@bongos/core 1.21.56 → 1.21.58

package/tests/guild_engagement.mjs

@@ -0,0 +1,881 @@
+// tests/guild_engagement.mjs — guild engagements, DB-free (task 1002303, R27;
+// ADR 0336 D7 as amended by ADR 0365).
+//
+// WHAT THIS PINS, each a rule rather than a behaviour:
+//
+//   1. THE STORED SHAPE — the engagement table has no filer and no status, the
+//      key is (guild, project, kind), the guild FK cascades, the echo's guild_id
+//      is SET NULL — and every statement the module issues agrees with it.
+//   2. OWNER-ONLY FILING — a member is told plainly (403), a stranger gets the
+//      unlisted-safe 404, and the owner test lives INSIDE the INSERT: called
+//      straight at the domain, a non-owner files nothing.
+//   3. NO ORACLE ON A PROJECT — unknown, inactive, private, stealth and dark-
+//      matter projects answer one byte-identical 404.
+//   4. THE INBOX — only my guilds, inside 30 days, naming only projects on the
+//      map AND Public, an `invited` row only if I was a member when it was
+//      sent, and never a project I build on, hold a live invite to, or applied
+//      to inside the window. client_id never crosses.
+//   5. A PROJECT INVITES A GUILD — the inviter gate is POST /projects/invite's,
+//      refusal and all; an unlisted guild is the unknown-guild 404; the links go
+//      to the PUBLIC roster only (shown_publicly AND accountVisibleSql); a
+//      private project's invite leaves no notice behind.
+//   6. THE JOIN — a `guild` that no longer resolves is a 409 that relays
+//      NOTHING; one that does reaches the echo, and a later solo application
+//      clears it.
+//
+// MECHANISM (the tests/recruiter_sliver_boundary.mjs harness, generalised): an
+// in-memory world whose row filters are built FROM EACH STATEMENT'S OWN WHERE
+// TEXT. Each recognised term is CONSUMED as it is matched; whatever survives
+// must be whitespace, parentheses and AND, and every placeholder must have been
+// read — so a predicate this interpreter cannot read, or an AND turned OR, is a
+// loud error rather than a silently different filter. Delete a term from the
+// real statement and the matching rows genuinely come back. Above the pool
+// everything is real: the routers, the domain, HTTP.
+//
+// Real-SQL semantics (the cascade, SET NULL, the upsert restarting the window)
+// are proved against Postgres by tests/guild_engagement_db.mjs.
+//
+// Run:  node tests/guild_engagement.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after, beforeEach } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const read = (p) => readFileSync(join(ROOT, p), 'utf8').replace(/\r\n/g, '\n');
+const MIGRATION = read('modules/platform-identity/migrations/platform_identity_030_guild_engagements.sql');
+const ECHO_MIGRATION = read('modules/platform-identity/migrations/platform_identity_016_application_echo.sql');
+const DOMAIN_SRC = read('modules/platform-identity/guild-engagements.js');
+const ECHO_SRC = read('modules/platform-identity/application-echo.js');
+
+const DAY = 24 * 60 * 60 * 1000;
+const NOW = Date.now();
+const ago = (days) => NOW - days * DAY;
+
+// ===========================================================================
+// The world
+// ===========================================================================
+
+const OWNER = '5001';    // owns guild-a and quiet-guild
+const MEMBER = '5002';   // in guild-a and quiet-guild, from long ago
+const LATE = '5003';     // joined guild-a AFTER proj-pub invited it
+const PRIV = '5004';     // in guild-a, shown, but a PRIVATE account
+const SHY = '5005';      // in guild-a, public account, NOT shown on the page
+const PROV = '5006';     // in guild-a, provisional
+const STRANGER = '5007'; // owns other-guild, in nothing else
+
+const ACCOUNTS = [
+  [OWNER, 'gowner', 'Owner'], [MEMBER, 'gmember', 'Member'], [LATE, 'glate', 'Late'],
+  [PRIV, 'gpriv', 'Priv'], [SHY, 'gshy', 'Shy'], [PROV, 'gprov', 'Prov'], [STRANGER, 'gstranger', 'Stranger'],
+].map(([id, handle, name]) => ({
+  github_id: id, handle, github_login: `${handle}-login`, display_name: `${name} Display`,
+  profile_state: id === PROV ? 'provisional' : 'active',
+  terms_accepted_at: id === PROV ? null : 'T1',
+  account_visibility: id === PRIV ? 'private' : 'public',
+  hide_stats: false,
+}));
+
+const GUILDS = [
+  { id: '71', slug: 'guild-a', name: 'Guild A', visibility: 'public' },
+  { id: '72', slug: 'quiet-guild', name: 'Quiet Guild', visibility: 'unlisted' },
+  { id: '73', slug: 'other-guild', name: 'Other Guild', visibility: 'public' },
+];
+const MEMBERS = [
+  { guild_id: '71', github_id: OWNER, membership_kind: 'owner', shown_publicly: true, joined_at: ago(200) },
+  { guild_id: '71', github_id: MEMBER, membership_kind: 'member', shown_publicly: true, joined_at: ago(100) },
+  { guild_id: '71', github_id: LATE, membership_kind: 'member', shown_publicly: true, joined_at: ago(2.5) },
+  { guild_id: '71', github_id: PRIV, membership_kind: 'member', shown_publicly: true, joined_at: ago(90) },
+  { guild_id: '71', github_id: SHY, membership_kind: 'member', shown_publicly: false, joined_at: ago(90) },
+  { guild_id: '71', github_id: PROV, membership_kind: 'member', shown_publicly: true, joined_at: ago(90) },
+  { guild_id: '72', github_id: OWNER, membership_kind: 'owner', shown_publicly: false, joined_at: ago(60) },
+  { guild_id: '72', github_id: MEMBER, membership_kind: 'member', shown_publicly: false, joined_at: ago(50) },
+  { guild_id: '73', github_id: STRANGER, membership_kind: 'owner', shown_publicly: true, joined_at: ago(30) },
+];
+
+// One registered client per project; the client_id is a sentinel that must never
+// reach a response body.
