@bongos/core 1.20.27 → 1.20.29

package/tests/application_lifecycle.mjs

@@ -54,6 +54,12 @@ const express = require('express');
 // ===========================================================================
 
 const HOUR = 60 * 60 * 1000;
+const DAY = 24 * HOUR;
+
+// An invite's door closes `days` after it was sent (task 1002969, ADR 0356). The
+// interpreter reads the window out of the statement itself, so the constant lives in
+// one place: src/bongos/invite-expiry.js.
+const inviteExpired = (r, days) => r.kind === 'invite' && r.created_at <= Date.now() - days * DAY;
 
 let rows = [];
 let builders = [];
@@ -114,6 +120,16 @@ function predicateFor(rawWhere, params) {
     where = where.replace(notMember[0], ' TRUE ');
   }
 
+  // The expiry itself (inviteLiveSql): the row is not an invite past its window.
+  // One unit, like the transition guard, so its inner `kind = 'invite'` is not
+  // re-read below as a filter of its own.
+  let live;
+  while ((live = /NOT \((?:(\w+)\.)?kind = 'invite' AND (?:\1\.)?created_at <= now\(\) - interval '(\d+) days'\)/.exec(where))) {
+    const days = Number(live[2]);
+    tests.push((r) => !inviteExpired(r, days));
+    where = where.replace(live[0], ' TRUE ');
+  }
+
   let m;
   const eat = () => { where = where.replace(m[0], ' TRUE '); };
   if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
@@ -225,12 +241,24 @@ const pool = {
       return { rows: hit.map((r) => ({ id: r.id, github_login: r.github_login, status: r.status, kind: r.kind, resolved_at: r.resolved_at })) };
     }
 
-    // The outstanding-invite list. Its sender is joined through created_by.
-    if ((m = /^SELECT ar\.id, ar\.github_login, ar\.note, ar\.created_at, ib\.github_login AS invited_by_login FROM access_requests ar LEFT JOIN builders ib ON ib\.id = ar\.created_by WHERE (.+?) ORDER BY ar\.created_at DESC LIMIT 200$/.exec(sql))) {
-      const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
+    // The outstanding-invite list. Its sender is joined through created_by. Since task
+    // 1002969 each row says when its door closes and whether it has, and an expired
+    // row is dropped when its login has a live invite: a window over the inner scan
+    // (`login_has_live`), with the sender filter outside it. Modelled as exactly that.
+    if ((m = /^SELECT inv\.id, inv\.github_login, inv\.note, inv\.created_at, inv\.expires_at, inv\.expired, inv\.invited_by_login FROM \(SELECT ar\.id, ar\.github_login, ar\.note, ar\.created_at, ar\.created_by, \(CASE WHEN ar\.kind = 'invite' THEN ar\.created_at \+ interval '(\d+) days' END\) AS expires_at, \(ar\.kind = 'invite' AND ar\.created_at <= now\(\) - interval '\1 days'\) AS expired, bool_or\(NOT \(ar\.kind = 'invite' AND ar\.created_at <= now\(\) - interval '\1 days'\)\) OVER \(PARTITION BY lower\(ar\.github_login\)\) AS login_has_live, ib\.github_login AS invited_by_login FROM access_requests ar LEFT JOIN builders ib ON ib\.id = ar\.created_by WHERE (.+?)\) inv WHERE NOT \(inv\.expired AND inv\.login_has_live\)(?: AND inv\.created_by = \$(\d+))? ORDER BY inv\.created_at DESC LIMIT 200$/.exec(sql))) {
+      const days = Number(m[1]);
+      const inner = rows.filter(predicateFor(m[2], params));
+      const key = (r) => String(r.github_login).toLowerCase();
+      const liveLogins = new Set(inner.filter((r) => !inviteExpired(r, days)).map(key));
+      const sender = m[3] ? params[Number(m[3]) - 1] : undefined;
+      const hit = inner
+        .filter((r) => !(inviteExpired(r, days) && liveLogins.has(key(r))))
+        .filter((r) => sender === undefined || String(r.created_by) === String(sender))
+        .sort((a, b) => b.created_at - a.created_at);
       return {
         rows: hit.map((r) => ({
           id: r.id, github_login: r.github_login, note: r.note, created_at: r.created_at,
+          expires_at: r.created_at + days * DAY, expired: inviteExpired(r, days),
           invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null,
         })),
       };
@@ -248,6 +276,9 @@ const pool = {
           // proves the route reads the column rather than that this fake invents it.
           ...(/\bar\.applicant_handle\b/.test(sql) ? { applicant_handle: r.applicant_handle ?? null } : {}),
           ...(/\bar\.kind\b/.test(sql) ? { kind: r.kind } : {}),
+          ...((m = /\(ar\.status = 'invited' AND \(ar\.kind = 'invite' AND ar\.created_at <= now\(\) - interval '(\d+) days'\)\) AS expired, \(CASE WHEN ar\.kind = 'invite' THEN ar\.created_at \+ interval '\1 days' END\) AS expires_at/.exec(sql))
+            ? { expired: r.status === 'invited' && inviteExpired(r, Number(m[1])), expires_at: r.kind === 'invite' ? r.created_at + Number(m[1]) * DAY : null }
+            : {}),
           ...(/\bib\.github_login AS invited_by_login\b/.test(sql) && /\bON ib\.id = ar\.created_by\b/.test(sql)
             ? { invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null } : {}),
           vouched: r.applicant_github_id !== null,
@@ -256,6 +287,27 @@ const pool = {
       };
     }
 
