@bongos/core 1.19.237 → 1.19.239

package/modules/discord/board-broadcast.js

@@ -18,9 +18,15 @@
 // in text instead (visible, unpinged, honest). #871's parse:[] still stands:
 // nothing typed into content can ever ring anyone.
 //
+// THE MIRROR'S SECOND HALF (R22, task 1003035): when the item closes, the SAME
+// message is edited to carry the outcome, so the channel never shows a stale open
+// window and the room never has to guess which of two messages is current. The
+// item's state lives in the DATABASE — this edit is a mirror of it, never a
+// source, and nothing is ever cast from Discord.
+//
 // BEST-EFFORT BY DESIGN, like every broadcast in this module: it never throws,
-// so a Discord hiccup can never fail a window open — the room in the hall is
-// the durable surface, this is the nudge.
+// so a Discord hiccup can never fail a window open or a close — the room in the
+// hall is the durable surface, this is the nudge.
 
 'use strict';
 
@@ -78,22 +84,30 @@ async function postBoardAnnouncement(payload, deps = {}) {
       }
     }
 
-    const subject = payload.subject_type === 'constitutional_amendment'
-      ? 'A constitutional amendment'
-      : 'A Full Idea';
+    const subject = subjectLabel(payload.subject_type);
     const clock = payload.window_minutes
       ? `within ${payload.window_minutes} minutes`
       : 'at your convenience — the sitting has no clock and closes on the first vote';
-    const origin = ((api.branding && api.branding().domains) || {}).buildersOrigin || '';
-    // Straight to THAT item: ?item=<id> — the Board Room panel reads it and
-    // scrolls to / highlights the named sitting (the hash stays the tab).
-    const link = `${origin ? origin.replace(/\/$/, '') : ''}/government?item=${encodeURIComponent(payload.item_id)}#board-room`;
+    const link = itemLink(payload.item_id);
     const line = `\u{1F3DB}\u{FE0F} ${subject} is before the board (item ${payload.item_id}). `
       + `${mentions.join(' ')} — your vote is wanted ${clock}. Vote in the hall: ${link}`;
 
     const post = deps.post || webhook.postWebhookMentions;
-    await post('board_room', line, result.mentioned);
+    const sent = await post(CHANNEL, line, result.mentioned);
     result.posted = true;
+    // Remember WHICH message this was, so R22's close can be edited onto it. A
+    // failed remember is not a failed announcement: the nudge is already in the
+    // channel, and the close then falls back to posting its outcome fresh.
+    const messageId = sent && (sent.message_id || (sent.message && sent.message.id));
+    if (messageId) {
+      const record = deps.recordMessage || ((row) => db.recordBoardMessage(row));
+      try {
+        await record({ itemId: payload.item_id, channel: CHANNEL, messageId: String(messageId) });
+        result.recorded = String(messageId);
+      } catch (e) {
+        log(`[discord] board announcement posted but not recorded (item ${payload.item_id}; the close will post fresh): ${e && e.message}`);
+      }
+    }
     log(`[discord] board announcement posted (item ${payload.item_id}; ${result.mentioned.length} mentioned, ${result.named.length} named)`);
   } catch (e) {
     result.skipped = 'post_failed';
@@ -102,4 +116,97 @@ async function postBoardAnnouncement(payload, deps = {}) {
   return result;
 }
 
