@bongos/core 1.20.27 → 1.20.28

package/scripts/gds/login.js

@@ -49,6 +49,8 @@ function pollDecision(body) {
   if (body.admitted === true) return 'admitted';
   if (body.status === 'member' || body.status === 'invited') return 'admitted';
   if (body.status === 'dismissed') return 'dismissed';
+  // An invite past its 30 days (task 1002969): the door is shut until they invite again.
+  if (body.status === 'expired') return 'expired';
   return 'wait';
 }
 
@@ -302,6 +304,10 @@ async function main() {
         console.error('\n✖ your access request was declined.');
         process.exit(1);
       }
+      if (decision === 'expired') {
+        console.error('\n✖ your invite has expired — ask the project to invite you again.');
+        process.exit(1);
+      }
       if (Date.now() > admitDeadline) {
         console.error('\n✖ timed out waiting for approval — re-run `bongos login` once an Archon has approved you.');
         process.exit(1);

package/scripts/gds/run-unit-tests.js

@@ -208,6 +208,10 @@ const INTEGRATION = new Set([
   // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
   // pre-migration row, and that publishableSql and projectPublishability agree.
   'project_visibility_db',
+  // task 1002969 (ADR 0356): the invite expiry against real SQL — the router's and the
+  // admission reads' statements run on Postgres, and the hub's notice restamp and
+  // listing. The DB-free sibling (application_lifecycle) interprets the same WHEREs.
+  'invite_expiry_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/db-kernel.js

@@ -25,6 +25,7 @@
 
 const crypto = require('node:crypto');
 const { pool } = require('./pool');
+const { inviteLiveSql } = require('./invite-expiry');
 const seams = require('../module-seams');
 
 // withTx(fn, {pool}) — run fn(client) inside BEGIN/COMMIT, ROLLBACK+rethrow on
@@ -232,11 +233,12 @@ async function getBuilderByGithubId(githubId) {
 
 // hasInvitedAccessRequest — has an Archon approved this login (an access_requests
 // row at status='invited', case-insensitive)? The approval signal that lets a
-// first-time web sign-in through.
+// first-time web sign-in through. An invite older than 30 days no longer counts
+// (inviteLiveSql, task 1002969 / ADR 0356); an approved application never expires.
 async function hasInvitedAccessRequest(login) {
   const { rows } = await pool.query(
     `SELECT 1 FROM access_requests
-      WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
+      WHERE lower(github_login) = lower($1) AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`,
     [login]
   );
   return rows.length > 0;
@@ -259,7 +261,8 @@ async function accessStateByLogin(login) {
        EXISTS (SELECT 1 FROM builders
                 WHERE lower(github_login) = lower($1))                        AS member,
        EXISTS (SELECT 1 FROM access_requests
-                WHERE lower(github_login) = lower($1) AND status = 'invited') AS invited,
+                WHERE lower(github_login) = lower($1) AND status = 'invited'
+                  AND ${inviteLiveSql()})                                     AS invited,
        EXISTS (SELECT 1 FROM access_requests
                 WHERE lower(github_login) = lower($1) AND status = 'pending') AS pending`,
     [login]

