@bongos/core 1.20.26 → 1.20.27

package/modules/government/board.js

@@ -57,6 +57,9 @@ const {
 // describeMembership renders a predicate in the words the proposer was thinking
 // in ("metic and above"), for the disenfranchisement refusal (task 1003094).
 const { describeMembership } = require('./membership-predicate');
+// The genesis charter + legislation vocabulary (task 1004427): the real form
+// and variable names, and the name a constitution reads as.
+const charter = require('./charter');
 
 // ADR 0175 §5: the completeness bar a Full Idea must clear to reach the board.
 // Held equal to economy's IDEA_FULL_PASS_BAR by test — see the header.
@@ -812,6 +815,56 @@ async function proposeAmendment({
   return { ok: true, amendment, item };
 }
 
+// ── the genesis charter + legislation choice (task 1004427, spec D10) ───────
+//
+// A founder picks a form of government (the charter stage) and fine-tunes its
+// settings (the legislation stage). Both land HERE and nowhere else: the choice
+// is built into a whole constitution on top of the live one (charter.js) and
+// filed as an ordinary AMENDMENT — validated strictly, decided under the
+// constitution in force, and applied by the close like any amendment. Under
+// the monarchy default the founder's one yes applies it; under any other form
+// it is a real sitting. There is no second write path to the constitution, and
+// the disenfranchisement guard applies exactly as it does to a hand-written
+// proposal (a founder choosing a council they do not sit on is asked to
+// acknowledge it).
+//
+// Returns proposeAmendment's shape plus `reads_as` (the form the PROPOSED
+// constitution will read as, or Custom), or a named refusal:
+//   charter.buildCharterProposal's reasons | 'unknown_council_rank' | 'no_change'
+//   | any proposeAmendment refusal.
+async function proposeCharter({
+  form, franchise, councilRank, passRule, windowMinutes,
+  rationaleMd = null, proposedBy, acknowledgeSelfRemoval = false,
+} = {}) {
+  const { board: live } = loadGovernmentConfig();
+  const built = charter.buildCharterProposal(live, { form, franchise, councilRank, passRule, windowMinutes });
+  if (!built.ok) return built;
+  const v = validateProposedConstitution(built.proposal);
+  if (!v.ok) return { ok: false, ...v };
+  if (proposedBy == null || proposedBy === '') return { ok: false, reason: 'missing_proposer' };
+  // A council is a custom rank, which is a DB row this module's pure half
+  // cannot see. A council that does not exist would seat nobody — fail-closed,
+  // but a sitting nobody can ever vote on — so it is refused before filing.
+  if (charter.readCharter(v.proposal).franchise === 'council') {
+    const key = v.proposal.membership.slice('rank:'.length);
+    if (!(await db.getRankByKey(key))) return { ok: false, reason: 'unknown_council_rank', rank_key: key };
+  }
+  const unchanged = ['membership', 'pass_rule', 'window_minutes', 'close_early_on_full_turnout']
+    .every((k) => v.proposal[k] === live[k]);
+  if (unchanged) return { ok: false, reason: 'no_change' };
+
+  const readsAs = charter.readCharter(v.proposal);
+  const out = await proposeAmendment({
+    proposal: v.proposal,
+    // The record says in words what was chosen, so the amendment history reads
+    // "Charter: Direct Democracy" rather than a bare JSON block.
+    rationaleMd: rationaleMd || `Charter: ${readsAs.name}. ${readsAs.explanation}`,
+    proposedBy,
+    acknowledgeSelfRemoval,
+  });
+  return out.ok ? { ...out, reads_as: readsAs } : out;
+}
+
 // ── the board's third subject: closing a genesis stage (task 1004429) ───────
 //
 // Spec decision D7 (docs/specs/bongos-v2-project-startup.md): a new project is
@@ -860,13 +913,12 @@ const stageByNumber = (n) => GENESIS_STAGES.find((s) => s.number === Number(n))
 // The pass rules, said in words for the founding band. Keyed by exactly
 // config.js PASS_RULES (held equal by tests/government_board_genesis_stage.mjs,
 // so a fifth rule cannot land without its words); an unknown rule in an old
-// snapshot says so rather than guessing.
-const PASS_RULE_WORDS = Object.freeze({
-  first_ratifier: 'One yes from any member decides it.',
-  consent: 'It passes unless a member objects, once everyone has voted or the clock runs out.',
-  majority: 'More than half of all members must say yes.',
-  unanimous: 'Everyone who votes must agree, and at least one member must say yes.',
-});
+// snapshot says so rather than guessing. The sentences are written ONCE, as the
+// pass-rule explanations in charter.js (task 1004427), so the legislation stage
+// and the founding band can never describe one rule two ways.
+const PASS_RULE_WORDS = Object.freeze(Object.fromEntries(
+  charter.PASS_RULE_OPTIONS.map((o) => [o.key, o.explanation]),
+));
 
