@bongos/core 1.19.805 → 1.19.806

package/modules/hall-ui/public/goals-render.js

@@ -883,7 +883,7 @@
     // this client gate deliberately doesn't re-derive the protected-module list
     // (that roster lives server-side only, module-scope-map.js) — a non-Archon
     // owner/manager sees the control on a protected-scope goal and gets a clear
-    // toast if the server 403s (see inviteMember's error handling below).
+    // toast if the server 403s (see sendInvitation's error handling below).
     const isOwner = sameId(g.created_by, selfId());
     const canManage = g.status === 'open' && (isArchon() || isOwner || iAmLead);
     renderActions(g, { joined, canManage });
@@ -1122,6 +1122,49 @@
     }
     return state.directory;
   }
+  // WHO IS STILL INVITABLE. Two exclusions, both of which exist to stop the page
+  // offering a name that can only fail:
+  //   - members, which POST /invitations 409s as `already_a_member`;
+  //   - anyone holding a PENDING row, which it 409s as `invite_pending`.
+  // The second is the one that matters, because a pending invitation is INVISIBLE
+  // from the member list — it is not a membership — so without this the user picks
+  // a perfectly ordinary-looking name and is handed an error they had no way to
+  // predict. `state.pendingRequests` carries BOTH kinds (invites the goal sent and
+  // join-requests it received) and the server refuses on either, so neither is
+  // filtered out here.
+  function invitableBuilders(members) {
+    const excluded = new Set((members || []).map((m) => String(m.builder_id)));
+    for (const r of state.pendingRequests || []) excluded.add(String(r.builder_id));
+    return (state.directory || []).filter((b) => !excluded.has(String(b.id)));
+  }
+  function builderOptionsHtml(list, selectedId) {
+    return list.map((b) => {
+      const id = String(b.id);
+      const sel = selectedId && id === String(selectedId) ? ' selected' : '';
+      return `<option value="${escapeHtml(id)}"${sel}>${escapeHtml(b.display_name || ('@' + b.github_login))}</option>`;
+    }).join('');
+  }
+  // THE INVITE BOX SENDS AN INVITATION; IT DOES NOT ADD ANYONE (task 1002886).
+  //
+  // This control used to POST /goals/:id/members — the immediate force-add — and
+  // then toast 'Invited.', which was simply untrue: the person was already in the
+  // goal and had never been asked. Meanwhile the consented flow ADR 0112 is built
+  // around (POST /goals/:id/invitations -> a pending row -> the invitee accepts)
+  // had its receiving half fully wired in goal-inbox.js and NO sender anywhere in
+  // the hall, so nothing in the product ever created an invitation.
+  //
+  // Now: the primary control invites, and the force-add survives as its own
+  // explicitly-labelled affordance (owner ruling, 2026-09-16) so nobody loses a
+  // capability they had — seeding a goal with a team who already agreed offline is
+  // a real thing people do. The rule the owner set is that BOTH paths say what
+  // they actually do; relocating the lie would have been worse than leaving it.
+  //
+  // NO MEMBERSHIP-KIND PICKER ON THE INVITE HALF, and that is not an oversight:
+  // `goal_membership_requests` has no membership_kind column, so an accepted
+  // invitation lands through addGoalMember's default 'member'. A picker here would
+  // be a choice silently dropped on the floor — the same class of defect as the
+  // toast it replaces. The form says so instead, and the picker stays on the
+  // add-directly path, where it IS honoured.
   function renderInviteBox(goalId, canInvite, members) {
     const box = $('#goal-invite');
     if (!box) return;
@@ -1129,6 +1172,7 @@
       box.hidden = true;
       box.innerHTML = '';
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       return;
     }
     box.hidden = false;
@@ -1141,42 +1185,111 @@
       });
       return;
     }
-    const memberIds = new Set((members || []).map((m) => String(m.builder_id)));
-    const invitable = (state.directory || []).filter((b) => !memberIds.has(String(b.id)));
-    const options = invitable
-      .map((b) => `<option value="${escapeHtml(String(b.id))}">${escapeHtml(b.display_name || ('@' + b.github_login))}</option>`)
-      .join('');
+    // This function rebuilds the box from scratch on every call, and it is called
+    // again when the pending-request list lands (see loadGoalMembership). Carry the
+    // half-filled form across that redraw, or a note someone is part-way through
+    // typing vanishes under them.
