@bongos/core 1.19.213 → 1.19.215

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.213",
-  "core_contract": "1.19.213",
-  "source_commit": "7cd1ca35002e12c66a3937a55bf8c9e6e69fd231",
+  "core_version": "1.19.215",
+  "core_contract": "1.19.215",
+  "source_commit": "697713806bfbd222ba0423c021aee84f56218f10",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:35:49.388Z",
+  "built_at": "2026-08-18T00:22:11.691Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1633,
-  "tree_sha256": "08e3fcc476f1d9209616049d1d79c946c56394953d7891706e2e41f8e3b28067",
+  "tree_sha256": "61d4b6bf40452f45053fe94cf02b44d682b2aed0e9684b0799a0d33eda1f675d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1372,7 +1372,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "274bd57fc6c0b83aba02cedb5cc6daa2fca4a9d74ae5268e527a81ebc10b50e0"
+      "sha256": "675d873f35c886145c80d954b885692ef0608b4e5b1b843943611f59260eceed"
     },
     {
       "path": "docs/architecture.md",
@@ -3557,7 +3557,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "7fa58e9a9c09ba4857d57fe7cc1ed36d827d34f8cc1119ae42dc9dffdd4653b5"
+      "sha256": "3d88ff6be3d8378f0cf2826af92437dfafbeb589a677aa8928d9f325124eac5b"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3652,7 +3652,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "a291701ef3b3f8bb548d8e3475707e52562d0c9f03d334a885ff2022c90358dc"
+      "sha256": "8763c40223e27e9d6fc65ea76442e479301407ba70e77b9582c5ffcd09f17a11"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b9113d8027c9a36b9d9923e3a850c655a0dfb57ce59633ba81042f1116127882"
+      "sha256": "5a687e1b2df8e52068aaa27dfa92dd50ed65164905c74f9fe121750d023e95d9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "27122dc34fcd4dbe96f345a2cdf6045447a4a94a20217e43f52c803e25576e02"
+      "sha256": "6b2203d8fa449d80e6ff225fd5f8dbe4969b4a72ca94ff61e478635fb754d445"
     },
     {
       "path": "public-docs/index.html",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c59f5553c52308967b71da155eab8249d7c8687a37184626b4c4b03ccf2d9fc7"
+      "sha256": "e2884e30e53fd3fe3c121df94ce9738bde706f3ddb414c023e6fd546ec1777ab"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6797,7 +6797,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "4bc1ecb2bec4345b55e074a06009d31f97e4b5e06b214669a72e485298307ac8"
+      "sha256": "59253dac0064ae1a9c7dd67ef87c1d32ff924d3c3dadf7cdb9553dbc76f88eb0"
     },
     {
       "path": "tests/goal_routes.mjs",
@@ -6812,7 +6812,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "508b8b99afe67f64c86b5e1b382052e02a4cc916bec58e28d396ba3716998baf"
+      "sha256": "c2e37bb797c1e9af23970bfee7587b16cd13f1fac23c0e334a5ea0d362174491"
     },
     {
       "path": "tests/goal_wall_proof.mjs",

package/docs/api/openapi.json

@@ -4276,7 +4276,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/invitations/:reqId/respond",
-        "description": "POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the invited builder resolves their OWN pending invite (task 1952). accept → they're added as a member; decline → the row is rejected. A protected-scope goal still requires a Metic+ member, re-checked against the accepting builder's current rank (the goal could have been re-scoped after the invite). rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the invited builder resolves their OWN pending invite (task 1952). accept → they're added as a member (only while the goal is still OPEN, and a protected-scope goal still requires a Metic+ member — both re-checked against the CURRENT goal row by authorizeInvitationAccept, task 1002887); decline → the row is rejected, allowed whatever the goal's state, since that is inbox cleanup rather than admission. rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/goals.js",
         "parameters": [