 // Put a finished stage to the board. Returns, never throws for a refusal:
 //   { opened: true,  item, stage }
@@ -1199,6 +1251,10 @@ async function constitutionView({ historyLimit = 50 } = {}) {
     // last passed one is not a shape this system has, and the honest failure
     // there is a missed warning rather than a wrong one.
     divergence: constitutionDivergence(live, history),
+    // The genesis charter + legislation stages' payload (task 1004427): every
+    // form and variable by its real name with its plain explanation, and the
+    // form the constitution in force reads as (or Custom). Pure — no query.
+    charter: charter.charterView(live),
     // THE CLOCK ADVICE THE AMENDMENT FORM NEEDS (task 1003733, ADR 0267 §3).
     // A proposer choosing a pass rule has to choose a window in the same breath
     // — a constitution is ratified whole, never by diff — and the two choices
@@ -1338,6 +1394,7 @@ async function pendingVotesFor(builderId) {
 module.exports = {
   GENESIS_STAGES,
   PASS_RULE_WORDS,
+  proposeCharter,
   openGenesisStageClose,
   genesisStageStatus,
   pendingVotesFor,

package/modules/government/charter.js

@@ -0,0 +1,232 @@
+'use strict';
+
+// modules/government/charter.js — the genesis charter and legislation stages'
+// vocabulary, on the REAL constitution (task 1004427 / BV2.PS13, spec decision
+// D10 in docs/specs/bongos-v2-project-startup.md).
+//
+// REAL NAMES, EACH EXPLAINED PLAINLY. Real-world governments are the model for
+// a project's structure, so every form and every setting is called what it
+// actually is — Monarchy / BDFL, Timocratic Republic, franchise, judicial
+// review — and carries a one- or two-sentence explanation of how it works in a
+// project. The explanation is simpler than the academic definition and never a
+// replacement for the name.
+//
+// ONLY WHAT IS BUILT CLAIMS TO BE. Two variables are the live board block:
+// franchise (`membership`) and pass rule (`pass_rule`). Loyalty of enforcement
+// is always on — authority is resolved from the rank you hold, per request and
+// uncached (ADR 0016), so nobody keeps a rank's powers after leaving it. The
+// other four are shown as coming later, and so are the three forms that need
+// machinery this system does not have (elections, member shares, federated
+// chambers).
+//
+// THE NAME FOLLOWS THE SETTINGS. `readCharter` reads what a constitution SEATS
+// (through the real membership parser) and its pass rule, and names the form
+// those make — or "Custom" when they make none. It reads the seated set, not
+// the spelling, so `rank:metic+` and `rank:metic,archon` read the same.
+//
+// APPLYING IS AN AMENDMENT. `buildCharterProposal` only BUILDS a whole
+// constitution from a choice; board.js `proposeCharter` files it through the
+// ordinary amendment path, so the choice is validated strictly and decided
+// under the constitution in force (under monarchy, the founder's one yes
+// applies it). There is no second write path to the constitution.
+//
+// Pure and DB-free: it requires only the catalog's ladder and the membership
+// grammar, so a test (or a boot-time caller) can use it without a database.
+//
+// The form names are held equal to the hall's charter library
+// (modules/hall-ui/public/government.js CHARTERS) by
+// tests/government_charter_forms.mjs — browser code cannot require this file,
+// and one form must never go by two names.
+
+const { RANK_ORDER } = require('./catalog');
+const { parseMembershipPredicate } = require('./membership-predicate');
+
+const freezeAll = (list) => Object.freeze(list.map((x) => Object.freeze({ ...x })));