+    // db-kernel's accessStateByLogin — the waiting page's three facts in one read.
+    // Each EXISTS is filtered by its own WHERE, so the expiry unit in `invited` is
+    // read by the interpreter like every other predicate.
+    if ((m = /^SELECT EXISTS \(SELECT 1 FROM builders WHERE (.+?)\) AS member, EXISTS \(SELECT 1 FROM access_requests WHERE (.+?)\) AS invited, EXISTS \(SELECT 1 FROM access_requests WHERE (.+?)\) AS pending$/.exec(sql))) {
+      return { rows: [{
+        member: builders.some(predicateFor(m[1], params)),
+        invited: rows.some(predicateFor(m[2], params)),
+        pending: rows.some(predicateFor(m[3], params)),
+      }] };
+    }
+
+    // The public status probe (task 1002969): an invite that still admits sorts first,
+    // then the newest request; an invite past its window reports itself expired.
+    if ((m = /^SELECT status, \(status = 'invited' AND \(kind = 'invite' AND created_at <= now\(\) - interval '(\d+) days'\)\) AS expired FROM access_requests WHERE (.+?) ORDER BY \(status = 'invited' AND NOT \(kind = 'invite' AND created_at <= now\(\) - interval '\1 days'\)\) DESC, created_at DESC LIMIT 1$/.exec(sql))) {
+      const days = Number(m[1]);
+      const admits = (r) => r.status === 'invited' && !inviteExpired(r, days);
+      const hit = rows.filter(predicateFor(m[2], params))
+        .sort((a, b) => (admits(b) - admits(a)) || (b.created_at - a.created_at));
+      return { rows: hit.slice(0, 1).map((r) => ({ status: r.status, expired: r.status === 'invited' && inviteExpired(r, days) })) };
+    }
+
     // A vouched re-application taking over an unvouched pending row (ADR 0333 D4).
     // The SET list is matched exactly, like the resolve's below.
     if ((m = /^UPDATE access_requests SET display_name = \$2, note = \$3, applicant_github_id = \$4, applicant_handle = \$5, vouched_at = \$6 WHERE (.+?)$/.exec(sql))) {
@@ -809,8 +861,12 @@ test('invite: a login that never applied signs straight in, and the row says it
   assert.equal(eve.note, 'Come build the parser', 'the inviter’s words, and kind says whose');
   statements = [];
   assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), true, 'the REAL admission read admits her — signing in is the acceptance act');
-  assert.ok(statements.length > 0 && statements.every(({ sql }) => !/\bkind\b|\bcreated_by\b/.test(sql)),
-    'and it admitted her without reading either new column (D2.5)');
+  // D2.5 as amended by ADR 0356 (task 1002969): admission never reads created_by, and
+  // reads `kind` ONLY inside the expiry unit, which can close a door but never open one.
+  const EXPIRY_UNIT = /NOT \(kind = 'invite' AND created_at <= now\(\) - interval '\d+ days'\)/g;
+  assert.ok(statements.length > 0 && statements.every(({ sql }) => !/\bcreated_by\b/.test(sql)
+    && !/\bkind\b/.test(sql.replace(EXPIRY_UNIT, ''))),
+  'and it admitted her reading kind only to ask whether her invite has expired (D2.5, ADR 0356)');
 });
 