package/modules/lifecycle/db.js

@@ -854,15 +854,48 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 // owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
 // guards. Role changes go through PATCH /goals/:id/members/:builderId only
 // (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
+//
+// ARRIVING AS A MEMBER CLOSES ANY PENDING ASK (task 1002888 / idea 1000688).
+// The membership write used to be a bare upsert that never looked at
+// goal_membership_requests, so a builder's pending row SURVIVED their arrival by
+// any other route — the goal flips to public and they self-join, or an Archon
+// adds them directly. The stale row lingered in the owner/manager inbox, a later
+// approve resolved a request for an existing member, and a later deny stamped
+// 'rejected' on someone who is in fact a member. Harmless to access control,
+// wrong in the audit trail.
+//
+// BOTH kinds are cancelled, not just 'request'. The partial-unique index
+// (core_188: one pending row per goal+builder, either direction) means there is
+// at most ONE pending row to close, and a stale pending INVITE is the same bug
+// mirrored — the invitee could later decline an invitation to a goal they are
+// already in, stamping 'rejected' on a member. 'cancelled' is the right terminal
+// state (core_188: "withdrawn/rescinded"); 'accepted' stays reserved for an
+// accept/approve flow that actually ran, so the inbox history never claims a
+// decision nobody made. resolvedBy is the ACTOR — the joiner themselves on
+// /join, the adding owner/manager/Archon on /members.
+//
+// One CTE, not two queries — the acceptMembershipRequestAndAddMember precedent:
+// the cancel commits with the membership write or not at all, so an error
+// between them can't leave the pair half-applied. The two arms are independent
+// (Postgres runs a data-modifying CTE to completion whether or not the primary
+// query reads it), and both see the same snapshot.
 
-async function addGoalMember({ goalId, builderId, role = 'member' }, deps = {}) {
+async function addGoalMember({ goalId, builderId, role = 'member', resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `INSERT INTO goal_members (goal_id, builder_id, role)
-          VALUES ($1, $2, $3)
-     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-     RETURNING goal_id, builder_id, role, joined_at`,
-    [goalId, builderId, role]
+    `WITH added AS (
+       INSERT INTO goal_members (goal_id, builder_id, role)
+            VALUES ($1, $2, $3)
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
+       RETURNING goal_id, builder_id, role, joined_at
+     ), cancelled AS (
+       UPDATE goal_membership_requests
+          SET status = 'cancelled', resolved_by = $4, resolved_at = now(), updated_at = now()
+        WHERE goal_id = $1 AND builder_id = $2 AND status = 'pending'
+       RETURNING id
+     )
+     SELECT goal_id, builder_id, role, joined_at FROM added`,
+    [goalId, builderId, role, resolvedBy]
   );
   return rows[0];
 }

package/modules/lifecycle/routes/goals.js

@@ -324,6 +324,44 @@ function authorizeInvitationResponse({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// authorizeInvitationAccept — the ORDERED, FAIL-CLOSED gate for the ACCEPT half of
+// POST /goals/:id/invitations/:reqId/respond, run against the GOAL after
+// authorizeInvitationResponse has cleared the request row (task 1002887).
+//
+// Accepting is an ADMISSION, so it needs the same goal-state floor every other
+// admission path already has: the create side requires an open goal
+// (authorizeGoalManagement) and the join-request approve side inherits that check
+// verbatim — only invitation-accept was missing it, so an invite issued while a
+// goal was open could still add a member AFTER the goal was achieved or archived.
+// DECLINE is deliberately NOT gated here: clearing a stale invitation out of your
+// inbox is cleanup, not admission (the route returns before calling this).
+// Ordering mirrors the sibling routes: goal_not_found → goal_not_open →
+// metic_required_for_protected_scope (the pre-existing protected-scope membership
+// floor, re-asserted against the ACCEPTING builder's current rank because the goal
+// may have been re-scoped since the invite; the actor-is-Archon half of
+// protectedScopeAdmissionBlock does not apply — the invitee is consenting).
+//
+// Unlike its {status, body} siblings this returns a res.fail SPEC ({ code, status,
+// message, details }) because the accept branch already answers through res.fail —
+// routing it through the envelope keeps the existing metic_required_for_protected_scope
+// response byte-identical while still being PURE + exported for DB-free tests.
+function authorizeInvitationAccept({ goal, scopeProtected, actorRank }) {
+  if (!goal) {
+    return { ok: false, code: 'goal_not_found', status: 404,
+      message: 'The goal behind this invitation no longer exists.' };
+  }
+  if (goal.status !== 'open') {
+    return { ok: false, code: 'goal_not_open', status: 409,
+      message: 'This goal is no longer open — an invitation can only be accepted while it is. You can still decline it.',
+      details: { status: goal.status } };
+  }
+  if (scopeProtected && !METIC_PLUS.includes(actorRank)) {
+    return { ok: false, code: 'metic_required_for_protected_scope', status: 403,
+      message: 'This goal is scoped to a protected module and requires a Metic+ member.' };
+  }
+  return { ok: true };
+}
+
 // authorizeJoinRequestResponse — the gate for POST /goals/:id/requests/:reqId/respond
 // (task 1952): an owner|manager|Archon approves/denies a pending join-request. The
 // authority prefix is authorizeGoalManagement VERBATIM (goal exists/open + owner|
@@ -580,7 +618,10 @@ module.exports = function buildGoalsRouter() {
           return res.fail('goal_private', { status: 409, message: 'This goal is private — request to join (POST /goals/:id/requests) or wait for an invitation.' });
         }
       }
-      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member' });
+      // resolvedBy: the joiner — arriving as a member cancels their own still-
+      // pending ask on this goal, atomically with the membership write (task
+      // 1002888). Self-joining is the same intent as withdrawing the request.
+      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member', resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/join', err);
@@ -786,9 +827,10 @@ module.exports = function buildGoalsRouter() {
 
   // POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the
   // invited builder resolves their OWN pending invite (task 1952). accept → they're
-  // added as a member; decline → the row is rejected. A protected-scope goal still
-  // requires a Metic+ member, re-checked against the accepting builder's current rank
-  // (the goal could have been re-scoped after the invite).
+  // added as a member (only while the goal is still OPEN, and a protected-scope goal
+  // still requires a Metic+ member — both re-checked against the CURRENT goal row by
+  // authorizeInvitationAccept, task 1002887); decline → the row is rejected, allowed
+  // whatever the goal's state, since that is inbox cleanup rather than admission.
   // rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.
   router.post('/goals/:id/invitations/:reqId/respond', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_goal_id' });
@@ -811,13 +853,14 @@ module.exports = function buildGoalsRouter() {
         return res.json({ ok: true, action, request: resolved });
       }
 
-      // accept — re-assert the protected-scope Metic+ membership invariant against
-      // the accepting builder's CURRENT rank (the goal may have been re-scoped since
-      // the invite). The invitee is consenting, so the actor-is-Archon half of the
-      // admission rule does NOT apply here — only the Metic+ membership floor does.
+      // accept — the goal-state + protected-scope floor, read against the goal's
+      // CURRENT row (fail-closed if it is gone). See authorizeInvitationAccept.
       const goal = await db.getGoal(id);
-      if (goal && scopeIncludesProtected(goal.scope_modules) && !METIC_PLUS.includes(req.builder.rank)) {
-        return res.fail('metic_required_for_protected_scope', { status: 403, message: 'This goal is scoped to a protected module and requires a Metic+ member.' });
+      const admit = authorizeInvitationAccept({
+        goal, scopeProtected: !!goal && scopeIncludesProtected(goal.scope_modules), actorRank: req.builder.rank,
+      });
+      if (!admit.ok) {
+        return res.fail(admit.code, { status: admit.status, message: admit.message, details: admit.details });
       }
       // Resolve + add atomically (one statement) — never an 'accepted' invite
       // with no membership (the task-1952 review fix).
@@ -939,7 +982,10 @@ module.exports = function buildGoalsRouter() {
       if (scopeIncludesProtected(goal.scope_modules) && !METIC_PLUS.includes(target.rank)) {
         return res.fail('metic_required_for_protected_scope', { status: 403, message: 'A protected-scope goal requires a Metic+ member; sub-Metic membership is deferred to the Phase-5 ADR.' });
       }
-      const member = await db.addGoalMember({ goalId: id, builderId, role });
+      // resolvedBy: the ADDER (not the target) — a direct add closes the target's
+      // pending ask, and the audit trail should name whoever admitted them
+      // (task 1002888).
+      const member = await db.addGoalMember({ goalId: id, builderId, role, resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/members', err);
@@ -1499,6 +1545,9 @@ module.exports.RESOLVE_ACTIONS = RESOLVE_ACTIONS;
 module.exports.protectedScopeAdmissionBlock = protectedScopeAdmissionBlock;
 module.exports.authorizeCreateJoinRequest = authorizeCreateJoinRequest;
 module.exports.authorizeInvitationResponse = authorizeInvitationResponse;
+// task 1002887: the goal-state floor on the ACCEPT half of the invitation-respond
+// route — exported for tests/goal_membership_requests.mjs, same precedent.
+module.exports.authorizeInvitationAccept = authorizeInvitationAccept;
 module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.213",
+  "version": "1.19.215",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.213",
+      "version": "1.19.215",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.213",
+  "version": "1.19.215",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -853,8 +853,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.211 with no explicit bump. run 32080157462. (task 1002620)
 //   1.19.213 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
+//   1.19.214 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.213 with no explicit bump. run 32081917908. (task 1002620)
+//   1.19.215 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.214 with no explicit bump. run 32084187695. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.213'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.215'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -13,6 +13,11 @@
 //   • listInboxFor — the three buckets, and that joinRequests gates on
 //     owner (goals.created_by) OR manager (goal_members 'lead').
 //   • listPendingRequestsForGoal — pending both-kinds for one goal.
+//   • addGoalMember (task 1002888) — arriving as a member by ANY route cancels
+//     that builder's still-pending ask, atomically and kind-agnostically.
+//   • authorizeInvitationAccept (task 1002887) — accepting an invite re-checks the
+//     goal is still OPEN (a stale invite can't admit to an achieved/archived goal);
+//     declining stays allowed, so the route declines before ever reading the goal.
 //   • the migration is additive + private-safe (default 'public', partial unique).
 
