@bongos/core 1.20.27 → 1.20.28

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2188,
-    "unique_ids": 1888,
-    "certain": 2188,
+    "strings": 2189,
+    "unique_ids": 1889,
+    "certain": 2189,
     "heuristic": 0,
     "duplicate_ids": 207
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 109,
-      "strings": 1617
+      "strings": 1618
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -182,7 +182,7 @@
         "modules/hall-ui/public/idea.js:234",
         "modules/hall-ui/public/ideas.js:201",
         "modules/hall-ui/public/ideas.js:782",
-        "modules/hall-ui/public/watch.js:1265"
+        "modules/hall-ui/public/watch.js:1271"
       ]
     },
     {
@@ -268,7 +268,7 @@
         "modules/hall-ui/public/board-room.js:526",
         "modules/hall-ui/public/gate.js:234",
         "modules/hall-ui/public/government.js:890",
-        "modules/hall-ui/public/watch.js:1294"
+        "modules/hall-ui/public/watch.js:1300"
       ]
     },
     {
@@ -638,7 +638,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/collab.js:91",
-        "modules/hall-ui/public/watch.js:511"
+        "modules/hall-ui/public/watch.js:517"
       ]
     },
     {
@@ -1378,7 +1378,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/drachmae.js:148",
-        "modules/hall-ui/public/watch.js:1155"
+        "modules/hall-ui/public/watch.js:1161"
       ]
     },
     {
@@ -2187,7 +2187,7 @@
       "text": "{…} {…}{…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/watch.js:497",
+        "modules/hall-ui/public/watch.js:503",
         "modules/hall-ui/public/work.js:265"
       ]
     },
@@ -3180,7 +3180,7 @@
       "surface": "builders-hall",
       "text": "Asked {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 511,
+      "line": 517,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4251,7 +4251,7 @@
       "surface": "builders-hall",
       "text": "Could not change rank: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 883,
+      "line": 889,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4260,7 +4260,7 @@
       "surface": "builders-hall",
       "text": "Could not change standing: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 909,
+      "line": 915,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4476,7 +4476,7 @@
       "surface": "builders-hall",
       "text": "Could not load this page.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1345,
+      "line": 1351,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4557,7 +4557,7 @@
       "surface": "builders-hall",
       "text": "Could not read the report: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 663,
+      "line": 669,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4845,7 +4845,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Go back and try again.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1344,
+      "line": 1350,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6631,6 +6631,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "33a35c77d372",
+      "surface": "builders-hall",
+      "text": "Invite expired {…} — invite them again to reopen the door",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 501,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "b9cb720ad5d1",
       "surface": "builders-hall",
@@ -8679,7 +8688,7 @@
       "surface": "builders-hall",
       "text": "Over the last {…} days",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1182,
+      "line": 1188,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9138,7 +9147,7 @@
       "surface": "builders-hall",
       "text": "Rank set to {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 877,
+      "line": 883,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9210,7 +9219,7 @@
       "surface": "builders-hall",
       "text": "Read it as a table",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1155,
+      "line": 1161,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9543,7 +9552,7 @@
       "surface": "builders-hall",
       "text": "Report {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 597,
+      "line": 603,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9714,7 +9723,7 @@
       "surface": "builders-hall",
       "text": "Restricted.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1294,
+      "line": 1300,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10740,7 +10749,7 @@
       "surface": "builders-hall",
       "text": "System oversight: people, operations and security.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1358,
+      "line": 1364,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10983,7 +10992,7 @@
       "surface": "builders-hall",
       "text": "That's you",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 826,