-module.exports = { postBoardAnnouncement };
+// ── shared composition ───────────────────────────────────────────────────────
+
+const CHANNEL = 'board_room';
+
+function subjectLabel(subjectType) {
+  return subjectType === 'constitutional_amendment' ? 'A constitutional amendment' : 'A Full Idea';
+}
+
+// Straight to THAT item: ?item=<id> — the Board Room panel reads it and scrolls
+// to / highlights the named sitting (the hash stays the tab).
+function itemLink(itemId) {
+  const origin = ((api.branding && api.branding().domains) || {}).buildersOrigin || '';
+  return `${origin ? origin.replace(/\/$/, '') : ''}/government?item=${encodeURIComponent(itemId)}#board-room`;
+}
+
+// ── the close (BV1.R22 of goal 1000069) ──────────────────────────────────────
+
+// PURE. The outcome message that replaces the summons, composed from the event
+// payload alone — no Discord call, no DB read, so the wording is testable and the
+// tally can never disagree with the row the government closed.
+//
+// WHAT IT DELIBERATELY DOES NOT SAY: nobody's name and nobody's vote. The open
+// ballot is a HALL surface (ADR 0175 §9 — votes are visible to everyone there);
+// mirroring who objected into a chat channel turns a reasoned objection into a
+// public callout, and the reason plus its flagged section only make sense
+// alongside the idea. The count is the honest summary; the link is the record.
+function composeOutcomeLine(payload) {
+  const subject = subjectLabel(payload.subject_type);
+  const tally = payload.tally || {};
+  const yes = Number(tally.yes) || 0;
+  const no = Number(tally.no) || 0;
+  const verdict = payload.outcome === 'passed'
+    ? 'RATIFIED by the board'
+    : 'RETURNED to its author';
+  // A zero-vote pass is a real, designed outcome (ADR 0175 §3 — an absence is
+  // nulled, never a block), so it says what happened rather than leaving the
+  // room to read "0 in favour" as a mistake.
+  const counted = (yes + no) === 0
+    ? 'nobody objected before the window closed'
+    : `${yes} in favour, ${no} ${no === 1 ? 'objection' : 'objections'}`;
+  const how = payload.cause === 'expiry'
+    ? 'the window ran out'
+    : 'the vote closed it';
+  const tail = payload.outcome === 'passed'
+    ? 'The record:'
+    : 'The objection and the section it flags are in the hall:';
+  return `\u{1F3DB}\u{FE0F} ${subject} (item ${payload.item_id}) \u2014 ${verdict}. `
+    + `${counted}; ${how}. ${tail} ${itemLink(payload.item_id)}`;
+}
+
+// Mirror the close onto the announcement. Result shape mirrors the announcer's:
+//   { edited, posted, skipped }
+//     edited  — the summons itself now reads as the outcome (the happy path)
+//     posted  — no message to edit, so the outcome went out fresh instead
+//     skipped — a NAMED reason; never a throw, so a Discord hiccup can never fail
+//               a close (the close already committed — this runs after it).
+async function postBoardOutcome(payload, deps = {}) {
+  const result = { edited: false, posted: false, skipped: null };
+  if (!payload || payload.item_id == null) { result.skipped = 'no_item'; return result; }
+  if (payload.outcome !== 'passed' && payload.outcome !== 'returned') { result.skipped = 'no_outcome'; return result; }
+  const log = deps.log || console.log;
+  const line = composeOutcomeLine(payload);
+  try {
+    const getMessage = deps.getMessage || ((itemId) => db.getBoardMessage(itemId));
+    let row = null;
+    try { row = await getMessage(payload.item_id); } catch (_) { /* unreadable reads as unannounced */ }
+    if (row && row.message_id) {
+      const edit = deps.edit || webhook.editWebhook;
+      await edit(row.channel || CHANNEL, row.message_id, line);
+      result.edited = true;
+      const mark = deps.markEdited || ((itemId) => db.markBoardMessageEdited(itemId));
+      // The stamp is bookkeeping ONLY — `edited_at IS NULL` answers "does the
+      // channel still show this as open?" without asking Discord. A failed stamp
+      // must not turn a mirrored close into a reported failure.
+      try { await mark(payload.item_id); } catch (_) { /* the edit is what matters */ }
+      log(`[discord] board close mirrored onto the announcement (item ${payload.item_id}; ${payload.outcome})`);
+      return result;
+    }
+    // Nothing to edit: the window was never announced (Discord off at open time,
+    // an item older than R22), or the id could not be kept. Posting the outcome
+    // fresh keeps the room honest — and because this branch is reached only when
+    // there is NO stored message, a failed edit can never duplicate a notice.
+    const post = deps.post || webhook.postWebhook;
+    await post(CHANNEL, line);
+    result.posted = true;
+    log(`[discord] board close posted fresh — no announcement to edit (item ${payload.item_id}; ${payload.outcome})`);
+  } catch (e) {
+    result.skipped = 'mirror_failed';
+    log(`[discord] board close mirror skipped (the close itself is unaffected): ${e && e.message}`);
+  }
+  return result;
+}
+
+module.exports = { postBoardAnnouncement, postBoardOutcome, composeOutcomeLine };

package/modules/discord/db.js

@@ -79,6 +79,47 @@ async function countRecentDiscordBugFilings(builderId, sinceIso) {
   return rows[0].n;
 }
 
