@bongos/core 1.19.57 → 1.19.59

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.57",
-  "core_contract": "1.19.57",
-  "source_commit": "d5ca44895137856aa789c4d7c1d9ad732f18677e",
+  "core_version": "1.19.59",
+  "core_contract": "1.19.59",
+  "source_commit": "e93244fafbe4236b1b90218f03c70c92bfd0becb",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T22:30:38.907Z",
+  "built_at": "2026-08-11T23:37:01.674Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1529,
-  "tree_sha256": "8a7e64dbdd4ede2b54d71459203bde777a10357d5cd67e4e6ae4f0c7a6143260",
+  "tree_sha256": "0f793cd7617fce56439932f68de11239e7639d28e50f8d9ee485ba8a602a5f30",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "modules/dev-box/boxes.js",
       "mode": "0000644",
-      "sha256": "acb95d0a5fb535197e949effd0a8720dfaa743a6d86109f10d91505401197c63"
+      "sha256": "fbf9bb7bd4c70ac81627d7d473a94e98e6976581bc29f60c5342d428a39238cf"
     },
     {
       "path": "modules/dev-box/db.js",
@@ -2962,7 +2962,7 @@
     {
       "path": "modules/hall-ui/public/box-panel.js",
       "mode": "0000644",
-      "sha256": "271246b55dfd787c338b6f844b96d0032e111b2943d5e12cfaeb9bca3ef75f26"
+      "sha256": "d4b32aa4382100a7e60cc83e83ef23ba34dac0ff759143286b2deaebb8f56cb1"
     },
     {
       "path": "modules/hall-ui/public/brand-apply.js",
@@ -3057,7 +3057,7 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "bacccdcedf5abfe57ebe6ae4f521f00dace123c11509554b2ef6c934fde2afb4"
+      "sha256": "fcfe94b3e0cd00ddc881283d9897121518a7acc00b3d05b0715552911e2a0705"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
@@ -3382,7 +3382,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "89febe6a0002d2277a61b14cc08c4076d1ab6c738fdea8f8a4a1348e330c0b9e"
+      "sha256": "37303ffa7a795ea41db83f346bc736898720a3d1521434f566a71bbeb7b4dc15"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3477,7 +3477,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "9651f16e968983ab378aabc3d2a5e3d6ef6ba3fc3aaa00727fc5aff673b8d10e"
+      "sha256": "a291701ef3b3f8bb548d8e3475707e52562d0c9f03d334a885ff2022c90358dc"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9fe3440acdb516f9f7f017a6c8bbc81630d5b3ad35d142bc963e7e98d912b028"
+      "sha256": "f2e15bf06d0e8080e47aeea514dfc26dc267c14a96d32fe805cb240491f0baad"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "02fa8808a033c08a95574361009e2a7b57947d74fc537972aa20b17c030fe400"
+      "sha256": "c3feb3c561c5bf96e9580673b6995835a0d5674f54f96c8b3109fc304e090556"
     },
     {
       "path": "public-docs/index.html",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cbba8f9a639edf5e6d3b8cf26f830df5f2a2b1f96330660a71968ffa5dd98180"
+      "sha256": "a02eb4c1cfa272d700a9776652612143de38566cd86208f059ed1d0fed24934b"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5947,7 +5947,7 @@
     {
       "path": "tests/box_code_staleness.mjs",
       "mode": "0000644",
-      "sha256": "fc29b6b8be8aa4780486ff33abceceb3a46fc421198a78a09a2a8cf693fd33f1"
+      "sha256": "59d4580504c7352d5f83eec0914f21d0af559b9782bdde1353b5cb3eb2dbb31f"
     },
     {
       "path": "tests/box_connect_e2e.mjs",
@@ -6497,7 +6497,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "5a90f9030e1e50a62779460788ac6a56374fd36a839adf40433dd6a184a9b787"
+      "sha256": "4bc1ecb2bec4345b55e074a06009d31f97e4b5e06b214669a72e485298307ac8"
     },
     {
       "path": "tests/goal_routes.mjs",
@@ -6512,7 +6512,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "b2f2a0d1bb3c518f1a23a203d2525c1e27bd13f02bc52b287d82219af13ca383"
+      "sha256": "508b8b99afe67f64c86b5e1b382052e02a4cc916bec58e28d396ba3716998baf"
     },
     {
       "path": "tests/goal_wall_proof.mjs",