+      "line": 832,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13287,7 +13296,7 @@
       "surface": "builders-hall",
       "text": "Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last {…} locking everyone out — so another {…} does it.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 858,
+      "line": 864,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -15204,7 +15213,7 @@
       "surface": "builders-hall",
       "text": "task {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1265,
+      "line": 1271,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16176,7 +16185,7 @@
       "surface": "builders-hall",
       "text": "{…} {…}{…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 497,
+      "line": 503,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2710,6 +2710,8 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.20.26 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.25 with no explicit bump. run 36764011836. (task 1002620)
   1.20.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.20.26 with no explicit bump. run 36767793137. (task 1002620)
+        landed since 1.20.26 with no explicit bump. run 36768642814. (task 1002620)
+  1.20.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.27 with no explicit bump. run 36772266063. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -2980,7 +2980,7 @@
       "surface": "builders",
       "title": "Watch",
       "states_read": ["board","out","operations","security"],
-      "files_hash": "4139b4721a06ea62",
+      "files_hash": "4b89e8960b706953",
       "reading_hash": "de49e347cca76e41",
       "counts": {"lines":156,"placed":44,"shared":5,"unplaced":107},
       "omitted": {"data":123},
@@ -2991,7 +2991,7 @@
         {"key":"L0003","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":487,"string_id":"eba610d25523"},
         {"key":"L0004","section":"top bar","text":"Ctrl K","placement":"shared"},
         {"key":"L0005","section":"Watch","text":"Watch","placement":"unplaced"},
-        {"key":"L0006","section":"Watch","text":"System oversight: people, operations and security.","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1358,"string_id":"4894b1d9b0de"},
+        {"key":"L0006","section":"Watch","text":"System oversight: people, operations and security.","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1364,"string_id":"4894b1d9b0de"},
         {"key":"L0007","section":"Watch","text":"Access requests","placement":"placed","file":"modules/hall-ui/public/watch.html","line":46,"string_id":"996edffc1966"},
         {"key":"L0008","section":"Watch","text":"pending, on the People tab","placement":"placed","file":"modules/hall-ui/public/watch.html","line":46,"string_id":"2fb1dad96280"},
         {"key":"L0009","section":"Watch","text":"Security reports","placement":"placed","file":"modules/hall-ui/public/watch.html","line":47,"string_id":"ab8af800f2bb"},
@@ -3029,7 +3029,7 @@
         {"key":"L0041","section":"Security","text":"Requester","placement":"unplaced","state":"security"},
         {"key":"L0042","section":"Security","text":"Rationale","placement":"unplaced","state":"security"},
         {"key":"L0043","section":"Security","text":"Reward","placement":"unplaced","state":"security"},
-        {"key":"L0044","section":"Security","text":"Asked","placement":"placed","file":"modules/hall-ui/public/watch.js","line":511,"string_id":"b2656d0b2402","state":"security"},
+        {"key":"L0044","section":"Security","text":"Asked","placement":"placed","file":"modules/hall-ui/public/watch.js","line":517,"string_id":"b2656d0b2402","state":"security"},
         {"key":"L0045","section":"Security","text":"Decide","placement":"unplaced","state":"security"},
         {"key":"L0046","section":"Security","text":"Approve","placement":"unplaced","state":"security"},
         {"key":"L0047","section":"Security","text":"Deny","placement":"unplaced","state":"security"},
@@ -3061,7 +3061,7 @@
         {"key":"L0073","section":"Sessions","text":"Earned","placement":"unplaced","state":"operations"},
         {"key":"L0074","section":"Sessions","text":"Duration","placement":"unplaced","state":"operations"},
         {"key":"L0075","section":"Sessions","text":"Uploaded","placement":"unplaced","state":"operations"},
-        {"key":"L0076","section":"Sessions","text":"task {…}","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1265,"string_id":"4d8ee7d68974","state":"operations","occurrences":5},
+        {"key":"L0076","section":"Sessions","text":"task {…}","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1271,"string_id":"4d8ee7d68974","state":"operations","occurrences":5},
         {"key":"L0077","section":"Sessions","text":"412.0k","placement":"unplaced","state":"operations"},
