@bongos/core 1.19.1026 → 1.19.1028

package/tests/guilds_db.mjs

@@ -0,0 +1,343 @@
+// tests/guilds_db.mjs — guild CRUD, membership and visibility against REAL SQL
+// (task 1002300, R24; ADR 0336 D1–D4 + D6, ADR 0337 D4.4).
+//
+// Why a real database: the rules that matter here live in the schema and in
+// single statements a fake pool cannot execute — the one-owner PARTIAL unique
+// index, the open-request partial index, the expiry CTE that must be drained
+// before its INSERT, the FK cascade on dissolve, the two-statement transfer, and
+// an accept that resolves a row and inserts a membership in one statement. The
+// DB-free sibling, tests/guilds_api.mjs, covers the route layer.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it. Fixture ids are
+// high-numbered and every guild slug starts r24-, so a shared DB is safe; all
+// fixtures are deleted before and after.
+//
+// Run:  DATABASE_URL=... node tests/guilds_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`guilds_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const guilds = require('../modules/platform-identity/guilds.js');
+
+const OWNER = 9002300001;   // public, active — creates the guilds
+const ALICE = 9002300002;   // public, active
+const PRIV = 9002300003;    // private, active, NOT connected to OWNER
+const PRIVC = 9002300004;   // private, active, connected to OWNER
+const PROV = 9002300005;    // provisional — can take part in nothing
+const BOB = 9002300006;     // public, active
+const CARL = 9002300007;    // public, active
+const PRIV2 = 9002300008;   // private, active, connected to OWNER only
+const ALL_IDS = [OWNER, ALICE, PRIV, PRIVC, PROV, BOB, CARL, PRIV2];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_guilds WHERE slug LIKE 'r24-%'`).catch(() => {});
+  await q(`DELETE FROM platform_identity_connections
+            WHERE requester_github_id = ANY($1::bigint[]) OR addressee_github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+async function rejects(promise, code, msg) {
+  let caught = null;
+  try { await promise; } catch (e) { caught = e; }
+  ok(caught && caught.code === code, `${msg} (expected ${code}, got ${caught ? caught.code : 'no error'})`);
+}
+const memberRow = async (slug, gid) => (await q(
+  `SELECT m.* FROM platform_identity_guild_members m JOIN platform_identity_guilds g ON g.id = m.guild_id
+    WHERE g.slug = $1 AND m.github_id = $2`, [slug, gid])).rows[0] || null;
+const guildId = async (slug) => (await q(`SELECT id FROM platform_identity_guilds WHERE slug = $1`, [slug])).rows[0]?.id;
+const openRows = async (slug, gid) => (await q(
+  `SELECT r.* FROM platform_identity_guild_requests r JOIN platform_identity_guilds g ON g.id = r.guild_id
+    WHERE g.slug = $1 AND r.github_id = $2 ORDER BY r.id`, [slug, gid])).rows;
+const pendingId = async (slug, gid) => (await openRows(slug, gid)).find((r) => r.status === 'pending')?.id;
+
+try {
+  // The migrations this domain reads, all idempotent: accounts + consent,
+  // handles, privacy, terms, connections (addressing), and guilds.
