@bongos/core 1.19.212 → 1.19.214

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.212",
-  "core_contract": "1.19.212",
-  "source_commit": "2b4762e127c88a4114c66c25801c21aef9ebf2d9",
+  "core_version": "1.19.214",
+  "core_contract": "1.19.214",
+  "source_commit": "33a353b2b8d41b5d78870cf04e367ba35270db01",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:23:19.730Z",
+  "built_at": "2026-08-17T23:48:10.122Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1301,
+    "functional_verbatim": 1302,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1632,
-  "tree_sha256": "a403f7e947eaebd53f2d3b95ff22cc32202aec1c2c0d05aa5e8fdc68dccd599c",
+  "file_count": 1633,
+  "tree_sha256": "42e8f882bc77acfe1def79c56518e80678fb0bd4d4b635f94d013e55474b1ac1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3557,7 +3557,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "7fa58e9a9c09ba4857d57fe7cc1ed36d827d34f8cc1119ae42dc9dffdd4653b5"
+      "sha256": "3d88ff6be3d8378f0cf2826af92437dfafbeb589a677aa8928d9f325124eac5b"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3652,7 +3652,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "a291701ef3b3f8bb548d8e3475707e52562d0c9f03d334a885ff2022c90358dc"
+      "sha256": "9e963e289039a6b1c64b17deae161895876831de20e4e06b947ea3b3f49afdf6"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -3892,7 +3892,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "45c8a071f8bf61bd97bce83518fe3bd1b32cff99f31281c2cba84ad500359d60"
+      "sha256": "72796558274b45faec2b1a63e332100061a6ab0c690dadc42a54f1f39cb0c68e"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "61ee2e3d2da104909ace97881b37ba3fe85535e4f1ca2adfe430c2e12a93a087"
+      "sha256": "02845f76d2382f9e1568f039c838a34505297ae619cdb9cdbe5d8b583cd1dd40"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3e6a4e9d8281f4911612230833fa96b8ff7f3461f38e5655eafaff2f032aa1fb"
+      "sha256": "6abe7a4d894357f207a16ab1735c642f46e2f5905d3845c436b6df438f66a3ac"
     },
     {
       "path": "public-docs/index.html",
@@ -5792,7 +5792,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "b1389bf7cb4d53a27d332106ddbcd9327d76521c2330b4763d4ed0919c52f2a5"
+      "sha256": "c5688194f21600a64ced6b27aa5c12b4f580db786ffcf85a151422635269aa40"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a97718759370258d16378f3e7794180173fabef4053c2f3f1d28c7357affc5dc"
+      "sha256": "53487d418120e292c09bc2f647581d2541fbf7966052420827b8d6c49c77940d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6074,6 +6074,11 @@
       "mode": "0000644",
       "sha256": "0be7221de2aa3969a54dc856a9fa1548959abd18b1a6c55e67b6ca5030e7ac1d"
     },
+    {
+      "path": "tests/auth_device_start_status.mjs",
+      "mode": "0000644",
+      "sha256": "059fededeef783635945496d3183387c1c6407e84fdddf67d14e0d14a48e9dc9"
+    },
     {
       "path": "tests/auth_duplicate_cookie.mjs",
       "mode": "0000644",
@@ -6792,7 +6797,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "4bc1ecb2bec4345b55e074a06009d31f97e4b5e06b214669a72e485298307ac8"
+      "sha256": "660dd4143c21de0fe81b4507f3cb9f0731e5722e6c77806de8327156b18198f6"
     },
     {
       "path": "tests/goal_routes.mjs",
@@ -6807,7 +6812,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "508b8b99afe67f64c86b5e1b382052e02a4cc916bec58e28d396ba3716998baf"
+      "sha256": "c2e37bb797c1e9af23970bfee7587b16cd13f1fac23c0e334a5ea0d362174491"
     },
     {
       "path": "tests/goal_wall_proof.mjs",
@@ -7842,7 +7847,7 @@
     {
       "path": "tests/setup_device_flow_fallback.mjs",
       "mode": "0000644",
-      "sha256": "9a9df92b732b4f13d222329877ab17f8f972ef01370c9a918b00635716c76b5e"
+      "sha256": "0a7c2f4a0ee050573040a88c6a246c773e7b13074115df4b4d715ab99c903a9c"
     },
     {
       "path": "tests/setup_smoke.mjs",

