@bongos/core 1.19.238 → 1.19.239

package/scripts/gds/fitness.js

@@ -1741,6 +1741,71 @@ function vocabFilesToScan() {
   return out;
 }
 
+// ── Check 19b — the FOURTH "role": a goal membership is not a craft either ──
+//
+// task 1003013 / ADR 0177. ADR 0174 reserved `role` for the three crafts and R07
+// (checkVocabularyWall above) enforces it on the GOVERNMENT surface — deliberately
+// only there, because `builders.system_role` is a core machine-identity column and
+// Discord's API owns its own "role" noun. Goal membership was a fourth,
+// independent use of the word (`goal_members.role` = 'lead' | 'member'), which is
+// exactly why it survived the rename: the rule was silent on it, as designed.
+//
+// So this is a SECOND narrow wall rather than a widened first one — same reason the
+// first was scoped: the honest unit is a SURFACE, not the repo. The surface here is
+// the goal-membership one: the routes and pure gate that decide it, the hall page
+// that renders it, and (line-scoped) the membership SQL in the module's db.js. The
+// noun on it is `membership_kind`.
+//
+// Naming the rule stays legal — a line that cites ADR 0174 / ADR 0177 / task
+// 1003013 is meta-commentary about the ban, the same principle as
+// VOCAB_HISTORICAL_REF above. `role="…"` is stripped first: that is HTML's ARIA
+// attribute, a different word spelled the same.
+const GOAL_VOCAB_SURFACE = [
+  'modules/lifecycle/routes/goals.js',
+  'modules/lifecycle/goal-authz.js',
+  'modules/lifecycle/routes/done-when.js',
+  'modules/hall-ui/public/goals-page.js',
+  'modules/hall-ui/public/goals.html',
+  'modules/hall-ui/public/goals.css',
+];
+// modules/lifecycle/db.js is 5k+ lines and legitimately says "role" about ranks
+// (the rank-sync port, builders.system_role). Scanning it whole would need an
+// allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
+// the only thing that can regress here — a membership query reaching for the old
+// column — with no false positives to excuse.
+const GOAL_VOCAB_LINE_SCOPED = [{ file: 'modules/lifecycle/db.js', mustMention: /goal_members/ }];
+const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013/;
+
+function checkGoalMembershipVocabulary() {
+  const violations = [];
+  let scanned = 0;
+  const scanFile = (rel, lineFilter = null) => {
+    const abs = path.join(CORE_ROOT, rel);
+    let src;
+    try { src = fs.readFileSync(abs, 'utf8'); } catch { return; }
+    scanned += 1;
+    src.split('\n').forEach((line, i) => {
+      if (lineFilter && !lineFilter.test(line)) return;
+      const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
+      if (!/\brole/i.test(scanLine)) return;
+      if (GOAL_VOCAB_CITATION.test(scanLine)) return;
+      violations.push(`${rel}:${i + 1}: "role" — a goal membership is 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
+    });
+  };
+  for (const rel of GOAL_VOCAB_SURFACE) scanFile(rel);
+  for (const { file, mustMention } of GOAL_VOCAB_LINE_SCOPED) scanFile(file, mustMention);
+  return {
+    name: 'a goal membership is a "membership_kind", never a role (ADR 0177)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} goal-membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole + `
+        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming goal_members); no allowlist — `
+        + 'a line that CITES the rule is the only exemption.',
+  };
+}
+
 function checkVocabularyWall() {
   const violations = [];
   let scanned = 0;
@@ -1799,6 +1864,7 @@ const CHECKS = [
   checkCoreRequiresExcludedModule, // Check 16b — task 2135: core→excluded-module require guard (R89 split)
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
+  checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
 ];
 
@@ -1830,6 +1896,8 @@ if (require.main === module) main();
 module.exports = {
   checkVocabularyWall,
   VOCAB_ALLOW,
+  checkGoalMembershipVocabulary,
+  GOAL_VOCAB_SURFACE,
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/src/module-api.js

@@ -903,8 +903,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.236 with no explicit bump. run 32164526454. (task 1002620)
 //   1.19.238 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.237 with no explicit bump. run 32172843539. (task 1002620)
+//   1.19.239 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.238 with no explicit bump. run 32174983930. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.238'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.239'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/criterion_authoring_gate.mjs