package/src/bongos/invite-expiry.js

@@ -0,0 +1,47 @@
+// src/bongos/invite-expiry.js — a recruit invite's door closes 30 days after it is
+// sent, decided when it is READ (task 1002969; privacy spec D4, ADR 0356).
+//
+// There is no sweeper and no stored "expired" state. Every read that asks "does this
+// invite still open the door" computes the answer from created_at, so the sign-in
+// gate, the queues and the hub notice cannot disagree about the day it closed, and a
+// re-invite (a fresh row) opens a fresh door.
+//
+// ONLY `kind = 'invite'` ROWS EXPIRE. An approved application stays open: its
+// applicant asked, and spec D4 is about invites. Reading `kind` here makes it part
+// of admission for the first time (core_255 called it descriptive only), which is
+// safe for one reason: the predicate can only CLOSE a door. A row that is anything
+// but an invite behaves exactly as it did before this rule, so a mis-kinded row fails
+// toward the old gate, never past it (ADR 0356).
+'use strict';
+
+// The owner-signed window (spec D4). One constant, not per-instance config.
+const INVITE_EXPIRY_DAYS = 30;
+
+const ALIAS_RE = /^[a-z_][a-z0-9_]*$/;
+function columnPrefix(alias) {
+  if (alias == null || alias === '') return '';
+  if (!ALIAS_RE.test(alias)) throw new Error(`invite-expiry: bad table alias ${JSON.stringify(alias)}`);
+  return `${alias}.`;
+}
+
+// SQL: this access_requests row is an invite whose door has closed. `alias` names the
+// table in the caller's statement ('ar' → ar.kind); omit it for an unaliased table.
+function inviteExpiredSql(alias) {
+  const a = columnPrefix(alias);
+  return `(${a}kind = 'invite' AND ${a}created_at <= now() - interval '${INVITE_EXPIRY_DAYS} days')`;
+}
+
+// SQL: this row has not expired. ANDed beside `status = 'invited'` wherever the
+// question is "does it still admit".
+function inviteLiveSql(alias) {
+  return `NOT ${inviteExpiredSql(alias)}`;
+}
+
+// SQL: when this row's door closes if it is an invite, else NULL (an application
+// never expires). What a queue shows beside `expired`.
+function inviteExpiresAtSql(alias) {
+  const a = columnPrefix(alias);
+  return `(CASE WHEN ${a}kind = 'invite' THEN ${a}created_at + interval '${INVITE_EXPIRY_DAYS} days' END)`;
+}
+
+module.exports = { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql, inviteExpiresAtSql };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.27'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.28'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -375,6 +375,15 @@ module.exports = {
   //     instance's hub key and client_id itself, so a module can neither
   //     substitute a key nor re-address the check. Null is never a refusal.
   get readApplicationVouch() { return require('./bongos/auth').readApplicationVouch; },
+  // inviteExpiry — { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql }: a recruit
+  //     invite's door closes 30 days after it is sent, computed at read time (task
+  //     1002969, ADR 0356). The sign-in gate, the onboarding queues and the hub's
+  //     notice list all read this one definition, so no two can close on different days.
+  //     Destructured rather than returned whole so knip can see which exports are used.
+  get inviteExpiry() {
+    const { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql, inviteExpiresAtSql } = require('./bongos/invite-expiry');
+    return { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql, inviteExpiresAtSql };
+  },
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/access_requests_invite.mjs

@@ -225,7 +225,8 @@ test('invites list ?mine=1: only the caller’s own invites', async () => {
   const r = await get('/api/gds/access-requests/invites?mine=1');
   assert.equal(r.status, 200);
   assert.deepEqual(r.json.invites, []);
-  assert.match(calls[0].sql, /AND ar\.created_by = \$1/);
+  // Outside the expiry window (task 1002969), so another sender's live re-invite still counts.
+  assert.match(calls[0].sql, /\) inv\s+WHERE NOT \(inv\.expired AND inv\.login_has_live\)\s+AND inv\.created_by = \$1/);
   assert.deepEqual(calls[0].params, [42], 'narrowed to the acting builder, never to a caller-supplied id');
 });
 

package/tests/application_lifecycle.mjs

@@ -54,6 +54,12 @@ const express = require('express');
 // ===========================================================================
 
 const HOUR = 60 * 60 * 1000;
+const DAY = 24 * HOUR;
+
+// An invite's door closes `days` after it was sent (task 1002969, ADR 0356). The
+// interpreter reads the window out of the statement itself, so the constant lives in
+// one place: src/bongos/invite-expiry.js.
+const inviteExpired = (r, days) => r.kind === 'invite' && r.created_at <= Date.now() - days * DAY;
 
 let rows = [];
 let builders = [];
@@ -114,6 +120,16 @@ function predicateFor(rawWhere, params) {
     where = where.replace(notMember[0], ' TRUE ');
   }
 
+  // The expiry itself (inviteLiveSql): the row is not an invite past its window.
+  // One unit, like the transition guard, so its inner `kind = 'invite'` is not
+  // re-read below as a filter of its own.
+  let live;
+  while ((live = /NOT \((?:(\w+)\.)?kind = 'invite' AND (?:\1\.)?created_at <= now\(\) - interval '(\d+) days'\)/.exec(where))) {
+    const days = Number(live[2]);
+    tests.push((r) => !inviteExpired(r, days));
+    where = where.replace(live[0], ' TRUE ');
+  }
+
   let m;
   const eat = () => { where = where.replace(m[0], ' TRUE '); };
   if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
@@ -225,12 +241,24 @@ const pool = {
       return { rows: hit.map((r) => ({ id: r.id, github_login: r.github_login, status: r.status, kind: r.kind, resolved_at: r.resolved_at })) };
     }
 