+const onMap = { status: 'active', description: 'a real description', visibility_source: 'control-plane', visibility_reported_at: null };
+const PROJECTS = [
+  ['pub', { visibility: 'public' }],
+  ['priv', { visibility: 'private' }],
+  ['stealth', { visibility: 'stealth' }],
+  ['dark', { visibility: 'public', description: null }],
+  ['unreported', { visibility: 'public', visibility_source: null }],
+  ['dead', { visibility: 'public' }, 'inactive'],
+  ['member', { visibility: 'public' }],
+  ['pending', { visibility: 'public' }],
+  ['lapsed', { visibility: 'public' }],
+  ['echoed', { visibility: 'public' }],
+  ['stale-echo', { visibility: 'public' }],
+  ['old', { visibility: 'public' }],
+];
+const CLIENTS = PROJECTS.map(([k, , clientStatus], i) => ({
+  id: i + 1, client_id: `cid-${k}-SENTINEL`, name: `Client ${k}`, secret_hash: '', redirect_uris: [],
+  origin: `https://${k}.example`, owner_github_id: null, status: clientStatus || 'active',
+}));
+const PROJECT_ROWS = PROJECTS.map(([k, over]) => ({ origin: `https://${k}.example`, name: `Project ${k}`, ...onMap, ...over }));
+const cid = (k) => `cid-${k}-SENTINEL`;
+
+let ENGAGEMENTS = [];
+let PROJECT_MEMBERSHIPS = [];
+let ECHOES = [];
+function seed() {
+  ENGAGEMENTS = [
+    { guild_id: '72', client_id: cid('pub'), kind: 'apply', created_at: ago(1) },
+    { guild_id: '71', client_id: cid('pub'), kind: 'apply', created_at: ago(2) },
+    { guild_id: '71', client_id: cid('pub'), kind: 'invited', created_at: ago(3) },
+    ...['priv', 'stealth', 'dark', 'unreported', 'dead', 'member', 'pending', 'echoed']
+      .map((k, i) => ({ guild_id: '71', client_id: cid(k), kind: 'apply', created_at: ago(4 + i * 0.1) })),
+    { guild_id: '71', client_id: cid('priv'), kind: 'invited', created_at: ago(4.5) },
+    { guild_id: '71', client_id: cid('lapsed'), kind: 'apply', created_at: ago(5) },
+    { guild_id: '71', client_id: cid('stale-echo'), kind: 'apply', created_at: ago(6) },
+    { guild_id: '71', client_id: cid('old'), kind: 'apply', created_at: ago(31) },
+    { guild_id: '73', client_id: cid('pub'), kind: 'apply', created_at: ago(1.5) },
+  ];
+  PROJECT_MEMBERSHIPS = [
+    { client_id: cid('member'), github_id: MEMBER, membership_kind: 'member', joined_at: ago(10) },
+    { client_id: cid('pending'), github_id: MEMBER, membership_kind: 'pending', joined_at: ago(5) },
+    { client_id: cid('lapsed'), github_id: MEMBER, membership_kind: 'pending', joined_at: ago(40) },
+  ];
+  ECHOES = [
+    { github_id: MEMBER, client_id: cid('echoed'), applied_at: ago(2), guild_id: null },
+    { github_id: MEMBER, client_id: cid('stale-echo'), applied_at: ago(40), guild_id: null },
+  ];
+}
+
+// ===========================================================================
+// The interpreter
+// ===========================================================================
+
+let calls = [];
+let PARAMS = [];
+const P = (n) => PARAMS[Number(n) - 1];
+const norm = (s) => String(s).replace(/\s+/g, ' ').replace(/\( /g, '(').replace(/ \)/g, ')').trim();
+
+/**
+ * A row test built from a WHERE text: each [regex, make] term is consumed when
+ * it matches, then the residue must be pure conjunction and every placeholder
+ * in the text must have been inside a consumed term.
+ */
+function interpret(where, terms, label) {
+  let residue = where;
+  const consumed = new Set();
+  const tests = [];
+  for (const [re, make] of terms) {
+    const m = re.exec(residue);
+    if (!m) continue;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    for (const ph of m[0].matchAll(/\$(\d+)/g)) consumed.add(ph[1]);
+    tests.push(make(m));
+  }
+  for (const ph of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) throw new Error(`fake pool (${label}): unread predicate on $${ph[1]} in "${where}"`);
+  }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool (${label}): unmodelled boolean structure "${residue.trim()}" in "${where}"`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+// The naming rule's terms, on whatever the row calls its project.