package/modules/lifecycle/db.js

@@ -854,15 +854,48 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 // owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
 // guards. Role changes go through PATCH /goals/:id/members/:builderId only
 // (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
+//
+// ARRIVING AS A MEMBER CLOSES ANY PENDING ASK (task 1002888 / idea 1000688).
+// The membership write used to be a bare upsert that never looked at
+// goal_membership_requests, so a builder's pending row SURVIVED their arrival by
+// any other route — the goal flips to public and they self-join, or an Archon
+// adds them directly. The stale row lingered in the owner/manager inbox, a later
+// approve resolved a request for an existing member, and a later deny stamped
+// 'rejected' on someone who is in fact a member. Harmless to access control,
+// wrong in the audit trail.
+//
+// BOTH kinds are cancelled, not just 'request'. The partial-unique index
+// (core_188: one pending row per goal+builder, either direction) means there is
+// at most ONE pending row to close, and a stale pending INVITE is the same bug
+// mirrored — the invitee could later decline an invitation to a goal they are
+// already in, stamping 'rejected' on a member. 'cancelled' is the right terminal
+// state (core_188: "withdrawn/rescinded"); 'accepted' stays reserved for an
+// accept/approve flow that actually ran, so the inbox history never claims a
+// decision nobody made. resolvedBy is the ACTOR — the joiner themselves on
+// /join, the adding owner/manager/Archon on /members.
+//
+// One CTE, not two queries — the acceptMembershipRequestAndAddMember precedent:
+// the cancel commits with the membership write or not at all, so an error
+// between them can't leave the pair half-applied. The two arms are independent
+// (Postgres runs a data-modifying CTE to completion whether or not the primary
+// query reads it), and both see the same snapshot.
 
-async function addGoalMember({ goalId, builderId, role = 'member' }, deps = {}) {
+async function addGoalMember({ goalId, builderId, role = 'member', resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `INSERT INTO goal_members (goal_id, builder_id, role)
-          VALUES ($1, $2, $3)
-     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-     RETURNING goal_id, builder_id, role, joined_at`,
-    [goalId, builderId, role]
+    `WITH added AS (
+       INSERT INTO goal_members (goal_id, builder_id, role)
+            VALUES ($1, $2, $3)
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
+       RETURNING goal_id, builder_id, role, joined_at
+     ), cancelled AS (
+       UPDATE goal_membership_requests
+          SET status = 'cancelled', resolved_by = $4, resolved_at = now(), updated_at = now()
+        WHERE goal_id = $1 AND builder_id = $2 AND status = 'pending'
+       RETURNING id
+     )
+     SELECT goal_id, builder_id, role, joined_at FROM added`,
+    [goalId, builderId, role, resolvedBy]
   );
   return rows[0];
 }

package/modules/lifecycle/routes/goals.js

@@ -580,7 +580,10 @@ module.exports = function buildGoalsRouter() {
           return res.fail('goal_private', { status: 409, message: 'This goal is private — request to join (POST /goals/:id/requests) or wait for an invitation.' });
         }
       }
-      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member' });
+      // resolvedBy: the joiner — arriving as a member cancels their own still-
+      // pending ask on this goal, atomically with the membership write (task
+      // 1002888). Self-joining is the same intent as withdrawing the request.
+      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member', resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/join', err);
@@ -939,7 +942,10 @@ module.exports = function buildGoalsRouter() {
       if (scopeIncludesProtected(goal.scope_modules) && !METIC_PLUS.includes(target.rank)) {
         return res.fail('metic_required_for_protected_scope', { status: 403, message: 'A protected-scope goal requires a Metic+ member; sub-Metic membership is deferred to the Phase-5 ADR.' });
       }
-      const member = await db.addGoalMember({ goalId: id, builderId, role });
+      // resolvedBy: the ADDER (not the target) — a direct add closes the target's
+      // pending ask, and the audit trail should name whoever admitted them
+      // (task 1002888).
+      const member = await db.addGoalMember({ goalId: id, builderId, role, resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/members', err);

package/modules/platform-identity/routes/sso.js

@@ -303,7 +303,10 @@ module.exports = function ssoRoutes() {
       res.json(out);
     } catch (err) {
       console.error('[platform-identity] /sso/device/start', err);
-      res.fail('device_start_failed', { status: 502, message: String(err.message || 'error').slice(0, 200) });
+      // 424, not 502: Cloudflare replaces origin 5xx bodies with its own page, so a
+      // proxied upstream refusal must ride a 4xx to keep its JSON diagnosis readable
+      // externally (finding W2, task 1003052 — the core device/start twin).
+      res.fail('device_start_failed', { status: 424, message: String(err.message || 'error').slice(0, 200) });
     }
   });
 