-    // The outstanding-invite list. Its sender is joined through created_by.
-    if ((m = /^SELECT ar\.id, ar\.github_login, ar\.note, ar\.created_at, ib\.github_login AS invited_by_login FROM access_requests ar LEFT JOIN builders ib ON ib\.id = ar\.created_by WHERE (.+?) ORDER BY ar\.created_at DESC LIMIT 200$/.exec(sql))) {
-      const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
+    // The outstanding-invite list. Its sender is joined through created_by. Since task
+    // 1002969 each row says when its door closes and whether it has, and an expired
+    // row is dropped when its login has a live invite: a window over the inner scan
+    // (`login_has_live`), with the sender filter outside it. Modelled as exactly that.
+    if ((m = /^SELECT inv\.id, inv\.github_login, inv\.note, inv\.created_at, inv\.expires_at, inv\.expired, inv\.invited_by_login FROM \(SELECT ar\.id, ar\.github_login, ar\.note, ar\.created_at, ar\.created_by, \(CASE WHEN ar\.kind = 'invite' THEN ar\.created_at \+ interval '(\d+) days' END\) AS expires_at, \(ar\.kind = 'invite' AND ar\.created_at <= now\(\) - interval '\1 days'\) AS expired, bool_or\(NOT \(ar\.kind = 'invite' AND ar\.created_at <= now\(\) - interval '\1 days'\)\) OVER \(PARTITION BY lower\(ar\.github_login\)\) AS login_has_live, ib\.github_login AS invited_by_login FROM access_requests ar LEFT JOIN builders ib ON ib\.id = ar\.created_by WHERE (.+?)\) inv WHERE NOT \(inv\.expired AND inv\.login_has_live\)(?: AND inv\.created_by = \$(\d+))? ORDER BY inv\.created_at DESC LIMIT 200$/.exec(sql))) {
+      const days = Number(m[1]);
+      const inner = rows.filter(predicateFor(m[2], params));
+      const key = (r) => String(r.github_login).toLowerCase();
+      const liveLogins = new Set(inner.filter((r) => !inviteExpired(r, days)).map(key));
+      const sender = m[3] ? params[Number(m[3]) - 1] : undefined;
+      const hit = inner
+        .filter((r) => !(inviteExpired(r, days) && liveLogins.has(key(r))))
+        .filter((r) => sender === undefined || String(r.created_by) === String(sender))
+        .sort((a, b) => b.created_at - a.created_at);
       return {
         rows: hit.map((r) => ({
           id: r.id, github_login: r.github_login, note: r.note, created_at: r.created_at,
+          expires_at: r.created_at + days * DAY, expired: inviteExpired(r, days),
           invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null,
         })),
       };
@@ -248,6 +276,9 @@ const pool = {
           // proves the route reads the column rather than that this fake invents it.
           ...(/\bar\.applicant_handle\b/.test(sql) ? { applicant_handle: r.applicant_handle ?? null } : {}),
           ...(/\bar\.kind\b/.test(sql) ? { kind: r.kind } : {}),
+          ...((m = /\(ar\.status = 'invited' AND \(ar\.kind = 'invite' AND ar\.created_at <= now\(\) - interval '(\d+) days'\)\) AS expired, \(CASE WHEN ar\.kind = 'invite' THEN ar\.created_at \+ interval '\1 days' END\) AS expires_at/.exec(sql))
+            ? { expired: r.status === 'invited' && inviteExpired(r, Number(m[1])), expires_at: r.kind === 'invite' ? r.created_at + Number(m[1]) * DAY : null }
+            : {}),
           ...(/\bib\.github_login AS invited_by_login\b/.test(sql) && /\bON ib\.id = ar\.created_by\b/.test(sql)
             ? { invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null } : {}),
           vouched: r.applicant_github_id !== null,
@@ -256,6 +287,27 @@ const pool = {
       };
     }
 