+const naming = (get) => [
+  [/\bp\.status = 'active'/, () => (r) => get(r).status === 'active'],
+  [/\bbtrim\(coalesce\(p\.name, ''\)\) <> ''/, () => (r) => String(get(r).name || '').trim() !== ''],
+  [/\bbtrim\(coalesce\(p\.description, ''\)\) <> ''/, () => (r) => String(get(r).description || '').trim() !== ''],
+  [/\(p\.visibility_source = 'control-plane' OR p\.visibility_reported_at IS NOT NULL\)/,
+    () => (r) => get(r).visibility_source === 'control-plane' || get(r).visibility_reported_at != null],
+  [/\bp\.visibility = 'public'/, () => (r) => get(r).visibility === 'public'],
+];
+
+const ENG_FROM = 'platform_identity_guild_members m JOIN platform_identity_guilds g ON g.id = m.guild_id '
+  + 'JOIN platform_identity_guild_engagements e ON e.guild_id = m.guild_id '
+  + 'JOIN platform_identity_sso_clients c ON c.client_id = e.client_id '
+  + 'JOIN platform_identity_projects p ON p.origin = c.origin';
+const ENG_TERMS = [
+  [/NOT EXISTS \(SELECT 1 FROM platform_identity_project_memberships pm WHERE pm\.client_id = e\.client_id AND pm\.github_id = \$(\d+)::bigint AND \(pm\.membership_kind <> 'pending' OR pm\.joined_at > now\(\) - make_interval\(days => \$(\d+)::int\)\)\)/,
+    (m) => {
+      const who = String(P(m[1])); const days = Number(P(m[2]));
+      return (r) => !PROJECT_MEMBERSHIPS.some((pm) => pm.client_id === r.e.client_id && pm.github_id === who
+        && (pm.membership_kind !== 'pending' || pm.joined_at > Date.now() - days * DAY));
+    }],
+  [/NOT EXISTS \(SELECT 1 FROM platform_identity_application_echoes ae WHERE ae\.github_id = \$(\d+)::bigint AND ae\.client_id = e\.client_id AND ae\.applied_at > now\(\) - make_interval\(days => \$(\d+)::int\)\)/,
+    (m) => {
+      const who = String(P(m[1])); const days = Number(P(m[2]));
+      return (r) => !ECHOES.some((ae) => ae.github_id === who && ae.client_id === r.e.client_id && ae.applied_at > Date.now() - days * DAY);
+    }],
+  [/\bm\.github_id = \$(\d+)::bigint/, (m) => { const v = String(P(m[1])); return (r) => r.m.github_id === v; }],
+  [/\be\.created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/, (m) => { const d = Number(P(m[1])); return (r) => r.e.created_at > Date.now() - d * DAY; }],
+  [/\bc\.status = 'active'/, () => (r) => r.c.status === 'active'],
+  ...naming((r) => r.p),
+  [/\(e\.kind = 'apply' OR m\.joined_at <= e\.created_at\)/, () => (r) => r.e.kind === 'apply' || r.m.joined_at <= r.e.created_at],
+  [/\blower\(g\.slug\) = \$(\d+)/, (m) => { const v = String(P(m[1])); return (r) => r.g.slug.toLowerCase() === v; }],
+  [/\be\.client_id = \$(\d+)/, (m) => { const v = String(P(m[1])); return (r) => r.e.client_id === v; }],
+];
+const COLUMN = {
+  'g.slug': (r) => r.g.slug, 'g.name': (r) => r.g.name, 'g.id': (r) => r.g.id,
+  'e.kind': (r) => r.e.kind, 'e.created_at': (r) => new Date(r.e.created_at).toISOString(),
+  'p.name': (r) => r.p.name, 'p.origin': (r) => r.p.origin,
+};
+function project(selectList, r) {
+  // Every row also carries columns the statement never selected, so a response
+  // that spreads a row instead of whitelisting it leaks a sentinel.
+  const out = { client_id: r.e.client_id, guild_id: r.g.id, visibility: r.g.visibility };
+  for (const part of selectList.split(', ')) {
+    const [expr, alias] = part.split(' AS ');
+    if (!COLUMN[expr]) throw new Error(`fake pool: unknown column ${expr}`);
+    out[alias || expr.split('.')[1]] = COLUMN[expr](r);
+  }
+  return out;
+}
+
+const ACCT_TERMS = [
+  [/\bpa\.profile_state = 'active'/, () => (r) => r.a.profile_state === 'active'],
+  [/\bpa\.terms_accepted_at IS NOT NULL/, () => (r) => r.a.terms_accepted_at != null],
+  [/\bpa\.account_visibility = 'public'/, () => (r) => r.a.account_visibility === 'public'],
+];
+
+function upsertEngagement(guildId, clientId, kind) {
+  const hit = ENGAGEMENTS.find((e) => e.guild_id === String(guildId) && e.client_id === clientId && e.kind === kind);
+  if (hit) hit.created_at = Date.now();
+  else ENGAGEMENTS.push({ guild_id: String(guildId), client_id: clientId, kind, created_at: Date.now() });
+  return ENGAGEMENTS.find((e) => e.guild_id === String(guildId) && e.client_id === clientId && e.kind === kind);
+}
+const projectOf = (c) => PROJECT_ROWS.find((p) => p.origin === c.origin);
+
+let failNext = null;
+const pool = {
+  query: async (text, params = []) => {
+    const sql = norm(text);
+    calls.push({ sql, params });
+    PARAMS = params;
+    if (failNext && failNext.test(sql)) { failNext = null; throw new Error('the table is on fire'); }
+    let m;
+
+    // getAccount — the acting account.