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_012_account_privacy.sql',
+    'platform_identity_015_connections.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_025_guilds.sql',
+  ]) await q(migrationSql(f));
+  await q(migrationSql('platform_identity_025_guilds.sql')); // re-runnable
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, handle, display_name, profile_state, terms_accepted_at, account_visibility)
+     VALUES ($1, 'r24own', 'r24own', 'Owner', 'active', now(), 'public'),
+            ($2, 'r24alice', 'r24alice', 'Alice', 'active', now(), 'public'),
+            ($3, 'r24priv', 'r24priv', 'Priv', 'active', now(), 'private'),
+            ($4, 'r24privc', 'r24privc', 'PrivC', 'active', now(), 'private'),
+            ($5, 'r24prov', 'r24prov', 'Prov', 'provisional', NULL, 'public'),
+            ($6, 'r24bob', 'r24bob', 'Bob', 'active', now(), 'public'),
+            ($7, 'r24carl', 'r24carl', 'Carl', 'active', now(), 'public'),
+            ($8, 'r24priv2', 'r24priv2', 'Priv2', 'active', now(), 'private')`,
+    ALL_IDS,
+  );
+  await q(`INSERT INTO platform_identity_connections (requester_github_id, addressee_github_id, status, resolved_at)
+           VALUES ($1, $2, 'accepted', now()), ($1, $3, 'accepted', now())`, [OWNER, PRIVC, PRIV2]);
+
+  // --- 1. the schema holds its own rules (ADR 0336 D1) ---------------------
+  await rejects(q(`INSERT INTO platform_identity_guilds (slug, name) VALUES ('r24-nodefault', 'x')`),
+    '23502', 'visibility has NO default — the creator must choose');
+  await rejects(q(`INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ('r24-bad', 'x', 'private')`),
+    '23514', 'visibility is public or unlisted, nothing else');
+  await rejects(q(`INSERT INTO platform_identity_guilds (slug, name, visibility) VALUES ('R24-Upper', 'x', 'public')`),
+    '23514', 'the slug is stored in canonical lowercase form only');
+  const cols = (await q(
+    `SELECT column_name, column_default, is_nullable FROM information_schema.columns
+      WHERE table_name = 'platform_identity_guild_members'`)).rows;
+  const col = (n) => cols.find((c) => c.column_name === n);
+  ok(col('shown_publicly').is_nullable === 'NO' && col('shown_publicly').column_default === null,
+    'shown_publicly is NOT NULL with no default — every join must say what its card showed');
+  ok(col('counted_in_totals').is_nullable === 'NO' && col('counted_in_totals').column_default === 'true',
+    'counted_in_totals is NOT NULL DEFAULT true (ADR 0337 D4.4)');
+  ok(!col('role') && !!col('membership_kind'), 'membership_kind, never role (ADR 0174)');
+
+  // --- 2. create ------------------------------------------------------------
+  const pub = await guilds.createGuild({ githubId: OWNER, slug: 'r24-pub', name: 'Public Guild', visibility: 'public' }, { pool });
+  ok(pub.guild && pub.guild.slug === 'r24-pub' && pub.guild.id === undefined, 'createGuild returns the guild without its row id');
+  const ownerPub = await memberRow('r24-pub', OWNER);
+  ok(ownerPub.membership_kind === 'owner' && ownerPub.shown_publicly === true && ownerPub.counted_in_totals === true,
+    'the creator is the one owner, shown on a public guild, counted by default');
+  const unl = await guilds.createGuild({ githubId: OWNER, slug: 'r24-unl', name: 'Quiet Guild', visibility: 'unlisted' }, { pool });
+  ok(unl.guild.visibility === 'unlisted' && (await memberRow('r24-unl', OWNER)).shown_publicly === false,
+    'creating an unlisted guild leaves its owner unshown');
+  ok((await guilds.createGuild({ githubId: ALICE, slug: 'r24-pub', name: 'Dup', visibility: 'public' }, { pool })).taken === true,
+    'a taken slug is refused');
+  await rejects(q(`INSERT INTO platform_identity_guild_members (guild_id, github_id, membership_kind, shown_publicly)
+                   VALUES ($1, $2, 'owner', true)`, [await guildId('r24-pub'), ALICE]),
+    '23505', 'the database refuses a second owner');
+
+  // --- 3. the public read (D4) ------------------------------------------------
+  ok((await guilds.getPublicGuild('r24-unl', { pool })) === null, 'an unlisted guild has no public existence');
+  ok((await guilds.getPublicGuild('r24-nope', { pool })) === null, '…the same null as a guild that does not exist');
+
+  // --- 4. join requests: public only, two consents, silent decline -----------
+  ok((await guilds.requestToJoin({ slug: 'r24-unl', githubId: ALICE }, { pool })).outcome === 'not_found',
+    'an unlisted guild takes no requests, and says so as not_found');
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: ALICE, countedInTotals: false }, { pool })).outcome === 'created',
+    'a builder may ask a public guild');