 test('rescind: an invite keeps its sender through a rescind by a different archon, and the door re-locks', async () => {
@@ -873,6 +929,109 @@ test('the queue history tells an invite from an approved application, and names
   assert.equal(byLogin.ada.invite_note, null);
 });
 
+// ===========================================================================
+// Expiry — an invite's door closes 30 days after it is sent, read-time (task
+// 1002969, privacy spec D4, ADR 0356)
+// ===========================================================================
+
+// Backdate a row as if it had been written `days` ago (an invite's resolved_at is
+// its created_at: the route writes both in one statement).
+const age = (row, days) => {
+  row.created_at = Date.now() - days * DAY;
+  if (row.kind === 'invite') row.resolved_at = row.created_at;
+};
+
+test('expiry: an invite admits for 30 days and not after; an approved application never expires', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'eve'), 29);
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  age(row(3), 60); // cy: an application approved long ago
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), true, 'day 29: the door still opens');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('fay'), false, 'day 31: the REAL admission read refuses her');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), true, 'an approved application is not an invite and does not expire');
+  const state = await dbKernel.accessStateByLogin('fay');
+  assert.equal(state.invited, false, 'the waiting page does not call an expired invite imminent admission');
+});
+
+test('expiry: the queues show an expired invite as expired, and it offers the recruiter a re-invite, not a rescind', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  const hist = await call('GET', '/api/gds/access-requests?status=invited');
+  const h = Object.fromEntries(hist.json.requests.map((x) => [x.github_login, x]));
+  assert.equal(h.fay.expired, true);
+  assert.equal(h.eve.expired, false);
+  assert.equal(h.cy.expired, false, 'an approved application is never marked expired');
+  assert.equal(h.cy.expires_at, null, 'and has no day it closes');
+  assert.ok(h.fay.expires_at <= Date.now() && h.eve.expires_at > Date.now(), 'each invite says when its door closes');
+  const out = await call('GET', '/api/gds/access-requests/invites');
+  const o = Object.fromEntries(out.json.invites.map((x) => [x.github_login, x]));
+  assert.deepEqual(Object.keys(o).sort(), ['eve', 'fay'], 'an expired invite stays listed, so its sender knows to invite again');
+  assert.equal(o.fay.expired, true);
+  assert.equal(o.eve.expired, false);
+});
+
+test('expiry: re-inviting an expired login opens a fresh door, notices the hub, and retires the expired line', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  notices = [];
+  const again = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  assert.equal(again.status, 201, 'a fresh row, not already_invited: the expired invite does not stand');
+  assert.deepEqual(notices, [{ login: 'fay', invited: true }], 'the hub is told, so its notice shows again');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('fay'), true, 'the new door opens');
+  const out = await call('GET', '/api/gds/access-requests/invites');
+  const fays = out.json.invites.filter((x) => x.github_login === 'fay');
+  assert.equal(fays.length, 1, 'the expired line is replaced by the live one, not listed beside it');
+  assert.equal(fays[0].expired, false);
+});
+
+test('expiry: another sender re-inviting the login retires your expired line from your own list too', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' }); // sent by 42
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  actingId = 43;
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' }); // 43 re-invites
+  actingId = 42;
+  const mine = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(mine.json.invites.map((x) => x.github_login), [],
+    'the sender filter sits outside the "has a live invite" window, so 42 is not told to re-invite fay');
+  actingId = 43;
+  const theirs = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(theirs.json.invites.map((x) => [x.github_login, x.expired]), [['fay', false]]);
+});
+
+test('expiry: the public status probe says expired, and an expired invitee may apply', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  const st = await call('GET', '/api/gds/access-requests/status?github_login=fay');
+  assert.deepEqual(st.json, { github_login: 'fay', status: 'expired', admitted: false });
+  const asked = await call('POST', '/api/gds/access-requests', { github_login: 'fay' });
+  assert.equal(asked.status, 201, 'not already_approved: an expired invite is not an approval');
+  const st2 = await call('GET', '/api/gds/access-requests/status?github_login=fay');
+  assert.equal(st2.json.status, 'pending', 'the newer request is what the probe reports');
+});
+
+test('expiry: rescinding the last live invite clears the hub notice even though an expired one remains', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  age(rows.find((x) => x.github_login === 'fay'), 31);
+  const live = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  notices = [];
+  await call('PATCH', `/api/gds/access-requests/${live.json.request.id}`, { status: 'dismissed' });
+  assert.deepEqual(notices, [{ login: 'fay', invited: false }], 'an expired row is not a standing invite');
+});
+
 test('invite: resolving a pending application in place keeps it an application, with the applicant’s own note', async () => {
   reset();
   builders.push(...ARCHONS);