+// --- the board mirror's own bookkeeping (R22 of goal 1000069) ----------------
+//
+// Which message announced which board item, so the close can be EDITED onto the
+// same message instead of appended after it. Mirror state, discord-owned
+// (discord_001_board_messages) — government's schema stays ignorant of whether a
+// mirror exists.
+
+// Upsert: R21 announces once, but a re-announced item (a re-fired hook, a manual
+// re-drive) must leave ONE row pointing at the message that is actually live.
+async function recordBoardMessage({ itemId, channel, messageId }) {
+  const { rows } = await pool.query(
+    `INSERT INTO discord_board_messages (item_id, channel, message_id)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (item_id) DO UPDATE
+       SET channel = EXCLUDED.channel, message_id = EXCLUDED.message_id,
+           posted_at = now(), edited_at = NULL
+     RETURNING item_id, channel, message_id, posted_at, edited_at`,
+    [itemId, channel, String(messageId)],
+  );
+  return rows[0] || null;
+}
+
+async function getBoardMessage(itemId) {
+  const { rows } = await pool.query(
+    `SELECT item_id, channel, message_id, posted_at, edited_at
+       FROM discord_board_messages WHERE item_id = $1`,
+    [itemId],
+  );
+  return rows[0] || null;
+}
+
+// Stamped only after Discord accepted the edit, so `edited_at IS NULL` keeps
+// meaning "the channel still shows this window as open".
+async function markBoardMessageEdited(itemId) {
+  const { rowCount } = await pool.query(
+    `UPDATE discord_board_messages SET edited_at = now() WHERE item_id = $1`,
+    [itemId],
+  );
+  return { stamped: rowCount > 0 };
+}
+
 async function recordApplause({ targetTaskId, discordUserId }) {
   const { rowCount } = await pool.query(
     `INSERT INTO discord_applause (target_task_id, discord_user_id)
@@ -97,6 +138,9 @@ module.exports = {
   getDiscordLinks,
   countRecentDiscordBugFilings,
   recordApplause,
+  recordBoardMessage,
+  getBoardMessage,
+  markBoardMessageEdited,
   // kernel db helpers, re-exported off the doorway (one `db.*` namespace)
   insertAuditLog: (...a) => api.insertAuditLog(...a),
   // createTask is a LIFECYCLE write — resolve the `lifecycle` kernel port at call

package/modules/discord/migrations/discord_001_board_messages.sql

@@ -0,0 +1,50 @@
+-- discord_001_board_messages.sql — which message announced which board item
+-- (task 1003035 / R22 of goal 1000069, ADR 0175 §8 / criterion C6).
+--
+-- R21 posts an announcement when a window opens; R22 EDITS THAT SAME MESSAGE when
+-- the item closes, so the channel never shows a stale open window. Editing needs
+-- the message id Discord handed back, and a window can stay open across restarts —
+-- so the id has to be durable, and this is the smallest durable place for it.
+--
+-- WHY THIS TABLE LIVES IN THE DISCORD MODULE, NOT IN GOVERNMENT'S SCHEMA: a Discord
+-- message id is mirror state, not government state (ADR 0033 — Discord is a one-way
+-- window, never authority). government_board_items must stay ignorant of whether a
+-- mirror exists; the mirror remembers its own bookkeeping. Module migrations are
+-- ADDITIVE and NAMESPACED (ADR 0083 §Decision #5 / ADR 0108 §5): every object is
+-- discord_-prefixed, the filename stem is unique across repos, and there is no
+-- down-migration. Idempotent: safe to re-run.
+--
+-- NO FOREIGN KEY to government_board_items ON PURPOSE. A module migration may not
+-- reach across the module boundary into a sibling's table (the same rule that keeps
+-- anti-self-vote in the route rather than in a constraint — see
+-- government_003_board_tables.sql), and the discord module is optional: an instance
+-- that runs the board with Discord disabled must not carry a dangling reference.
+-- A row here whose item is gone is harmless — the mirror simply has nothing to edit.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS discord_board_messages (
+  -- One announcement per board item: the mirror is edited in place, never appended
+  -- to, so PRIMARY KEY (not merely UNIQUE) is the honest shape and the upsert below
+  -- has a conflict target that can never admit a second row for the same sitting.
+  item_id     bigint      PRIMARY KEY,
+
+  -- The channel key (webhook.js CHANNELS), not a Discord snowflake: the edit must
+  -- go back through the SAME webhook that posted, and the webhook URL is resolved
+  -- from this key at edit time (config/env can be re-pointed between the post and
+  -- the close without stranding the row).
+  channel     text        NOT NULL,
+
+  -- Discord snowflakes exceed 2^53 and are strings in Discord's own API — text, so
+  -- no JSON round-trip can ever round one off.
+  message_id  text        NOT NULL,
+
+  posted_at   timestamptz NOT NULL DEFAULT now(),
+
+  -- Set when the close is mirrored. NULL means "announced, not yet resolved" — a
+  -- read that answers "does this channel still show an open window?" without
+  -- asking Discord anything.
+  edited_at   timestamptz
+);
+
+COMMIT;