+    // db-kernel's accessStateByLogin — the waiting page's three facts in one read.
+    // Each EXISTS is filtered by its own WHERE, so the expiry unit in `invited` is
+    // read by the interpreter like every other predicate.
+    if ((m = /^SELECT EXISTS \(SELECT 1 FROM builders WHERE (.+?)\) AS member, EXISTS \(SELECT 1 FROM access_requests WHERE (.+?)\) AS invited, EXISTS \(SELECT 1 FROM access_requests WHERE (.+?)\) AS pending$/.exec(sql))) {
+      return { rows: [{
+        member: builders.some(predicateFor(m[1], params)),
+        invited: rows.some(predicateFor(m[2], params)),
+        pending: rows.some(predicateFor(m[3], params)),
+      }] };
+    }
+
+    // The public status probe (task 1002969): an invite that still admits sorts first,
+    // then the newest request; an invite past its window reports itself expired.
+    if ((m = /^SELECT status, \(status = 'invited' AND \(kind = 'invite' AND created_at <= now\(\) - interval '(\d+) days'\)\) AS expired FROM access_requests WHERE (.+?) ORDER BY \(status = 'invited' AND NOT \(kind = 'invite' AND created_at <= now\(\) - interval '\1 days'\)\) DESC, created_at DESC LIMIT 1$/.exec(sql))) {
+      const days = Number(m[1]);
+      const admits = (r) => r.status === 'invited' && !inviteExpired(r, days);
+      const hit = rows.filter(predicateFor(m[2], params))
+        .sort((a, b) => (admits(b) - admits(a)) || (b.created_at - a.created_at));
+      return { rows: hit.slice(0, 1).map((r) => ({ status: r.status, expired: r.status === 'invited' && inviteExpired(r, days) })) };
+    }
+
     // A vouched re-application taking over an unvouched pending row (ADR 0333 D4).
     // The SET list is matched exactly, like the resolve's below.
     if ((m = /^UPDATE access_requests SET display_name = \$2, note = \$3, applicant_github_id = \$4, applicant_handle = \$5, vouched_at = \$6 WHERE (.+?)$/.exec(sql))) {
@@ -809,8 +861,12 @@ test('invite: a login that never applied signs straight in, and the row says it
   assert.equal(eve.note, 'Come build the parser', 'the inviter’s words, and kind says whose');
   statements = [];
   assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), true, 'the REAL admission read admits her — signing in is the acceptance act');
-  assert.ok(statements.length > 0 && statements.every(({ sql }) => !/\bkind\b|\bcreated_by\b/.test(sql)),
-    'and it admitted her without reading either new column (D2.5)');
+  // D2.5 as amended by ADR 0356 (task 1002969): admission never reads created_by, and
+  // reads `kind` ONLY inside the expiry unit, which can close a door but never open one.
+  const EXPIRY_UNIT = /NOT \(kind = 'invite' AND created_at <= now\(\) - interval '\d+ days'\)/g;
+  assert.ok(statements.length > 0 && statements.every(({ sql }) => !/\bcreated_by\b/.test(sql)
+    && !/\bkind\b/.test(sql.replace(EXPIRY_UNIT, ''))),
+  'and it admitted her reading kind only to ask whether her invite has expired (D2.5, ADR 0356)');
 });
 
 test('rescind: an invite keeps its sender through a rescind by a different archon, and the door re-locks', async () => {
@@ -873,6 +929,109 @@ test('the queue history tells an invite from an approved application, and names
   assert.equal(byLogin.ada.invite_note, null);
 });
 