+  ok(!(await memberRow('r24-pub', ALICE)), 'asking is not joining — no self-join');
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: ALICE }, { pool })).outcome === 'already_open',
+    'a second open request for the pair is refused by the open-row index');
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: OWNER }, { pool })).outcome === 'already_member',
+    'a member cannot ask to join');
+
+  const aliceReq = await pendingId('r24-pub', ALICE);
+  ok((await guilds.acceptRequest({ id: aliceReq, githubId: BOB }, { pool })).outcome === 'not_found',
+    'only the owner may accept a request — anyone else is not_found');
+  ok((await guilds.acceptRequest({ id: aliceReq, githubId: OWNER, countedInTotals: true }, { pool })).outcome === 'accepted',
+    'the owner accepts the request');
+  const alicePub = await memberRow('r24-pub', ALICE);
+  ok(alicePub && alicePub.membership_kind === 'member' && alicePub.shown_publicly === true,
+    'a request to a public guild joins shown');
+  ok(alicePub.counted_in_totals === false,
+    'the requester\'s own counted_in_totals choice rides the request — the owner cannot override it');
+
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'created', 'Bob asks');
+  ok(await guilds.declineRequest({ id: await pendingId('r24-pub', BOB), githubId: OWNER }, { pool }), 'the owner declines');
+  const before = (await openRows('r24-pub', BOB)).length;
+  ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'swallowed',
+    'a re-ask inside the cooldown is swallowed…');
+  ok((await openRows('r24-pub', BOB)).length === before, '…and writes nothing');
+
+  // --- 5. invites: addressing, batch, the card (D3/D4) ------------------------
+  const unlId = await guildId('r24-unl');
+  const res = await guilds.inviteHandles({
+    guildId: unlId, ownerGithubId: OWNER,
+    handles: ['r24alice', 'R24PRIV', 'r24privc', 'r24prov', 'r24own', 'r24-ghost', 'r24alice'],
+  }, { pool });
+  const outcome = (h) => res.find((r) => r.handle === h)?.outcome;
+  ok(outcome('r24alice') === 'invited', 'a public account is invitable into an unlisted guild');
+  ok(outcome('r24priv') === 'not_found', 'a private stranger is not_found');
+  ok(outcome('r24privc') === 'invited', 'a private account the owner is connected to is invitable (ADR 0202 D4 §2)');
+  ok(outcome('r24prov') === 'not_found', 'a provisional account cannot be invited');
+  ok(outcome('r24own') === 'already_member', 'the owner is already a member');
+  ok(outcome('r24-ghost') === 'not_found', 'an unknown handle is not_found — one answer with private and provisional');
+  ok(res.filter((r) => r.handle === 'r24alice').length === 1, 'a repeated handle in one batch is invited once');
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: ALICE, handles: ['r24bob'] }, { pool });
+  ok((await openRows('r24-unl', BOB)).length === 0,
+    'a non-owner invite writes nothing (the owner gate is in the statement, not only the route)');
+  ok((await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24priv2'] }, { pool }))[0].outcome === 'invited',
+    'the owner invites a second private account they are connected to');
+
+  const aliceInv = await pendingId('r24-unl', ALICE);
+  ok((await guilds.acceptRequest({ id: aliceInv, githubId: ALICE }, { pool })).outcome === 'card_required',
+    'an invite accept must carry the visibility its card showed');
+  const changed = await guilds.acceptRequest({ id: aliceInv, githubId: ALICE, cardVisibility: 'public' }, { pool });
+  ok(changed.outcome === 'visibility_changed' && changed.visibility === 'unlisted',
+    'a card that does not match the guild is refused, naming the current visibility');
+  ok((await guilds.acceptRequest({ id: aliceInv, githubId: OWNER, cardVisibility: 'unlisted' }, { pool })).outcome === 'not_found',
+    'only the invitee may accept an invite');
+  ok((await guilds.acceptRequest({ id: aliceInv, githubId: ALICE, cardVisibility: 'unlisted', countedInTotals: false }, { pool })).outcome === 'accepted',
+    'the invitee accepts with the card they saw');
+  const aliceUnl = await memberRow('r24-unl', ALICE);
+  ok(aliceUnl.shown_publicly === false && aliceUnl.counted_in_totals === false,
+    'joining an unlisted guild leaves the member unshown; the card switch is honoured');
+
+  const privcInv = await pendingId('r24-unl', PRIVC);
+  ok((await guilds.acceptRequest({ id: privcInv, githubId: PRIVC, cardVisibility: 'unlisted' }, { pool })).outcome === 'accepted',
+    'a private account can join');
+  ok((await guilds.acceptRequest({ id: privcInv, githubId: PRIVC, cardVisibility: 'unlisted' }, { pool })).outcome === 'not_found',
+    'an accepted row cannot be accepted twice');
+
+  // Decline cooldown on invites, and the owner's queue.