+    const keep = {
+      builder: $('#goal-invite-builder')?.value || '',
+      note: $('#goal-invite-note')?.value || '',
+      direct: $('#goal-direct-builder')?.value || '',
+      kind: $('#goal-direct-kind')?.value || 'member',
+    };
+    const invitable = invitableBuilders(members);
+    const none = !invitable.length;
+    const emptyLabel = 'Nobody left to invite';
     box.innerHTML = `
       <form class="goal-invite__form" id="goal-invite-form">
-        <select id="goal-invite-builder" required ${invitable.length ? '' : 'disabled'}>
-          ${invitable.length ? `<option value="" disabled selected>Choose a builder…</option>${options}`
-            : '<option value="">Everyone is already a member</option>'}
-        </select>
-        <select id="goal-invite-kind">
-          <option value="member">Member</option>
-          <option value="lead">Manager</option>
+        <select id="goal-invite-builder" required ${none ? 'disabled' : ''}>
+          ${none ? `<option value="">${emptyLabel}</option>`
+            : `<option value="" disabled${keep.builder ? '' : ' selected'}>Choose a builder…</option>${builderOptionsHtml(invitable, keep.builder)}`}
         </select>
-        <button class="landing__btn" type="submit" ${invitable.length ? '' : 'disabled'}>Invite</button>
+        <input id="goal-invite-note" type="text" maxlength="500" placeholder="Note (optional) — why you're asking" value="${escapeHtml(keep.note)}" ${none ? 'disabled' : ''}>
+        <button class="landing__btn" type="submit" ${none ? 'disabled' : ''}>Send invitation</button>
         <button class="btn-ghost" id="goal-invite-cancel" type="button">Cancel</button>
-      </form>`;
+      </form>
+      <p class="goal-invite__hint">They join as a member once they accept — you can change that afterwards. Nobody is added until they do.</p>
+      ${state.addDirectOpen ? `
+        <form class="goal-invite__form goal-invite__direct" id="goal-direct-form">
+          <select id="goal-direct-builder" required ${none ? 'disabled' : ''}>
+            ${none ? `<option value="">${emptyLabel}</option>`
+              : `<option value="" disabled${keep.direct ? '' : ' selected'}>Choose a builder…</option>${builderOptionsHtml(invitable, keep.direct)}`}
+          </select>
+          <select id="goal-direct-kind" ${none ? 'disabled' : ''}>
+            <option value="member"${keep.kind === 'member' ? ' selected' : ''}>Member</option>
+            <option value="lead"${keep.kind === 'lead' ? ' selected' : ''}>Manager</option>
+          </select>
+          <button class="btn-ghost" type="submit" ${none ? 'disabled' : ''}>Add without asking</button>
+          <button class="btn-ghost" id="goal-direct-cancel" type="button">Cancel</button>
+        </form>
+        <p class="goal-invite__hint">They are added straight away and never asked. Use this only for someone who has already agreed.</p>`
+      : '<button class="goal-invite__more" id="goal-direct-open" type="button">Or add someone without asking…</button>'}`;
     $('#goal-invite-cancel')?.addEventListener('click', () => {
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       renderInviteBox(goalId, canInvite, members);
     });
     $('#goal-invite-form')?.addEventListener('submit', (ev) => {
       ev.preventDefault();
       const builderId = $('#goal-invite-builder')?.value;
-      const membershipKind = $('#goal-invite-kind')?.value || 'member';
-      if (builderId) inviteMember(goalId, builderId, membershipKind);
+      const note = $('#goal-invite-note')?.value || '';
+      if (builderId) sendInvitation(goalId, builderId, note);
+    });
+    $('#goal-direct-open')?.addEventListener('click', () => {
+      state.addDirectOpen = true;
+      renderInviteBox(goalId, canInvite, members);
+    });
+    $('#goal-direct-cancel')?.addEventListener('click', () => {
+      state.addDirectOpen = false;
+      renderInviteBox(goalId, canInvite, members);
+    });
+    $('#goal-direct-form')?.addEventListener('submit', (ev) => {
+      ev.preventDefault();
+      const builderId = $('#goal-direct-builder')?.value;
+      const membershipKind = $('#goal-direct-kind')?.value || 'member';
+      if (builderId) addMemberDirectly(goalId, builderId, membershipKind);
     });
   }
-  async function inviteMember(goalId, builderId, membershipKind) {
+  // The ADR 0112 sender. 201 means a PENDING row exists — not a membership — so
+  // the toast may not claim the person is in the goal.