+// ===========================================================================
+// Expiry — an invite's door closes 30 days after it is sent, read-time (task
+// 1002969, privacy spec D4, ADR 0356)
+// ===========================================================================
+
+// Backdate a row as if it had been written `days` ago (an invite's resolved_at is
+// its created_at: the route writes both in one statement).
+const age = (row, days) => {
+  row.created_at = Date.now() - days * DAY;
+  if (row.kind === 'invite') row.resolved_at = row.created_at;
+};
+
+test('expiry: an invite admits for 30 days and not after; an approved application never expires', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'eve'), 29);
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  age(row(3), 60); // cy: an application approved long ago
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), true, 'day 29: the door still opens');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('fay'), false, 'day 31: the REAL admission read refuses her');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), true, 'an approved application is not an invite and does not expire');
+  const state = await dbKernel.accessStateByLogin('fay');
+  assert.equal(state.invited, false, 'the waiting page does not call an expired invite imminent admission');
+});
+
+test('expiry: the queues show an expired invite as expired, and it offers the recruiter a re-invite, not a rescind', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  const hist = await call('GET', '/api/gds/access-requests?status=invited');
+  const h = Object.fromEntries(hist.json.requests.map((x) => [x.github_login, x]));
+  assert.equal(h.fay.expired, true);
+  assert.equal(h.eve.expired, false);
+  assert.equal(h.cy.expired, false, 'an approved application is never marked expired');
+  assert.equal(h.cy.expires_at, null, 'and has no day it closes');
+  assert.ok(h.fay.expires_at <= Date.now() && h.eve.expires_at > Date.now(), 'each invite says when its door closes');
+  const out = await call('GET', '/api/gds/access-requests/invites');
+  const o = Object.fromEntries(out.json.invites.map((x) => [x.github_login, x]));
+  assert.deepEqual(Object.keys(o).sort(), ['eve', 'fay'], 'an expired invite stays listed, so its sender knows to invite again');
+  assert.equal(o.fay.expired, true);
+  assert.equal(o.eve.expired, false);
+});
+
+test('expiry: re-inviting an expired login opens a fresh door, notices the hub, and retires the expired line', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  notices = [];
+  const again = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  assert.equal(again.status, 201, 'a fresh row, not already_invited: the expired invite does not stand');
+  assert.deepEqual(notices, [{ login: 'fay', invited: true }], 'the hub is told, so its notice shows again');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('fay'), true, 'the new door opens');
+  const out = await call('GET', '/api/gds/access-requests/invites');
+  const fays = out.json.invites.filter((x) => x.github_login === 'fay');
+  assert.equal(fays.length, 1, 'the expired line is replaced by the live one, not listed beside it');
+  assert.equal(fays[0].expired, false);
+});
+
+test('expiry: another sender re-inviting the login retires your expired line from your own list too', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' }); // sent by 42
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  actingId = 43;
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' }); // 43 re-invites
+  actingId = 42;
+  const mine = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(mine.json.invites.map((x) => x.github_login), [],
+    'the sender filter sits outside the "has a live invite" window, so 42 is not told to re-invite fay');
+  actingId = 43;
+  const theirs = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(theirs.json.invites.map((x) => [x.github_login, x.expired]), [['fay', false]]);
+});
+
+test('expiry: the public status probe says expired, and an expired invitee may apply', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  const st = await call('GET', '/api/gds/access-requests/status?github_login=fay');
+  assert.deepEqual(st.json, { github_login: 'fay', status: 'expired', admitted: false });
+  const asked = await call('POST', '/api/gds/access-requests', { github_login: 'fay' });
+  assert.equal(asked.status, 201, 'not already_approved: an expired invite is not an approval');
+  const st2 = await call('GET', '/api/gds/access-requests/status?github_login=fay');
+  assert.equal(st2.json.status, 'pending', 'the newer request is what the probe reports');
+});
+
+test('expiry: rescinding the last live invite clears the hub notice even though an expired one remains', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  const live = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  notices = [];
+  await call('PATCH', `/api/gds/access-requests/${live.json.request.id}`, { status: 'dismissed' });
+  assert.deepEqual(notices, [{ login: 'fay', invited: false }], 'an expired row is not a standing invite');
+});
+
 test('invite: resolving a pending application in place keeps it an application, with the applicant’s own note', async () => {
   reset();
   builders.push(...ARCHONS);

package/tests/bongos_login.mjs

@@ -39,6 +39,8 @@ test('pollDecision maps the /access-requests/status body to a loop action', () =
   assert.equal(pollDecision({ status: 'invited' }), 'admitted');
   assert.equal(pollDecision({ status: 'member', admitted: true }), 'admitted');
   assert.equal(pollDecision({ status: 'dismissed' }), 'dismissed');
+  // task 1002969: an invite past its 30 days stops the loop rather than waiting on a shut door
+  assert.equal(pollDecision({ status: 'expired', admitted: false }), 'expired');
   assert.equal(pollDecision({ status: 'pending', admitted: false }), 'wait');
   assert.equal(pollDecision({ status: 'none' }), 'wait');
   assert.equal(pollDecision(null), 'wait');