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24bob', 'r24carl'] }, { pool });
+  const q1 = await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: OWNER }, { pool });
+  ok(q1.outgoing.length === 3 && q1.outgoing.some((r) => r.handle === 'r24priv2') && q1.outgoing.every((r) => !('seen_at' in r) && r.handle && !('github_id' in r)),
+    'the owner sees invites still out — named by handle, never github_id, never the invitee\'s seen_at');
+  ok((await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: ALICE }, { pool })).outgoing.length === 0,
+    'a non-owner reads an empty queue (the owner gate is in the statement)');
+  const bobQ = await guilds.listMyRequests({ githubId: BOB }, { pool });
+  ok(bobQ.incoming.length === 1 && bobQ.incoming[0].visibility === 'unlisted' && bobQ.incoming[0].slug === 'r24-unl',
+    'the invitee\'s queue carries the card: slug and current visibility');
+  ok((await openRows('r24-unl', BOB))[0].seen_at !== null, 'reading the queue stamps seen_at on the invite');
+  ok(await guilds.declineRequest({ id: await pendingId('r24-unl', BOB), githubId: BOB }, { pool }), 'Bob declines — silently');
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24bob'] }, { pool });
+  ok((await openRows('r24-unl', BOB)).length === 1, 'a re-invite inside the cooldown is swallowed: no new row');
+
+  // Cancel: the opener only.
+  const carlInv = await pendingId('r24-unl', CARL);
+  ok(!(await guilds.cancelRequest({ id: carlInv, githubId: CARL }, { pool })), 'an invitee cannot cancel an invite (that is a decline)');
+  ok(await guilds.cancelRequest({ id: carlInv, githubId: OWNER }, { pool }), 'the owner cancels an invite');
+
+  // Expiry is read-time, and the next write resolves the stale row in the same statement.
+  await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24carl'] }, { pool });
+  await q(`UPDATE platform_identity_guild_requests SET created_at = now() - interval '31 days'
+            WHERE github_id = $1 AND status = 'pending'`, [CARL]);
+  const stale = await pendingId('r24-unl', CARL);
+  ok((await guilds.acceptRequest({ id: stale, githubId: CARL, cardVisibility: 'unlisted' }, { pool })).outcome === 'not_found',
+    'an invite older than the expiry cannot be accepted');
+  const again = await guilds.inviteHandles({ guildId: unlId, ownerGithubId: OWNER, handles: ['r24carl'] }, { pool });
+  ok(again[0].outcome === 'invited' && (await openRows('r24-unl', CARL)).some((r) => r.status === 'expired'),
+    'a fresh invite resolves the stale row as expired in the same statement, instead of hitting the open-row index');
+
+  // --- 6. visibility changes flip only the owner (D4 §3) ---------------------
+  const flipped = await guilds.updateGuild({ guildId: unlId, githubId: OWNER, visibility: 'public' }, { pool });
+  ok(flipped && flipped.visibility === 'public', 'the owner makes the guild public');
+  ok((await memberRow('r24-unl', OWNER)).shown_publicly === true, 'the owner who flipped it is now shown');
+  ok((await memberRow('r24-unl', ALICE)).shown_publicly === false, 'a member who joined it unlisted is NOT shown until they agree');
+  ok(!(await guilds.updateGuild({ guildId: unlId, githubId: ALICE, name: 'Hijack' }, { pool })), 'a non-owner cannot edit the guild');
+  const carlCard = await guilds.acceptRequest({ id: await pendingId('r24-unl', CARL), githubId: CARL, cardVisibility: 'unlisted' }, { pool });
+  ok(carlCard.outcome === 'visibility_changed', 'an invite accepted from a card that predates the flip is refused');
+
+  let page = await guilds.getPublicGuild('r24-unl', { pool });
+  ok(page && page.members.map((m) => m.handle).join(',') === 'r24own' && page.size === 1,
+    'the public roster shows only members who agreed to be shown; size is its length');
+  ok(page.members.every((m) => !('github_id' in m)), 'the public roster never carries github_id');
+
+  ok((await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: ALICE, shownPublicly: true }, { pool })).shown_publicly === true,
+    'a member agrees to be shown');
+  await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: PRIVC, shownPublicly: true }, { pool });
