   // regression to it is caught by behaviour (a grandfather that never gives way).
   m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean THEN COALESCE\\(${esc}, (.+?)\\) ELSE ${esc} END$`, 'i').exec(expr);
-  if (m) return activate ? (existing != null ? existing : src(m[2])) : existing;
+  if (m) return on(m[1]) ? (existing != null ? existing : src(m[2])) : existing;
 
   // The overwriting shape — a real possibility, and the one the idempotence
   // assertion below must be able to tell apart from the shipped one.
   m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean THEN (.+?) ELSE ${esc} END$`, 'i').exec(expr);
-  if (m) return activate ? src(m[2]) : existing;
+  if (m) return on(m[1]) ? src(m[2]) : existing;
 
   // The INSERT-branch shape: activate ? src : NULL
   m = /^CASE WHEN \$(\d+)::boolean THEN (.+?) ELSE NULL END$/i.exec(expr);
-  if (m) return activate ? src(m[2]) : null;
+  if (m) return on(m[1]) ? src(m[2]) : null;
 
   // Unconditional — a caller-independent write. Recognised so the "non-activating
   // paths never stamp" assertion can catch it rather than erroring out.
@@ -272,16 +300,28 @@ function makePool() {
         const id = String(params[0]);
         const existing = accounts.get(id);
 
-        if (/ON CONFLICT \(github_id\) DO NOTHING/i.test(sql)) {
-          if (!existing) accounts.set(id, { github_id: id, github_login: params[1], profile_state: 'provisional', terms_accepted_at: null, terms_version: null, terms_accepted_source: null, account_visibility: 'public', hide_stats: false, handle: 'h' });
-          return { rows: [], rowCount: existing ? 0 : 1 };
-        }
-
         const valuesRaw = /VALUES \((.+?)\) ON CONFLICT/i.exec(sql);
         assert.ok(valuesRaw, `the upsert changed shape — update the interpreter, do not bypass it: ${sql.slice(0, 200)}`);
         const values = splitTopLevel(valuesRaw[1]);
         assert.equal(values.length, cols.length, 'the INSERT column list and VALUES list must line up');
 
+        // ensureAccount's insert-only write. Built from the statement's OWN column
+        // list, not a hardcoded row: were an acceptance column added to it, the
+        // row below would really carry it and the assertions would really fail.
+        if (/ON CONFLICT \(github_id\) DO NOTHING/i.test(sql)) {
+          if (existing) return { rows: [], rowCount: 0 };
+          const row = { github_id: id, github_login: params[1], account_visibility: 'public', hide_stats: false, handle: 'h' };
+          for (const col of ACCEPTANCE_COLUMNS) {
+            const i = cols.indexOf(col);
+            row[col] = i === -1 ? null : evalAcceptance(values[i], { col, existing: null, params, now: clock });
+          }
+          const ps = /^'(\w+)'$/.exec(values[cols.indexOf('profile_state')] || '');
+          assert.ok(ps, 'the insert-only write stopped stating its profile_state literally — update the interpreter');
+          row.profile_state = ps[1];
+          accounts.set(id, row);
+          return { rows: [], rowCount: 1 };
+        }
+
         const activate = params[4] === true;
         let row;
         if (!existing) {
@@ -289,7 +329,7 @@ function makePool() {
           for (const col of ACCEPTANCE_COLUMNS) {
             const i = cols.indexOf(col);
             assert.notEqual(i, -1, `the upsert stopped writing ${col} on insert`);
-            row[col] = evalAcceptance(values[i], { col, activate, existing: null, params, now: clock });
+            row[col] = evalAcceptance(values[i], { col, existing: null, params, now: clock });
           }
           row.profile_state = activate ? 'active' : 'provisional';
           accounts.set(id, row);
@@ -305,7 +345,7 @@ function makePool() {
           const oldRow = { ...row };
           for (const col of ACCEPTANCE_COLUMNS) {
             assert.ok(assigns.has(col), `the conflict branch stopped writing ${col} — an account that signs in again would never record its acceptance`);
-            row[col] = evalAcceptance(assigns.get(col), { col, activate, existing: oldRow[col], oldRow, params, now: clock });
+            row[col] = evalAcceptance(assigns.get(col), { col, existing: oldRow[col], oldRow, params, now: clock });
           }
           if (activate) row.profile_state = 'active';
         }
@@ -392,7 +432,7 @@ const authorize = (qs = '') => request(
 );
 
