@bongos/core 1.19.409 → 1.19.410

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1535,
-    "unique_ids": 1334,
-    "certain": 1535,
+    "strings": 1542,
+    "unique_ids": 1339,
+    "certain": 1542,
     "heuristic": 0,
-    "duplicate_ids": 154
+    "duplicate_ids": 156
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 71,
-      "strings": 1130
+      "strings": 1137
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -955,6 +955,26 @@
         "modules/hall-ui/public/work.js:1014"
       ]
     },
+    {
+      "id": "0bc1d1470e22",
+      "surface": "builders-hall",
+      "text": "Only an open goal can be managed.",
+      "occurrences": 2,
+      "at": [
+        "modules/hall-ui/public/goals-render.js:976",
+        "modules/hall-ui/public/goals-render.js:992"
+      ]
+    },
+    {
+      "id": "fa818ee444b4",
+      "surface": "builders-hall",
+      "text": "Only this goal's owner or a manager (or an Archon) may do this.",
+      "occurrences": 2,
+      "at": [
+        "modules/hall-ui/public/goals-render.js:975",
+        "modules/hall-ui/public/goals-render.js:991"
+      ]
+    },
     {
       "id": "6912678b962b",
       "surface": "builders-hall",
@@ -1291,8 +1311,8 @@
       "text": "This goal is not open.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/goals-render.js:934",
-        "modules/hall-ui/public/goals-render.js:950"
+        "modules/hall-ui/public/goals-render.js:946",
+        "modules/hall-ui/public/goals-render.js:962"
       ]
     },
     {
@@ -1812,7 +1832,7 @@
       "surface": "builders-hall",
       "text": "+ Invite",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 882,
+      "line": 894,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1992,7 +2012,7 @@
       "surface": "builders-hall",
       "text": "A protected-scope goal requires a Metic+ member.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 932,
+      "line": 944,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -2451,7 +2471,7 @@
       "surface": "builders-hall",
       "text": "Awaiting the owner/manager's approval",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 781,
+      "line": 788,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3319,6 +3339,15 @@
       "origin": "js-notice",
       "confidence": "certain"
     },
+    {
+      "id": "1ef1efc15b6c",
+      "surface": "builders-hall",
+      "text": "Could not change that just now.",
+      "file": "modules/hall-ui/public/goals-render.js",
+      "line": 993,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
     {
       "id": "78e18ea59b9f",
       "surface": "builders-hall",
@@ -3387,7 +3416,7 @@
       "surface": "builders-hall",
       "text": "Could not invite that builder just now.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 935,
+      "line": 947,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3864,7 +3893,7 @@
       "surface": "builders-hall",
       "text": "Could not send the request just now.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 979,
+      "line": 1008,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3900,7 +3929,7 @@
       "surface": "builders-hall",
       "text": "Could not update visibility just now.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 965,
+      "line": 977,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3936,7 +3965,7 @@
       "surface": "builders-hall",
       "text": "Could not {…} just now.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 951,
+      "line": 963,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4449,7 +4478,7 @@
       "surface": "builders-hall",
       "text": "Everyone is already a member",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 898,
+      "line": 910,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4764,7 +4793,7 @@
       "surface": "builders-hall",
       "text": "Goals could not be loaded. Refresh to try again.",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 867,
+      "line": 889,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5182,6 +5211,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "dad3388b49c9",
+      "surface": "builders-hall",
+      "text": "Invitation rescinded.",
+      "file": "modules/hall-ui/public/goals-page.js",
+      "line": 692,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
     {
       "id": "24f9e88c21f6",
       "surface": "builders-hall",
@@ -5196,7 +5234,7 @@
       "surface": "builders-hall",
       "text": "Invited.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 924,
+      "line": 936,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5259,7 +5297,7 @@
       "surface": "builders-hall",
       "text": "Join goal",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 787,
+      "line": 798,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5277,7 +5315,7 @@
       "surface": "builders-hall",
       "text": "Join requests",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 1012,
+      "line": 1047,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5439,7 +5477,7 @@
       "surface": "builders-hall",
       "text": "Leave goal",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 778,
+      "line": 785,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6334,6 +6372,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a290f6c14df9",
+      "surface": "builders-hall",
+      "text": "Not taking requests",
+      "file": "modules/hall-ui/public/goals-render.js",
+      "line": 793,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "19adac0efed1",
       "surface": "builders-hall",
@@ -6501,7 +6548,16 @@
       "surface": "builders-hall",
       "text": "Only an open goal can be managed.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 964,
+      "line": 976,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
+    {
+      "id": "0bc1d1470e22",
+      "surface": "builders-hall",
+      "text": "Only an open goal can be managed.",
+      "file": "modules/hall-ui/public/goals-render.js",
+      "line": 992,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6510,7 +6566,16 @@
       "surface": "builders-hall",
       "text": "Only this goal's owner or a manager (or an Archon) may do this.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 963,
+      "line": 975,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
+    {
+      "id": "fa818ee444b4",
+      "surface": "builders-hall",
+      "text": "Only this goal's owner or a manager (or an Archon) may do this.",
+      "file": "modules/hall-ui/public/goals-render.js",
+      "line": 991,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6519,7 +6584,7 @@
       "surface": "builders-hall",
       "text": "Only this goal's owner or a manager (or an Archon) may invite.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 933,
+      "line": 945,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6780,7 +6845,7 @@
       "surface": "builders-hall",
       "text": "Pending invitations",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 1013,
+      "line": 1048,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7410,7 +7475,7 @@
       "surface": "builders-hall",
       "text": "Request sent — the owner or a manager will review it.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 971,
+      "line": 999,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7428,7 +7493,7 @@
       "surface": "builders-hall",
       "text": "Request withdrawn.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 986,
+      "line": 1015,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7959,7 +8024,7 @@
       "surface": "builders-hall",
       "text": "Sign in to filter to your goals",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 844,
+      "line": 866,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8301,7 +8366,7 @@
       "surface": "builders-hall",
       "text": "Tasks could not be loaded.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 855,
+      "line": 867,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8440,6 +8505,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "4dd13bc5a35b",
+      "surface": "builders-hall",
+      "text": "The goal's leads have paused applications; they can still invite you",
+      "file": "modules/hall-ui/public/goals-render.js",
+      "line": 793,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "797f02fa8295",
       "surface": "builders-hall",
@@ -8733,7 +8807,7 @@
       "surface": "builders-hall",
       "text": "This goal is Archon-mediated — request to join instead.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 947,
+      "line": 959,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8751,7 +8825,7 @@
       "surface": "builders-hall",
       "text": "This goal is not open.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 934,
+      "line": 946,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8760,7 +8834,7 @@
       "surface": "builders-hall",
       "text": "This goal is not open.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 950,
+      "line": 962,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8769,7 +8843,7 @@
       "surface": "builders-hall",
       "text": "This goal is open — joining directly instead.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 978,
+      "line": 1006,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8778,7 +8852,7 @@
       "surface": "builders-hall",
       "text": "This goal is private — request to join instead.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 948,
+      "line": 960,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8787,7 +8861,16 @@
       "surface": "builders-hall",
       "text": "This goal is scoped to a protected module — only an Archon may add members.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 931,
+      "line": 943,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
+    {
+      "id": "ba404d3207f7",
+      "surface": "builders-hall",
+      "text": "This goal isn't taking requests right now.",
+      "file": "modules/hall-ui/public/goals-render.js",
+      "line": 1007,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9399,7 +9482,7 @@
       "surface": "builders-hall",
       "text": "You already have a pending request or invitation for this goal.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 976,
+      "line": 1004,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9408,7 +9491,7 @@
       "surface": "builders-hall",
       "text": "You are already a member of this goal.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 977,
+      "line": 1005,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9417,7 +9500,7 @@
       "surface": "builders-hall",
       "text": "You are not a member of this goal.",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 949,
+      "line": 961,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -10317,7 +10400,7 @@
       "surface": "builders-hall",
       "text": "invited — awaiting their response",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 1007,
+      "line": 1039,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11784,7 +11867,7 @@
       "surface": "builders-hall",
       "text": "🔒 Request to join",
       "file": "modules/hall-ui/public/goals-render.js",
-      "line": 784,
+      "line": 795,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/migrations/core_229_goals_accepting_requests.sql