@@ -343,7 +346,11 @@ module.exports = function ssoRoutes() {
       res.json({ state: 'ok', assertion });
     } catch (err) {
       console.error('[platform-identity] /sso/device/poll', err);
-      res.fail('device_poll_failed', { status: 500, message: 'internal error' });
+      // 424, matching the core device/poll (finding W2, task 1003052): this catch
+      // proxies the hub's GitHub poll refusals, and a 5xx body never survives
+      // Cloudflare. (The !out.client_id branch above keeps its 500: an internal
+      // invariant breach, not an upstream proxy.)
+      res.fail('device_poll_failed', { status: 424, message: 'internal error' });
     }
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.212",
+  "version": "1.19.214",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.212",
+      "version": "1.19.214",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.212",
+  "version": "1.19.214",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/auth.js

@@ -320,9 +320,13 @@ module.exports = function buildAuthRouter() {
       // Surface the underlying reason (task 2126). A thrown device-flow start is almost
       // always a GitHub OAuth-App misconfig (device_flow_disabled / bad client) — safe,
       // non-secret, and actionable — so return it instead of an opaque "internal error".
-      // 502: the failure is upstream (GitHub), not a bug in this server.
+      // 424 (failed dependency), NOT 502: the failure IS upstream (GitHub), but
+      // Cloudflare replaces an origin 5xx body with its own bare error page, so the
+      // diagnosis never reached an external caller — the walk's single most likely
+      // fresh-instance auth failure could only be read via curl on the box itself
+      // (finding W2, task 1003052). A 4xx passes the proxy with the JSON intact.
       const reason = String(err && err.message ? err.message : 'internal error').slice(0, 300);
-      res.fail('device_start_failed', { status: 502, message: reason });
+      res.fail('device_start_failed', { status: 424, message: reason });
     }
   });
 
@@ -349,7 +353,10 @@ module.exports = function buildAuthRouter() {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
       console.error('[gds] device/poll', err);
-      res.fail('device_poll_failed', { status: 500, message: 'internal error' });
+      // 424 for the same reason as device/start above (finding W2, task 1003052):
+      // this catch proxies GitHub's poll refusals too, and a 5xx body never
+      // survives Cloudflare — the JSON envelope (its code at minimum) must.
+      res.fail('device_poll_failed', { status: 424, message: 'internal error' });
     }
   });
 

package/src/module-api.js

@@ -851,8 +851,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.210 with no explicit bump. run 32079512489. (task 1002620)
 //   1.19.212 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.211 with no explicit bump. run 32080157462. (task 1002620)
+//   1.19.213 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
+//   1.19.214 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.213 with no explicit bump. run 32081917908. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.212'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.214'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_device_start_status.mjs