package/modules/dev-box/boxes.js

@@ -752,8 +752,17 @@ const CODE_STALE_LAG_MS = 2 * 24 * 60 * 60 * 1000; // 2 days behind deployed cod
 // { stale, reason } where reason ∈
 //   not_active            — only active boxes are judged (parked/destroyed → n/a)
 //   awaiting_first_report — active, never reported, still inside provision grace
-//   never_reported        — active, past grace, never reported ⇒ too old to even
-//                           run the reporter (a pre-self-update box) ⇒ STALE
+//   never_reported        — active, past grace, never reported ⇒ NOT stale. Silence
+//                           is an unknown, not a verdict: it means the reporter never
+//                           ran, which is at least as likely to be OUR fault as the
+//                           box's. It was our fault for the whole life of this feature
+//                           (task 1002698) — ADR 0072 specified infra/box-report-version.sh
+//                           and it was never written (task 1002699), so EVERY box in the
+//                           fleet read as stale, and the banner's only remedy (destroy the
+//                           box, provision a fresh one) could not possibly clear it. A
+//                           builder who believed it rebuilt in a loop, losing uncommitted
+//                           work and spending money each time. Only a box that has ACTUALLY
+//                           REPORTED can be called stale — see 'behind'.
 //   behind                — reported, but its commit is > CODE_STALE_LAG_MS older
 //                           than the server's deployed commit ⇒ STALE (a box whose
 //                           `pull --ff-only` has been silently failing)
@@ -772,7 +781,9 @@ function computeCodeStaleness({ state, provisionedAt, codeReportedAt, codeCommit
     const prov = toMs(provisionedAt);
     const withinGrace = prov != null && (now - prov) < CODE_REPORT_GRACE_MS;
     if (withinGrace) return { stale: false, reason: 'awaiting_first_report' };
-    return { stale: true, reason: 'never_reported' };
+    // Not stale — see the 'never_reported' note above. The reason is still returned
+    // so an operator surface can show "we don't know", which is the honest answer.
+    return { stale: false, reason: 'never_reported' };
   }
 
   const boxCommit = toMs(codeCommittedAt);

package/modules/hall-ui/public/box-panel.js

@@ -183,15 +183,28 @@
     function renderBoxActive(box, term, cost) {
       const parts = ['<p class="setup__box-msg setup__box-msg--ok">Your dev box is ready.</p>'];
 
-      // idea 332 / task 1316 (ADR 0072): flag a box running old code. A box too
-      // old to self-update can't be fixed in place — only a rebuild (Close box →
-      // provision fresh) brings it onto current code. Points at the Close button
-      // below. The server decides `stale` (boxes.computeCodeStaleness).
+      // idea 332 / task 1316 (ADR 0072): flag a box running old code. The server
+      // decides `stale` (boxes.computeCodeStaleness), and since task 1002698 it says
+      // so ONLY for reason 'behind' — a box that actually reported a commit far
+      // behind the deployed one. Silence ('never_reported') is an unknown and no
+      // longer flags, so this banner can't fire on a healthy box any more.
+      //
+      // Lead with the CHEAP, NON-DESTRUCTIVE fix. A 'behind' box is reporting, so its
+      // sync cron is alive and a pull usually clears this on its own; closing the box
+      // destroys uncommitted work and costs a fresh spin-up. The old copy named the
+      // rebuild as the ONLY remedy ("It can't update itself"), which sent builders
+      // straight to the destructive option — and while never_reported still flagged,
+      // sent them there in a loop it could never resolve.
       if (box.code && box.code.stale) {
+        const days = Number(box.code.lag_ms) > 0
+          ? Math.floor(Number(box.code.lag_ms) / 86400000) : 0;
         parts.push(
-          '<p class="setup__box-msg setup__box-msg--warn">⚠ This box is running <strong>old code</strong>, '
-          + 'which can break art generation and reconnecting. It can\'t update itself — '
-          + 'use <strong>Close box</strong> below, then provision a fresh one to bring it current.</p>'
+          '<p class="setup__box-msg setup__box-msg--warn">⚠ This box is running <strong>older code</strong>'
+          + (days ? ` (about ${days} day${days === 1 ? '' : 's'} behind)` : '')
+          + ', which can break art generation and reconnecting. '
+          + 'Run <code>/builder-sync</code> in the terminal to pull the latest — that fixes it in place, '
+          + 'and keeps your work. If it is still behind after that, use <strong>Close box</strong> below '
+          + 'and provision a fresh one.</p>'
         );
       }
 