package/tests/bongos_login.mjs

@@ -39,6 +39,8 @@ test('pollDecision maps the /access-requests/status body to a loop action', () =
   assert.equal(pollDecision({ status: 'invited' }), 'admitted');
   assert.equal(pollDecision({ status: 'member', admitted: true }), 'admitted');
   assert.equal(pollDecision({ status: 'dismissed' }), 'dismissed');
+  // task 1002969: an invite past its 30 days stops the loop rather than waiting on a shut door
+  assert.equal(pollDecision({ status: 'expired', admitted: false }), 'expired');
   assert.equal(pollDecision({ status: 'pending', admitted: false }), 'wait');
   assert.equal(pollDecision({ status: 'none' }), 'wait');
   assert.equal(pollDecision(null), 'wait');

package/tests/core_upgrade_door.mjs

@@ -18,7 +18,7 @@ import { createRequire } from 'node:module';
 import { readFileSync, readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { parseRepoNote } from '../modules/provisioning/core-upgrade.js';
+import { parseRepoNote, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, makeUpdateChannelHandler as updateChannelHandlerFor } from '../modules/provisioning/core-upgrade.js';
 
 const require = createRequire(import.meta.url);
 const P = require('../modules/provisioning/provisioning.js');
@@ -885,5 +885,84 @@ await t('lastMoveSuperseded computes no version ORDERING — only identity', ()
   assert.equal(CU.lastMoveSuperseded('1.19.921', '1.19.900', '1.19.949'), true);
 });
 