@@ -0,0 +1,101 @@
+// tests/auth_device_start_status.mjs — a proxied upstream refusal must SURVIVE
+// Cloudflare (walk finding W2, task 1003052).
+//
+// The repro this pins: GitHub refuses POST /auth/device/start (e.g. Device Flow
+// disabled on the app) and the route used to proxy that as HTTP 502 with a JSON
+// diagnosis in the body — but Cloudflare REPLACES origin 5xx bodies with its own
+// bare "error code: 502" page, so an external caller got zero information; the
+// real message was only readable via curl on the box itself. The fix is the
+// status-code choice: a 4xx (424 failed dependency) passes the proxy with the
+// JSON envelope intact.
+//
+// DB-free + network-free: auth.startDeviceFlow / authConfigured are stubbed on
+// the cached auth module (the github_token_store.mjs pattern).
+//
+// THE SWEEP (task 1003052's done-when requires it recorded): upstream-refusal
+// proxies found on the auth surface and how each was dispositioned —
+//   • device_start_failed (core routes/auth.js + the platform-identity SSO
+//     twin) — FIXED, 502 → 424 (the W2 repro itself).
+//   • device_poll_failed catch blocks (both files) — FIXED, 500 → 424: the
+//     poll leg proxies GitHub refusals the same way.
+//   • sso.js `!out.client_id` → device_poll_failed 500 — KEPT 500: an internal
+//     invariant breach, not an upstream proxy.
+//   • routes/github.js github_error 502 ×4 (repo list/create + visibility
+//     read/flip) — NOTED, not fixed: same eaten-body class, but the consuming
+//     UI already renders generic copy on any failure; candidates for the same
+//     4xx treatment.
+//   • platform-identity my-projects.js join_relay_failed 502 — NOTED: same class.
+//   • auth_not_configured / idp_not_configured 503s — NOTED: config-state
+//     answers, not upstream proxies, but their bodies are equally eaten by
+//     Cloudflare (the blocker-1000105 class) if external diagnosability ever
+//     matters there.
+//   • api-errors.js catalogs bad_gateway=502 — any route leaning on it
+//     inherits the hazard.
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+const buildAuthRouter = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+function fakeRes() {
+  const res = { _status: 200, _body: null };
+  res.status = (c) => { res._status = c; return res; };
+  res.json = (b) => { res._body = b; return res; };
+  attachFail({}, res, () => {});
+  return res;
+}
+function finalHandler(router, method, pth) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pth && l.route.methods[method]);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle;
+}
+
+test('an upstream device-flow refusal answers 424 with the diagnosis intact — never a Cloudflare-eaten 5xx', async () => {
+  const orig = { configured: auth.authConfigured, start: auth.startDeviceFlow };
+  auth.authConfigured = () => true;
+  auth.startDeviceFlow = async () => {
+    throw new Error('GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app.');
+  };
+  try {
+    const handler = finalHandler(buildAuthRouter(), 'post', '/auth/device/start');
+    const res = fakeRes();
+    await handler({}, res);
+    assert.equal(res._status, 424, 'a 4xx passes Cloudflare with its body; a 5xx does not');
+    assert.ok(res._status < 500, 'the whole 5xx range is the Cloudflare-intercepted range');
+    assert.equal(res._body.error.code, 'device_start_failed');
+    assert.match(res._body.error.message, /device_flow_disabled/,
+      'the upstream reason travels in the body — this is the diagnosis W2 lost');
+  } finally {
+    auth.authConfigured = orig.configured;
+    auth.startDeviceFlow = orig.start;
+  }
+});
+
+test('the sweep holds: no device-flow refusal site anywhere proxies a 5xx from a catch', () => {
+  // The same refusal codes are minted in two places (the core routes and the
+  // platform-identity SSO hub twins); a consumer must never see two statuses.
+  // The one sanctioned 500 is sso.js's `!out.client_id` internal-invariant
+  // branch — recognizable because it is NOT inside a catch's console.error run.
+  for (const file of [
+    'src/bongos/routes/auth.js',
+    'modules/platform-identity/routes/sso.js',
+  ]) {
+    const src = fs.readFileSync(path.join(ROOT, file), 'utf8');
+    for (const m of src.matchAll(/device_start_failed',\s*\{\s*status:\s*(\d+)/g)) {
+      assert.ok(Number(m[1]) < 500,
+        `${file} proxies device_start_failed as ${m[1]} — Cloudflare eats 5xx bodies (W2)`);
+    }
+    for (const m of src.matchAll(/console\.error\([^\n]*device\/poll[^\n]*\);[\s\S]{0,400}?device_poll_failed',\s*\{\s*status:\s*(\d+)/g)) {
+      assert.ok(Number(m[1]) < 500,
+        `${file}'s device/poll catch proxies device_poll_failed as ${m[1]} — same W2 class`);
+    }
+  }
+});

package/tests/goal_membership_requests.mjs

@@ -13,6 +13,8 @@
 //   • listInboxFor — the three buckets, and that joinRequests gates on
 //     owner (goals.created_by) OR manager (goal_members 'lead').
 //   • listPendingRequestsForGoal — pending both-kinds for one goal.
+//   • addGoalMember (task 1002888) — arriving as a member by ANY route cancels
+//     that builder's still-pending ask, atomically and kind-agnostically.
 //   • the migration is additive + private-safe (default 'public', partial unique).
 