+  page = await guilds.getPublicGuild('r24-unl', { pool });
+  ok(page.members.map((m) => m.handle).sort().join(',') === 'r24alice,r24own' && page.size === 2,
+    'a private account is never on a public roster, whatever its flag');
+  ok(page.members[0].handle === 'r24own', 'the owner leads; the rest are ordered by handle, a published field');
+  const roster = await guilds.listMemberRoster({ guildId: unlId }, { pool });
+  ok(roster.some((m) => m.handle === 'r24privc'), 'fellow members still see the private member in the own-scope roster');
+  ok((await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: ALICE, countedInTotals: true }, { pool })).counted_in_totals === true,
+    'a member flips their own counted_in_totals');
+  ok((await guilds.setMembershipFlags({ slug: 'r24-unl', githubId: BOB, countedInTotals: false }, { pool })) === null,
+    'a non-member has no switch to flip');
+  ok((await guilds.listMyGuilds({ githubId: ALICE }, { pool })).length === 2, 'my guilds lists both memberships');
+
+  // --- 7. transfer, remove, leave, dissolve (D2) -----------------------------
+  ok(await guilds.transferOwnership({ guildId: unlId, ownerGithubId: ALICE, handle: 'r24privc' }, { pool }) === 'not_owner',
+    'a member cannot transfer ownership');
+  ok((await memberRow('r24-unl', ALICE)).membership_kind === 'member', '…and the refused attempt changed nothing');
+  ok(await guilds.transferOwnership({ guildId: unlId, ownerGithubId: OWNER, handle: 'r24bob' }, { pool }) === 'not_member',
+    'ownership goes only to an existing member');
+  ok(await guilds.transferOwnership({ guildId: unlId, ownerGithubId: OWNER, handle: 'r24alice' }, { pool }) === 'transferred',
+    'the owner transfers to a member');
+  ok((await memberRow('r24-unl', ALICE)).membership_kind === 'owner' && (await memberRow('r24-unl', OWNER)).membership_kind === 'member',
+    'demote then promote: exactly one owner, and it is the new one');
+  const newOwnerQ = await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: ALICE }, { pool });
+  ok(newOwnerQ.outgoing.some((r) => r.handle === 'r24carl') && !newOwnerQ.outgoing.some((r) => r.handle === 'r24priv2'),
+    'after a transfer, the new owner sees public invitees but not a private one the previous owner invited');
+  ok((await guilds.listGuildRequests({ guildId: unlId, ownerGithubId: OWNER }, { pool })).outgoing.length === 0,
+    'and the previous owner no longer reads the queue at all');
+
+  ok(!(await guilds.removeMember({ guildId: unlId, ownerGithubId: OWNER, handle: 'r24privc' }, { pool })),
+    'the former owner can no longer remove members');
+  ok(await guilds.removeMember({ guildId: unlId, ownerGithubId: ALICE, handle: 'r24privc' }, { pool }),
+    'the owner removes a member');
+  ok(!(await memberRow('r24-unl', PRIVC)), 'removal is a hard delete');
+  ok(!(await openRows('r24-unl', PRIVC)).some((r) => r.status === 'accepted'),
+    'removal also deletes the accepted invite that admitted them — no record they were ever here');
+  ok(!(await guilds.removeMember({ guildId: unlId, ownerGithubId: ALICE, handle: 'r24alice' }, { pool })),
+    'the owner cannot remove themselves');
+
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: ALICE }, { pool }) === 'must_transfer',
+    'an owner with members must transfer before leaving');
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: OWNER }, { pool }) === 'left', 'a member leaves');
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: OWNER }, { pool }) === null, 'a non-member cannot leave');
+  ok(await guilds.leaveGuild({ guildId: unlId, githubId: ALICE }, { pool }) === 'dissolved',
+    'the last member leaving dissolves the guild');
+  ok(!(await guildId('r24-unl')) && (await openRows('r24-unl', CARL)).length === 0,
+    'dissolving hard-deletes the guild and cascades to its open requests');
+
+  const pubId = await guildId('r24-pub');
+
+  // A leave racing a transfer that promotes the leaver. The transfer holds the
+  // leaver's row locked; the leave must wait, then see 'owner', and refuse —
+  // never delete the new owner from a stale snapshot and orphan the guild.