 import { strict as assert } from 'node:assert';
@@ -31,6 +36,7 @@ const {
   getMembershipRequest,
   resolveMembershipRequest,
   acceptMembershipRequestAndAddMember,
+  addGoalMember,
   listInboxFor,
   listPendingRequestsForGoal,
 } = require('../modules/lifecycle/db.js');
@@ -39,6 +45,7 @@ const {
   protectedScopeAdmissionBlock,
   authorizeCreateJoinRequest,
   authorizeInvitationResponse,
+  authorizeInvitationAccept,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
@@ -190,6 +197,92 @@ await test('listPendingRequestsForGoal: pending both-kinds for one goal', async
   assert.deepEqual(find(pool.queries, /goal_membership_requests/).params, [5]);
 });
 
+// =========================================================================
+// addGoalMember — arriving as a member CLOSES any pending ask (task 1002888 /
+// idea 1000688). The bug: the membership write was a bare upsert that never
+// read goal_membership_requests, so a pending row survived the builder's
+// arrival by any OTHER route (visibility flips to public and they self-join;
+// an Archon adds them directly). The stale row sat in the owner/manager inbox,
+// a later approve resolved a request for an existing member, and a later deny
+// stamped 'rejected' on someone who is in fact a member.
+// =========================================================================
+
+const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+const addMemberPool = () => fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [ADD_MEMBER_ROW] } : null));
+
+// join-cancels-request: the joiner arrives under their own steam.
+await test('addGoalMember: a join cancels the joiner\'s pending ask in ONE statement', async () => {
+  const pool = addMemberPool();
+  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member', resolvedBy: 42 }, { pool });
+  assert.deepEqual(out, ADD_MEMBER_ROW, 'still returns the member row — the route response shape is unchanged');
+  assert.equal(pool.queries.length, 1, 'ONE statement: the cancel commits with the membership write or not at all');
+  const q = find(pool.queries, /^WITH added AS/);
+  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/.test(norm(q.sql)),
+    'the membership upsert is the first arm, role still preserved (task 1002689)');
+  assert.ok(/UPDATE goal_membership_requests[\s\S]*SET status = 'cancelled', resolved_by = \$4/.test(norm(q.sql)),
+    'the second arm closes the ask as cancelled, attributed to the actor');
+  assert.ok(/WHERE goal_id = \$1 AND builder_id = \$2 AND status = 'pending'/.test(norm(q.sql)),
+    'scoped to THIS goal+builder, and only a pending row');
+  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, role, resolvedBy — in that order');
+});
+
+// add-cancels-request: an owner/manager/Archon admits them directly. Same
+// statement; resolvedBy is the ADDER, so the audit trail names who admitted them.
+await test('addGoalMember: a direct member-add cancels the target\'s pending ask, attributed to the adder', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, role: 'lead', resolvedBy: 99 }, { pool });
+  const q = find(pool.queries, /^WITH added AS/);
+  assert.deepEqual(q.params, [7, 42, 'lead', 99],
+    'resolved_by is the ADDER (99), not the target (42) — who admitted them is the audit fact');
+});
+
+// The mirror-case decision (task 1002888): a stale pending INVITE is the same
+// bug reflected — the invitee could later decline an invitation to a goal they
+// are already in, stamping 'rejected' on a member. core_188's partial-unique
+// index allows at most ONE pending row per (goal, builder) in EITHER direction,
+// so "any pending row" is unambiguous and the cancel is deliberately kind-blind.
+await test('addGoalMember: the cancel is kind-AGNOSTIC — a stale pending invite closes too', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, resolvedBy: 42 }, { pool });
+  const cancelArm = norm(find(pool.queries, /^WITH added AS/).sql).match(/UPDATE goal_membership_requests.*?RETURNING id/)[0];
+  assert.ok(!/kind\s*=/.test(cancelArm),
+    'no kind filter: both a pending request and a pending invite are closed by arrival');
+});
+
+// 'accepted' stays reserved for an accept/approve flow that actually ran, so the
+// inbox history never claims a decision nobody made; resolved rows are the audit
+// trail and must survive untouched.
+await test('addGoalMember: closes as \'cancelled\' (never \'accepted\'), and only pending rows', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, resolvedBy: 42 }, { pool });
+  const sql = norm(find(pool.queries, /^WITH added AS/).sql);
+  assert.ok(!/status = 'accepted'/.test(sql), "arrival never fabricates an 'accepted' decision");
+  assert.ok(/status = 'pending'/.test(sql), 'already-resolved rows stay as the audit trail');
+});
+
+await test('addGoalMember: resolvedBy defaults to null for a non-route caller', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
+  assert.equal(find(pool.queries, /^WITH added AS/).params[3], null);
+});
+
+// Both route call sites must actually SUPPLY the actor — the db helper defaults