@@ -0,0 +1,37 @@
+-- core_229_goals_accepting_requests.sql — a private goal can be CLOSED to
+-- join-requests without being closed as a goal (task 1002971, spec
+-- docs/specs/bongos-v1-privacy-and-invites.md D6).
+--
+-- core_188 gave a goal `visibility`, and a private goal has always accepted
+-- join-requests: the only "we're not taking applications" a lead could express
+-- was to archive the goal, which is a different (and destructive) statement.
+-- `accepting_requests` separates the two: a private goal with it FALSE still
+-- runs, still invites, still shows in the list — it just refuses new
+-- join-requests with honest copy instead of queueing asks nobody will answer.
+--
+-- INVITATIONS ARE UNAFFECTED BY DESIGN. Closing applications is about unsolicited
+-- inbound; a lead reaching out to a specific builder is the deliberate act the
+-- flag exists to protect. The flag is likewise MEANINGLESS on a public goal
+-- (self-join needs no request), which is why the toggle renders only on private
+-- goals — the column still exists on every row so the write path needs no
+-- branch, and the refusal gate reads visibility first.
+--
+-- goals is a CORE-owned table (created in 160_goal_tier; ADR 0083 §Decision 5 —
+-- a module migration may touch only its own <key>_ objects), so this lives in
+-- core migrations/, core_-namespaced (ADR 0108 §5: a core migration numbered
+-- above LEGACY_BARE_CORE_MAX=187 must carry the core_ prefix, else the fitness
+-- namespacing check reds the build).
+--
+-- PURELY ADDITIVE + idempotent: DEFAULT true means every existing goal keeps
+-- today's behaviour (a private goal takes requests), NOT NULL is safe because
+-- the default backfills, and IF NOT EXISTS makes a replay a no-op.
+-- Fresh-DB-replay safe; no hard-coded builder ids (learning 1238). migrate.sh
+-- records this file's stem in schema_migrations (the modern 187 pattern — the
+-- file does not self-insert).
+
+BEGIN;
+
+ALTER TABLE goals
+  ADD COLUMN IF NOT EXISTS accepting_requests boolean NOT NULL DEFAULT true;
+
+COMMIT;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -324,6 +324,8 @@ function createClient(opts = {}) {
       getGoalsId: (args) => request("GET", "/goals/{id}", { hasBody: false }, args),
       // PATCH /goals/{id} — rank: any-builder — PATCH /goals/:id
       patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
+      // PATCH /goals/{id}/accepting-requests — rank: any-builder — PATCH /goals/:id/accepting-requests
+      patchGoalsIdAcceptingRequests: (args) => request("PATCH", "/goals/{id}/accepting-requests", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
       // PATCH /goals/{id}/category — rank: any-builder — PATCH /goals/:id/category
@@ -334,6 +336,8 @@ function createClient(opts = {}) {
       postGoalsIdConflictsResolve: (args) => request("POST", "/goals/{id}/conflicts/resolve", { hasBody: true }, args),
       // POST /goals/{id}/invitations — rank: any-builder — POST /goals/:id/invitations
       postGoalsIdInvitations: (args) => request("POST", "/goals/{id}/invitations", { hasBody: true }, args),
+      // POST /goals/{id}/invitations/{reqId}/rescind — rank: any-builder — POST /goals/:id/invitations/:reqId/rescind
+      postGoalsIdInvitationsReqIdRescind: (args) => request("POST", "/goals/{id}/invitations/{reqId}/rescind", { hasBody: true }, args),
       // POST /goals/{id}/invitations/{reqId}/respond — rank: any-builder — POST /goals/:id/invitations/:reqId/respond
       postGoalsIdInvitationsReqIdRespond: (args) => request("POST", "/goals/{id}/invitations/{reqId}/respond", { hasBody: true }, args),
       // POST /goals/{id}/join — rank: any-builder — POST /goals/:id/join