@@ -50,8 +50,8 @@ const G_ACHIEVED = { id: 43, version_id: 'BONGOS-V1', status: 'achieved', create
 const G_ARCHIVED = { id: 44, version_id: 'BONGOS-V1', status: 'archived', created_by: OWNER };
 const G_SYSTEM = { id: 45, version_id: 'BONGOS-V1', status: 'open', created_by: null };
 
-const LEAD = { role: 'lead' };
-const PLAIN = { role: 'member' };
+const LEAD = { membership_kind: 'lead' };
+const PLAIN = { membership_kind: 'member' };
 
 const ask = (o) => authorizeCriterionCreate({ version: V_BUILDING, actorRank: 'metic', ...o });
 
@@ -62,12 +62,12 @@ await test('the goal OWNER may author their goal\'s criterion', () => {
   assert.equal(d.ok, true);
 });
 
-await test('owner authority is created_by, not the role row — an owner with no membership still passes', () => {
+await test('owner authority is created_by, not the membership row — an owner with no membership still passes', () => {
   const d = ask({ goal: G_OPEN, actorId: OWNER, actorMembership: null });
   assert.equal(d.ok, true, 'created_by is the fixed authority (goal-authz isGoalOwner)');
 });
 
-await test('a MANAGER (goal_members.role=lead) may author', () => {
+await test('a MANAGER (goal_members.membership_kind=lead) may author', () => {
   const d = ask({ goal: G_OPEN, actorId: MANAGER, actorMembership: LEAD });
   assert.equal(d.ok, true);
 });

package/tests/goal_conflicts.mjs

@@ -162,8 +162,8 @@ await test('detector: no inputs → no conflicts (and never throws)', () => {
 // =========================================================================
 
 const OPEN_GOAL = { id: 7, status: 'open', created_by: '1' };
-const manager = (builderId) => ({ goal_id: 7, builder_id: builderId, role: 'lead' });
-const member = (builderId) => ({ goal_id: 7, builder_id: builderId, role: 'member' });
+const manager = (builderId) => ({ goal_id: 7, builder_id: builderId, membership_kind: 'lead' });
+const member = (builderId) => ({ goal_id: 7, builder_id: builderId, membership_kind: 'member' });
 
 await test('gate: owner / manager / archon pass; ordering goal_not_found → goal_not_open → not_owner_or_manager', () => {
   for (const actor of [
@@ -182,7 +182,7 @@ await test('gate: owner / manager / archon pass; ordering goal_not_found → goa
   assert.equal(denied.body.error, 'not_owner_or_manager', 'a plain member cannot manage');
 });
 
-await test('gate: owner authority is created_by, not the role row', () => {
+await test('gate: owner authority is created_by, not the membership row', () => {
   const d = authorizeGoalManagement({ goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: member(1) });
   assert.deepEqual(d, { ok: true });
 });