         {"key":"L0078","section":"Sessions","text":"1h 31m","placement":"unplaced","state":"operations"},
         {"key":"L0079","section":"Sessions","text":"1.2M","placement":"unplaced","state":"operations"},
@@ -3082,8 +3082,8 @@
         {"key":"L0094","section":"Repo health","text":"Dead Files","placement":"unplaced","state":"operations"},
         {"key":"L0095","section":"Repo health","text":"Stale Branches","placement":"unplaced","state":"operations"},
         {"key":"L0096","section":"Repo health","text":"Confirmed Unshipped","placement":"unplaced","state":"operations"},
-        {"key":"L0097","section":"Repo health","text":"Over the last {…} days","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1182,"string_id":"d89d1923ecf9","state":"operations"},
-        {"key":"L0098","section":"Repo health","text":"Read it as a table","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1155,"string_id":"b03e17693dcd","state":"operations","occurrences":4},
+        {"key":"L0097","section":"Repo health","text":"Over the last {…} days","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1188,"string_id":"d89d1923ecf9","state":"operations"},
+        {"key":"L0098","section":"Repo health","text":"Read it as a table","placement":"placed","file":"modules/hall-ui/public/watch.js","line":1161,"string_id":"b03e17693dcd","state":"operations","occurrences":4},
         {"key":"L0099","section":"Repo health","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","state":"operations"},
         {"key":"L0100","section":"Repo health","text":"Dead exports","placement":"unplaced","state":"operations"},
         {"key":"L0101","section":"Repo health","text":"Exported symbols nothing imports — the knip scan, run daily. 0 – 3 across 28 snapshots.","placement":"unplaced","state":"operations"},
@@ -3111,7 +3111,7 @@
         {"key":"L0123","section":"Access requests","text":"Admitted","placement":"unplaced"},
         {"key":"L0124","section":"Access requests","text":"Declined","placement":"unplaced"},
         {"key":"L0125","section":"Access requests","text":"Name unvouched","placement":"placed","file":"modules/hall-ui/public/watch.js","line":397,"string_id":"5e8199266a8a","occurrences":2},
-        {"key":"L0126","section":"Access requests","text":"Asked {…}","placement":"placed","file":"modules/hall-ui/public/watch.js","line":511,"string_id":"b2656d0b2402","occurrences":2},
+        {"key":"L0126","section":"Access requests","text":"Asked {…}","placement":"placed","file":"modules/hall-ui/public/watch.js","line":517,"string_id":"b2656d0b2402","occurrences":2},
         {"key":"L0127","section":"Access requests","text":"Dismiss","placement":"unplaced","occurrences":2},
         {"key":"L0128","section":"Roster","text":"Roster","placement":"unplaced"},
         {"key":"L0129","section":"Roster","text":"Every builder in {{worldName}} — rank, {{currency}}, karma, and active claims.","placement":"placed","file":"modules/hall-ui/public/watch.html","line":69,"string_id":"8690c6424585"},
@@ -3124,9 +3124,9 @@
         {"key":"L0136","section":"Roster","text":"Action","placement":"unplaced"},
         {"key":"L0137","section":"Roster","text":"Offboard","placement":"unplaced","occurrences":3},
         {"key":"L0138","section":"Roster","text":"stale","placement":"unplaced"},
-        {"key":"L0139","section":"Roster","text":"That's you","placement":"placed","file":"modules/hall-ui/public/watch.js","line":826,"string_id":"6e5a324b2972"},
+        {"key":"L0139","section":"Roster","text":"That's you","placement":"placed","file":"modules/hall-ui/public/watch.js","line":832,"string_id":"6e5a324b2972"},
         {"key":"L0140","section":"Roster","text":"Reactivate","placement":"unplaced"},
-        {"key":"L0141","section":"Roster","text":"Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last {…} locking everyone out — so another {…} does it.","placement":"placed","file":"modules/hall-ui/public/watch.js","line":858,"string_id":"5e0ec4cd1cfe"},
+        {"key":"L0141","section":"Roster","text":"Your own row carries no controls. Nobody can change their own rank or standing — that guard is what stops the last {…} locking everyone out — so another {…} does it.","placement":"placed","file":"modules/hall-ui/public/watch.js","line":864,"string_id":"5e0ec4cd1cfe"},
         {"key":"L0142","section":"Reviews by builder","text":"Reviews by builder","placement":"placed","file":"modules/hall-ui/public/watch.html","line":75,"string_id":"4e062d4f8d69"},
         {"key":"L0143","section":"Reviews by builder","text":"How each builder's shipped work has been graded over the past thirty days.","placement":"placed","file":"modules/hall-ui/public/watch.html","line":76,"string_id":"0bab9286ea38"},
         {"key":"L0144","section":"Reviews by builder","text":"Builder","placement":"unplaced"},