package/modules/hall-ui/public/goals-page.js

@@ -678,9 +678,31 @@
     }
   }
 
+  // rescindInvitation (task 1002971) — the goal's own authority takes back an
+  // invitation nobody has answered yet, the manager-side mirror of the
+  // requester's Withdraw. Shares respondToJoinRequest's in-flight guard so a
+  // double-click can't fire two rescinds at one row.
+  async function rescindInvitation(goalId, reqId, btn) {
+    const key = `rescind:${reqId}`;
+    if (pendingActionsPending.has(key)) return;
+    pendingActionsPending.add(key);
+    if (btn) btn.disabled = true;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/invitations/${encodeURIComponent(reqId)}/rescind`, {});
+      toast('Invitation rescinded.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      toast((err && err.data && err.data.message) || 'Could not rescind that invitation just now.');
+      if (btn) btn.disabled = false;
+    } finally {
+      pendingActionsPending.delete(key);
+    }
+  }
+
   // task 1953 — every pending row on THIS goal, rendered for a manager: join
-  // requests get Approve/Deny; outstanding invites are informational (only the
-  // invitee can accept/decline theirs — the server has no manager-cancel route).
+  // requests get Approve/Deny; an outstanding invite the goal sent can be
+  // rescinded (task 1002971), and only the invitee can accept/decline theirs.
 