+
+// ── franchise: who gets a vote ───────────────────────────────────────────────
+// `predicate` is the exact membership string written to the constitution, and
+// `seats` is what it must resolve to. `council` names a custom rank the owner
+// chooses, so its predicate is built from that choice.
+const FRANCHISE_OPTIONS = freezeAll([
+  { key: 'founder', name: 'The founder', predicate: 'rank:archon', seats: ['archon'],
+    explanation: 'Only the founder votes (the Archon rank). Right for a solo start, when there is nobody else to ask.' },
+  { key: 'trusted', name: 'Trusted builders and up', predicate: 'rank:metic+', seats: ['metic', 'archon'],
+    explanation: 'Builders who have earned the trusted rank by shipping get a vote, along with the founder.' },
+  { key: 'everyone', name: 'Every builder', predicate: 'rank:xenos+', seats: [...RANK_ORDER],
+    explanation: 'Everyone on the project gets a vote, from the newest builder to the founder.' },
+  { key: 'council', name: 'A council you name', predicate: null, seats: null,
+    explanation: 'Only the members of a council rank you create get a vote. You choose who sits on it.' },
+]);
+
+// ── pass rule (winning coalition): how many must agree ───────────────────────
+// Exactly the four rules config.js PASS_RULES knows (held equal by test).
+const PASS_RULE_OPTIONS = freezeAll([
+  { key: 'first_ratifier', name: 'One yes is enough',
+    explanation: 'One yes from any member decides it.' },
+  { key: 'consent', name: 'Passes unless someone objects',
+    explanation: 'It passes unless a member objects, once everyone has voted or the clock runs out.' },
+  { key: 'majority', name: 'More than half',
+    explanation: 'More than half of all members must say yes.' },
+  { key: 'unanimous', name: 'Everyone who votes agrees',
+    explanation: 'Everyone who votes must agree, and at least one member must say yes.' },
+]);
+
+// ── trajectory: how the government changes as the project grows ─────────────
+const TRAJECTORIES = freezeAll([
+  { key: 'locked', name: 'Locked',
+    explanation: 'The government stays as founded until the project votes to change it.' },
+  { key: 'laddered', name: 'Laddered',
+    explanation: 'The government steps up automatically as the team crosses each size threshold.' },
+  { key: 'scheduled', name: 'Scheduled',
+    explanation: 'The government changes on dates the project commits to in advance.' },
+]);
+
+// ── the government doc's seven variables ─────────────────────────────────────
+// status: 'live' (a real setting of the constitution today) | 'always_on' |
+// 'later' (shown, explained, and not yet settable).
+const VARIABLES = freezeAll([
+  { key: 'franchise', name: 'Franchise', question: 'Who gets a vote?', status: 'live',
+    explanation: 'Who sits on the board and votes on the project\'s decisions.' },
+  { key: 'pass_rule', name: 'Pass rule (winning coalition)', question: 'How many must agree?', status: 'live',
+    explanation: 'How much agreement a decision needs before it passes.' },
+  { key: 'veto_points', name: 'Veto points', question: 'How many checkpoints must a big change pass?', status: 'later',
+    explanation: 'How many separate approvals a big change must collect before it happens.' },
+  { key: 'executive_legislative', name: 'Executive–legislative relationship',
+    question: 'Does the leader serve at the team\'s confidence?', status: 'later',
+    explanation: 'Whether the team can replace its leader by vote, or the leader holds office for a set term.' },