+  async function sendInvitation(goalId, builderId, note) {
+    try {
+      const body = { builder_id: Number(builderId) };
+      const trimmed = String(note || '').trim();
+      if (trimmed) body.note = trimmed;
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/invitations`, body);
+      toast('Invitation sent — they join once they accept.');
+      state.inviteOpen = false;
+      state.addDirectOpen = false;
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      const code = err?.data?.error;
+      // `invite_pending` and `already_a_member` are both filtered out of the
+      // dropdown above, so reaching either means the goal changed under this form
+      // — say what happened rather than a generic failure, because the name really
+      // was offered a moment ago.
+      if (code === 'invite_pending') toast('They already have an invitation or a join-request pending on this goal.');
+      else if (code === 'already_a_member') toast('They joined this goal already.');
+      else if (code === 'builder_not_found') toast('That builder no longer exists.');
+      else if (code === 'archon_required_for_protected_scope') toast('This goal is scoped to a protected module — only an Archon may bring someone in.');
+      else if (code === 'metic_required_for_protected_scope') toast('A protected-scope goal requires a Metic+ member.');
+      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may invite.');
+      else if (code === 'goal_not_open') toast('This goal is not open.');
+      else toast('Could not send that invitation just now.');
+    }
+  }
+  // The force-add, kept on purpose and labelled for what it is. Same endpoint the
+  // '+ Invite' button used to call behind the word 'Invited.'
+  async function addMemberDirectly(goalId, builderId, membershipKind) {
     try {
       // `membership_kind`, not `role` — ADR 0174 reserves that word for the three
       // crafts (task 1003013).
       await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), membership_kind: membershipKind });
-      toast('Invited.');
+      toast('Added — they are in the goal now, without being asked.');
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       await loadDetail(goalId, { force: true });
       renderDetail(goalId);
       renderList();
@@ -1184,9 +1297,9 @@
       const code = err?.data?.error;
       if (code === 'archon_required_for_protected_scope') toast('This goal is scoped to a protected module — only an Archon may add members.');
       else if (code === 'metic_required_for_protected_scope') toast('A protected-scope goal requires a Metic+ member.');
-      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may invite.');
+      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may add members.');
       else if (code === 'goal_not_open') toast('This goal is not open.');
-      else toast('Could not invite that builder just now.');
+      else toast('Could not add that builder just now.');
     }
   }
   async function joinLeave(goalId, action) {
@@ -1324,7 +1437,16 @@
     if (!sameId(state.current, goalId)) return;
     renderPendingRequests();
     const d = currentDetail();
-    if (d) renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+    if (d) {
+      renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+      // The invite dropdown's exclusion set reads state.pendingRequests, which
+      // lands HERE — after renderDetail has already drawn the box. Without this
+      // redraw a form opened before this resolved keeps offering a builder whose
+      // invitation is already pending, which is the exact invisible 409 the
+      // filter exists to prevent. renderInviteBox carries the half-filled form
+      // across the redraw.