package/modules/hall-ui/public/goals-page.js

@@ -1237,7 +1237,13 @@
       // manager-only).
       const lockSpan = g.visibility === 'private'
         ? '<span class="goal-badge goal-badge--locked" title="Private — join is by invitation or an approved request">🔒 Private</span>' : '';
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${scope} ${depsSpan}`;
+      // task 1002689 — a PROTECTED-scope goal is join-gated too (Archon-mediated
+      // membership, ADR 0086 §3): badge it so it doesn't read as open-join. The
+      // flag is server-derived (scope_protected on the goal payload) — the client
+      // still never re-derives the protected roster.
+      const gateSpan = g.scope_protected
+        ? '<span class="goal-badge goal-badge--locked" title="Protected module scope — join by request; an Archon admits members">🛡 Archon-mediated</span>' : '';
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
     }
 
     // task 1762: the goal's own owner/manager (or an Archon) can invite/manage
@@ -1266,11 +1272,13 @@
 
   // task 1953 — the goal-detail Actions row: Leave/Join (unchanged), a manager's
   // Private/Public toggle (PATCH /goals/:id/visibility), and — for a non-member
-  // viewer of a PRIVATE goal — Request to join / Requested (withdraw) in place of
-  // Join (private goals are join-GATED: POST /goals/:id/join 409s goal_private for
-  // a non-Archon non-member). An Archon keeps the plain Join button: the server
-  // lets them self-join any goal regardless of visibility (POST /goals/:id/join),
-  // so "request" would be a pointless extra step for them.
+  // viewer of a PRIVATE or PROTECTED-scope goal — Request to join / Requested
+  // (withdraw) in place of Join. Both are join-GATED for a non-Archon non-member:
+  // POST /goals/:id/join 409s goal_private on a private goal and 403s
+  // archon_approval_required on a protected-scope one, while the server accepts a
+  // join-request on either (task 1002689 — scope_protected is server-derived on
+  // the goal payload). An Archon keeps the plain Join button: the server lets
+  // them self-join any goal, so "request" would be a pointless extra step.
   function renderActions(g, { joined, canManage }) {
     const actions = $('#goal-detail-actions');
     if (!actions) return;
@@ -1283,7 +1291,7 @@
     if (g.status === 'open') {
       if (joined) {
         parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
-      } else if (g.visibility === 'private' && !isArchon()) {
+      } else if ((g.visibility === 'private' || g.scope_protected) && !isArchon()) {
         if (state.myPendingRequest) {
           parts.push('<span class="role-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
           parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
@@ -1468,7 +1476,7 @@
       renderList();
     } catch (err) {
       const code = err?.data?.error;
-      if (code === 'archon_approval_required') toast('This goal is Archon-mediated — an Archon must add you.');
+      if (code === 'archon_approval_required') toast('This goal is Archon-mediated — request to join instead.');
       else if (code === 'goal_private') toast('This goal is private — request to join instead.');
       else if (code === 'not_a_member') toast('You are not a member of this goal.');
       else if (code === 'goal_not_open') toast('This goal is not open.');

package/modules/lifecycle/db.js

@@ -823,16 +823,20 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
   return { achieved: true, goal: updated };
 }
 