+  { key: 'judicial_review', name: 'Judicial review', question: 'Who can void a decision that breaks the charter?', status: 'later',
+    explanation: 'Who may cancel a decision that goes against the project\'s charter.' },
+  { key: 'loyalty_of_enforcement', name: 'Loyalty of enforcement',
+    question: 'Does power belong to the office or the person?', status: 'always_on',
+    explanation: 'Whoever holds a rank holds its powers, and nobody keeps them after leaving it.' },
+  { key: 'trajectory', name: 'Trajectory', question: 'How does the government change as you grow?', status: 'later',
+    explanation: 'Whether the government stays put, grows with the team, or changes on a schedule.' },
+]);
+
+// ── the forms ────────────────────────────────────────────────────────────────
+// An available form is a franchise + a pass rule; choosing it sets exactly
+// those two. `key` matches the hall charter library's key.
+const FORMS = freezeAll([
+  { key: 'monarchy', name: 'Monarchy / BDFL', available: true, franchise: 'founder', pass_rule: 'first_ratifier',
+    explanation: 'One leader decides. In a project the founder makes the calls, which is fast, clear and honest for a solo start.' },
+  { key: 'timocratic-republic', name: 'Timocratic Republic', available: true, franchise: 'trusted', pass_rule: 'consent',
+    explanation: 'A say is earned, not given. Builders who have reached the trusted rank decide together.' },
+  { key: 'direct-democracy', name: 'Direct Democracy', available: true, franchise: 'everyone', pass_rule: 'consent',
+    explanation: 'Every builder votes directly. A decision passes unless someone objects with a reason.' },
+  { key: 'foundation', name: 'Foundation', available: true, franchise: 'council', pass_rule: 'consent',
+    explanation: 'A written charter looked after by a small council of trustees you appoint.' },
+  { key: 'presidential', name: 'Presidential', available: false,
+    explanation: 'The team elects a leader for a fixed term. Coming later, because it needs elections.' },
+  { key: 'cooperative', name: 'Cooperative', available: false,
+    explanation: 'Every member holds a share and gets one vote. Coming later, because it needs member shares.' },
+  { key: 'federation', name: 'Federation', available: false,
+    explanation: 'Self-governing teams coordinate under one shared pact. Coming later, for projects with many teams.' },
+]);
+
+const CUSTOM_EXPLANATION = 'These settings match no named form of government. They are still the real rules the board runs under.';
+
+const byKey = (list, key) => list.find((x) => x.key === key) || null;
+const sameSet = (a, b) => a.length === b.length && a.every((k) => b.includes(k));
+
+// Is this a single CUSTOM rank (a council)? A custom rank is a DB row this file
+// cannot see, so "not on the standard ladder" is the whole test here; whether
+// it exists is board.js's check against the live rows.
+const isCustomRankKey = (key) => typeof key === 'string' && !RANK_ORDER.includes(key);
+
+// Which franchise option does a membership predicate SEAT? Read through the
+// real parser, so an equivalent spelling reads the same and an unparseable one
+// reads as custom rather than as a guess.
+function franchiseOf(membership) {
+  const parsed = parseMembershipPredicate(membership);
+  if (!parsed) return 'custom';
+  const seats = [...parsed.rankKeys];
+  for (const o of FRANCHISE_OPTIONS) if (o.seats && sameSet(o.seats, seats)) return o.key;
+  if (seats.length === 1 && isCustomRankKey(seats[0])) return 'council';
+  return 'custom';
+}
+
+// The name follows the settings: which form does this board block make?
+function readCharter(board) {