   // task 1953 — async membership-queue load, kicked off (fire-and-forget) from
   // renderDetail like loadGoalTasks: my own pending request on this goal (any
@@ -1060,6 +1082,8 @@
     if (approveBtn) { respondToJoinRequest(state.current, approveBtn.dataset.approveReq, 'approve', approveBtn); return; }
     const denyBtn = e.target.closest('[data-deny-req]');
     if (denyBtn) { respondToJoinRequest(state.current, denyBtn.dataset.denyReq, 'deny', denyBtn); return; }
+    const rescindBtn = e.target.closest('[data-rescind-inv]');
+    if (rescindBtn) { rescindInvitation(state.current, rescindBtn.dataset.rescindInv, rescindBtn); return; }
   });
   window.addEventListener('hashchange', route);
 

package/modules/hall-ui/public/goals-render.js

@@ -772,6 +772,13 @@
       const nextVisibility = g.visibility === 'private' ? 'public' : 'private';
       const label = g.visibility === 'private' ? '🔒 Private — make public' : 'Make private';
       parts.push(`<button class="btn-ghost" id="goal-visibility-btn" type="button" data-next-visibility="${escapeHtml(nextVisibility)}">${label}</button>`);
+      // task 1002971 (spec D6) — "closed to applications" is a PRIVATE-goal idea
+      // only: a public goal is self-join, so the toggle would say nothing there.
+      // Closing never touches invitations — a lead can always still invite.
+      if (g.visibility === 'private') {
+        const closing = g.accepting_requests !== false;
+        parts.push(`<button class="btn-ghost" id="goal-accepting-btn" type="button" data-next-accepting="${closing ? 'false' : 'true'}" title="${closing ? 'Stop taking join-requests; you can still invite people' : 'Take join-requests again'}">${closing ? 'Close to requests' : 'Open to requests'}</button>`);
+      }
     }
     if (g.status === 'open') {
       if (joined) {
@@ -780,6 +787,10 @@
         if (state.myPendingRequest) {
           parts.push('<span class="member-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
           parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
+        } else if (g.visibility === 'private' && g.accepting_requests === false) {
+          // task 1002971 — say so instead of offering a button the server will
+          // refuse; the same honest copy the API answers with.
+          parts.push('<span class="member-pill" title="The goal\'s leads have paused applications; they can still invite you">Not taking requests</span>');
         } else {
           parts.push('<button class="btn-ghost" id="goal-request-btn" type="button">🔒 Request to join</button>');
         }
@@ -791,6 +802,7 @@
     $('#goal-join-btn')?.addEventListener('click', () => joinLeave(g.id, 'join'));
     $('#goal-leave-btn')?.addEventListener('click', () => joinLeave(g.id, 'leave'));
     $('#goal-visibility-btn')?.addEventListener('click', (e) => toggleVisibility(g.id, e.currentTarget.dataset.nextVisibility));
+    $('#goal-accepting-btn')?.addEventListener('click', (e) => toggleAcceptingRequests(g.id, e.currentTarget.dataset.nextAccepting === 'true'));
     $('#goal-request-btn')?.addEventListener('click', () => requestToJoin(g.id));
     $('#goal-withdraw-btn')?.addEventListener('click', () => withdrawRequest(g.id, state.myPendingRequest && state.myPendingRequest.id));
   }
@@ -965,6 +977,22 @@
       else toast('Could not update visibility just now.');
     }
   }
+  // task 1002971 (spec D6) — open/close a PRIVATE goal to join-requests. Closing
+  // refuses new asks with honest copy; it never affects invitations, which is why
+  // the toast says so out loud rather than reading as "the goal is shut".
+  async function toggleAcceptingRequests(goalId, accepting) {
+    try {
+      await patchJSON(`${API}/goals/${encodeURIComponent(goalId)}/accepting-requests`, { accepting_requests: accepting });
+      toast(accepting ? 'This goal is taking join-requests again.' : 'Closed to join-requests — you can still invite people.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      const code = err?.data?.error;
+      if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may do this.');
+      else if (code === 'goal_not_open') toast('Only an open goal can be managed.');
+      else toast('Could not change that just now.');
+    }
+  }
   async function requestToJoin(goalId) {
     try {
       await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests`, {});
@@ -976,6 +1004,7 @@
       if (code === 'request_pending') toast('You already have a pending request or invitation for this goal.');
       else if (code === 'already_a_member') toast('You are already a member of this goal.');
       else if (code === 'goal_is_open') toast('This goal is open — joining directly instead.');
+      else if (code === 'not_accepting_requests') toast('This goal isn\'t taking requests right now.');
       else toast('Could not send the request just now.');
     }
   }
@@ -1004,9 +1033,15 @@
           <button class="btn-ghost" type="button" data-deny-req="${escapeHtml(String(r.id))}">Deny</button>
         </span>
       </li>`;
+    // task 1002971 — an invitation the goal SENT can now be taken back by the
+    // people who sent it (core_188's 'cancelled' = "withdrawn/rescinded by the
+    // opener"); before this the only un-send was asking the invitee to decline.
     const inviteLi = (r) => `<li class="pending-row">
         <span class="pending-row__who">${escapeHtml(pendingRequestWho(r))}</span>
         <span class="pending-row__note">invited — awaiting their response</span>
+        <span class="pending-row__actions">
+          <button class="btn-ghost" type="button" data-rescind-inv="${escapeHtml(String(r.id))}">Rescind</button>
+        </span>
       </li>`;
     const parts = [];
     if (requests.length) parts.push(`<div class="pending-group"><h3 class="pending-group__h">Join requests<span class="count-pill">${requests.length}</span></h3><ul class="pending-list">${requests.map(requestLi).join('')}</ul></div>`);