package/modules/discord/module.json

@@ -6,6 +6,7 @@
   "default": false,
   "maintenance": { "status": "core-maintained" },
   "contributes": {
+    "migrations": true,
     "routes": ["discord", "bug-attachments"],
     "pollers": ["discord-bot"],
     "uiSections": []

package/modules/discord/routes/discord.js

@@ -45,6 +45,7 @@ let _shipListenerOff = null;
 let _strandListenerOff = null;
 let _roleSyncListenerOff = null;
 let _boardListenerOff = null;
+let _boardCloseListenerOff = null;
 function registerSeams() {
   if (!api.hasProvider('discord.isLinked')) {
     api.registerProvider('discord.isLinked', async (builderId) => !!(await db.getDiscordLink(builderId)));
@@ -64,6 +65,11 @@ function registerSeams() {
   // — the government module emits, this module posts. Outbound only (§8).
   if (_boardListenerOff) _boardListenerOff();
   _boardListenerOff = api.on('board.item.opened', (payload) => boardBroadcast.postBoardAnnouncement(payload));
+  // R22: the same sitting, closed — the announcement is EDITED into an outcome
+  // notice, so the channel never shows a stale open window. Fires on a return as
+  // well as a pass; still outbound only, still nothing cast from Discord.
+  if (_boardCloseListenerOff) _boardCloseListenerOff();
+  _boardCloseListenerOff = api.on('board.item.closed', (payload) => boardBroadcast.postBoardOutcome(payload));
   if (_roleSyncListenerOff) _roleSyncListenerOff();
   _roleSyncListenerOff = api.on('builder.role-sync-needed', ({ builderId }) =>
     roleSync.syncBuilderRole(builderId).catch((e) =>