package/migrations/core_266_access_requests_invited_login_idx.sql

@@ -0,0 +1,31 @@
+-- core_266 — index the invited rows by login (task 1002969, the owner's go-ahead
+-- on a grader finding)
+--
+-- access_requests had two indexes, both partial on status = 'pending' (060). Every
+-- read of an INVITED row therefore scanned the table:
+--
+--   the sign-in gate       hasInvitedAccessRequest / accessStateByLogin
+--                          (lower(github_login) = lower($1) AND status = 'invited')
+--   the standing invite    the onboarding routes' STANDING_INVITE_SQL: re-invite,
+--                          rescind-clears-notice, the public POST's already-approved check
+--   the outstanding list   GET /access-requests/invites (status = 'invited', windowed
+--                          by lower(github_login) since the invite expiry, ADR 0356)
+--
+-- Invite and approved rows are kept as history, so the scan grew with the table's
+-- lifetime rather than with one login's rows. One partial index on the expression
+-- every one of those reads already uses serves them all, and it stays small:
+-- it holds invited rows only.
+--
+-- Additive and idempotent: an index only, no column, constraint or data. Safe to
+-- run forward against a live database, and an older release running against it
+-- just has an unused index. Rollback is DROP INDEX.
+
+CREATE INDEX IF NOT EXISTS idx_access_requests_invited_login
+  ON access_requests (lower(github_login))
+  WHERE status = 'invited';
+
+COMMENT ON INDEX idx_access_requests_invited_login IS
+  'Every read of an invited row: the sign-in gate (hasInvitedAccessRequest), the standing-invite probe, and the outstanding-invite list (ADR 0356). 060''s indexes are partial on pending and cannot serve them.';
+
+INSERT INTO schema_migrations (version) VALUES ('core_266_access_requests_invited_login_idx')
+  ON CONFLICT DO NOTHING;

package/modules/hall-ui/public/watch.js

@@ -474,6 +474,9 @@
   // invite form above, which is what the server's own refusal names.
   function gateRowActions(r) {
     const id = escapeHtml(r.id);
+    // An expired invite's door is already shut: inviting again (the form above) is
+    // the only move, so the row offers none.
+    if (r.expired) return '';
     if (r.status === 'invited') {
       return ghost(`data-gate-action="dismissed" data-gate-from="invited" data-id="${id}"`, 'Rescind', true);
     }
@@ -493,9 +496,12 @@
     // A rescind overwrites the approver with the rescinder (ADR 0208), so this
     // names who put the row in the state it is in now — which is what it says.
     const by = r.resolved_by_login ? ` by <span class="ov-mono">@${escapeHtml(r.resolved_by_login)}</span>` : '';
-    const decided = r.resolved_at
-      ? `<span class="ov-row__when">${r.status === 'invited' ? 'Admitted' : 'Declined'} ${escapeHtml(fmtDate(r.resolved_at))}${by}</span>`
-      : '';
+    // An invite past its 30 days is still 'invited' in storage, but no longer admits.
+    const decided = r.expired
+      ? `<span class="ov-row__when">Invite expired ${escapeHtml(fmtDate(r.expires_at))} — invite them again to reopen the door</span>`
+      : r.resolved_at
+        ? `<span class="ov-row__when">${r.status === 'invited' ? 'Admitted' : 'Declined'} ${escapeHtml(fmtDate(r.resolved_at))}${by}</span>`
+        : '';
     const actions = gateRowActions(r);
     return (
       `<li class="ov-row" data-req-id="${escapeHtml(r.id)}">` +

package/modules/onboarding/routes/access-requests.js

@@ -61,6 +61,9 @@ const api = require('../../../src/module-api');
 const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission };
 const { pool } = api;
 const { validateOrRespond, parseId, accountExistenceReadRateLimit } = api;
+// A recruit invite's door closes 30 days after it is sent, computed at read time
+// (task 1002969, ADR 0356): one definition, shared with the sign-in gate itself.
+const { inviteLiveSql, inviteExpiredSql, inviteExpiresAtSql } = api.inviteExpiry;
 const approvalBroadcast = require('../approval-broadcast');
 const log = api.logger('onboarding');
 