package/modules/lifecycle/db-goals.js

@@ -32,7 +32,7 @@ const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 // Shared column list so every goal read/return shapes a row identically.
 
 const GOAL_COLS =
-  'id, version_id, title, subtitle, description, scope_modules, status, visibility, created_by, succeeded_by_goal_id, sort_order, category_id, created_at, updated_at';
+  'id, version_id, title, subtitle, description, scope_modules, status, visibility, accepting_requests, created_by, succeeded_by_goal_id, sort_order, category_id, created_at, updated_at';
 
 // Shared column list for a goal_membership_requests row (task 1951 / ADR 0112) —
 // the invite / join-request queue behind private goals. Every helper below shapes
@@ -567,6 +567,26 @@ async function setGoalVisibility({ goalId, visibility }, deps = {}) {
   return rows[0] ?? null;
 }
 
+// setGoalAcceptingRequests — open or close a PRIVATE goal to new join-requests
+// (task 1002971, spec D6). false = closed: the request path refuses with honest
+// copy instead of queueing asks nobody will answer; invitations keep working, so
+// a lead can still reach out to a specific builder. Meaningless on a public goal
+// (self-join needs no request) — the column exists on every row, and the refusal
+// gate is what reads visibility. Bumps updated_at. Returns the updated goal row,
+// or null for an unknown id. The route gates WHO may call this
+// (authorizeGoalManagement: owner|manager|Archon); this helper just writes.
+async function setGoalAcceptingRequests({ goalId, acceptingRequests }, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `UPDATE goals
+        SET accepting_requests = $2, updated_at = now()
+      WHERE id = $1
+      RETURNING ${GOAL_COLS}`,
+    [goalId, acceptingRequests]
+  );
+  return rows[0] ?? null;
+}
+
 // createMembershipRequest — open a pending invite (kind='invite', a manager asks
 // builder_id in) or join-request (kind='request', the builder asks to join). The
 // partial-unique index (one pending row per goal+builder) means a duplicate ask
@@ -758,6 +778,7 @@ module.exports = {
   setGoalMembershipKind,
   setGoalStatus,
   setGoalSuccessor,
+  setGoalAcceptingRequests,
   setGoalVisibility,
   transferGoalOwnership,
 };