package/modules/discord/webhook.js

@@ -7,7 +7,10 @@
 // module needs lives IN the module. scripts/discord/lib.js stays for the two CORE
 // consumers that still post webhooks (src/bongos/approval-broadcast.js + the
 // scripts/discord/post.js CLI). KEEP THE TWO IN SYNC — same channels, same
-// 2000-char cap, same allowed_mentions suppression (#871). Config is read through
+// 2000-char cap, same allowed_mentions suppression (#871) — the R22 board-mirror
+// edit path (postCore's `wait=true` + editWebhook) is deliberately module-only:
+// no core consumer edits a message it posted, so copying it into the twin would
+// add an unused surface rather than keep the two honest. Config is read through
 // the published doorway (configPath) so the path resolves identically.
 //
 // Discord is a one-way window into the GDS (the trust-boundary ADR): this only
@@ -48,7 +51,7 @@ function loadWebhooks() {
 // #871's rule holds in both: parse:[] always, so nothing typed INTO content can
 // ever ring — postWebhookMentions adds an explicit server-resolved user
 // allowlist and nothing else.
-async function postCore(channel, text, allowedMentions) {
+function resolveWebhookUrl(channel) {
   if (!CHANNELS.has(channel)) {
     throw new Error(`Unknown Discord channel '${channel}'. Known: ${[...CHANNELS].join(', ')}`);
   }
@@ -59,18 +62,34 @@ async function postCore(channel, text, allowedMentions) {
       `or env DISCORD_${channel.toUpperCase()}_WEBHOOK. See scripts/discord/README.md.`
     );
   }
-  // Discord hard-caps message content at 2000 chars.
-  const content = String(text).slice(0, 2000);
-  const res = await fetch(url, {
+  return url;
+}
+
+// Discord hard-caps message content at 2000 chars — one place, so a post and an
+// edit of the same text can never disagree about what got truncated.
+function capContent(text) {
+  return String(text).slice(0, 2000);
+}
+
+// R22 (the board mirror) needs the id of the message it just posted so the close
+// can be edited onto it, so the POST asks for the created message back
+// (`?wait=true` — Discord then answers 200 + the message JSON instead of 204 with
+// no body). The extra field is additive: every existing caller ignores the return.
+async function postCore(channel, text, allowedMentions) {
+  const url = resolveWebhookUrl(channel);
+  const res = await fetch(`${url}${url.includes('?') ? '&' : '?'}wait=true`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ content, allowed_mentions: allowedMentions }),
+    body: JSON.stringify({ content: capContent(text), allowed_mentions: allowedMentions }),
   });
   if (!res.ok) {
     const body = await res.text().catch(() => '');
     throw new Error(`Discord webhook POST -> ${res.status}: ${body.slice(0, 300)}`);
   }
-  return { ok: true, status: res.status }; // 204 No Content on success
+  // `wait=true` answers with the message; a body we cannot parse is not a failed
+  // post — the message IS in the channel, we just cannot edit it later.
+  const message = await res.json().catch(() => null);
+  return { ok: true, status: res.status, message, message_id: message && message.id ? String(message.id) : null };
 }
 
 // SECURITY (#871): suppress ALL mention pings. The content is DB-sourced and
@@ -91,4 +110,30 @@ async function postWebhookMentions(channel, text, userIds = []) {
   return postCore(channel, text, { parse: [], users });
 }
 
-module.exports = { CHANNELS, WEBHOOKS_PATH, loadWebhooks, postWebhook, postWebhookMentions };
+// editWebhook — rewrite a message this webhook already posted, in place (R22 of
+// goal 1000069). PATCH /webhooks/<id>/<token>/messages/<message_id>, which is the
+// only edit a webhook is allowed: its OWN messages, in the channel it owns.
+//
+// FULLY SUPPRESSED, ALWAYS. The edit is an outcome notice, not a summons — and an
+// edit that carried a mentions allowlist could re-ring a board that already voted.
+// parse:[] with no `users` is #871's default, and the mention exception stays
+// scoped to the one post that means "your vote is wanted".
+async function editWebhook(channel, messageId, text) {
+  const url = resolveWebhookUrl(channel);
+  const [base] = String(url).split('?');
+  const res = await fetch(`${base.replace(/\/$/, '')}/messages/${encodeURIComponent(String(messageId))}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ content: capContent(text), allowed_mentions: { parse: [] } }),
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Discord webhook PATCH -> ${res.status}: ${body.slice(0, 300)}`);
+  }
+  return { ok: true, status: res.status };
+}
+
+module.exports = {
+  CHANNELS, WEBHOOKS_PATH, loadWebhooks, resolveWebhookUrl,
+  postWebhook, postWebhookMentions, editWebhook,
+};

package/modules/government/board.js

@@ -106,6 +106,31 @@ async function emitWindowOpened(item) {
   } catch (_) { /* a nudge that fails is a quiet sitting, never a failed open */ }
 }
 