+      if (state.inviteOpen) renderInviteBox(goalId, canManage, d.members || []);
+    }
   }
   async function loadDetail(goalId, { force = false } = {}) {
     if (!force && state.details.has(String(goalId))) return state.details.get(String(goalId));

package/modules/hall-ui/public/goals.css

@@ -200,7 +200,22 @@
    collapsed behind "+ Invite" (disclosure, closed by default — task 2171). */
 .goal-invite { margin: 4px 0 10px; }
 .goal-invite__form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-.goal-invite__form select#goal-invite-builder { flex: 1; min-width: 180px; }
+.goal-invite__form select#goal-invite-builder,
+.goal-invite__form select#goal-direct-builder { flex: 1; min-width: 180px; }
+.goal-invite__form input#goal-invite-note { flex: 1; min-width: 180px; }
+
+/* task 1002886 — BOTH admission paths now say what they do, so both carry a
+   line of their own: the invite half promises nobody is added until they
+   accept, the force-add half admits nobody is asked. Muted, because this is
+   the consequence of the button beside it, not a warning. */
+.goal-invite__hint { margin: 4px 0 8px; font-size: 12.5px; color: var(--ink-faint); max-width: var(--measure); }
+/* The force-add is deliberately QUIETER than the invite it sits under — same
+   authority, but it is the path that skips consent, so it does not get equal
+   visual weight. It stays one click away, never hidden. */
+.goal-invite__more { background: none; border: 0; padding: 0; margin: 0 0 8px; cursor: pointer;
+  font: inherit; font-size: 12.5px; color: var(--ink-soft); text-decoration: underline; }
+.goal-invite__more:hover { color: var(--ink); }
+.goal-invite__direct { padding-top: 8px; border-top: var(--line) solid var(--rule-soft); }
 
 /* task 1953 — private goals: the lock badge (meta line) + the goal's own
    pending invite/join-request queue (manager view, next to the invite box). */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.805",
+  "version": "1.19.806",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.805",
+      "version": "1.19.806",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.805",
+  "version": "1.19.806",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.805'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.806'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_invite_consent.mjs

@@ -0,0 +1,307 @@
+// tests/goal_invite_consent.mjs — the goals page INVITES; it does not force-add
+// behind the word "Invited." (task 1002886, goal 1000095).
+//
+// WHY THIS FILE EXISTS. The '+ Invite' control posted to POST /goals/:id/members
+// — the immediate force-add — and then toasted 'Invited.' The person was already
+// in the goal and had never been asked. Meanwhile ADR 0112's consented flow
+// (POST /goals/:id/invitations -> a pending row -> the invitee accepts) had its
+// RECEIVING half fully wired in goal-inbox.js and no sender anywhere in the hall,
+// so nothing in the product ever created an invitation.
+//
+// Nothing in tests/ touched the invite box before this file — which is how a
+// control could claim one thing and do the opposite for as long as it did. The
+// lesson generalises past this button: assert the REQUEST a control issues and
+// the SENTENCE it then shows, because those two drifting apart is invisible to
+// any test that only checks the control renders.
+//
+// It runs the REAL goals-render.js (plus the real goals-lib, task-lib and kit)
+// in a vm against a stub DOM and a recording postJSON, and drives renderDetail —
+// the actual entry point, not the private renderer — so what is asserted is the
+// call the page really makes.