+  const b = board || {};
+  const franchise = franchiseOf(b.membership);
+  const passRule = byKey(PASS_RULE_OPTIONS, b.pass_rule) ? b.pass_rule : 'custom';
+  const form = FORMS.find((f) => f.available && f.franchise === franchise && f.pass_rule === passRule);
+  return Object.freeze(form
+    ? { form: form.key, name: form.name, explanation: form.explanation, franchise, pass_rule: passRule }
+    : { form: 'custom', name: 'Custom', explanation: CUSTOM_EXPLANATION, franchise, pass_rule: passRule });
+}
+
+// Build the WHOLE constitution a charter choice makes, on top of the live one.
+// A choice is a form, a franchise, a pass rule, a window, or a form fine-tuned by
+// the others (the legislation stage tunes what the charter stage picked). The
+// fields a charter does not speak to — the clock and the full-turnout early
+// close — are KEPT from the live constitution unless a window is named, because
+// a constitution is ratified whole and the choice must not quietly change them.
+// Returns { ok: true, proposal } or { ok: false, reason }; the caller validates
+// the result strictly and files it as an amendment.
+function buildCharterProposal(liveBoard, { form, franchise, councilRank, passRule, windowMinutes } = {}) {
+  const live = liveBoard || {};
+  let franchiseKey = franchise;
+  let rule = passRule;
+  if (form !== undefined && form !== null) {
+    const f = byKey(FORMS, form);
+    if (!f) return { ok: false, reason: 'unknown_form' };
+    if (!f.available) return { ok: false, reason: 'form_not_available' };
+    if (franchiseKey == null) franchiseKey = f.franchise;
+    if (rule == null) rule = f.pass_rule;
+  }
+  if (franchiseKey == null && rule == null && windowMinutes === undefined) return { ok: false, reason: 'nothing_chosen' };
+
+  let membership = live.membership;
+  if (franchiseKey != null) {
+    const option = byKey(FRANCHISE_OPTIONS, franchiseKey);
+    if (!option) return { ok: false, reason: 'unknown_franchise' };
+    if (option.key === 'council') {
+      if (councilRank == null || councilRank === '') return { ok: false, reason: 'council_needs_a_rank' };
+      const predicate = `rank:${councilRank}`;
+      const parsed = parseMembershipPredicate(predicate);
+      if (!parsed || parsed.rankKeys.length !== 1 || !isCustomRankKey(parsed.rankKeys[0])) {
+        return { ok: false, reason: 'council_needs_a_custom_rank' };
+      }
+      membership = predicate;
+    } else {
+      membership = option.predicate;
+    }
+  }
+  if (rule != null && !byKey(PASS_RULE_OPTIONS, rule)) return { ok: false, reason: 'unknown_pass_rule' };
+
+  return {
+    ok: true,
+    proposal: {
+      membership,
+      pass_rule: rule != null ? rule : live.pass_rule,
+      window_minutes: windowMinutes !== undefined ? windowMinutes : (live.window_minutes ?? null),
+      close_early_on_full_turnout: live.close_early_on_full_turnout,
+    },
+  };
+}
+
+// The whole vocabulary plus what the constitution in force reads as — the
+// payload the genesis charter and legislation stages render from.
+function charterView(liveBoard) {
+  return {
+    forms: FORMS,
+    variables: VARIABLES.map((v) => (
+      v.key === 'franchise' ? { ...v, options: FRANCHISE_OPTIONS }
+        : v.key === 'pass_rule' ? { ...v, options: PASS_RULE_OPTIONS }
+          : v.key === 'trajectory' ? { ...v, options: TRAJECTORIES }
+            : v)),
+    reads_as: readCharter(liveBoard),
+  };
+}
+
+module.exports = {
+  FORMS,
+  VARIABLES,
+  FRANCHISE_OPTIONS,
+  PASS_RULE_OPTIONS,
+  TRAJECTORIES,
+  readCharter,
+  buildCharterProposal,
+  charterView,
+};