+console.log('\nthe project\'s update rule (task 1004445):');
+
+const channelHandler = (inst, calls) => updateChannelHandlerFor({
+  provisioning: {
+    getInstanceById: async () => inst,
+    recordEvent: async (_db, e) => { calls.push({ event: e.event, detail: e.detail, actor: e.actor }); },
+  },
+  pool: { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [] }; } },
+  parseId: () => 7, validateOrRespond: () => false, log: { error() {} },
+});
+const runChannel = async (inst, body, calls = []) => {
+  let out = null;
+  const res = { json: (b) => { out = b; return res; }, fail: (code, o) => { out = { code, ...o }; return res; } };
+  await channelHandler(inst, calls)({ builder: { id: 42 }, params: { id: '7' }, body }, res);
+  return out;
+};
+
+await t('the web tier\'s channel list is the runner\'s, and the migration\'s CHECK carries the same values', () => {
+  const policy = require('../scripts/gds/update-channel.js');
+  assert.deepEqual([...UPDATE_CHANNELS], policy.VALID_CHANNELS, 're-stated in the module (ADR 0083) — so it must be equal');
+  assert.equal(DEFAULT_UPDATE_CHANNEL, policy.DEFAULT_CHANNEL);
+  const sql = read('modules', 'provisioning', 'migrations', 'provisioning_029_update_channel.sql');
+  assert.match(sql, /DEFAULT 'patch'/);
+  for (const c of policy.VALID_CHANNELS) assert.match(sql, new RegExp(`'${c}'`), `the CHECK admits ${c}`);
+});
+
+await t('updateChannelOf reads the row and falls back to patch for a pre-column row', () => {
+  assert.equal(updateChannelOf({ update_channel: 'minor' }), 'minor');
+  assert.equal(updateChannelOf({}), 'patch');
+  assert.equal(updateChannelOf({ update_channel: 'everything' }), 'patch');
+});
+
+await t('setting the rule writes the row and audits who changed it, from what to what', async () => {
+  const calls = [];
+  const out = await runChannel({ ...ACTIVE, update_channel: 'patch' }, { channel: 'minor' }, calls);
+  assert.equal(out.ok, true);
+  assert.equal(out.update_channel, 'minor');
+  assert.equal(out.changed, true);
+  const w = calls.find((c) => c.sql && /UPDATE provisioning_instances SET update_channel/.test(c.sql));
+  assert.ok(w, 'the row was written');
+  assert.deepEqual(w.params, [7, 'minor']);
+  const ev = calls.find((c) => c.event === 'update-channel-changed');
+  assert.ok(ev, 'and an event recorded');
+  assert.match(ev.detail, /from patch to minor/);
+  assert.equal(ev.actor, 'api:archon:42');
+  assert.ok(!calls.some((c) => c.sql && /provisioning_intents/.test(c.sql)), 'nothing is queued — a rule change moves no core');
+});
+
+await t('an unknown rule is a 400 naming the valid ones, and writes nothing', async () => {
+  const calls = [];
+  const out = await runChannel(ACTIVE, { channel: 'major' }, calls);
+  assert.equal(out.code, 'bad_update_channel');
+  assert.equal(out.status, 400);
+  assert.deepEqual(out.details.valid, ['pinned', 'patch', 'minor']);
+  assert.equal(calls.length, 0);
+});
+
+await t('re-sending the current rule changes nothing and says so', async () => {
+  const calls = [];
+  const out = await runChannel({ ...ACTIVE, update_channel: 'minor' }, { channel: 'MINOR' }, calls);
+  assert.equal(out.ok, true);
+  assert.equal(out.changed, false);
+  assert.equal(calls.length, 0, 'no write, no event');
+});
+
+await t('the preview carries the rule, so the page can say which rule shaped the offer', () => {
+  assert.equal(CU.previewFromSnapshot({ ...ACTIVE, update_channel: 'minor' }, null, null, null).update_channel, 'minor');
+  assert.equal(CU.previewFromSnapshot(ACTIVE, null, null, null).update_channel, 'patch');
+});
+
+await t('the route is gated like the move: the owner door OR core.pin.move', () => {
+  const src = read('modules', 'provisioning', 'routes', 'core-upgrade.js');
+  const i = src.indexOf("'/provisioning/instances/:id/update-channel'");
+  assert.ok(i > 0, 'the route exists');
+  const block = src.slice(i, src.indexOf(');', i));
+  assert.match(block, /api\.requireBuilder/);
+  assert.match(block, /requireOwnProjectOrPin\(\{ pinGate: api\.requirePermission\('core\.pin\.move'\)/);
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/core_upgrade_runner.mjs