@@ -161,8 +164,10 @@ async function attachApplicantProfiles(rows) {
 // doorway port that swallows every failure, so the hub can neither slow nor fail an
 // invite. No hub (self-hosted), or an older one without the route, costs the notice
 // alone.
+// "Standing" means the door still opens, so an expired invite neither blocks a
+// re-invite nor keeps the hub's notice alive.
 const STANDING_INVITE_SQL = `SELECT 1 FROM access_requests
-          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`;
+          WHERE lower(github_login) = lower($1) AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`;
 
 function noticeHubInvited(login) {
   api.notifyHubOfInvite(login, { invited: true });
@@ -223,11 +228,8 @@ module.exports = function buildAccessRequestsRouter() {
         return res.fail('already_member', { status: 409, message: 'You already have an account — just sign in with GitHub.' });
       }
       // Already approved (invited) but not yet signed in? No new request needed.
-      const invited = await pool.query(
-        `SELECT 1 FROM access_requests
-          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
-        [login]
-      );
+      // An expired invite is not an approval any more, so its invitee may ask.
+      const invited = await pool.query(STANDING_INVITE_SQL, [login]);
       if (invited.rows.length > 0) {
         return res.fail('already_approved', { status: 409, message: "You're already approved — sign in with GitHub to enter." });
       }
@@ -267,7 +269,9 @@ module.exports = function buildAccessRequestsRouter() {
   // (the device_code is spent), so the CLI can't re-poll the flow — it polls this
   // instead, then restarts sign-in once admitted. Exposes nothing the public POST
   // above doesn't already reveal through its 409s (already_member / already_approved).
-  // status ∈ member | invited | pending | dismissed | none; admitted = member||invited.
+  // status ∈ member | invited | expired | pending | dismissed | none; admitted =
+  // member||invited. `expired` is an invite past its 30 days (task 1002969): the door
+  // is shut, and the CLI stops waiting rather than polling a door that will not open.
   // rank: public — a would-be builder is by definition outside the system.
   // Declared BEFORE `GET /access-requests` so the literal `/status` path is matched
   // as its own route (not swallowed as a query on the list route).
@@ -294,15 +298,17 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.json({ github_login: login, status: 'member', admitted: true });
       }
-      // Prefer an 'invited' row if one exists, else the most recent request.
+      // Prefer an invite that still admits, else the most recent request.
       const ar = await pool.query(
-        `SELECT status FROM access_requests
+        `SELECT status, (status = 'invited' AND ${inviteExpiredSql()}) AS expired
+           FROM access_requests
           WHERE lower(github_login) = lower($1)
-          ORDER BY (status = 'invited') DESC, created_at DESC
+          ORDER BY (status = 'invited' AND ${inviteLiveSql()}) DESC, created_at DESC
           LIMIT 1`,
         [login]
       );
-      const status = ar.rows.length > 0 ? ar.rows[0].status : 'none';
+      const top = ar.rows[0];
+      const status = !top ? 'none' : top.expired ? 'expired' : top.status;
       return res.json({ github_login: login, status, admitted: status === 'invited' });
     } catch (err) {
       console.error('[gds] GET /access-requests/status', err);
@@ -335,9 +341,13 @@ module.exports = function buildAccessRequestsRouter() {
     try {
       // `kind` + `invited_by_login` let the invited history tell an invite from
       // an approved application (ADR 0335 D2) — descriptive, like the vouch.
+      // `expired` + `expires_at` mark an invite whose 30 days are up (task 1002969):
+      // still 'invited' in storage, but its door no longer opens.
       const { rows } = await pool.query(
         `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
                 ar.created_at, ar.resolved_at, ar.kind,
+                (ar.status = 'invited' AND ${inviteExpiredSql('ar')}) AS expired,
+                ${inviteExpiresAtSql('ar')} AS expires_at,
                 ar.applicant_github_id, ar.applicant_handle, ar.vouched_at,
                 (ar.applicant_github_id IS NOT NULL) AS vouched,
                 rb.github_login AS resolved_by_login,
@@ -560,21 +570,34 @@ module.exports = function buildAccessRequestsRouter() {
   // still 'invited' (not rescinded), and no builder row yet (not yet accepted by
   // signing in), each naming its sender; ?mine=1 keeps only the caller's own
   // (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id.
+  // Each carries `expires_at`, and `expired` once its 30 days are up (task 1002969):
+  // listed so the sender knows to invite again, and dropped once a newer invite
+  // for the same login is live, since that one already replaced it.
   // rank: archon — it names logins that are not members yet.
   router.get('/access-requests/invites', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const mine = req.query.mine === '1';
-    const mineClause = mine ? 'AND ar.created_by = $1' : '';
+    // `login_has_live` is a window over the rows this scan already reads, not a
+    // lookup per row: access_requests has no index on lower(github_login) outside
+    // pending rows, and invite rows are kept as history. The sender filter sits
+    // OUTSIDE the window, so another sender's live re-invite still retires yours.
+    const mineClause = mine ? 'AND inv.created_by = $1' : '';
     try {
       const { rows } = await pool.query(
-        `SELECT ar.id, ar.github_login, ar.note, ar.created_at,
-                ib.github_login AS invited_by_login
-           FROM access_requests ar
-           LEFT JOIN builders ib ON ib.id = ar.created_by
-          WHERE ar.kind = 'invite' AND ar.status = 'invited'
-            AND NOT EXISTS (SELECT 1 FROM builders b
-                             WHERE lower(b.github_login) = lower(ar.github_login))
+        `SELECT inv.id, inv.github_login, inv.note, inv.created_at,
+                inv.expires_at, inv.expired, inv.invited_by_login
+           FROM (SELECT ar.id, ar.github_login, ar.note, ar.created_at, ar.created_by,
+                        ${inviteExpiresAtSql('ar')} AS expires_at,
+                        ${inviteExpiredSql('ar')} AS expired,
+                        bool_or(${inviteLiveSql('ar')}) OVER (PARTITION BY lower(ar.github_login)) AS login_has_live,
+                        ib.github_login AS invited_by_login
+                   FROM access_requests ar
+                   LEFT JOIN builders ib ON ib.id = ar.created_by
+                  WHERE ar.kind = 'invite' AND ar.status = 'invited'
+                    AND NOT EXISTS (SELECT 1 FROM builders b
+                                     WHERE lower(b.github_login) = lower(ar.github_login))) inv
+          WHERE NOT (inv.expired AND inv.login_has_live)
             ${mineClause}
-          ORDER BY ar.created_at DESC
+          ORDER BY inv.created_at DESC
           LIMIT 200`,
         mine ? [req.builder.id] : []
       );