+  const tx = await pool.connect();
+  let raced;
+  try {
+    await tx.query('BEGIN');
+    await tx.query(`SELECT 1 FROM platform_identity_guild_members WHERE guild_id = $1 AND github_id = $2 FOR UPDATE`, [pubId, ALICE]);
+    await tx.query(`UPDATE platform_identity_guild_members SET membership_kind = 'member' WHERE guild_id = $1 AND github_id = $2`, [pubId, OWNER]);
+    await tx.query(`UPDATE platform_identity_guild_members SET membership_kind = 'owner' WHERE guild_id = $1 AND github_id = $2`, [pubId, ALICE]);
+    raced = guilds.leaveGuild({ guildId: pubId, githubId: ALICE }, { pool });
+    let waiting = false;
+    for (let i = 0; i < 50 && !waiting; i++) {
+      await new Promise((r) => setTimeout(r, 50));
+      const { rows } = await q(`SELECT 1 FROM pg_stat_activity WHERE wait_event_type = 'Lock' AND query LIKE '%WITH mine AS%'`);
+      waiting = rows.length > 0;
+    }
+    ok(waiting, 'the racing leave is blocked on the transfer\'s row lock');
+    await tx.query('COMMIT');
+  } finally { tx.release(); }
+  ok(await raced === 'must_transfer', 'once the transfer commits, the leave re-reads the row as owner and refuses');
+  ok((await memberRow('r24-pub', ALICE)).membership_kind === 'owner', 'the guild still has its (new) owner');
+
+  ok(await guilds.transferOwnership({ guildId: pubId, ownerGithubId: ALICE, handle: 'r24own' }, { pool }) === 'transferred',
+    'ownership is handed back');
+  ok(await guilds.leaveGuild({ guildId: pubId, githubId: ALICE }, { pool }) === 'left', 'the member leaves');
+  ok(!(await openRows('r24-pub', ALICE)).some((r) => r.status === 'accepted'),
+    'leaving deletes the accepted request that admitted them');
+  ok(!(await guilds.dissolveGuild({ guildId: pubId, githubId: ALICE }, { pool })), 'a non-owner cannot dissolve');
+  ok(await guilds.dissolveGuild({ guildId: pubId, githubId: OWNER }, { pool }), 'the owner dissolves');
+  ok((await q(`SELECT count(*)::int AS n FROM platform_identity_guild_members WHERE guild_id = $1`, [pubId])).rows[0].n === 0,
+    'dissolving cascades to every membership');
+
+  console.log(`\nguilds_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/my_projects_surface.mjs

@@ -19,10 +19,11 @@
 //   2. WHETHER ANYTHING LEAKED. No: every /my-projects* route is sign-in-gated
 //      and reads the caller's OWN identity off the session. This is the half the
 //      audit could not confirm, so it is asserted here rather than described.