package/modules/government/routes/government.js

@@ -114,6 +114,11 @@ const governmentPort = {
   // the constitution in force. And the founding band's read: per stage, what it
   // is waiting on. A pass is announced as `board.genesis_stage.passed`.
   openGenesisStageClose: board.openGenesisStageClose,
+  // task 1004427 (BV2.PS13): the genesis charter + legislation choice, filed as
+  // an ordinary amendment under the constitution in force — for the genesis
+  // home, which renders the stages from GET /government/constitution's
+  // `charter` block. Opening a sitting decides nothing; the vote does.
+  proposeCharter: board.proposeCharter,
   genesisStageStatus: board.genesisStageStatus,
 };
 
@@ -536,6 +541,63 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.item.open — the genesis charter + legislation choice (task
+  // 1004427, spec D10): a form of government and/or its two live settings
+  // (franchise, pass rule), built into a whole constitution on top of the live
+  // one and filed through the SAME amendment path as the route above — the same
+  // atom, the same strict validation, the same self-removal guard. Nothing here
+  // changes the constitution; the sitting it opens is what decides.
+  router.post('/government/board/charter', api.requireBuilder, api.requirePermission('board.item.open'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      form: { type: 'string', maxLength: 64 },
+      franchise: { type: 'string', maxLength: 32 },
+      council_rank: { type: 'string', maxLength: RANK_KEY_MAX },
+      pass_rule: { type: 'string', maxLength: 32 },
+      rationale_md: { type: 'string', maxLength: 5000 },
+      acknowledge_self_removal: { type: 'boolean' },
+    })) return;
+    const body = req.body || {};
+    if (body.window_minutes !== undefined && body.window_minutes !== null && !Number.isInteger(body.window_minutes)) {
+      return res.fail('invalid_proposal', 400, { reason: 'bad_window_minutes', expected: 'null (no clock) or a whole number of minutes' });
+    }
+    try {
+      const out = await board.proposeCharter({
+        form: body.form ?? undefined,
+        franchise: body.franchise ?? undefined,
+        councilRank: body.council_rank ?? undefined,
+        passRule: body.pass_rule ?? undefined,
+        windowMinutes: body.window_minutes,
+        rationaleMd: body.rationale_md ?? null,
+        proposedBy: req.builder.id,
+        acknowledgeSelfRemoval: body.acknowledge_self_removal === true,
+      });
+      if (!out.ok) {
+        if (out.reason === 'proposer_would_lose_their_seat') {
+          return res.fail('proposer_would_lose_their_seat', 409, {
+            membership: out.membership,
+            describes: out.describes,
+            what_this_means: out.what_this_means,
+            hint: out.hint,
+            retry_with: { acknowledge_self_removal: true },
+          });
+        }
+        if (out.reason === 'no_change') {
+          return res.fail('no_change', 409, { reason: 'the constitution in force already has these settings' });
+        }
+        return res.fail('invalid_charter', 400, {
+          reason: out.reason,
+          ...(out.field ? { field: out.field } : {}),
+          ...(out.expected ? { expected: out.expected } : {}),
+          ...(out.rank_key ? { rank_key: out.rank_key } : {}),
+        });
+      }
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, reads_as: out.reads_as });
+    } catch (err) {
+      log.error('[gds] POST /government/board/charter', err);
+      res.fail('charter_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: perm board.vote.cast — cast a vote on an open board item (R08 of goal
   // 1000069, ADR 0175). The atom FLOORS AT XENOS deliberately (the R04 carry-
   // note): the permission is only the coarse gate, and the real wall is the

package/modules/hall-ui/public/government.js

@@ -678,6 +678,16 @@
   // hand" note; PASS_RULE_NAME sits beside its sentence-length twin
   // PASS_RULE_PLAIN there, so the two renderings of one pass rule cannot drift.
 
+  // The form of government the constitution in force READS AS (task 1004427):
+  // the real name and its plain explanation, or Custom. The server does the
+  // reading (charter.js readCharter) — the name follows the settings, so this
+  // page never guesses it. An older server without the block is said plainly.
+  function formOfGovernmentSentence(charter) {
+    const r = charter && charter.reads_as;
+    if (!r || !r.name) return 'Not available from this server yet.';
+    return `<strong>${escapeHtml(r.name)}</strong>. ${escapeHtml(r.explanation || '')}`;
+  }
+
   function dialRow(name, sentenceHtml) {
     return `<li class="ov-row"><div class="ov-row__main"><span class="ov-row__title">${escapeHtml(name)}</span><p class="ov-row__sub">${sentenceHtml}</p></div></li>`;
   }
@@ -829,6 +839,7 @@
     live.innerHTML = `
       ${divergenceHtml(data.divergence)}
       <ul class="ov-rows">
+        ${dialRow('Form of government', formOfGovernmentSentence(data.charter))}
         ${dialRow('Who sits on the board', membershipSentence(b))}
         ${dialRow('What counts as passing', passRuleSentence(b))}
         ${dialRow('How long a sitting runs', windowSentence(b, data.clock))}

package/modules/platform-identity/migrations/platform_identity_028_purge_pre_notice_invites.sql