package/modules/platform-identity/platform-identity.js

@@ -529,22 +529,25 @@ async function listMembershipsForAccount(githubId, { pool = defaultPool } = {})
 
 // Record that a project invited a builder: pre-seed a 'pending' membership, which is
 // a NOTICE shown in My Projects — the project's own row is what admits (ADR 0353;
-// written only from invite-notices.js now). Does NOT clobber an existing membership (ON CONFLICT DO NOTHING) — a
-// current member is left as-is. Returns { invited:true, row } when a pending row was
-// created, or { invited:false, alreadyMember:true } when a membership already existed.
+// written only from invite-notices.js now). Never clobbers a membership: a member is
+// left as-is, and a pending notice is restamped only once its invite's 30 days are up,
+// so a re-invite shows again (ADR 0356). Returns { invited:true, row } when it wrote,
+// or { invited:false, alreadyMember:true } when a membership or live notice stood.
 async function inviteToProject({ clientId, githubId }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind)
+    `INSERT INTO platform_identity_project_memberships AS m (client_id, github_id, membership_kind)
      VALUES ($1, $2, 'pending')
-     ON CONFLICT (client_id, github_id) DO NOTHING
+     ON CONFLICT (client_id, github_id) DO UPDATE SET joined_at = now()
+       WHERE m.membership_kind = 'pending' AND m.joined_at <= now() - make_interval(days => $3)
      RETURNING id, client_id, github_id, membership_kind`,
-    [clientId, githubId],
+    [clientId, githubId, api.inviteExpiry.INVITE_EXPIRY_DAYS],
   );
   if (rows[0]) return { invited: true, row: rows[0] };
   return { invited: false, alreadyMember: true };
 }
 