package/tests/{goal_member_roles.mjs → goal_member_kinds.mjs}

@@ -1,18 +1,18 @@
-// tests/goal_member_roles.mjs — the goal owner/manager authority model (task 1735).
+// tests/goal_member_kinds.mjs — the goal owner/manager authority model (task 1735).
 //
 // The model: the OWNER is goals.created_by — the fixed authority, set at create
-// and moved only via POST /goals/:id/transfer. MANAGER is the goal_members.role
+// and moved only via POST /goals/:id/transfer. MANAGER is the goal_members.membership_kind
 // 'lead' value (the hall renders it "manager"), owner-equivalent EXCEPT that a
 // manager cannot demote a fellow manager (owner-only) and cannot transfer
 // ownership. The owner's own row is never demotable. This file pins, in the
 // goal_routes pattern:
 //
-//   1. the PURE ordered gates (authorizeMemberRoleChange +
+//   1. the PURE ordered gates (authorizeMembershipKindChange +
 //      authorizeOwnershipTransfer) — every rejection, DB-free, ordering
 //      included (the authorizeGoalTaskCreate precedent);
 //   2. the request-validation schema of the PATCH route;
 //   3. the db helpers' SQL contracts via the SQL-aware fake pool —
-//      getGoalMember / setGoalMemberRole (the atomic owner-demotion guard) /
+//      getGoalMember / setGoalMembershipKind (the atomic owner-demotion guard) /
 //      transferGoalOwnership (atomic created_by move + lead upsert);
 //      createGoal's creator-becomes-owner CTE lives in tests/goal_tier.mjs;
 //   4. the route-rank PINS: both routes stay 'any-builder' (the wall is
@@ -26,14 +26,14 @@
 //   B   manager promotes a member → manager                 → ALLOW (owner-equivalent)
 //   C   owner demotes a manager → member                    → ALLOW
 //   D   manager demotes a fellow manager                    → 403 owner_only_demotion
-//   E   owner/Archon demotes the OWNER's row                → 409 owner_role_fixed
-//   F   plain member tries any role change                  → 403 not_owner_or_manager
-//   G   non-member Metic tries any role change              → 403 not_owner_or_manager
+//   E   owner/Archon demotes the OWNER's row                → 409 owner_membership_fixed
+//   F   plain member tries any membership change                  → 403 not_owner_or_manager
+//   G   non-member Metic tries any membership change              → 403 not_owner_or_manager
 //   H   Archon (not a member) promotes and demotes          → ALLOW (the Archon arm)
 //   I   target isn't a member                               → 404 not_a_member
 //   J   goal doesn't exist                                  → 404 goal_not_found
 //   K   goal not open (achieved/archived)                   → 409 goal_not_open
-//   L   role already as requested                           → no-op (ok, changed:false)
+//   L   membership already as requested                           → no-op (ok, changed:false)
 //   O1  ordering: unauthorized actor + non-member target    → not_owner_or_manager (no membership leak)
 //   O2  ordering: closed goal short-circuits everything     → goal_not_open
 //
@@ -47,7 +47,7 @@
 //   T6  transfer to the current owner                       → no-op
 //   T7  closed goal / unknown goal                          → 409 / 404
 //
-// Run:  node tests/goal_member_roles.mjs
+// Run:  node tests/goal_member_kinds.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -57,8 +57,8 @@ process.env.NODE_ENV = 'test';
 
 const require = createRequire(import.meta.url);
 const { validate } = require('../src/bongos/routes/_helpers.js');
-const { authorizeMemberRoleChange, authorizeOwnershipTransfer } = require('../modules/lifecycle/routes/goals.js');
-const { getGoalMember, setGoalMemberRole, transferGoalOwnership } = require('../modules/lifecycle/db.js');
+const { authorizeMembershipKindChange, authorizeOwnershipTransfer } = require('../modules/lifecycle/routes/goals.js');
+const { getGoalMember, setGoalMembershipKind, transferGoalOwnership } = require('../modules/lifecycle/db.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
 
 const { test, summary } = makeRunner();
@@ -74,49 +74,49 @@ const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(
 // must compare loosely (String-normalized), exactly as the route receives it.
 const OPEN_GOAL = { id: 7, status: 'open', created_by: '1' };
 const ORPHAN_GOAL = { id: 8, status: 'open', created_by: null }; // migration-160 default
-const manager = (builderId) => ({ goal_id: 7, builder_id: builderId, role: 'lead', joined_at: 'T0' });
-const member = (builderId) => ({ goal_id: 7, builder_id: builderId, role: 'member', joined_at: 'T1' });
+const manager = (builderId) => ({ goal_id: 7, builder_id: builderId, membership_kind: 'lead', joined_at: 'T0' });
+const member = (builderId) => ({ goal_id: 7, builder_id: builderId, membership_kind: 'member', joined_at: 'T1' });
 
 // =========================================================================
-// 1a. authorizeMemberRoleChange — the role-change matrix
+// 1a. authorizeMembershipKindChange — the membership-change matrix
 // =========================================================================
 
 await test('A: the owner promotes a member → manager — ALLOW', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: manager(1),
-    targetMembership: member(2), targetId: 2, role: 'lead',
+    targetMembership: member(2), targetId: 2, membershipKind: 'lead',
   });
   assert.deepEqual(d, { ok: true });
 });
 