+    if (/^SELECT .* FROM platform_identity_accounts WHERE github_id = \$1$/.test(sql)) {
+      return { rows: ACCOUNTS.filter((a) => a.github_id === String(params[0])) };
+    }
+    // getMembership — the caller's own row in the guild named by slug.
+    if ((m = /^SELECT g\.id, g\.slug, .* FROM platform_identity_guilds g JOIN platform_identity_guild_members m ON m\.guild_id = g\.id AND m\.github_id = \$2::bigint WHERE lower\(g\.slug\) = \$1$/.exec(sql))) {
+      const g = GUILDS.find((x) => x.slug === String(params[0]));
+      const mm = g && MEMBERS.find((x) => x.guild_id === g.id && x.github_id === String(params[1]));
+      return { rows: mm ? [{ ...g, ...mm, description: null, counted_in_totals: true }] : [] };
+    }
+    // getClient / getClientByOrigin.
+    if (/FROM platform_identity_sso_clients WHERE client_id = \$1$/.test(sql)) {
+      return { rows: CLIENTS.filter((c) => c.client_id === params[0]) };
+    }
+    if (/FROM platform_identity_sso_clients WHERE origin = \$1 AND status = 'active' ORDER BY id ASC LIMIT 1$/.test(sql)) {
+      return { rows: CLIENTS.filter((c) => c.origin === params[0] && c.status === 'active').slice(0, 1) };
+    }
+
+    // THE MEMBER-FACING READS (the inbox and the join's check): one shared shape.
+    if ((m = /^SELECT (.+?) FROM (platform_identity_guild_members m JOIN .+?) WHERE (.+?)(?: ORDER BY (.+?))? LIMIT (\$\d+|\d+)$/.exec(sql))
+      && /platform_identity_guild_engagements/.test(sql)) {
+      if (m[2] !== ENG_FROM) throw new Error(`fake pool: the engagement join moved — ${m[2]}`);
+      const keep = interpret(m[3], ENG_TERMS, 'engagements');
+      const joined = [];
+      for (const mm of MEMBERS) {
+        const g = GUILDS.find((x) => x.id === mm.guild_id);
+        for (const e of ENGAGEMENTS.filter((x) => x.guild_id === mm.guild_id)) {
+          const c = CLIENTS.find((x) => x.client_id === e.client_id);
+          const p = c && projectOf(c);
+          if (g && c && p) joined.push({ m: mm, g, e, c, p });
+        }
+      }
+      let rows = joined.filter(keep);
+      if (m[4]) {
+        if (m[4] !== 'e.created_at DESC, g.slug, e.kind') throw new Error(`fake pool: the inbox order moved — ${m[4]}`);
+        rows.sort((a, b) => (b.e.created_at - a.e.created_at) || a.g.slug.localeCompare(b.g.slug) || a.e.kind.localeCompare(b.e.kind));
+      }
+      const limit = /^\$/.test(m[5]) ? Number(P(m[5].slice(1))) : Number(m[5]);
+      rows = rows.slice(0, limit);
+      return { rows: rows.map((r) => project(m[1], r)) };
+    }
+
+    // fileEngagement — target CTE + the owner-gated upsert, ONE statement.
+    if ((m = /^WITH target AS \(SELECT c\.client_id, p\.name, p\.origin FROM platform_identity_sso_clients c JOIN platform_identity_projects p ON p\.origin = c\.origin WHERE (.+?)\), filed AS \(INSERT INTO platform_identity_guild_engagements AS e \(guild_id, client_id, kind\) SELECT g\.id, target\.client_id, 'apply' FROM platform_identity_guilds g CROSS JOIN target WHERE (.+?) ON CONFLICT \(guild_id, client_id, kind\) DO UPDATE SET created_at = now\(\) RETURNING e\.guild_id, e\.kind, e\.created_at\) SELECT g\.slug, g\.name AS guild_name, filed\.kind, filed\.created_at, target\.name AS project_name, target\.origin AS project_origin FROM filed JOIN platform_identity_guilds g ON g\.id = filed\.guild_id CROSS JOIN target$/.exec(sql))) {
+      const target = interpret(m[1], [
+        [/c\.client_id = \(SELECT c1\.client_id FROM platform_identity_sso_clients c1 WHERE (.+?) ORDER BY c1\.id ASC LIMIT 1\)/, (mm) => {
+          const inner = interpret(mm[1], [
+            [/\bc1\.origin = \$(\d+)/, (x) => { const v = P(x[1]); return (c) => c.origin === v; }],
+            [/\bc1\.status = 'active'/, () => (c) => c.status === 'active'],
+          ], 'target client');
+          const chosen = CLIENTS.filter(inner).sort((a, b) => a.id - b.id)[0];
+          return (r) => !!chosen && r.c.client_id === chosen.client_id;
+        }],
+        ...naming((r) => r.p),
+      ], 'filing target');
+      const gate = interpret(m[2], [
+        [/EXISTS \(SELECT 1 FROM platform_identity_guild_members o WHERE o\.guild_id = g\.id AND o\.github_id = \$(\d+)::bigint AND o\.membership_kind = 'owner'\)/, (x) => {
+          const who = String(P(x[1]));
+          return (r) => MEMBERS.some((o) => o.guild_id === r.g.id && o.github_id === who && o.membership_kind === 'owner');
+        }],
+        [/\bg\.id = \$(\d+)/, (x) => { const v = String(P(x[1])); return (r) => r.g.id === v; }],
+      ], 'filing gate');
+      const targets = CLIENTS.map((c) => ({ c, p: projectOf(c) })).filter((r) => r.p && target(r));
+      const rows = [];
+      for (const g of GUILDS) {
+        for (const t of targets) {
+          if (!gate({ g, t })) continue;
+          const e = upsertEngagement(g.id, t.c.client_id, 'apply');
+          rows.push({ slug: g.slug, guild_name: g.name, kind: e.kind, created_at: new Date(e.created_at).toISOString(),
+            project_name: t.p.name, project_origin: t.p.origin, client_id: t.c.client_id });
+        }
+      }
+      return { rows };
+    }
+
+    // inviteGuild — the guild, by slug, PUBLIC only.