-//   3. WHAT IS STILL MISSING. The invitations half has no caller anywhere — no
-//      surface fetches the invite list, so a builder holding an invitation still
-//      cannot act on it. That is tracked work (task 1002970, idea 1000903), and
-//      pinning it keeps a known gap from decaying back into an unknown one.
+//   3. WHAT WAS STILL MISSING. The invitations half had no caller anywhere — no
+//      surface fetched the invite list, so a builder holding an invitation could
+//      not act on it. Closed by task 1003774: the hub's /projects?view=mine now
+//      reads GET /my-projects/invites (idea 1000903). The pin below flipped from
+//      "no surface calls this" to "some surface does" for the same reason.
 //
 // Static reads only (no import of the app, no DB) → runs in the `unit` gate.
 //
@@ -88,13 +89,11 @@ test('every /my-projects handler reads the caller identity from the session', ()
     'no /my-projects handler may take the account id from the request body or query');
 });
 
-// ── 3. the gap that is left, named and tracked ─────────────────────────────
-test('the invitations API still has no caller — the tracked gap, pinned', () => {
-  // Deliberately asserts a MISSING feature. Task 1003308 removed the only
-  // surface that fetched invitations, so a builder who holds one has nowhere to
-  // accept or decline it. Task 1002970 (blocked on task 1002969) and idea
-  // 1000903 own the replacement; this pin exists so the gap stays visible until
-  // one of them lands, and so it is impossible to close this quietly.
+// ── 3. the gap is closed — a surface now calls the invite list ──────────────
+test('an invitations surface exists — the hub reads GET /my-projects/invites (task 1003774)', () => {
+  // The quoted form is the actual fetch-call shape (`API + '/my-projects/invites'`);
+  // matching on that, rather than the bare path, keeps a doc comment that merely
+  // NAMES the route from satisfying this on its own.
   const surfaces = [];
   const modules = path.join(ROOT, 'modules');
   for (const key of fs.readdirSync(modules)) {
@@ -102,11 +101,24 @@ test('the invitations API still has no caller — the tracked gap, pinned', () =
     if (!fs.existsSync(pub)) continue;
     for (const f of fs.readdirSync(pub)) {
       if (!/\.(js|html)$/.test(f)) continue;
-      if (fs.readFileSync(path.join(pub, f), 'utf8').includes('/my-projects/invites')) {
+      if (fs.readFileSync(path.join(pub, f), 'utf8').includes("'/my-projects/invites'")) {
         surfaces.push(`modules/${key}/public/${f}`);
       }
     }
   }
-  assert.deepEqual(surfaces, [],
-    `an invitations surface exists now (${surfaces.join(', ')}) — good: delete this pin and close task 1002970 / idea 1000903`);
+  assert.ok(surfaces.length > 0,
+    'no surface calls GET /my-projects/invites — the gap task 1003774 closed is back open');
+});
+
+// ── 4. the accept flip stays retired (ADR 0335) ─────────────────────────────
+// Task 1003774 restores the invitations list but deliberately does NOT wire an
+// Accept button to POST /my-projects/invites/:id/accept: that hub-only flip
+// never admits anyone into the project's own instance (ADR 0335), so it is a
+// dead end the moment a caller exists to press it. Each invite renders as a
+// way IN (a link to the project) instead — signing in there is the acceptance
+// act (task 1002969).