 import { strict as assert } from 'node:assert';
@@ -31,6 +33,7 @@ const {
   getMembershipRequest,
   resolveMembershipRequest,
   acceptMembershipRequestAndAddMember,
+  addGoalMember,
   listInboxFor,
   listPendingRequestsForGoal,
 } = require('../modules/lifecycle/db.js');
@@ -190,6 +193,92 @@ await test('listPendingRequestsForGoal: pending both-kinds for one goal', async
   assert.deepEqual(find(pool.queries, /goal_membership_requests/).params, [5]);
 });
 
+// =========================================================================
+// addGoalMember — arriving as a member CLOSES any pending ask (task 1002888 /
+// idea 1000688). The bug: the membership write was a bare upsert that never
+// read goal_membership_requests, so a pending row survived the builder's
+// arrival by any OTHER route (visibility flips to public and they self-join;
+// an Archon adds them directly). The stale row sat in the owner/manager inbox,
+// a later approve resolved a request for an existing member, and a later deny
+// stamped 'rejected' on someone who is in fact a member.
+// =========================================================================
+
+const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+const addMemberPool = () => fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [ADD_MEMBER_ROW] } : null));
+
+// join-cancels-request: the joiner arrives under their own steam.
+await test('addGoalMember: a join cancels the joiner\'s pending ask in ONE statement', async () => {
+  const pool = addMemberPool();
+  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member', resolvedBy: 42 }, { pool });
+  assert.deepEqual(out, ADD_MEMBER_ROW, 'still returns the member row — the route response shape is unchanged');
+  assert.equal(pool.queries.length, 1, 'ONE statement: the cancel commits with the membership write or not at all');
+  const q = find(pool.queries, /^WITH added AS/);
+  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/.test(norm(q.sql)),
+    'the membership upsert is the first arm, role still preserved (task 1002689)');
+  assert.ok(/UPDATE goal_membership_requests[\s\S]*SET status = 'cancelled', resolved_by = \$4/.test(norm(q.sql)),
+    'the second arm closes the ask as cancelled, attributed to the actor');
+  assert.ok(/WHERE goal_id = \$1 AND builder_id = \$2 AND status = 'pending'/.test(norm(q.sql)),
+    'scoped to THIS goal+builder, and only a pending row');
+  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, role, resolvedBy — in that order');
+});
+
+// add-cancels-request: an owner/manager/Archon admits them directly. Same
+// statement; resolvedBy is the ADDER, so the audit trail names who admitted them.
+await test('addGoalMember: a direct member-add cancels the target\'s pending ask, attributed to the adder', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, role: 'lead', resolvedBy: 99 }, { pool });
+  const q = find(pool.queries, /^WITH added AS/);
+  assert.deepEqual(q.params, [7, 42, 'lead', 99],
+    'resolved_by is the ADDER (99), not the target (42) — who admitted them is the audit fact');
+});
+
+// The mirror-case decision (task 1002888): a stale pending INVITE is the same
+// bug reflected — the invitee could later decline an invitation to a goal they
+// are already in, stamping 'rejected' on a member. core_188's partial-unique
+// index allows at most ONE pending row per (goal, builder) in EITHER direction,
+// so "any pending row" is unambiguous and the cancel is deliberately kind-blind.
+await test('addGoalMember: the cancel is kind-AGNOSTIC — a stale pending invite closes too', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, resolvedBy: 42 }, { pool });
+  const cancelArm = norm(find(pool.queries, /^WITH added AS/).sql).match(/UPDATE goal_membership_requests.*?RETURNING id/)[0];
+  assert.ok(!/kind\s*=/.test(cancelArm),
+    'no kind filter: both a pending request and a pending invite are closed by arrival');
+});
+
+// 'accepted' stays reserved for an accept/approve flow that actually ran, so the
+// inbox history never claims a decision nobody made; resolved rows are the audit
+// trail and must survive untouched.
+await test('addGoalMember: closes as \'cancelled\' (never \'accepted\'), and only pending rows', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, resolvedBy: 42 }, { pool });
+  const sql = norm(find(pool.queries, /^WITH added AS/).sql);
+  assert.ok(!/status = 'accepted'/.test(sql), "arrival never fabricates an 'accepted' decision");
+  assert.ok(/status = 'pending'/.test(sql), 'already-resolved rows stay as the audit trail');
+});
+
+await test('addGoalMember: resolvedBy defaults to null for a non-route caller', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
+  assert.equal(find(pool.queries, /^WITH added AS/).params[3], null);
+});
+
+// Both route call sites must actually SUPPLY the actor — the db helper defaults
+// resolvedBy to null, so a missed wire-up would silently drop the attribution
+// while still cancelling. The routes are verified against live Postgres (see
+// goal_routes.mjs header), so this pins the wiring at the source level.
+await test('routes: both /join and /members pass resolvedBy to addGoalMember', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const calls = src.match(/db\.addGoalMember\(\{[^}]*\}\)/g) || [];
+  assert.equal(calls.length, 2, 'exactly two membership-add call sites: POST /join and POST /members');
+  for (const c of calls) {
+    assert.ok(/resolvedBy:\s*req\.builder\.id/.test(c),
+      `every membership add attributes the cancel to the acting builder — got: ${c}`);
+  }
+  assert.ok(calls.some((c) => /builderId:\s*req\.builder\.id/.test(c)), '/join adds the caller themselves');
+  assert.ok(calls.some((c) => /builderId,/.test(c)), '/members adds the named target builder');
+});
+
 // =========================================================================
 // The migration is additive + private-safe
 // =========================================================================