-// addGoalMember — join (or change role on re-join). Upserts on the (goal_id,
-// builder_id) PK so a member re-joining as lead is promoted, not a duplicate-key
-// error. role defaults to 'member'.
+// addGoalMember — join. Upserts on the (goal_id, builder_id) PK so a re-join is
+// not a duplicate-key error, and the conflict arm PRESERVES the stored role
+// (task 1002689): overwriting it let POST /goals/:id/join (always role 'member')
+// and a POST /goals/:id/members re-add silently demote a lead — including the
+// owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
+// guards. Role changes go through PATCH /goals/:id/members/:builderId only
+// (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
 
 async function addGoalMember({ goalId, builderId, role = 'member' }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `INSERT INTO goal_members (goal_id, builder_id, role)
           VALUES ($1, $2, $3)
-     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = EXCLUDED.role
+     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
      RETURNING goal_id, builder_id, role, joined_at`,
     [goalId, builderId, role]
   );

package/modules/lifecycle/routes/goals.js

@@ -373,6 +373,16 @@ function authorizeWithdrawJoinRequest({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// decorateGoalScope — additive, derived scope_protected flag on goal payloads
+// (task 1002689). A protected-scope goal is join-gated like a private one
+// (Archon-mediated membership, ADR 0086 §3), but the hall cannot re-derive the
+// protected roster client-side (module-scope-map is server-only) — so the
+// list/detail reads carry the boolean and the UI renders the request-to-join
+// path instead of a dead-end Join button. Never persisted; a pure map.
+function decorateGoalScope(goal) {
+  return goal ? { ...goal, scope_protected: scopeIncludesProtected(goal.scope_modules) } : goal;
+}
+
 module.exports = function buildGoalsRouter() {
   const router = express.Router();
 
@@ -443,7 +453,7 @@ module.exports = function buildGoalsRouter() {
     }
     try {
       const goals = await db.listGoals({ versionId: version || null, status: status || null });
-      return res.json({ goals });
+      return res.json({ goals: goals.map(decorateGoalScope) });
     } catch (err) {
       console.error('[gds] GET /goals', err);
       return res.fail('list_failed', { status: 500, message: 'internal error' });
@@ -512,7 +522,7 @@ module.exports = function buildGoalsRouter() {
         db.listCriteriaForGoal(id),
         db.getGoalDependencies(id),  // task 1761 — prerequisite goals + satisfied state
       ]);
-      return res.json({ goal, members, criteria, dependencies });
+      return res.json({ goal: decorateGoalScope(goal), members, criteria, dependencies });
     } catch (err) {
       console.error('[gds] GET /goals/:id', err);
       return res.fail('fetch_failed', { status: 500, message: 'internal error' });
@@ -559,7 +569,7 @@ module.exports = function buildGoalsRouter() {
         return res.fail('goal_not_open', 409, { status: goal.status });
       }
       if (scopeIncludesProtected(goal.scope_modules) && req.builder.rank !== 'archon') {
-        return res.fail('archon_approval_required', { status: 403, message: 'This goal is scoped to a protected module; an Archon must add you (POST /goals/:id/members).' });
+        return res.fail('archon_approval_required', { status: 403, message: 'This goal is scoped to a protected module; request to join (POST /goals/:id/requests) or ask an Archon to add you (POST /goals/:id/members).' });
       }
       // Private goals are join-GATED (task 1952 / ADR 0112): a non-member can't
       // self-join — they request to join or wait for an invite. An existing member
@@ -1493,3 +1503,6 @@ module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.
 module.exports.authorizeWithdrawJoinRequest = authorizeWithdrawJoinRequest;
+// task 1002689: the derived scope_protected payload decorator — exported for
+// tests/goal_membership_requests.mjs (DB-free), same precedent.
+module.exports.decorateGoalScope = decorateGoalScope;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.57",
+  "version": "1.19.59",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.57",
+      "version": "1.19.59",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.57",
+  "version": "1.19.59",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -541,8 +541,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.55 with no explicit bump. run 31535063954. (task 1002620)
 //   1.19.57 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.56 with no explicit bump. run 31542659439. (task 1002620)
+//   1.19.58 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.57 with no explicit bump. run 31546064883. (task 1002620)
+//   1.19.59 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.58 with no explicit bump. run 31547103265. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.57'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.59'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_code_staleness.mjs

@@ -42,14 +42,27 @@ t('active + never reported + just provisioned → not stale (awaiting first repo
   assert.equal(r.reason, 'awaiting_first_report');
 });
 