-await test('A2: owner authority is created_by, not the role row — owner with a plain member row still promotes', () => {
-  const d = authorizeMemberRoleChange({
+await test('A2: owner authority is created_by, not the membership row — owner with a plain member row still promotes', () => {
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: member(1),
-    targetMembership: member(2), targetId: 2, role: 'lead',
+    targetMembership: member(2), targetId: 2, membershipKind: 'lead',
   });
   assert.deepEqual(d, { ok: true });
 });
 
 await test('B: a manager promotes a member → manager — ALLOW (owner-equivalent)', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 3, actorRank: 'metic', actorMembership: manager(3),
-    targetMembership: member(2), targetId: 2, role: 'lead',
+    targetMembership: member(2), targetId: 2, membershipKind: 'lead',
   });
   assert.deepEqual(d, { ok: true });
 });
 
 await test('C: the owner demotes a manager → member — ALLOW', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: manager(1),
-    targetMembership: manager(3), targetId: 3, role: 'member',
+    targetMembership: manager(3), targetId: 3, membershipKind: 'member',
   });
   assert.deepEqual(d, { ok: true });
 });
 
 await test('D: a manager cannot demote a fellow manager — 403 owner_only_demotion', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 3, actorRank: 'metic', actorMembership: manager(3),
-    targetMembership: manager(4), targetId: 4, role: 'member',
+    targetMembership: manager(4), targetId: 4, membershipKind: 'member',
   });
   assert.equal(d.ok, false);
   assert.equal(d.status, 403);
@@ -124,32 +124,32 @@ await test('D: a manager cannot demote a fellow manager — 403 owner_only_demot
 });
 
 await test('D2: a manager cannot demote themselves either — same owner-only rule', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 3, actorRank: 'metic', actorMembership: manager(3),
-    targetMembership: manager(3), targetId: 3, role: 'member',
+    targetMembership: manager(3), targetId: 3, membershipKind: 'member',
   });
   assert.equal(d.body.error, 'owner_only_demotion');
 });
 
-await test('E: the OWNER row is never demotable — 409 owner_role_fixed (even self / Archon)', () => {
+await test('E: the OWNER row is never demotable — 409 owner_membership_fixed (even self / Archon)', () => {
   for (const actor of [
     { actorId: 1, actorRank: 'metic', actorMembership: manager(1) }, // owner themselves
     { actorId: 99, actorRank: 'archon', actorMembership: null },     // an Archon
   ]) {
-    const d = authorizeMemberRoleChange({
+    const d = authorizeMembershipKindChange({
       goal: OPEN_GOAL, ...actor,
-      targetMembership: manager(1), targetId: 1, role: 'member',
+      targetMembership: manager(1), targetId: 1, membershipKind: 'member',
     });
     assert.equal(d.ok, false, `${actor.actorRank} demoting the owner must refuse`);
     assert.equal(d.status, 409);
-    assert.equal(d.body.error, 'owner_role_fixed');
+    assert.equal(d.body.error, 'owner_membership_fixed');
   }
 });
 
-await test('F: a plain member cannot change roles — 403 not_owner_or_manager', () => {
-  const d = authorizeMemberRoleChange({
+await test('F: a plain member cannot change memberships — 403 not_owner_or_manager', () => {
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 2, actorRank: 'metic', actorMembership: member(2),
-    targetMembership: member(5), targetId: 5, role: 'lead',
+    targetMembership: member(5), targetId: 5, membershipKind: 'lead',
   });
   assert.equal(d.ok, false);
   assert.equal(d.status, 403);
@@ -157,38 +157,38 @@ await test('F: a plain member cannot change roles — 403 not_owner_or_manager',
 });
 
 await test('G: a non-member (whatever their rank below archon) — 403 not_owner_or_manager', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 9, actorRank: 'metic', actorMembership: null,
-    targetMembership: member(2), targetId: 2, role: 'lead',
+    targetMembership: member(2), targetId: 2, membershipKind: 'lead',
   });
   assert.equal(d.body.error, 'not_owner_or_manager');
 });
 
 await test('H: an Archon who is not a member may promote AND demote — the Archon arm', () => {
-  const promote = authorizeMemberRoleChange({
+  const promote = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 99, actorRank: 'archon', actorMembership: null,
-    targetMembership: member(2), targetId: 2, role: 'lead',
+    targetMembership: member(2), targetId: 2, membershipKind: 'lead',
   });
   assert.deepEqual(promote, { ok: true });
-  const demote = authorizeMemberRoleChange({
+  const demote = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 99, actorRank: 'archon', actorMembership: null,
-    targetMembership: manager(3), targetId: 3, role: 'member',
+    targetMembership: manager(3), targetId: 3, membershipKind: 'member',
   });
   assert.deepEqual(demote, { ok: true });
 });
 