 // ===========================================================================
-// 3. The capture point — the hub's own sign-in, and nothing else
+// 3. The capture point — the project sign-in leg (/sso/authorize), and nothing else
 // ===========================================================================
 
 console.log('\nthe capture point (only the hub can say a human accepted):');
@@ -405,7 +445,7 @@ await ta('CONTROL: a hub-session authorize records the acceptance', async () =>
   assert.equal(res.status, 302, 'the authorize leg should hand back a code');
   const row = pool.accounts.get('4242');
   assert.ok(row, 'no account was written at all — the rest of this section would pass vacuously');
-  assert.equal(row.terms_accepted_at, NOW, 'the acceptance was not stamped by the hub sign-in');
+  assert.equal(row.terms_accepted_at, NOW, 'the acceptance was not stamped by the platform-account sign-in to a project');
   assert.equal(row.terms_version, TERMS_VERSION, 'the record must name WHICH text was accepted');
   assert.equal(row.terms_accepted_source, 'signin',
     'and HOW it was given — a sign-in, queryably distinct from a grandfather (task 1003360)');
@@ -494,13 +534,19 @@ await ta('a NON-activating write never touches an existing acceptance', async ()
   pool.setClock(NOW);
   await authorize();
 
-  // ensureAccount is the federated path (check-in / device-poll): it must not
-  // create, restamp, or clear an acceptance.
+  // Neither non-activating writer may create, restamp, or clear an acceptance:
+  // ensureAccount (the federated membership check-in, insert-only) and the
+  // non-activating upsertAccount (POST /sso/device/poll and PATCH /me/handle),
+  // whose conflict branch really runs here — its "leave it alone" ELSE half.
   const pi = require('../modules/platform-identity/platform-identity.js');
   pool.setClock(LATER);
   await pi.ensureAccount({ githubId: '4242', githubLogin: 'octo', displayName: 'x', avatarUrl: null }, { pool });
   assert.equal(pool.accounts.get('4242').terms_accepted_at, NOW,
     'a federated check-in changed the acceptance record');
+  await pi.upsertAccount({ githubId: '4242', githubLogin: 'octo', displayName: 'x', avatarUrl: null }, { pool });
+  const row = pool.accounts.get('4242');
+  assert.deepEqual([row.terms_accepted_at, row.terms_version, row.terms_accepted_source], [NOW, TERMS_VERSION, 'signin'],
+    'a non-activating upsert (device poll, handle change) changed the acceptance record');
 });
 
 await ta('a federated check-in creates an account with NO acceptance at all', async () => {

package/tests/terms_grandfather_db.mjs

@@ -4,7 +4,7 @@
 // Proves migration platform_identity_024 against real SQL: an account the hub
 // had already witnessed is published immediately after the migration, without
 // signing in again; its acceptance is queryably distinct from a real sign-in;
-// the grandfather runs once; and the owner's next hub sign-in replaces it.
+// the grandfather runs once; and the owner's next project sign-in replaces it.
 // tests/terms_acceptance.mjs pins the same rules DB-free (the statement shapes
 // and the executed conflict branch); only a transaction engine can run the
 // migration's DO block and its UPDATEs.
@@ -106,7 +106,7 @@ try {
   await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
   ok((await row(LATE)).terms_accepted_at === null, 'replaying 024 grandfathers nobody new — the grandfather was an event, not a rule');
 
-  // The owner's next hub sign-in replaces the grandfather with their own acceptance.
+  // The owner's next project sign-in replaces the grandfather with their own acceptance.
   await pi.upsertAccount({ githubId: LEGACY, githubLogin: 'legacy-b', activate: true }, { pool: client });
   const after = await row(LEGACY);
   ok(after.terms_accepted_source === 'signin', 'the next sign-in replaces the grandfather with a signin');