-t('active + never reported + past the provision grace → STALE (never_reported, ancient box)', () => {
+t('active + never reported + past the provision grace → NOT stale (never_reported is an unknown, task 1002698)', () => {
   const r = boxes.computeCodeStaleness({
     state: 'active', provisionedAt: iso(NOW - 13 * DAY), codeReportedAt: null, now: NOW,
   });
-  assert.equal(r.stale, true);
+  assert.equal(r.stale, false);
   assert.equal(r.reason, 'never_reported');
 });
 
+// Regression (task 1002698): the whole fleet reported never_reported because the
+// reporter ADR 0072 specified was never written (task 1002699). Silence must never
+// be enough on its own to tell a builder to destroy a working box.
+t('silence alone never flags a box — a report is required to call it stale', () => {
+  for (const age of [31 * 60 * 1000, 13 * DAY, 400 * DAY]) {
+    const r = boxes.computeCodeStaleness({
+      state: 'active', provisionedAt: iso(NOW - age), codeReportedAt: null,
+      serverCommittedAt: iso(NOW - HOUR), now: NOW,
+    });
+    assert.equal(r.stale, false, `age=${age}`);
+  }
+});
+
 t('active + reported a commit within the lag window → current', () => {
   const r = boxes.computeCodeStaleness({
     state: 'active',

package/tests/goal_membership_requests.mjs

@@ -41,6 +41,7 @@ const {
   authorizeInvitationResponse,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
+  decorateGoalScope,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
 
@@ -338,6 +339,30 @@ await test('authorizeWithdrawJoinRequest: the requester (string vs number id)
   assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// =========================================================================
+// decorateGoalScope (task 1002689) — goal payloads carry a derived
+// scope_protected flag so the hall can render the join-gate on a
+// protected-scope goal without re-deriving the roster client-side
+// (module-scope-map is server-only). 'kernel' is definitionally protected;
+// 'ideas' is not in the protected set.
+// =========================================================================
+
+await test('decorateGoalScope: protected-scope goal → scope_protected true', () => {
+  const g = decorateGoalScope({ id: 1, scope_modules: ['kernel'] });
+  assert.equal(g.scope_protected, true);
+});
+await test('decorateGoalScope: unprotected / empty scope → false; null passes through', () => {
+  assert.equal(decorateGoalScope({ id: 1, scope_modules: ['ideas'] }).scope_protected, false);
+  assert.equal(decorateGoalScope({ id: 1, scope_modules: [] }).scope_protected, false);
+  assert.equal(decorateGoalScope(null), null);
+});
+await test('decorateGoalScope: returns a copy, never mutates the row', () => {
+  const row = { id: 1, scope_modules: ['ideas'] };
+  const out = decorateGoalScope(row);
+  assert.notEqual(out, row);
+  assert.equal('scope_protected' in row, false);
+});
+
 // =========================================================================
 // route-rank pins (task 1952/1953) — the walls are in-handler, so the routes
 // stay 'any-builder'; an accidental requireRank re-gate must be a red build.

package/tests/goal_tier.mjs

@@ -154,13 +154,14 @@ await test('setGoalStatus: unknown goal returns null', async () => {
 // =========================================================================
 // addGoalMember
 // =========================================================================
-await test('addGoalMember: upserts on the PK (re-join changes role, no dup-key)', async () => {
+await test('addGoalMember: upsert PRESERVES the existing role (re-join cannot demote a lead)', async () => {
   const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
-  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'lead' }, { pool });
-  assert.equal(out.role, 'lead');
+  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member' }, { pool });
+  assert.equal(out.role, 'lead', 'an existing lead row survives a role:member re-add');
   const ins = find(pool.queries, /^INSERT INTO goal_members/);
-  assert.deepEqual(ins.params, [7, 42, 'lead']);
-  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = EXCLUDED.role/, 'upsert, not plain insert');
+  assert.deepEqual(ins.params, [7, 42, 'member']);
+  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/,
+    'conflict keeps the stored role — role changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
 });
 
 await test('addGoalMember: role defaults to member', async () => {