 await test('H2: an ownerless goal (created_by NULL) is Archon-run — a manager there still cannot demote', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: ORPHAN_GOAL, actorId: 3, actorRank: 'metic', actorMembership: manager(3),
-    targetMembership: manager(4), targetId: 4, role: 'member',
+    targetMembership: manager(4), targetId: 4, membershipKind: 'member',
   });
   assert.equal(d.body.error, 'owner_only_demotion', 'no owner exists, so only an Archon demotes');
 });
 
 await test('I: target is not a member — 404 not_a_member', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: manager(1),
-    targetMembership: null, targetId: 5, role: 'lead',
+    targetMembership: null, targetId: 5, membershipKind: 'lead',
   });
   assert.equal(d.ok, false);
   assert.equal(d.status, 404);
@@ -196,19 +196,19 @@ await test('I: target is not a member — 404 not_a_member', () => {
 });
 
 await test('J: unknown goal — 404 goal_not_found (fail-closed on missing input)', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: null, actorId: 99, actorRank: 'archon', actorMembership: null,
-    targetMembership: null, targetId: 2, role: 'lead',
+    targetMembership: null, targetId: 2, membershipKind: 'lead',
   });
   assert.equal(d.status, 404);
   assert.equal(d.body.error, 'goal_not_found');
 });
 
-await test('K: a non-open goal refuses role changes — 409 goal_not_open', () => {
+await test('K: a non-open goal refuses membership changes — 409 goal_not_open', () => {
   for (const status of ['achieved', 'archived']) {
-    const d = authorizeMemberRoleChange({
+    const d = authorizeMembershipKindChange({
       goal: { id: 7, status, created_by: '1' }, actorId: 1, actorRank: 'metic',
-      actorMembership: manager(1), targetMembership: member(2), targetId: 2, role: 'lead',
+      actorMembership: manager(1), targetMembership: member(2), targetId: 2, membershipKind: 'lead',
     });
     assert.equal(d.ok, false, `status=${status} must refuse`);
     assert.equal(d.status, 409);
@@ -216,34 +216,34 @@ await test('K: a non-open goal refuses role changes — 409 goal_not_open', () =
   }
 });
 
-await test('L: role already as requested — no-op, not an error (idempotent PATCH)', () => {
-  const d = authorizeMemberRoleChange({
+await test('L: membership already as requested — no-op, not an error (idempotent PATCH)', () => {
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: manager(1),
-    targetMembership: manager(3), targetId: 3, role: 'lead',
+    targetMembership: manager(3), targetId: 3, membershipKind: 'lead',
   });
   assert.deepEqual(d, { ok: true, noop: true });
 });
 
 await test('L2: the no-op wins over the demotion rules — re-demoting an already-member target', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 3, actorRank: 'metic', actorMembership: manager(3),
-    targetMembership: member(2), targetId: 2, role: 'member',
+    targetMembership: member(2), targetId: 2, membershipKind: 'member',
   });
   assert.deepEqual(d, { ok: true, noop: true }, 'a manager "demoting" a member to member is a no-op, not owner_only_demotion');
 });
 
 await test('O1: ordering — an unauthorized actor learns nothing about the target', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: OPEN_GOAL, actorId: 2, actorRank: 'metic', actorMembership: member(2),
-    targetMembership: null, targetId: 5, role: 'lead',
+    targetMembership: null, targetId: 5, membershipKind: 'lead',
   });
   assert.equal(d.body.error, 'not_owner_or_manager', 'authority is checked BEFORE the target lookup');
 });
 
 await test('O2: ordering — a closed goal short-circuits before authority', () => {
-  const d = authorizeMemberRoleChange({
+  const d = authorizeMembershipKindChange({
     goal: { id: 7, status: 'archived', created_by: '1' }, actorId: 2, actorRank: 'metic',
-    actorMembership: member(2), targetMembership: null, targetId: 5, role: 'lead',
+    actorMembership: member(2), targetMembership: null, targetId: 5, membershipKind: 'lead',
   });
   assert.equal(d.body.error, 'goal_not_open');
 });
@@ -316,27 +316,36 @@ await test('T7: unknown goal → 404; closed goal → 409 (fail-closed ordering)
 // =========================================================================
 // 2. request-validation schema — the EXACT schema declared in goals.js's
 //    PATCH /goals/:id/members/:builderId; keep in sync if the route changes.
-//    (role's lead|member vocabulary is an in-handler check → 400 bad_role, and
+//    (the lead|member vocabulary is an in-handler check → 400 bad_membership_kind, and
 //    the transfer route coerces builder_id in-handler — the /members precedent.)
 // =========================================================================
 