package/tests/hub_invite_notices.mjs

@@ -107,8 +107,11 @@ test('notify seeds a PENDING row on the calling project, and cannot touch a real
   const w = writes();
   assert.equal(w.length, 1);
   assert.match(w[0].sql, /VALUES \(\$1, \$2, 'pending'\)/, 'a notice is a pending row, never a membership');
-  assert.match(w[0].sql, /ON CONFLICT \(client_id, github_id\) DO NOTHING/, 'a current member is left exactly as they are');
-  assert.deepEqual(w[0].params, ['mercury', '4242'], 'keyed on the authenticated client and the account the LOGIN resolves to');
+  // The conflict branch restamps ONLY joined_at, and only on a pending row past its 30
+  // days (a re-invite, task 1002969): a current member is left exactly as they are.
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, github_id\) DO UPDATE SET joined_at = now\(\)\s+WHERE m\.membership_kind = 'pending' AND m\.joined_at <= now\(\) - make_interval\(days => \$3\)/,
+    'a current member is left exactly as they are');
+  assert.deepEqual(w[0].params, ['mercury', '4242', 30], 'keyed on the authenticated client and the account the LOGIN resolves to');
 });
 
 test('clear drops ONLY a pending row on the calling project', async () => {

package/tests/invite_expiry.mjs

@@ -0,0 +1,37 @@
+// tests/invite_expiry.mjs — task 1002969 (privacy spec D4, ADR 0356). DB-free.
+//
+// The one definition of when a recruit invite's door closes. The behaviour is proved
+// in tests/application_lifecycle.mjs (interpreted) and tests/invite_expiry_db.mjs
+// (real Postgres); this pins the definition itself: the owner-signed window, that
+// only an invite can expire, that "live" is exactly "not expired", and that a table
+// alias can never carry SQL into the statements that interpolate it.
+//
+// Run:  node --test tests/invite_expiry.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const expiry = require('../src/bongos/invite-expiry.js');
+const api = require('../src/module-api.js');
+
+test('the window is the owner-signed 30 days, and the doorway serves this same module', () => {
+  assert.equal(expiry.INVITE_EXPIRY_DAYS, 30);
+  for (const k of ['INVITE_EXPIRY_DAYS', 'inviteExpiredSql', 'inviteLiveSql', 'inviteExpiresAtSql']) {
+    assert.equal(api.inviteExpiry[k], expiry[k], `${k}: modules read the definition core reads, not a copy`);
+  }
+});
+
+test('only an invite expires, and live is exactly not-expired', () => {
+  assert.equal(expiry.inviteExpiredSql(), "(kind = 'invite' AND created_at <= now() - interval '30 days')");
+  assert.equal(expiry.inviteLiveSql('ar'), `NOT ${expiry.inviteExpiredSql('ar')}`);
+  assert.match(expiry.inviteExpiresAtSql('ar'), /^\(CASE WHEN ar\.kind = 'invite' THEN ar\.created_at \+ interval '30 days' END\)$/,
+    'an application has no closing day');
+});
+
+test('an alias is an identifier or nothing', () => {
+  assert.match(expiry.inviteLiveSql('x'), /x\.kind = 'invite' AND x\.created_at/);
+  for (const bad of ['ar;', "a'", 'a b', 'A', '1a', 'a.b']) {
+    assert.throws(() => expiry.inviteExpiredSql(bad), /bad table alias/, JSON.stringify(bad));
+  }
+});