+//
+// Run:  node tests/goal_invite_consent.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const P = 'modules/hall-ui/public/';
+const RENDER_JS = read(`${P}goals-render.js`);
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+const SELF = 7001;          // the viewer: the goal's creator, so canManage is true
+const MEMBER_ID = 7002;     // already in the goal
+const PENDING_ID = 7003;    // holds a pending invitation the goal sent
+const FREE_ID = 7004;       // neither — the only genuinely invitable builder
+
+function makeEl(id) {
+  const el = {
+    id,
+    innerHTML: '', textContent: '', value: '', className: '',
+    hidden: false, disabled: false, checked: false,
+    options: [], style: {}, dataset: {},
+    children: [],
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild(c) { el.children.push(c); return c; },
+    setAttribute() {}, removeAttribute() {}, focus() {}, scrollIntoView() {},
+    _on: new Map(),
+    addEventListener(ev, fn) {
+      if (!el._on.has(ev)) el._on.set(ev, []);
+      el._on.get(ev).push(fn);
+    },
+    fire(ev, arg) {
+      for (const fn of el._on.get(ev) || []) fn(arg || { preventDefault() {} });
+    },
+    querySelector() { return null; },
+    querySelectorAll() { return []; },
+  };
+  return el;
+}
+
+function harness({ pendingRequests = [] } = {}) {
+  const els = new Map();
+  // The box is re-rendered by replacing innerHTML, and the stub DOM does not
+  // parse HTML — so the controls the page writes into #goal-invite are modelled
+  // by their ids, which is exactly how the page reaches them ($('#id')).
+  // Ids the invite box writes INTO itself. Listed rather than inferred because
+  // the stub does not parse HTML — this is the seam where it has to imitate the
+  // one thing real innerHTML does that matters here: destroy what was there.
+  const INVITE_CHILD_IDS = [
+    'goal-invite-open', 'goal-invite-form', 'goal-invite-builder', 'goal-invite-note',
+    'goal-invite-cancel', 'goal-direct-open', 'goal-direct-form', 'goal-direct-builder',
+    'goal-direct-kind', 'goal-direct-cancel',
+  ];
+  const getEl = (id) => {
+    const key = String(id).replace(/^#/, '');
+    if (!els.has(key)) {
+      const el = makeEl(key);
+      if (key === 'goal-invite') {
+        // THE BUG THIS MODELS IS REAL: renderInviteBox rebuilds the box on every
+        // call, and a stub that kept the old nodes alive would keep their click
+        // handlers too — so a single click would re-enter the renderer once per
+        // previous render. That is a defect in the STUB, not the page, but only
+        // because the page really does replace these nodes. Keep them in step.
+        let html = '';
+        Object.defineProperty(el, 'innerHTML', {
+          get: () => html,
+          set: (v) => { html = String(v); for (const cid of INVITE_CHILD_IDS) els.delete(cid); },
+        });
+      }
+      els.set(key, el);
+    }
+    return els.get(key);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    body: makeEl('body'),
+    getElementById: getEl,
+    querySelector: (sel) => getEl(sel),
+    querySelectorAll: () => [],
+    createElement: () => makeEl(),
+    addEventListener() {},
+  };
+
+  const posts = [];
+  const toasts = [];
+  const state = {
+    current: 1,
+    view: 'detail',
+    details: new Map(),
+    directory: [
+      { id: MEMBER_ID, display_name: 'Ada Member', github_login: 'ada' },
+      { id: PENDING_ID, display_name: 'Ben Pending', github_login: 'ben' },
+      { id: FREE_ID, display_name: 'Cleo Free', github_login: 'cleo' },
+    ],
+    pendingRequests,
+    myPendingRequest: null,
+    inviteOpen: false,
+    addDirectOpen: false,
+    // The rest of the page state renderDetail walks through on its way to the
+    // invite box. Shapes copied from goals-page.js's initial state — the
+    // renderers read several of these unguarded, so a partial stub throws
+    // before execution ever reaches what is under test here.