+// The close event (R22's Discord mirror): the summons that R21 posted is edited
+// into an outcome notice, so the channel never shows a stale open window. Emitted
+// for a RETURN as well as a pass, with the tally the close already counted — no
+// consumer should have to re-read votes to state what happened. Best-effort by
+// construction, like the open nudge.
+async function emitItemClosed(closed, { cause, votes } = {}) {
+  try {
+    if (!api.emitAsync) return;
+    const cast = votes || [];
+    await api.emitAsync('board.item.closed', {
+      item_id: String(closed.id),
+      subject_type: closed.subject_type,
+      subject_id: String(closed.subject_id),
+      outcome: closed.outcome,
+      cause: cause || 'vote',
+      closed_at: closed.closed_at || null,
+      tally: {
+        yes: cast.filter((v) => v.direction === 'yes').length,
+        no: cast.filter((v) => v.direction === 'no').length,
+        total: cast.length,
+      },
+    });
+  } catch (_) { /* a mirror that fails is a quiet channel, never a failed close */ }
+}
+
 // ── the vote (BV1.R08 of goal 1000069, ADR 0175 §§4/6/9) ────────────────────
 //
 // OPEN BALLOT, ONE VOTE, NO EDITING. A vote is member + direction + timestamp,
@@ -388,6 +413,16 @@ async function closeItem(item, { cause = 'vote' } = {}) {
     } catch (_) { /* emitAsync isolates listener errors; nothing that moves credits subscribes */ }
   }
 
+  // R22's mirror event: BOTH outcomes, after commit, emitAsync. Separate from
+  // `board.item.passed` on purpose — that one is the pass CONTRACT the credit lane
+  // reads (docs/specs/board-room-pass-event-contract.md: seven fields, no tally),
+  // and a mirror needs the opposite things: it fires on a return too, and it
+  // carries the count so the channel can state the outcome without reading the DB.
+  // Widening the contract event to cover returns would put a payer on a path that
+  // also fires for "nothing was ratified". Nothing that decides or pays may
+  // subscribe here — the row is the durable fact, this is a nudge.
+  await emitItemClosed(closed, { cause, votes });
+
   return {
     closed: true, item: closed, outcome, cause, author_karma: authorKarma,
     ...(credit ? { credit } : {}),

package/modules/hall-ui/public/goals-page.js

@@ -1,6 +1,6 @@
 // goals-page.js — the dedicated Goals page (task 1734, owner request from the
 // task-1723 review): list every goal, then per-goal detail — completion card,
-// members with lead (manager) roles, work to do vs completed, and a conflicts
+// members with lead (manager) standing, work to do vs completed, and a conflicts
 // panel. Hash-routed (#/goal/N) inside one page; the server gate is
 // SIGNEDIN_BUILDERS_PAGE_RE in serve-internal.js.
 //
@@ -18,7 +18,7 @@
 // to the top-100-by-credits window).
 // Writes: POST /goals/:id/join | /leave | /members (task 1762 — owner/manager
 // invite, mirrors the server's authorizeGoalManagement gate; task 1877 picks
-// the invitee from a dropdown instead of typing a GitHub login). Lead role
+// the invitee from a dropdown instead of typing a GitHub login). Lead
 // management is task 1735.
 (function () {
   'use strict';
@@ -1190,7 +1190,7 @@
     return `<li class="member">
       <span class="member__avatar">${memberAvatar(m)}</span>
       <span class="member__name">${escapeHtml(memberName(m))} ${m.rank ? `<small>· ${escapeHtml(rankLabel(m.rank))}</small>` : ''}</span>
-      <span class="role-pill${m.role === 'lead' ? ' role-pill--lead' : ''}">${m.role === 'lead' ? 'Manager' : 'Member'}</span>
+      <span class="member-pill${m.membership_kind === 'lead' ? ' member-pill--lead' : ''}">${m.membership_kind === 'lead' ? 'Manager' : 'Member'}</span>
     </li>`;
   }
 
@@ -1221,7 +1221,7 @@
       <span class="member__avatar">${memberAvatar(m)}</span>
       <span class="member__name">${escapeHtml(memberName(m))} ${m.rank ? `<small>· ${escapeHtml(rankLabel(m.rank))}</small>` : ''}</span>
       <span class="member__stats" title="Contribution to this goal">${statLine}</span>
-      <span class="role-pill${m.role === 'lead' ? ' role-pill--lead' : ''}">${m.role === 'lead' ? 'Manager' : 'Member'}</span>
+      <span class="member-pill${m.membership_kind === 'lead' ? ' member-pill--lead' : ''}">${m.membership_kind === 'lead' ? 'Manager' : 'Member'}</span>
     </li>`;
   }
 