+test('the hub never calls the accept route — ADR 0335 retired that flip', () => {
+  const html = read('modules/public-landing/public/projects.html');
+  assert.doesNotMatch(html, /invites\/[^'"]*\/accept/,
+    'a hub caller of the accept route reopens the dead end ADR 0335 closed — render the invite as a link into the project instead');
 });

package/tests/own_scope_guard.mjs

@@ -123,6 +123,11 @@ const OWN_SCOPED_SURFACES = [
     why: 'the connection graph (ADR 0202, task 1002295). The ACTING account is always the session; a counterparty is named by public handle or by the connection row id, never by an account identifier — and the degree label is a viewer-relative own-scope read (D4 §4).',
     crossOwner: [],
   },
+  {
+    file: 'modules/platform-identity/routes/guilds.js',
+    why: 'guilds (ADR 0336, task 1002300). The ACTING account is always the session: a guild is named by slug, a person by public handle, an invite or request by its row id, and owner-only acts are re-asserted against the session inside each statement. The one public read, GET /guilds/:slug, is deliberately in routes/guilds-public.js so this whole file can be held to the rule.',
+    crossOwner: [],
+  },
   {
     file: 'modules/platform-identity/routes/my-projects.js',
     why: "the caller's OWN cross-project memberships, invitations, applications and leave (ADR 0141 §3; the application echo, ADR 0201 D1.3, task 1002284) — every route keyed on req.builder.github_id / github_login. The only path param is :clientId, which names a PROJECT and never a builder: a project is the resource being acted on, and the actor is always the session, which is why join can relay an application for nobody but the caller.",

package/tests/public_landing_projects.mjs

@@ -508,3 +508,43 @@ test('a stamped asset still serves — the query string is not part of the filen
   assert.equal(res.status, 200, 'express.static must ignore the ?v= when resolving the file');
   assert.match(res.body, /\.shell\{/, 'and it must be the real stylesheet');
 });
+
+// ── #view-mine: invitations, projects-you-build-on, join-by-URL (task 1003774) ──
+// The hall's my-projects page was deleted in task 1003308 on the owner's own
+// decision that this is a hub surface; these three reads/actions were left with
+// nowhere to live until now. loadMemberships() already fetched GET /my-projects
+// for the map's Apply button (R10, task 1002286) — this just renders the rest
+// of what that same read carries, plus the separate invites list.
+test('#view-mine reads the invitations list, alongside the building-on and join surfaces', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /\/my-projects\/invites/, 'GET /my-projects/invites must be called');
+  assert.match(body, /id="invitesList"/);
+  assert.match(body, /id="buildingList"/);
+  assert.match(body, /\/my-projects\/join/, 'the join-by-URL field must post to /my-projects/join');
+  assert.match(body, /id="joinOrigin"/);
+  assert.match(body, /id="joinNote"/, 'the applicant note (task 1002330) rides along, and stays optional');
+  assert.match(body, /\/my-projects\/'\s*\+\s*encodeURIComponent/, 'Leave must address the project by its own client id');
+  assert.match(body, /origin = 'https:\/\/' \+ origin/,
+    'a bare host ("grove.cloudbongos.com") must be assumed https:// rather than sent as-is — the server\'s origin lookup is an exact match');
+});
+
+test('an invite renders as a way INTO the project, never the retired accept flip (ADR 0335)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  // the hub-only accept flip never admits anyone to the project's own instance
+  // (ADR 0335) — a caller of it here would reopen the exact dead end that ADR
+  // retired, so the invite's action is an outbound link instead
+  assert.doesNotMatch(body, /invites\/[^'"]*\/accept/, 'no caller of the retired hub accept route');
+  assert.match(body, /Open project/, 'the invite links into the project — signing in there is the acceptance act');
+  assert.match(body, /'\/my-projects\/invites\/' \+ encodeURIComponent\([^)]+\) \+ '\/decline'/,
+    'decline still works: it only clears the hub\'s own pending row');
+});
+
+test('the map card\'s Apply button reads as truly inert once applied, with a live status region (R10 fixups)', async () => {
+  const page = await request('/projects', 'game.test.local');
+  assert.match(page.body, /id="cardApplyMsg" role="status" aria-live="polite"/, 'the apply outcome must be announced to assistive tech');
+  const stamped = (page.body.match(/\/assets\/cosmos\.css\?v=[0-9a-f]+/) || [])[0];
+  assert.ok(stamped, 'need a stamped URL to fetch');
+  const css = await request(stamped);
+  assert.match(css.body, /\.btn\.ghost:disabled\{/, 'a disabled ghost button (the Applied state) must not keep full-strength styling');
+  assert.match(css.body, /\.projCard \.cardActions \.projMsg\{flex-basis:100%;?\}/, 'the outcome must sit under the buttons, not beside them');
+});