+    workSort: { todo: { by: null, dir: 'desc' }, done: { by: null, dir: 'desc' } },
+    work: { todo: [], done: [] },
+    workLoaded: false,
+    claimsByTask: new Map(),
+    conflictPairs: null,
+    conflictSource: null,
+    rollups: new Map(),
+    activity: new Map(),
+  };
+
+  const windowObj = {
+    location: { assign() {}, href: '/goals' },
+    localStorage: { getItem: () => null, setItem() {}, removeItem() {} },
+    scrollTo() {}, addEventListener() {},
+    matchMedia: () => ({ matches: false, addEventListener() {}, addListener() {} }),
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+      $: (sel) => documentObj.querySelector(sel),
+      fmtNum: (n) => String(n ?? ''),
+      fmtInt: (n) => String(n ?? ''),
+      fmtDate: (d) => String(d ?? '').slice(0, 10),
+      toast: (m) => toasts.push(String(m)),
+      rankLabel: (r) => String(r ?? ''),
+      categoryChip: () => '',
+      num: (n) => Number(n) || 0,
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON, Set, Map,
+    fetch: () => Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  for (const f of ['hall-kit.js', 'task-lib.js', 'goals-lib.js', 'goals-render.js']) {
+    vm.runInContext(read(P + f), sandbox, { filename: f });
+  }
+
+  const goal = {
+    id: 1, version_id: 'BONGOS-V2', status: 'open', visibility: 'public',
+    created_by: SELF, title: 'A goal', scope_modules: [], accepting_requests: true,
+  };
+  const members = [{ builder_id: MEMBER_ID, display_name: 'Ada Member', membership_kind: 'member' }];
+  const detail = { goal, members, criteria: [], satisfied: [], tasks: [] };
+  state.details.set('1', detail);
+
+  const api = sandbox.window.OTBGoalsRender({
+    API: '/api/bongos',
+    curLabel: () => 'Credits',
+    // URL-aware, because the renderers walk several feeds on the way to the
+    // invite box and a one-shape-fits-all reply feeds the wrong array into the
+    // wrong pager.
+    getJSON: async (url) => {
+      if (/\/goals\/\d+\/requests$/.test(url)) return { requests: pendingRequests };
+      if (/\/goals\/inbox$/.test(url)) return { myPendingRequests: [] };
+      if (/\/builders\/directory/.test(url)) return { builders: state.directory };
+      if (/\/tasks/.test(url)) return { tasks: [] };
+      if (/\/claims/.test(url)) return { claims: [] };
+      return {};
+    },
+    patchJSON: async () => ({}),
+    postJSON: async (url, body) => { posts.push({ url, body }); return { ok: true }; },
+    sameId: (a, b) => String(a ?? '') === String(b ?? ''),
+    selfId: () => SELF,
+    state,
+    get workTabs() { return { activate() {} }; },
+  });
+
+  return { api, state, posts, toasts, getEl, els };
+}
+
+// Open the invite box the way a user does: render the detail, then click
+// "+ Invite". Returns the harness with the form on screen.
+async function openInviteForm(h) {
+  h.api.renderDetail(1);
+  await tick();
+  h.getEl('goal-invite-open').fire('click');
+  await tick(); await tick();
+  return h;
+}
+
+// ---------------------------------------------------------------------------
+
+await test('the source no longer names the force-add as an "invite"', () => {
+  assert.ok(!/async function inviteMember\b/.test(RENDER_JS),
+    'inviteMember() was the force-add wearing the word invite — it is split in two');
+  assert.match(RENDER_JS, /async function sendInvitation\(/, 'the consented sender exists');
+  assert.match(RENDER_JS, /async function addMemberDirectly\(/, 'the force-add is named for what it does');
+  assert.ok(!/toast\('Invited\.'\)/.test(RENDER_JS), "the 'Invited.' toast on a force-add is gone");
+});
+
+await test('the invite form posts to /invitations and never claims they joined', async () => {
+  const h = await openInviteForm(harness());
+  h.getEl('goal-invite-builder').value = String(FREE_ID);
+  h.getEl('goal-invite-note').value = '  we could use your eye on this  ';
+  h.getEl('goal-invite-form').fire('submit');
+  await tick(); await tick();
+
+  assert.equal(h.posts.length, 1, 'exactly one write');