@@ -1231,7 +1231,7 @@
     const members = d.members || [];
     const lede = $('#goal-members-lede');
     if (lede) {
-      const leads = members.filter((m) => m.role === 'lead');
+      const leads = members.filter((m) => m.membership_kind === 'lead');
       lede.textContent = leads.length
         ? 'Leads manage this goal’s scope and (soon) resolve its conflicts.'
         : 'No lead assigned yet — an Archon can appoint one.';
@@ -1287,7 +1287,7 @@
     const members = d.members || [];
     const sat = crit.filter((c) => c.satisfied).length;
     const joined = members.some((m) => sameId(m.builder_id, selfId()));
-    const iAmLead = members.some((m) => sameId(m.builder_id, selfId()) && m.role === 'lead');
+    const iAmLead = members.some((m) => sameId(m.builder_id, selfId()) && m.membership_kind === 'lead');
 
     const h = $('#goal-detail-h');
     // task 2163 — surface the numeric goal id alongside the title (escaped title,
@@ -1367,7 +1367,7 @@
         parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
       } else if ((g.visibility === 'private' || g.scope_protected) && !isArchon()) {
         if (state.myPendingRequest) {
-          parts.push('<span class="role-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
+          parts.push('<span class="member-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
           parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
         } else {
           parts.push('<button class="btn-ghost" id="goal-request-btn" type="button">🔒 Request to join</button>');
@@ -1471,7 +1471,7 @@
   }
 
   // task 1762/1877 — owner/manager invite control. Shows a compact form (a
-  // builder dropdown + role) in place of a button while open. Idempotent
+  // builder dropdown + membership) in place of a button while open. Idempotent
   // re-render: always rebuilds the box from scratch, so state.inviteOpen is the
   // only thing that survives a renderDetail() call while the form is open.
   function renderInviteBox(goalId, canInvite, members) {
@@ -1504,7 +1504,7 @@
           ${invitable.length ? `<option value="" disabled selected>Choose a builder…</option>${options}`
             : '<option value="">Everyone is already a member</option>'}
         </select>
-        <select id="goal-invite-role">
+        <select id="goal-invite-kind">
           <option value="member">Member</option>
           <option value="lead">Manager</option>
         </select>
@@ -1518,14 +1518,16 @@
     $('#goal-invite-form')?.addEventListener('submit', (ev) => {
       ev.preventDefault();
       const builderId = $('#goal-invite-builder')?.value;
-      const role = $('#goal-invite-role')?.value || 'member';
-      if (builderId) inviteMember(goalId, builderId, role);
+      const membershipKind = $('#goal-invite-kind')?.value || 'member';
+      if (builderId) inviteMember(goalId, builderId, membershipKind);
     });
   }
 
-  async function inviteMember(goalId, builderId, role) {
+  async function inviteMember(goalId, builderId, membershipKind) {
     try {
-      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), role });
+      // `membership_kind`, not `role` — ADR 0174 reserves that word for the three
+      // crafts (task 1003013).
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), membership_kind: membershipKind });
       toast('Invited.');
       state.inviteOpen = false;
       await loadDetail(goalId, { force: true });

package/modules/hall-ui/public/goals.css

@@ -173,8 +173,8 @@ a.goal-card:hover { text-decoration: none; border-color: var(--border-strong); b
 .member__avatar img { width: 100%; height: 100%; object-fit: cover; border-radius: 50%; }
 .member__name { flex: 1; min-width: 0; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .member__name small { color: var(--ink-faint); }
-.role-pill { display: inline-flex; align-items: center; height: 20px; padding: 0 9px; border-radius: 999px; font-size: 11px; font-weight: 600; background: var(--surface-2); color: var(--ink-soft); }
-.role-pill--lead { background: var(--accent-weak); color: var(--accent-text); }
+.member-pill { display: inline-flex; align-items: center; height: 20px; padding: 0 9px; border-radius: 999px; font-size: 11px; font-weight: 600; background: var(--surface-2); color: var(--ink-soft); }
+.member-pill--lead { background: var(--accent-weak); color: var(--accent-text); }
 
 /* task 1762/1877 — owner/manager invite control (goal member admission),
    collapsed behind "+ Invite" (disclosure, closed by default — task 2171). */