+    if ((m = /^SELECT id, slug, name FROM platform_identity_guilds WHERE (.+)$/.exec(sql))) {
+      const keep = interpret(m[1], [
+        [/\blower\(slug\) = \$(\d+)/, (x) => { const v = String(P(x[1])); return (g) => g.slug === v; }],
+        [/\bvisibility = 'public'/, () => (g) => g.visibility === 'public'],
+      ], 'invite guild');
+      return { rows: GUILDS.filter(keep).map(({ visibility, ...g }) => g) };
+    }
+    // ... the `invited` write, naming-gated.
+    if ((m = /^INSERT INTO platform_identity_guild_engagements AS e \(guild_id, client_id, kind\) SELECT \$1::bigint, c\.client_id, 'invited' FROM platform_identity_sso_clients c JOIN platform_identity_projects p ON p\.origin = c\.origin WHERE (.+?) ON CONFLICT \(guild_id, client_id, kind\) DO UPDATE SET created_at = now\(\)$/.exec(sql))) {
+      const keep = interpret(m[1], [
+        [/EXISTS \(SELECT 1 FROM platform_identity_guilds pg WHERE pg\.id = \$(\d+) AND pg\.visibility = 'public'\)/, (x) => {
+          const v = String(P(x[1])); return () => GUILDS.some((g) => g.id === v && g.visibility === 'public');
+        }],
+        [/\bc\.client_id = \$(\d+)/, (x) => { const v = P(x[1]); return (r) => r.c.client_id === v; }],
+        [/\bc\.status = 'active'/, () => (r) => r.c.status === 'active'],
+        ...naming((r) => r.p),
+      ], 'invited write');
+      const hits = CLIENTS.map((c) => ({ c, p: projectOf(c) })).filter((r) => r.p && keep(r));
+      for (const r of hits) upsertEngagement(params[0], r.c.client_id, 'invited');
+      return { rows: [], rowCount: hits.length };
+    }
+    // ... the public roster the links go to.
+    if ((m = /^SELECT pa\.handle, pa\.display_name, pa\.github_login FROM platform_identity_guild_members m JOIN platform_identity_accounts pa ON pa\.github_id = m\.github_id WHERE (.+?) ORDER BY \(m\.membership_kind = 'owner'\) DESC, lower\(pa\.handle\) LIMIT \$(\d+)$/.exec(sql))) {
+      const keep = interpret(m[1], [
+        [/\bm\.guild_id = \$(\d+)/, (x) => { const v = String(P(x[1])); return (r) => r.m.guild_id === v; }],
+        [/\bm\.shown_publicly\b/, () => (r) => r.m.shown_publicly === true],
+        ...ACCT_TERMS,
+      ], 'invite roster');
+      const rows = MEMBERS.map((mm) => ({ m: mm, a: ACCOUNTS.find((a) => a.github_id === mm.github_id) })).filter(keep)
+        .sort((x, y) => (Number(y.m.membership_kind === 'owner') - Number(x.m.membership_kind === 'owner')) || x.a.handle.localeCompare(y.a.handle))
+        .slice(0, Number(P(m[2])))
+        .map((r) => ({ handle: r.a.handle, display_name: r.a.display_name, github_login: r.a.github_login, github_id: r.a.github_id }));
+      return { rows };
+    }
+
+    // recordApplication — the echo upsert; the SET clause is READ, not assumed.
+    if ((m = /^INSERT INTO platform_identity_application_echoes \(github_id, client_id, applied_at, guild_id\) VALUES \(\$1::bigint, \$2, now\(\), \$3::bigint\) ON CONFLICT \(github_id, client_id\) DO UPDATE SET (.+)$/.exec(sql))) {
+      const sets = m[1].split(', ');
+      for (const s of sets) {
+        if (!['applied_at = now()', 'guild_id = EXCLUDED.guild_id'].includes(s)) throw new Error(`fake pool: unmodelled echo SET ${s}`);
+      }
+      const [githubId, clientId, guildId] = params;
+      const hit = ECHOES.find((e) => e.github_id === String(githubId) && e.client_id === clientId);
+      if (!hit) ECHOES.push({ github_id: String(githubId), client_id: clientId, applied_at: Date.now(), guild_id: guildId });
+      else {
+        if (sets.includes('applied_at = now()')) hit.applied_at = Date.now();
+        if (sets.includes('guild_id = EXCLUDED.guild_id')) hit.guild_id = guildId;
+      }
+      return { rows: [] };
+    }
+
+    // echoGuildLabel — the membership requirement is a JOIN, so the join is read too.