-const PATCH_MEMBER_ROLE_SCHEMA = {
-  role: { required: true, type: 'string' },
+const PATCH_MEMBER_SCHEMA = {
+  membership_kind: { required: true, type: 'string' },
 };
 
-await test('PATCH schema: role required', () => {
-  const r = validate({}, PATCH_MEMBER_ROLE_SCHEMA);
-  assert.ok(r && r.details.some((d) => d.field === 'role' && d.reason === 'missing'));
+await test('PATCH schema: membership_kind required', () => {
+  const r = validate({}, PATCH_MEMBER_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'membership_kind' && d.reason === 'missing'));
 });
 
-await test('PATCH schema: non-string role → wrong_type', () => {
-  const r = validate({ role: 42 }, PATCH_MEMBER_ROLE_SCHEMA);
-  assert.ok(r && r.details.some((d) => d.field === 'role' && d.reason === 'wrong_type'));
+await test('PATCH schema: non-string membership_kind → wrong_type', () => {
+  const r = validate({ membership_kind: 42 }, PATCH_MEMBER_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'membership_kind' && d.reason === 'wrong_type'));
 });
 
-await test('PATCH schema: role=lead / role=member pass', () => {
-  assert.equal(validate({ role: 'lead' }, PATCH_MEMBER_ROLE_SCHEMA), null);
-  assert.equal(validate({ role: 'member' }, PATCH_MEMBER_ROLE_SCHEMA), null);
+await test('PATCH schema: membership_kind=lead / =member pass', () => {
+  assert.equal(validate({ membership_kind: 'lead' }, PATCH_MEMBER_SCHEMA), null);
+  assert.equal(validate({ membership_kind: 'member' }, PATCH_MEMBER_SCHEMA), null);
+});
+
+await test('the RESERVED WORD is gone from the goal-membership surface (task 1003013, ADR 0174)', () => {
+  // A body that still says `role` no longer satisfies the schema — the rename is
+  // a contract change, not an alias, so this pins the ABSENCE of the old field
+  // (the ADR 0174 lesson: a shim that outlives its release is a lie).
+  const r = validate({ role: 'lead' }, PATCH_MEMBER_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'membership_kind' && d.reason === 'missing'),
+    'the old field name buys nothing — membership_kind is required');
 });
 
 await test('transfer builder_id coercion contract: int + numeric string pass, junk rejected', () => {
@@ -350,7 +359,7 @@ await test('transfer builder_id coercion contract: int + numeric string pass, ju
 // 3. db helpers — SQL contracts via the SQL-aware fake pool
 // =========================================================================
 
-const MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'lead', joined_at: 'T0' };
+const MEMBER_ROW = { goal_id: 7, builder_id: 42, membership_kind: 'lead', joined_at: 'T0' };
 const GOAL_ROW = {
   id: 7, version_id: 'BONGOS-V1', title: 'g', description: null, scope_modules: [],
   status: 'open', created_by: 5, succeeded_by_goal_id: null, created_at: 'T0', updated_at: 'T1',
@@ -360,16 +369,16 @@ await test('getGoalMember: SELECT by (goal_id, builder_id), returns the row or n
   const pool = fakePool((s) => (/FROM goal_members WHERE goal_id = \$1 AND builder_id = \$2/.test(s) ? { rows: [MEMBER_ROW] } : null));
   const out = await getGoalMember({ goalId: 7, builderId: 42 }, { pool });
   assert.deepEqual(out, MEMBER_ROW);
-  const sel = find(pool.queries, /SELECT goal_id, builder_id, role, joined_at FROM goal_members/);
+  const sel = find(pool.queries, /SELECT goal_id, builder_id, membership_kind, joined_at FROM goal_members/);
   assert.deepEqual(sel.params, [7, 42]);
 
   const empty = fakePool(() => ({ rows: [] }));
   assert.equal(await getGoalMember({ goalId: 7, builderId: 99 }, { pool: empty }), null);
 });
 