@@ -31,7 +31,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 // An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
-import { parseSchemaPending, repoNote, REPO_NOTES } from '../scripts/gds/provision-core-upgrade.js';
+import { parseSchemaPending, repoNote, REPO_NOTES, instanceChannel } from '../scripts/gds/provision-core-upgrade.js';
 import { parseRepoNote } from '../modules/provisioning/core-upgrade.js';
 
 const require = createRequire(import.meta.url);
@@ -1396,5 +1396,58 @@ await t('the DRAIN LOOP resolves a done-with-a-note move WITH its note, still as
   assert.equal(statusWrites.length, 0, 'a healthy instance is not marked anything');
 });
 
+console.log('\nthe project\'s own update rule (task 1004445):');
+
+// The REAL policy module, not the stub makeDeps hands every other case: these cases are
+// about which rule the runner applies, so a stub that admits everything would prove nothing.
+const realChannel = require('../scripts/gds/update-channel.js');
+const withRealChannel = (over) => {
+  const d = makeDeps(over);
+  d.updateChannel = { ...realChannel, listAvailableVersions: () => ({ ok: true, versions: over.available }) };
+  return d;
+};
+
+await t('instanceChannel reads the row, and a row from before the column falls back to patch', () => {
+  assert.equal(instanceChannel({ update_channel: 'minor' }, realChannel), 'minor');
+  assert.equal(instanceChannel({ update_channel: 'pinned' }, realChannel), 'pinned');
+  assert.equal(instanceChannel({}, realChannel), 'patch', 'no column yet → the old default');
+  assert.equal(instanceChannel({ update_channel: 'bogus' }, realChannel), 'patch', 'unknown → the default, never a wider rule');
+});
+
+await t('a project on PATCH still refuses a step-up release (1.19 → 1.20)', async () => {
+  const d = withRealChannel({ installed: '1.19.1081', served: '1.19.1081', available: ['1.19.1081', '1.20.1'] });
+  const r = await R.coreUpgradeInstance(inst({ update_channel: 'patch' }), d, intent({ target_version: '1.20.1' }));
+  assert.equal(r.ok, false);
+  assert.match(r.error, /outside this project's 'patch' update channel/);
+  assert.ok(!d.ran.some((c) => /upgrade\.js/.test(c)), 'and nothing was run');
+});
+
+await t('a project on MINOR takes that same step-up release', async () => {
+  const d = withRealChannel({ installed: '1.19.1081', served: '1.20.1', available: ['1.19.1081', '1.20.1'] });
+  const r = await R.coreUpgradeInstance(inst({ update_channel: 'minor' }), d, intent({ target_version: '1.20.1' }));
+  assert.ok(!(r.error && /update channel/.test(r.error)), `the channel must not refuse it: ${r.error}`);
+  assert.ok(d.ran.some((c) => /upgrade\.js/.test(c) && /--to 1\.20\.1/.test(c)), 'the upgrade was invoked for 1.20.1');
+});
+
+await t('MINOR still refuses a MAJOR jump — no rule makes 2.0 automatic', async () => {
+  const d = withRealChannel({ installed: '1.19.1081', served: '1.19.1081', available: ['1.19.1081', '2.0.0'] });
+  const r = await R.coreUpgradeInstance(inst({ update_channel: 'minor' }), d, intent({ target_version: '2.0.0' }));
+  assert.equal(r.ok, false);
+  assert.match(r.error, /outside this project's 'minor' update channel/);
+});
+
+await t('the snapshot OFFERS what the project\'s rule admits — the button and the runner agree', async () => {
+  const available = ['1.19.1081', '1.19.1082', '1.20.1', '1.20.11'];
+  const offered = async (update_channel) => {
+    const queries = [];
+    await R.snapshotCoreVersions(inst({ update_channel }), withRealChannel({ served: '1.19.1081', available, queries }));
+    return queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql)).params[3];
+  };
+  assert.equal(await offered('patch'), '1.19.1082', 'patch offers the newest fix on the same line');
+  assert.equal(await offered('minor'), '1.20.11', 'minor offers the step up');
+  assert.equal(await offered('pinned'), null, 'pinned offers nothing');
+  assert.equal(await offered(undefined), '1.19.1082', 'a pre-column row behaves exactly as before');
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/hub_invite_notices.mjs