@@ -0,0 +1,65 @@
+-- platform_identity_028_purge_pre_notice_invites.sql — delete the `pending` rows the
+-- OLD hub invite wrote (task 1004408, the owner's call on ADR 0353's open consequence).
+--
+-- WHY. Before ADR 0353 the hub's POST /projects/invite wrote a `pending` membership
+-- row and nothing on the project. My Projects renders that row as "Open project →",
+-- and on any door but `open` (the default is `apply`) it leads to the project's own
+-- gate, which never heard of the invite: a locked door. Since ADR 0353 a `pending`
+-- row is a NOTICE that only the project writes (POST /sso/invites/notify), after it
+-- wrote its own `invited` row. So a pending row is a dead end exactly when it
+-- predates the hub's first run of ADR 0353 code.
+--
+-- THE CUTOFF IS THAT FIRST RUN, read from the core_upgrades ledger: the earliest
+-- upgrade to core 1.20.22 or later (the first release carrying ADR 0353, PR 1367).
+-- No such row means the hub has never served a notice route, so every pending row
+-- is an old one and all of them go. That is the expected case: the hub served
+-- 1.19.1081 when this was written, and upgrade.js writes the ledger row AFTER
+-- migrate, so the upgrade applying this file is not yet in the ledger. The ledger
+-- row lands just after the restart, so a notice written in those few seconds would
+-- also go; an old-style row cannot survive either way.
+--
+-- WHAT IS LOST. The owner accepted this (option (a)): an old row on an `open` door
+-- did lead somewhere, and it is deleted too. That invitee can still sign in to the
+-- project, and the inviter can re-invite through the project's own hall.
+--
+-- Touches `pending` rows only, so no real membership (owner, member, visitor) can
+-- be removed. One-shot: a replay after this file is recorded does nothing, so a
+-- hand-run later can never sweep up real notices. Deletes data but adds nothing
+-- the previous release cannot read, so it is forward-safe (ADR 0083 §5).
+
+BEGIN;
+
+DO $$
+DECLARE
+  notices_since timestamptz;
+  removed       integer;
+BEGIN
+  IF EXISTS (SELECT 1 FROM schema_migrations
+              WHERE version = 'platform_identity_028_purge_pre_notice_invites') THEN
+    RETURN;
+  END IF;
+
+  -- Only a well-formed x.y.z counts (any suffix ignored); the digit caps keep the
+  -- int cast from overflowing, so a malformed ledger row can never fail the deploy.
+  IF to_regclass('core_upgrades') IS NOT NULL THEN
+    SELECT min(applied_at) INTO notices_since
+      FROM (SELECT applied_at,
+                   substring(to_version FROM '^v?([0-9]{1,6}\.[0-9]{1,6}\.[0-9]{1,6})(?:[^0-9]|$)') AS xyz
+              FROM core_upgrades) u
+     WHERE xyz IS NOT NULL
+       AND string_to_array(xyz, '.')::int[] >= ARRAY[1, 20, 22];
+  END IF;
+
+  DELETE FROM platform_identity_project_memberships
+   WHERE membership_kind = 'pending'
+     AND (notices_since IS NULL OR joined_at < notices_since);
+  GET DIAGNOSTICS removed = ROW_COUNT;
+
+  RAISE NOTICE 'platform_identity_028: removed % pre-ADR-0353 pending invite row(s) (cutoff: %)',
+    removed, COALESCE(notices_since::text, 'none, the hub never ran ADR 0353');
+END $$;
+
+INSERT INTO schema_migrations (version) VALUES ('platform_identity_028_purge_pre_notice_invites')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;