package/tests/invite_expiry_db.mjs

@@ -0,0 +1,196 @@
+// tests/invite_expiry_db.mjs — task 1002969 (privacy spec D4, ADR 0356). Real DB.
+//
+// A recruit invite's door closes 30 days after it is sent, computed at read time.
+// tests/application_lifecycle.mjs pins the behaviour over an interpreter that reads
+// each statement's WHERE; this file runs the SAME statements on Postgres, because an
+// interpreter cannot tell you that Postgres would reject a statement, or what
+// `now() - interval '30 days'` does at the boundary. Two halves:
+//
+//   the instance — the real onboarding router and the real db-kernel admission reads,
+//                  over access_requests built from its real migrations;
+//   the hub      — inviteToProject and listPendingInvitesForAccount over the real
+//                  memberships table: an expired notice is hidden, a re-invite
+//                  restamps it, and a member's row is never touched.
+//
+// Each half builds its tables in a throwaway schema, so a shared database's rows are
+// never seen or changed.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/invite_expiry_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const express = require('express');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const coreSql = (f) => readFileSync(join(here, '..', 'migrations', `${f}.sql`), 'utf8');
+const piSql = (f) => readFileSync(join(here, '..', 'modules', 'platform-identity', 'migrations', `platform_identity_${f}.sql`), 'utf8');
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try {
+  client = await pgPool.connect();
+} catch (e) {
+  console.log(`invite_expiry_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+
+const q = (sql, params) => client.query(sql, params);
+const SCHEMA = `t1002969_${process.pid}`;
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+// Core's admission reads go through ./pool, and the router through the doorway's
+// pool: both are pointed at this one connection, whose search_path is the schema.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: client } };
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+let notices = [];
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: client,
+  projectJoinDoor: () => 'apply',
+  logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
+  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'owner' }; next(); },
+  requirePermission: () => (_req, _res, next) => next(),
+  readApplicationVouch: () => null,
+  notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
+};
+const broadcastPath = require.resolve('../modules/onboarding/approval-broadcast.js');
+require.cache[broadcastPath] = { id: broadcastPath, filename: broadcastPath, loaded: true, exports: { postMemberApprovalRequest: async () => ({}) } };
+
+const dbKernel = require('../src/bongos/db-kernel.js');
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAccessRequestsRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const port = server.address().port;
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({ host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, json: JSON.parse(Buffer.concat(chunks).toString('utf8') || 'null') }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// Backdate one login's rows by `days` (an invite's resolved_at is its created_at).
+const age = (login, days) => q(
+  `UPDATE access_requests SET created_at = now() - make_interval(days => $2),
+          resolved_at = CASE WHEN kind = 'invite' THEN now() - make_interval(days => $2) ELSE resolved_at END
+    WHERE github_login = $1`, [login, days]);
+
+try {
+  await q(`CREATE SCHEMA ${SCHEMA}`);
+  await q(`SET search_path TO ${SCHEMA}`);
+  await q('CREATE TABLE schema_migrations (version text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())');
+  await q('CREATE TABLE builders (id bigserial PRIMARY KEY, github_login text NOT NULL)');
+  await q(`INSERT INTO builders (id, github_login) VALUES (42, 'owner')`);
+  for (const f of ['060_access_requests', 'core_230_access_requests_applicant_vouch',
+    'core_254_access_requests_applicant_handle', 'core_255_access_requests_invite_kind',
+    'core_266_access_requests_invited_login_idx']) await q(coreSql(f));
+
+  // ── The instance: the door, the queues, the probe ────────────────────────
+  console.log('the instance:');
+  for (const login of ['eve', 'fay']) assert.equal((await call('POST', '/api/gds/access-requests/invite', { github_login: login })).status, 201);
+  await q(`INSERT INTO access_requests (github_login, status, resolved_at, created_at) VALUES ('cy', 'invited', now(), now() - interval '60 days')`);
+  await age('eve', 29);
+  await age('fay', 31);
+  ok(await dbKernel.hasInvitedAccessRequest('eve') === true, 'day 29: the invite still admits');
+  ok(await dbKernel.hasInvitedAccessRequest('fay') === false, 'day 31: the sign-in gate refuses it');
+  ok(await dbKernel.hasInvitedAccessRequest('cy') === true, 'an application approved 60 days ago is not an invite and still admits');