+  const { url, body } = h.posts[0];
+  assert.match(url, /\/goals\/1\/invitations$/, 'the CONSENTED endpoint, not /members');
+  assert.ok(!/\/members$/.test(url), 'the force-add endpoint is not what Invite calls');
+  assert.equal(body.builder_id, FREE_ID);
+  assert.equal(body.note, 'we could use your eye on this', 'the note is sent, trimmed');
+  assert.ok(!('membership_kind' in body),
+    'the invitations route carries no membership_kind — sending one would be a choice dropped in silence');
+
+  const said = h.toasts.join(' ');
+  assert.match(said, /accept/i, 'the toast turns on their acceptance');
+  assert.ok(!/^Invited\.$/.test(h.toasts[0]), 'the old lie is not relocated');
+  assert.ok(!/\b(added|joined|is now a member)\b/i.test(said),
+    `nobody joined anything yet — got: ${JSON.stringify(h.toasts)}`);
+});
+
+await test('an empty note is omitted rather than sent as an empty string', async () => {
+  const h = await openInviteForm(harness());
+  h.getEl('goal-invite-builder').value = String(FREE_ID);
+  h.getEl('goal-invite-note').value = '   ';
+  h.getEl('goal-invite-form').fire('submit');
+  await tick(); await tick();
+  assert.ok(!('note' in h.posts[0].body), 'a blank note is absent, not ""');
+});
+
+await test('the invite form offers no membership-kind picker', async () => {
+  const h = await openInviteForm(harness());
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(!/id="goal-invite-kind"/.test(html),
+    'the picker cannot be honoured by an invitation — goal_membership_requests has no such column');
+  assert.match(html, /join as a member/i, 'and the form says what they will join as instead');
+});
+
+await test('the dropdown excludes members AND anyone already pending', async () => {
+  const h = await openInviteForm(harness({
+    pendingRequests: [{ id: 55, kind: 'invite', builder_id: PENDING_ID, display_name: 'Ben Pending' }],
+  }));
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(html.includes(`value="${FREE_ID}"`), 'the invitable builder is offered');
+  assert.ok(!html.includes(`value="${MEMBER_ID}"`), 'a member would 409 already_a_member');
+  // The one that matters: a pending invitation is INVISIBLE in the member list,
+  // so without this filter the user picks an ordinary-looking name and is handed
+  // an error they had no way to predict.
+  assert.ok(!html.includes(`value="${PENDING_ID}"`), 'a pending invitee would 409 invite_pending');
+});
+
+await test('a pending JOIN-REQUEST is excluded too, not just an invitation', async () => {
+  const h = await openInviteForm(harness({
+    pendingRequests: [{ id: 56, kind: 'request', builder_id: PENDING_ID }],
+  }));
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(!html.includes(`value="${PENDING_ID}"`),
+    'the server refuses on EITHER kind, so the filter may not look only at invites');
+});
+
+await test('the force-add survives, one click away, and says nobody was asked', async () => {
+  const h = await openInviteForm(harness());
+  const collapsed = h.getEl('goal-invite').innerHTML;
+  assert.match(collapsed, /without asking/i, 'the path is discoverable, not removed');
+  assert.ok(!/id="goal-direct-form"/.test(collapsed), 'but it is not the default control');
+
+  h.getEl('goal-direct-open').fire('click');
+  await tick();
+  const open = h.getEl('goal-invite').innerHTML;
+  assert.match(open, /id="goal-direct-kind"/, 'the membership kind IS honoured on this path, so it is offered here');
+
+  h.getEl('goal-direct-builder').value = String(FREE_ID);
+  h.getEl('goal-direct-kind').value = 'lead';
+  h.getEl('goal-direct-form').fire('submit');
+  await tick(); await tick();
+
+  assert.equal(h.posts.length, 1);
+  assert.match(h.posts[0].url, /\/goals\/1\/members$/, 'the force-add endpoint');
+  assert.equal(h.posts[0].body.membership_kind, 'lead', 'and the chosen kind travels');
+  const said = h.toasts.join(' ');
+  assert.match(said, /without being asked/i, 'the consequence is stated, not hidden behind "Invited."');
+});
+
+summary();