-await test('setGoalMemberRole: the UPDATE carries the atomic owner-demotion guard', async () => {
+await test('setGoalMembershipKind: the UPDATE carries the atomic owner-demotion guard', async () => {
   const pool = fakePool((s) => (/UPDATE goal_members/.test(s) ? { rows: [MEMBER_ROW] } : null));
-  const out = await setGoalMemberRole({ goalId: 7, builderId: 42, role: 'lead' }, { pool });
+  const out = await setGoalMembershipKind({ goalId: 7, builderId: 42, membershipKind: 'lead' }, { pool });
   assert.deepEqual(out, MEMBER_ROW);
   const upd = find(pool.queries, /UPDATE goal_members/);
   assert.deepEqual(upd.params, [7, 42, 'lead']);
@@ -378,12 +387,12 @@ await test('setGoalMemberRole: the UPDATE carries the atomic owner-demotion guar
   const sql = String(upd.sql).replace(/\s+/g, ' ');
   assert.match(sql, /\$3 = 'lead' OR gm\.builder_id IS DISTINCT FROM \(SELECT g\.created_by FROM goals g WHERE g\.id = \$1\)/,
     'the owner-demotion guard is IN the statement, not only in the route gate');
-  assert.match(sql, /RETURNING goal_id, builder_id, role, joined_at/);
+  assert.match(sql, /RETURNING goal_id, builder_id, membership_kind, joined_at/);
 });
 
-await test('setGoalMemberRole: guard blocked / no such member → null (route answers 409)', async () => {
+await test('setGoalMembershipKind: guard blocked / no such member → null (route answers 409)', async () => {
   const pool = fakePool(() => ({ rows: [] }));
-  assert.equal(await setGoalMemberRole({ goalId: 7, builderId: 42, role: 'member' }, { pool }), null);
+  assert.equal(await setGoalMembershipKind({ goalId: 7, builderId: 42, membershipKind: 'member' }, { pool }), null);
 });
 
 await test('transferGoalOwnership: created_by moves and the new owner upserts to lead, one statement', async () => {
@@ -393,9 +402,9 @@ await test('transferGoalOwnership: created_by moves and the new owner upserts to
   const upd = find(pool.queries, /UPDATE goals SET created_by = \$2/);
   assert.deepEqual(upd.params, [7, 5]);
   const sql = String(upd.sql).replace(/\s+/g, ' ');
-  assert.match(sql, /INSERT INTO goal_members \(goal_id, builder_id, role\)/,
+  assert.match(sql, /INSERT INTO goal_members \(goal_id, builder_id, membership_kind\)/,
     'the new owner\'s membership rides in the same statement');
-  assert.match(sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = 'lead'/,
+  assert.match(sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET membership_kind = 'lead'/,
     'an existing membership upgrades to lead rather than erroring');
   assert.match(sql, /updated_at = now\(\)/);
 });
@@ -409,7 +418,7 @@ await test('transferGoalOwnership: unknown goal → null', async () => {
 // 4. the route-rank pins — the wall is in-handler, the pins keep it that way
 // =========================================================================
 
-await test('route-rank pins: role change + transfer stay any-builder (in-handler walls)', () => {
+await test('route-rank pins: membership change + transfer stay any-builder (in-handler walls)', () => {
   const pins = MODULE_EXPECTED_RANKS.lifecycle;
   assert.equal(pins['PATCH /goals/:id/members/:builderId'], 'any-builder',
     'the owner/manager wall is in-handler — a requireRank re-gate must be a red build');