+    if ((m = /^SELECT g\.slug, g\.name, g\.visibility FROM platform_identity_application_echoes ae (.+?) WHERE (.+?) LIMIT 1$/.exec(sql))) {
+      const joins = m[1];
+      if (!/^JOIN platform_identity_guilds g ON g\.id = ae\.guild_id\b/.test(joins)) throw new Error(`fake pool: the label join moved — ${joins}`);
+      const rest = joins.replace(/^JOIN platform_identity_guilds g ON g\.id = ae\.guild_id/, '').trim();
+      const mustBeMember = rest === 'JOIN platform_identity_guild_members m ON m.guild_id = ae.guild_id AND m.github_id = ae.github_id';
+      if (rest && !mustBeMember) throw new Error(`fake pool: unmodelled label join — ${rest}`);
+      const keep = interpret(m[2], [
+        [/\bae\.github_id = \$(\d+)::bigint/, (x) => { const v = String(P(x[1])); return (e) => e.github_id === v; }],
+        [/\bae\.client_id = \$(\d+)/, (x) => { const v = P(x[1]); return (e) => e.client_id === v; }],
+        [/\bae\.applied_at > now\(\) - make_interval\(days => \$(\d+)::int\)/, (x) => { const d = Number(P(x[1])); return (e) => e.applied_at > Date.now() - d * DAY; }],
+      ], 'echo label');
+      const rows = ECHOES.filter(keep)
+        .filter((e) => e.guild_id != null)
+        .filter((e) => !mustBeMember || MEMBERS.some((mm) => mm.guild_id === String(e.guild_id) && mm.github_id === e.github_id))
+        .map((e) => GUILDS.find((g) => g.id === String(e.guild_id)))
+        .filter(Boolean)
+        .map((g) => ({ slug: g.slug, name: g.name, visibility: g.visibility, id: g.id }));
+      return { rows: rows.slice(0, 1) };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql.slice(0, 160)}`);
+  },
+};
+
+// ===========================================================================
+// The routers, over the real domain, with the doorway pinned
+// ===========================================================================
+
+const api = require('../src/module-api.js');
+let session = { id: 1, github_id: OWNER, github_login: 'gowner-login' };
+api.pool = pool;
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+api.requireBuilder = (req, _res, next) => { req.builder = { ...session }; next(); };
+// The inviter gate's rank door, as project_invite_ownership.mjs stands it in: a
+// holder passes, anyone else gets the route's one refusal.
+api.requirePermission = (...required) => (req, res, next) => {
+  if (req.builder && req.builder.curate) return next();
+  return res.fail('permission_forbidden', {
+    status: 403, message: `missing permission: ${required.join(', ')} (floor: metic)`,
+    details: { required, held: [], floors: { [required[0]]: 'metic' } },
+  });
+};
+// Nobody owns a project through provisioning here, and no publish-identity port
+// exists: the join relays, and the inviter gate falls to the rank door.
+const realResolveOptional = api.resolveOptional;
+api.resolveOptional = (name) => (name === 'provisioning.projectOwnedBy' || name === 'provisioning.projectPublishIdentity'
+  ? null : realResolveOptional(name));
+
+const engagements = require('../modules/platform-identity/guild-engagements.js');
+const guilds = require('../modules/platform-identity/guilds.js');
+const { hallInviteUrl } = require('../modules/platform-identity/invite-notices.js');
+const { APPLICATION_ECHO_WINDOW_DAYS } = require('../modules/platform-identity/application-echo.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// The project's own admission surface, scripted; `relayed` records every relay.
+let relayed = [];
+let relayAnswer = { status: 201, body: { ok: true } };
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url, init) => {
+  if (String(url).endsWith('/api/bongos/access-requests')) {
+    relayed.push({ url: String(url), body: JSON.parse(init.body) });
+    return { status: relayAnswer.status, json: async () => relayAnswer.body };
+  }
+  throw new Error(`unexpected fetch: ${url}`);
+};
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', require('../modules/platform-identity/routes/guilds.js')());
+app.use('/api/bongos', require('../modules/platform-identity/routes/projects.js')());
+app.use('/api/bongos', require('../modules/platform-identity/routes/my-projects.js')());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const { port } = server.address();
+after(() => { server.close(); globalThis.fetch = realFetch; });
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* empty */ }
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+const as = (githubId, extra = {}) => { session = { id: Number(githubId), github_id: githubId, github_login: `${githubId}-login`, ...extra }; };
+const engagementWrites = () => calls.filter((c) => /INSERT INTO platform_identity_guild_engagements/.test(c.sql));
+
+beforeEach(() => { seed(); calls = []; relayed = []; relayAnswer = { status: 201, body: { ok: true } }; as(OWNER); });
+
+// ===========================================================================