package/tests/goal_tier.mjs

@@ -154,20 +154,25 @@ await test('setGoalStatus: unknown goal returns null', async () => {
 // =========================================================================
 // addGoalMember
 // =========================================================================
+// task 1002888 wrapped the bare upsert in a CTE that also cancels any pending
+// membership request, so the statement now STARTS with `WITH added AS (` — the
+// INSERT is the first arm. The pending-ask cancellation itself is pinned in
+// tests/goal_membership_requests.mjs; here we only re-anchor the role contract.
 await test('addGoalMember: upsert PRESERVES the existing role (re-join cannot demote a lead)', async () => {
-  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
   const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member' }, { pool });
   assert.equal(out.role, 'lead', 'an existing lead row survives a role:member re-add');
-  const ins = find(pool.queries, /^INSERT INTO goal_members/);
-  assert.deepEqual(ins.params, [7, 42, 'member']);
+  const ins = find(pool.queries, /^WITH added AS/);
+  assert.deepEqual(ins.params, [7, 42, 'member', null], 'resolvedBy defaults to null when no actor is supplied');
+  assert.match(ins.sql, /INSERT INTO goal_members/, 'the membership write is the first CTE arm');
   assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/,
     'conflict keeps the stored role — role changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
 });
 
 await test('addGoalMember: role defaults to member', async () => {
-  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [MEMBER_ROW] } : null));
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [MEMBER_ROW] } : null));
   await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
-  assert.equal(find(pool.queries, /^INSERT INTO goal_members/).params[2], 'member');
+  assert.equal(find(pool.queries, /^WITH added AS/).params[2], 'member');
 });
 
 // =========================================================================

package/tests/setup_device_flow_fallback.mjs

@@ -51,10 +51,12 @@ const ta = async (name, fn) => {
 
 console.log('isDeviceFlowDisabled — the refusal detector:');
 
-// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:502,
+// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:424,
 // message: 'GitHub rejected device-flow start: device_flow_disabled — …'}).
+// (424 since task 1003052 — a 502's body was eaten by Cloudflare; the detector
+// matches on TEXT, so both the new 424 and an older server's 502 register.)
 const REAL_REFUSAL = {
-  ok: false, status: 502,
+  ok: false, status: 424,
   data: { error: { code: 'device_start_failed', message: 'GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app: open https://github.com/settings/apps, open your app, check "Enable Device Flow", and save. Web sign-in is unaffected.' } },
 };
 
@@ -62,6 +64,10 @@ t('matches the real device_start_failed envelope carrying device_flow_disabled',
   assert.equal(setup.isDeviceFlowDisabled(REAL_REFUSAL), true);
 });
 
+t('still matches an older server\'s 502 shape — the CLI talks to many core versions', () => {
+  assert.equal(setup.isDeviceFlowDisabled({ ...REAL_REFUSAL, status: 502 }), true);
+});
+
 t('matches a legacy flat error shape too', () => {
   assert.equal(setup.isDeviceFlowDisabled({ ok: false, status: 502, data: { error: 'device_start_failed', message: 'x device_flow_disabled y' } }), true);
 });