+  ok((await dbKernel.accessStateByLogin('fay')).invited === false, 'the waiting page agrees with the gate');
+
+  // core_266: the gate's own statement, captured as it runs, can use the invited-login
+  // index. Seq scans are switched off only so a tiny table still shows the plan.
+  const seen = [];
+  const realQuery = client.query.bind(client);
+  client.query = (text, params) => { seen.push({ text, params }); return realQuery(text, params); };
+  await dbKernel.hasInvitedAccessRequest('eve');
+  client.query = realQuery;
+  await q('SET enable_seqscan = off');
+  const plan = (await q(`EXPLAIN ${seen[0].text}`, seen[0].params)).rows.map((r) => r['QUERY PLAN']).join('\n');
+  await q('RESET enable_seqscan');
+  ok(/idx_access_requests_invited_login/.test(plan), 'the sign-in gate can read invited rows through core_266\'s index');
+
+  const hist = Object.fromEntries((await call('GET', '/api/gds/access-requests?status=invited')).json.requests.map((r) => [r.github_login, r]));
+  ok(hist.fay.expired === true && hist.eve.expired === false && hist.cy.expired === false, 'the queue marks only the expired invite');
+  ok(hist.cy.expires_at === null && new Date(hist.fay.expires_at) <= new Date() && new Date(hist.eve.expires_at) > new Date(),
+    'and says when each invite closes; an application has no such day');
+
+  const probe = (await call('GET', '/api/gds/access-requests/status?github_login=fay')).json;
+  ok(probe.status === 'expired' && probe.admitted === false, 'the status probe reports expired, not invited');
+
+  notices = [];
+  const again = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  ok(again.status === 201 && await dbKernel.hasInvitedAccessRequest('fay') === true, 're-inviting an expired login opens a fresh door');
+  ok(notices.length === 1 && notices[0].invited === true, 'and tells the hub');
+  const out = (await call('GET', '/api/gds/access-requests/invites')).json.invites;
+  ok(out.filter((r) => r.github_login === 'fay').length === 1 && out.find((r) => r.github_login === 'fay').expired === false,
+    'the outstanding list shows the live invite in place of the expired one');
+  const mine = (await call('GET', '/api/gds/access-requests/invites?mine=1')).json.invites;
+  ok(mine.filter((r) => r.github_login === 'fay').length === 1, 'and so does the sender\'s own list (?mine=1)');
+
+  notices = [];
+  await call('PATCH', `/api/gds/access-requests/${again.json.request.id}`, { status: 'dismissed' });
+  ok(notices.length === 1 && notices[0].invited === false, 'rescinding the live invite clears the hub notice; the expired row does not stand');
+
+  // ── The hub: the notice follows the door ──────────────────────────────────
+  console.log('the hub:');
+  for (const f of ['001_tables', '003_project_memberships', '010_membership_kind', '021_drop_legacy_role']) await q(piSql(f));
+  const joined = async (id) => (await q(
+    `SELECT membership_kind, joined_at FROM platform_identity_project_memberships WHERE client_id = 'demo' AND github_id = $1`, [id])).rows[0];
+  const backdate = (id, days) => q(
+    `UPDATE platform_identity_project_memberships SET joined_at = now() - make_interval(days => $2) WHERE client_id = 'demo' AND github_id = $1`, [id, days]);
+
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 1 }, { pool: client })).invited === true, 'a first invite writes a notice');
+  await backdate(1, 10);
+  const before = (await joined(1)).joined_at;
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 1 }, { pool: client })).invited === false
+    && (await joined(1)).joined_at.getTime() === before.getTime(), 'a re-send while the invite is live leaves the notice as it was');
+
+  await pi.inviteToProject({ clientId: 'demo', githubId: 2 }, { pool: client });
+  await backdate(2, 31);
+  const listed = async (id) => (await pi.listPendingInvitesForAccount(id, { pool: client })).length;
+  ok(await listed(1) === 1, 'a 10-day-old notice is listed');
+  ok(await listed(2) === 0, 'a 31-day-old notice is not: its door no longer opens');
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 2 }, { pool: client })).invited === true && await listed(2) === 1,
+    'a re-invite after the 30 days restamps the notice, so it shows again');
+
+  await q(`INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind, joined_at)
+           VALUES ('demo', 3, 'member', now() - interval '400 days')`);
+  const member = await joined(3);
+  ok((await pi.inviteToProject({ clientId: 'demo', githubId: 3 }, { pool: client })).invited === false, 'inviting a member writes nothing');
+  const after = await joined(3);
+  ok(after.membership_kind === 'member' && after.joined_at.getTime() === member.joined_at.getTime(),
+    'and their row is untouched, however old it is');
+
+  console.log(`\ninvite_expiry_db.mjs: ${pass} passed`);
+} finally {
+  await new Promise((r) => server.close(r));
+  await q(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end().catch(() => {});
+}