+// 0. The instrument is calibrated before it is trusted
+// ===========================================================================
+
+test('the interpreter refuses what it cannot read: an unread placeholder, an unknown term, an AND turned OR', () => {
+  assert.throws(() => interpret('m.github_id = $1::bigint AND x = $2', ENG_TERMS, 't'), /unread predicate on \$2/);
+  assert.throws(() => interpret("m.github_id = $1::bigint AND g.visibility = 'public'", ENG_TERMS, 't'), /unmodelled boolean structure/);
+  assert.throws(() => interpret("m.github_id = $1::bigint OR c.status = 'active'", ENG_TERMS, 't'), /unmodelled boolean structure/,
+    'an OR must never be read as the conjunction it replaced');
+});
+
+// ===========================================================================
+// 1. The stored shape, and every statement agreeing with it
+// ===========================================================================
+
+const TABLE = MIGRATION.match(/CREATE TABLE IF NOT EXISTS platform_identity_guild_engagements \(([\s\S]*?)\n\);/)[1];
+const TABLE_COLUMNS = [...TABLE.matchAll(/^\s+([a-z_]+)\s+(?:bigint|text|timestamptz)/gm)].map((x) => x[1]);
+
+test('migration 030: the engagement table is (guild_id, client_id, kind, created_at) keyed on all three, no filer, no status', () => {
+  assert.deepEqual(TABLE_COLUMNS, ['guild_id', 'client_id', 'kind', 'created_at']);
+  assert.match(TABLE, /guild_id\s+bigint NOT NULL REFERENCES platform_identity_guilds\(id\) ON DELETE CASCADE,/,
+    'a dissolved guild takes its engagements with it (the ADR 0336 D2 no-tombstone reason)');
+  assert.match(TABLE, /kind\s+text NOT NULL CHECK \(kind IN \('apply', 'invited'\)\),/);
+  assert.match(TABLE, /PRIMARY KEY \(guild_id, client_id, kind\)/);
+  assert.doesNotMatch(TABLE, /\bstatus\b/, 'no status column: the hub holds no admission fact about someone else\'s project (ADR 0201 D1.3)');
+  assert.doesNotMatch(TABLE, /filed_by|filer|created_by|github_id/, 'no filer column, as the guild row keeps no creator');
+  assert.match(MIGRATION, /CREATE INDEX IF NOT EXISTS platform_identity_guild_engagements_client\s+ON platform_identity_guild_engagements \(client_id\);/);
+});
+
+test('migration 030: the echo gains a nullable guild_id that is SET NULL on dissolve; additive and idempotent', () => {
+  assert.match(MIGRATION, /ALTER TABLE platform_identity_application_echoes\s+ADD COLUMN IF NOT EXISTS guild_id bigint REFERENCES platform_identity_guilds\(id\) ON DELETE SET NULL;/);
+  const code = MIGRATION.replace(/^--.*$/gm, '');
+  assert.match(code, /^\s*BEGIN;[\s\S]*COMMIT;\s*$/, 'one transaction');
+  assert.doesNotMatch(code, /\bDROP\b|\bRENAME\b|ALTER COLUMN/i, 'additive only (ADR 0083 §5)');
+  assert.doesNotMatch(code, /\brole\b/, 'ADR 0174 reserves `role` for the crafts');
+  assert.ok(/COMMENT ON TABLE platform_identity_guild_engagements IS[\s\S]*No filer column[\s\S]*No status column[\s\S]*30-day window/.test(MIGRATION),
+    'the table comment states the three rules: no filer, no status, window read-time');
+});
+
+test('every engagement statement agrees with the migration: columns, conflict target, and kinds', () => {
+  const inserts = [...DOMAIN_SRC.matchAll(/INSERT INTO platform_identity_guild_engagements AS e \(([^)]*)\)[\s\S]*?ON CONFLICT \(([^)]*)\) DO UPDATE SET ([^\n`]*)/g)];
+  assert.equal(inserts.length, 2, 'two writers: the owner\'s apply and the project\'s invite');
+  for (const [, cols, conflict, set] of inserts) {
+    assert.deepEqual(cols.split(', '), ['guild_id', 'client_id', 'kind'], 'created_at comes from its default');
+    for (const c of cols.split(', ')) assert.ok(TABLE_COLUMNS.includes(c), `${c} is a real column`);
+    assert.equal(conflict, 'guild_id, client_id, kind', 'the conflict target IS the primary key');
+    assert.match(set.trim(), /^created_at = now\(\)/, 're-filing restarts the window and touches nothing else');
+  }
+  const kindsWritten = [...DOMAIN_SRC.matchAll(/target\.client_id, '(\w+)'|c\.client_id, '(\w+)'/g)].map((x) => x[1] || x[2]).sort();
+  assert.deepEqual(kindsWritten, ['apply', 'invited'], 'each writer writes exactly its own kind, both in the CHECK');
+  assert.equal(engagements.ENGAGEMENT_WINDOW_DAYS, 30, 'the 30-day read-time window (ADR 0365 D1)');
+});
+
+test('no statement reads or writes a status OF AN ENGAGEMENT or of the echo', () => {
+  const sqlOf = (src) => [...src.matchAll(/`([^`]*)`/g)].map((x) => x[1]).filter((s) => /platform_identity_/.test(s));
+  for (const s of sqlOf(DOMAIN_SRC)) {
+    assert.doesNotMatch(s, /\be\.status\b|\bae\.status\b/, 'an engagement and an echo have no status to read');
+    assert.doesNotMatch(s, /INSERT INTO platform_identity_guild_engagements[^(]*\([^)]*status/, 'nor one to write');
+  }
+  // The only statuses these statements read are the PROJECT's own catalog state —
+  // the naming rule (onMapSql) and the registration being live — never an outcome.