+// resolvedBy to null, so a missed wire-up would silently drop the attribution
+// while still cancelling. The routes are verified against live Postgres (see
+// goal_routes.mjs header), so this pins the wiring at the source level.
+await test('routes: both /join and /members pass resolvedBy to addGoalMember', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const calls = src.match(/db\.addGoalMember\(\{[^}]*\}\)/g) || [];
+  assert.equal(calls.length, 2, 'exactly two membership-add call sites: POST /join and POST /members');
+  for (const c of calls) {
+    assert.ok(/resolvedBy:\s*req\.builder\.id/.test(c),
+      `every membership add attributes the cancel to the acting builder — got: ${c}`);
+  }
+  assert.ok(calls.some((c) => /builderId:\s*req\.builder\.id/.test(c)), '/join adds the caller themselves');
+  assert.ok(calls.some((c) => /builderId,/.test(c)), '/members adds the named target builder');
+});
+
 // =========================================================================
 // The migration is additive + private-safe
 // =========================================================================
@@ -281,6 +374,54 @@ await test('authorizeInvitationResponse: the invitee (string vs number id) → A
   assert.deepEqual(authorizeInvitationResponse({ request: INVITE, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// authorizeInvitationAccept (task 1002887) — the goal-state floor on ACCEPT only.
+const OPEN_GOAL = { id: 5, status: 'open', scope_modules: null };
+await test('authorizeInvitationAccept: open, unprotected goal → ALLOW', () => {
+  assert.deepEqual(authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: false, actorRank: 'thetes' }), { ok: true });
+});
+await test('authorizeInvitationAccept: the goal is gone → 404 (fail-closed, never a member of nothing)', () => {
+  const d = authorizeInvitationAccept({ goal: null, scopeProtected: false, actorRank: 'archon' });
+  assert.equal(d.ok, false); assert.equal(d.status, 404); assert.equal(d.code, 'goal_not_found');
+});
+for (const status of ['achieved', 'archived']) {
+  await test(`authorizeInvitationAccept: ${status} goal → 409 goal_not_open (a stale invite can't admit)`, () => {
+    const d = authorizeInvitationAccept({ goal: { ...OPEN_GOAL, status }, scopeProtected: false, actorRank: 'archon' });
+    assert.equal(d.ok, false); assert.equal(d.status, 409); assert.equal(d.code, 'goal_not_open');
+    assert.deepEqual(d.details, { status }, 'carries the blocking status, like every sibling goal_not_open');
+  });
+}
+await test('authorizeInvitationAccept: goal-state is checked BEFORE scope (ordering, like the join route)', () => {
+  const d = authorizeInvitationAccept({ goal: { ...OPEN_GOAL, status: 'archived' }, scopeProtected: true, actorRank: 'thetes' });
+  assert.equal(d.code, 'goal_not_open', 'a closed goal refuses on state, not on the scope floor');
+});
+await test('authorizeInvitationAccept: open + protected + sub-Metic invitee → 403 metic_required (unchanged)', () => {
+  const d = authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: true, actorRank: 'thetes' });
+  assert.equal(d.status, 403); assert.equal(d.code, 'metic_required_for_protected_scope');
+  assert.equal(d.message, 'This goal is scoped to a protected module and requires a Metic+ member.');
+  assert.equal(d.details, undefined, 'no details — the res.fail envelope stays byte-identical to the pre-1002887 response');
+});
+await test('authorizeInvitationAccept: open + protected + Metic invitee → ALLOW (consent, no Archon actor needed)', () => {
+  assert.deepEqual(authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: true, actorRank: 'metic' }), { ok: true });
+});
+
+// DECLINE stays allowed on a closed goal — clearing a stale invitation out of your
+// inbox is cleanup, not admission. The route's decline branch must therefore return
+// BEFORE the goal is ever fetched; pinned at the source level (the addGoalMember
+// resolvedBy precedent above), since the live route is exercised in goal_routes.mjs.
+await test('routes: invitation-respond declines before the goal-state gate', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const handler = src.slice(src.indexOf("router.post('/goals/:id/invitations/:reqId/respond'"));
+  const body = handler.slice(0, handler.indexOf('\n  });'));
+  const declineAt = body.indexOf("if (action === 'decline')");
+  const gateAt = body.indexOf('authorizeInvitationAccept({');
+  assert.ok(declineAt > 0 && gateAt > 0, 'both branches present in the respond handler');
+  assert.ok(declineAt < gateAt, 'decline resolves and returns before the accept-only goal gate');
+  assert.ok(body.indexOf('db.getGoal(') > declineAt, 'decline never even reads the goal');
+  assert.ok(gateAt < body.indexOf('db.acceptMembershipRequestAndAddMember('),
+    'the gate runs before the membership add');
+});
+
 // authorizeJoinRequestResponse — owner|manager|Archon resolves a join-request.
 const OWNER_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
 const REQUEST = { id: 8, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };

package/tests/goal_tier.mjs

@@ -154,20 +154,25 @@ await test('setGoalStatus: unknown goal returns null', async () => {
 // =========================================================================
 // addGoalMember
 // =========================================================================
+// task 1002888 wrapped the bare upsert in a CTE that also cancels any pending
+// membership request, so the statement now STARTS with `WITH added AS (` — the
+// INSERT is the first arm. The pending-ask cancellation itself is pinned in
+// tests/goal_membership_requests.mjs; here we only re-anchor the role contract.
 await test('addGoalMember: upsert PRESERVES the existing role (re-join cannot demote a lead)', async () => {
-  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
   const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member' }, { pool });
   assert.equal(out.role, 'lead', 'an existing lead row survives a role:member re-add');
-  const ins = find(pool.queries, /^INSERT INTO goal_members/);
-  assert.deepEqual(ins.params, [7, 42, 'member']);
+  const ins = find(pool.queries, /^WITH added AS/);
+  assert.deepEqual(ins.params, [7, 42, 'member', null], 'resolvedBy defaults to null when no actor is supplied');
+  assert.match(ins.sql, /INSERT INTO goal_members/, 'the membership write is the first CTE arm');
   assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/,
     'conflict keeps the stored role — role changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
 });
 
 await test('addGoalMember: role defaults to member', async () => {
-  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [MEMBER_ROW] } : null));
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [MEMBER_ROW] } : null));
   await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
-  assert.equal(find(pool.queries, /^INSERT INTO goal_members/).params[2], 'member');
+  assert.equal(find(pool.queries, /^WITH added AS/).params[2], 'member');
 });
 
 // =========================================================================