package/tests/goal_membership_requests.mjs

@@ -1,6 +1,6 @@
 // tests/goal_membership_requests.mjs — private goals: the visibility flag + the
 // invite / join-request queue db layer (task 1951 / ADR 0112). DB-free: the
-// SQL-aware fake pool (the goal_member_roles.mjs precedent) pins each helper's
+// SQL-aware fake pool (the goal_member_kinds.mjs precedent) pins each helper's
 // SQL contract + return shaping. The route authorization gates are task 1952's
 // tests; this file pins the query layer under them.
 //
@@ -139,7 +139,7 @@ await test('resolveMembershipRequest: a lost race (nothing pending) → null', a
 // without a membership.
 await test('acceptMembershipRequestAndAddMember: one atomic CTE; returns { request, member }', async () => {
   const REQ = { ...REQUEST_ROW, status: 'accepted' };
-  const MEMBER = { goal_id: 1, builder_id: 2, role: 'member', joined_at: 'T2' };
+  const MEMBER = { goal_id: 1, builder_id: 2, membership_kind: 'member', joined_at: 'T2' };
   const pool = fakePool((s) => (/WITH resolved AS/.test(s) ? { rows: [{ request: REQ, member: MEMBER }] } : null));
   const out = await acceptMembershipRequestAndAddMember({ id: 10, resolvedBy: 5 }, { pool });
   assert.deepEqual(out, { request: REQ, member: MEMBER });
@@ -179,7 +179,7 @@ await test('listInboxFor: shapes {invitations, joinRequests, myPendingRequests}'
 await test('listInboxFor: joinRequests gates on owner (created_by) OR manager (lead)', async () => {
   const pool = fakePool(() => ({ rows: [] }));
   await listInboxFor(95, { pool });
-  const jq = find(pool.queries, /r\.kind = 'request'.*g\.created_by = \$1.*role = 'lead'/);
+  const jq = find(pool.queries, /r\.kind = 'request'.*g\.created_by = \$1.*membership_kind = 'lead'/);
   assert.ok(jq, 'a join-request only reaches an owner or a manager of the goal');
   // and it must not leak: the same $1 builder id feeds every bucket.
   for (const q of pool.queries) assert.deepEqual(q.params, [95]);
@@ -207,30 +207,30 @@ await test('listPendingRequestsForGoal: pending both-kinds for one goal', async
 // stamped 'rejected' on someone who is in fact a member.
 // =========================================================================
 
-const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, membership_kind: 'member', joined_at: 'T0' };
 const addMemberPool = () => fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [ADD_MEMBER_ROW] } : null));
 
 // join-cancels-request: the joiner arrives under their own steam.
 await test('addGoalMember: a join cancels the joiner\'s pending ask in ONE statement', async () => {
   const pool = addMemberPool();
-  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member', resolvedBy: 42 }, { pool });
+  const out = await addGoalMember({ goalId: 7, builderId: 42, membershipKind: 'member', resolvedBy: 42 }, { pool });
   assert.deepEqual(out, ADD_MEMBER_ROW, 'still returns the member row — the route response shape is unchanged');
   assert.equal(pool.queries.length, 1, 'ONE statement: the cancel commits with the membership write or not at all');
   const q = find(pool.queries, /^WITH added AS/);
-  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/.test(norm(q.sql)),
-    'the membership upsert is the first arm, role still preserved (task 1002689)');
+  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET membership_kind = goal_members\.membership_kind/.test(norm(q.sql)),
+    'the membership upsert is the first arm, membership_kind still preserved (task 1002689)');
   assert.ok(/UPDATE goal_membership_requests[\s\S]*SET status = 'cancelled', resolved_by = \$4/.test(norm(q.sql)),
     'the second arm closes the ask as cancelled, attributed to the actor');
   assert.ok(/WHERE goal_id = \$1 AND builder_id = \$2 AND status = 'pending'/.test(norm(q.sql)),
     'scoped to THIS goal+builder, and only a pending row');
-  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, role, resolvedBy — in that order');
+  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, membership_kind, resolvedBy — in that order');
 });
 
 // add-cancels-request: an owner/manager/Archon admits them directly. Same
 // statement; resolvedBy is the ADDER, so the audit trail names who admitted them.
 await test('addGoalMember: a direct member-add cancels the target\'s pending ask, attributed to the adder', async () => {
   const pool = addMemberPool();
-  await addGoalMember({ goalId: 7, builderId: 42, role: 'lead', resolvedBy: 99 }, { pool });
+  await addGoalMember({ goalId: 7, builderId: 42, membershipKind: 'lead', resolvedBy: 99 }, { pool });
   const q = find(pool.queries, /^WITH added AS/);
   assert.deepEqual(q.params, [7, 42, 'lead', 99],
     'resolved_by is the ADDER (99), not the target (42) — who admitted them is the audit fact');
@@ -425,7 +425,7 @@ await test('routes: invitation-respond declines before the goal-state gate', ()
 // authorizeJoinRequestResponse — owner|manager|Archon resolves a join-request.
 const OWNER_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
 const REQUEST = { id: 8, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };
-const mgr = (bid) => ({ goal_id: 5, builder_id: bid, role: 'lead' });
+const mgr = (bid) => ({ goal_id: 5, builder_id: bid, membership_kind: 'lead' });
 await test('authorizeJoinRequestResponse: non-authority actor → 403 (before any request lookup — no leak)', () => {
   const d = authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 7, actorRank: 'metic', actorMembership: null, request: REQUEST, goalId: 5 });
   assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');