-// The pending invitations for one account (joined to the project display fields).
+// The pending invitations for one account (joined to the project display fields),
+// minus any past its invite's 30 days: that door no longer opens (ADR 0356).
 async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT m.client_id, m.joined_at AS invited_at,
@@ -552,8 +555,9 @@ async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {
        FROM platform_identity_project_memberships m
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = m.client_id
       WHERE m.github_id = $1 AND m.membership_kind = 'pending'
+        AND m.joined_at > now() - make_interval(days => $2)
       ORDER BY m.joined_at DESC`,
-    [githubId],
+    [githubId, api.inviteExpiry.INVITE_EXPIRY_DAYS],
   );
   return rows;
 }

package/modules/platform-identity/tests/platform-identity.mjs

@@ -538,10 +538,12 @@ await ta('inviteToProject pre-seeds a pending row, never clobbering an existing
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_project_memberships/);
   assert.match(c.text, /VALUES \(\$1, \$2, 'pending'\)/);
-  assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO NOTHING/, 'must not downgrade an existing member');
+  // Only joined_at, only on an expired pending notice (task 1002969); real SQL in
+  // ../../tests/invite_expiry_db.mjs.
+  assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE SET joined_at = now\(\)\s+WHERE m\.membership_kind = 'pending' AND/, 'must not downgrade an existing member');
 });
 
-await ta('inviteToProject reports already-member when the row exists (DO NOTHING → no row)', async () => {
+await ta('inviteToProject reports already-member when the row exists (no row returned)', async () => {
   const pool = mockPool([{ rows: [] }]);
   const out = await P.inviteToProject({ clientId: 'c1', githubId: 42 }, { pool });
   assert.deepEqual(out, { invited: false, alreadyMember: true });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.27",
+  "version": "1.20.28",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.27",
+      "version": "1.20.28",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.27",
+  "version": "1.20.28",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8218,6 +8218,10 @@
     }
   ],
   "1.20.27": [
+    {
+      "id": "1004431",
+      "text": "The new profile and leaderboard design is approved. Every builder keeps one profile that leads with the role they choose, and shows their other roles only once those have earned credits. Ideators get a small version of the sky"
+    },
     {
       "id": "1004416",
       "text": "A new project can now store the seven startup answers: new or existing, where everyone is, whether under-18s are building, what the entity is, how many builders, how they'll be rewarded, and how much Bongos should run. A wrong"
@@ -8230,5 +8234,11 @@
       "id": "1004408",
       "text": "Old project invitations that led to a locked door are cleared from people's My Projects list."
     }
+  ],
+  "1.20.28": [
+    {
+      "id": "1002969",
+      "text": "An invitation to join a project now expires after 30 days; the person who sent it can simply invite again."
+    }
   ]
 }

package/scripts/gds/fitness.js

@@ -558,6 +558,10 @@ const KERNEL_FILES = [
   // the import-direction guarantee on a file two surfaces now trust.
   'src/bongos/middleware/rate-limit.js',     // the sliding-window abuse ceilings (write + per-surface read)
   'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
+  // task 1002969 (ADR 0356): when an invite's door closes is part of the admission
+  // gate db-kernel.js runs, and the doorway hands the same definition to the
+  // onboarding and hub modules. It requires NOTHING, so joining costs nothing.
+  'src/bongos/invite-expiry.js',             // the read-time invite expiry (INVITE_EXPIRY_DAYS + its SQL)
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)
   'src/instance-config.js',