@@ -107,8 +107,11 @@ test('notify seeds a PENDING row on the calling project, and cannot touch a real
   const w = writes();
   assert.equal(w.length, 1);
   assert.match(w[0].sql, /VALUES \(\$1, \$2, 'pending'\)/, 'a notice is a pending row, never a membership');
-  assert.match(w[0].sql, /ON CONFLICT \(client_id, github_id\) DO NOTHING/, 'a current member is left exactly as they are');
-  assert.deepEqual(w[0].params, ['mercury', '4242'], 'keyed on the authenticated client and the account the LOGIN resolves to');
+  // The conflict branch restamps ONLY joined_at, and only on a pending row past its 30
+  // days (a re-invite, task 1002969): a current member is left exactly as they are.
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, github_id\) DO UPDATE SET joined_at = now\(\)\s+WHERE m\.membership_kind = 'pending' AND m\.joined_at <= now\(\) - make_interval\(days => \$3\)/,
+    'a current member is left exactly as they are');
+  assert.deepEqual(w[0].params, ['mercury', '4242', 30], 'keyed on the authenticated client and the account the LOGIN resolves to');
 });
 
 test('clear drops ONLY a pending row on the calling project', async () => {

package/tests/invite_expiry.mjs

@@ -0,0 +1,37 @@
+// tests/invite_expiry.mjs — task 1002969 (privacy spec D4, ADR 0356). DB-free.
+//
+// The one definition of when a recruit invite's door closes. The behaviour is proved
+// in tests/application_lifecycle.mjs (interpreted) and tests/invite_expiry_db.mjs
+// (real Postgres); this pins the definition itself: the owner-signed window, that
+// only an invite can expire, that "live" is exactly "not expired", and that a table
+// alias can never carry SQL into the statements that interpolate it.
+//
+// Run:  node --test tests/invite_expiry.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const expiry = require('../src/bongos/invite-expiry.js');
+const api = require('../src/module-api.js');
+
+test('the window is the owner-signed 30 days, and the doorway serves this same module', () => {
+  assert.equal(expiry.INVITE_EXPIRY_DAYS, 30);
+  for (const k of ['INVITE_EXPIRY_DAYS', 'inviteExpiredSql', 'inviteLiveSql', 'inviteExpiresAtSql']) {
+    assert.equal(api.inviteExpiry[k], expiry[k], `${k}: modules read the definition core reads, not a copy`);
+  }
+});
+
+test('only an invite expires, and live is exactly not-expired', () => {
+  assert.equal(expiry.inviteExpiredSql(), "(kind = 'invite' AND created_at <= now() - interval '30 days')");
+  assert.equal(expiry.inviteLiveSql('ar'), `NOT ${expiry.inviteExpiredSql('ar')}`);
+  assert.match(expiry.inviteExpiresAtSql('ar'), /^\(CASE WHEN ar\.kind = 'invite' THEN ar\.created_at \+ interval '30 days' END\)$/,
+    'an application has no closing day');
+});
+
+test('an alias is an identifier or nothing', () => {
+  assert.match(expiry.inviteLiveSql('x'), /x\.kind = 'invite' AND x\.created_at/);
+  for (const bad of ['ar;', "a'", 'a b', 'A', '1a', 'a.b']) {
+    assert.throws(() => expiry.inviteExpiredSql(bad), /bad table alias/, JSON.stringify(bad));
+  }
+});