+  const statusReads = sqlOf(DOMAIN_SRC).flatMap((s) => [...s.matchAll(/\b(\w+)\.status\b/g)].map((x) => x[1]));
+  assert.ok(statusReads.every((a) => a === 'c' || a === 'c1'), `only the sso client's own status is spelled here: ${statusReads}`);
+  const echoWrite = ECHO_SRC.match(/INSERT INTO platform_identity_application_echoes \(([^)]*)\)[\s\S]*?ON CONFLICT \(([^)]*)\) DO UPDATE SET ([^`]*)`/);
+  assert.deepEqual(echoWrite[1].split(', '), ['github_id', 'client_id', 'applied_at', 'guild_id']);
+  for (const c of ['github_id', 'client_id', 'applied_at']) assert.match(ECHO_MIGRATION, new RegExp(`\\b${c}\\b`));
+  assert.equal(echoWrite[3].trim(), 'applied_at = now(), guild_id = EXCLUDED.guild_id',
+    'the most recent application decides the label — a solo re-apply clears it (ADR 0365 D1)');
+  assert.doesNotMatch(echoWrite[0], /\bstatus\b/);
+});
+
+// ===========================================================================
+// 2. Owner-only filing (D2)
+// ===========================================================================
+
+const fileApply = (slug, origin) => call('POST', `/api/bongos/guilds/${slug}/engagements`, { origin });
+
+test('the owner files "this guild is applying to P"; the answer is exactly the contract shape', async () => {
+  const res = await fileApply('guild-a', 'https://pub.example/');
+  assert.equal(res.status, 200);
+  assert.deepEqual(Object.keys(res.json), ['engagement']);
+  const e = res.json.engagement;
+  assert.deepEqual(Object.keys(e).sort(), ['created_at', 'guild', 'kind', 'project']);
+  assert.deepEqual(e.guild, { slug: 'guild-a', name: 'Guild A' });
+  assert.equal(e.kind, 'apply');
+  assert.deepEqual(e.project, { name: 'Project pub', origin: 'https://pub.example' });
+  assert.ok(!res.text.includes('SENTINEL'), 'client_id never crosses');
+  assert.equal(res.headers['cache-control'], 'no-store');
+  const write = engagementWrites()[0];
+  assert.deepEqual(write.params, ['71', OWNER, 'https://pub.example'], 'the guild, the SESSION, and the origin with its trailing slash trimmed');
+  assert.ok(!relayed.length, 'filing applies for nobody — the owner included (ADR 0365 D2)');
+  assert.ok(!ECHOES.some((x) => x.github_id === OWNER), 'and writes no echo');
+});
+
+test('the owner test lives INSIDE the INSERT: called straight at the domain, a non-owner files nothing', async () => {
+  const before = ENGAGEMENTS.length;
+  const out = await engagements.fileEngagement({ guildId: '71', githubId: MEMBER, origin: 'https://lapsed.example' }, { pool });
+  assert.equal(out, null, 'a member who skipped the route\'s pre-check still cannot file');
+  assert.equal(ENGAGEMENTS.length, before);
+  const filed = calls.find((c) => /INSERT INTO platform_identity_guild_engagements/.test(c.sql));
+  const insert = filed.sql.split('INSERT INTO platform_identity_guild_engagements')[1].split(' RETURNING ')[0];
+  assert.match(insert, /EXISTS \(SELECT 1 FROM platform_identity_guild_members o WHERE o\.guild_id = g\.id AND o\.github_id = \$2::bigint AND o\.membership_kind = 'owner'\)/,
+    'ownerExistsSql, re-asserted in the INSERT itself (guilds.js\'s shared fragment)');
+  assert.equal(filed.params[1], MEMBER);
+});
+
+test('a member who is not the owner is told plainly (403); a stranger gets the guild 404, byte-identical to no guild', async () => {
+  as(MEMBER);
+  const member = await fileApply('guild-a', 'https://pub.example');
+  assert.equal(member.status, 403);
+  assert.equal(member.json.error.code, 'guild_owner_only');
+  assert.equal(engagementWrites().length, 0, 'nothing reached the INSERT');
+
+  as(STRANGER);
+  const stranger = await fileApply('quiet-guild', 'https://pub.example');
+  const unknown = await fileApply('no-such-guild', 'https://pub.example');
+  assert.equal(stranger.status, 404);
+  assert.equal(stranger.json.error.code, 'guild_not_found');
+  assert.equal(stranger.text, unknown.text, 'a non-member cannot learn an unlisted guild exists');
+  assert.equal(engagementWrites().length, 0);
+});
+
+test('P unknown, inactive, private, stealth, dark matter or door-unknown: ONE byte-identical 404, and nothing written', async () => {
+  const bodies = [];
+  for (const origin of ['https://nowhere.example', 'https://dead.example', 'https://priv.example',
+    'https://stealth.example', 'https://dark.example', 'https://unreported.example']) {
+    const before = ENGAGEMENTS.map((e) => `${e.guild_id}|${e.client_id}|${e.kind}|${e.created_at}`).join();
+    const r = await fileApply('guild-a', origin);
+    assert.equal(r.status, 404, origin);
+    assert.equal(r.json.error.code, 'unknown_project');
+    assert.equal(ENGAGEMENTS.map((e) => `${e.guild_id}|${e.client_id}|${e.kind}|${e.created_at}`).join(), before, `${origin}: nothing written or restarted`);
+    bodies.push(r.text);
+  }
+  assert.equal(new Set(bodies).size, 1, 'no oracle: a private project and no project answer the same bytes (ADR 0365 D4)');
+});
+
+test('re-filing restarts the window rather than piling up a row', async () => {
+  const old = ENGAGEMENTS.find((e) => e.guild_id === '71' && e.client_id === cid('lapsed') && e.kind === 'apply');
+  const was = old.created_at;
+  await fileApply('guild-a', 'https://lapsed.example');
+  const rows = ENGAGEMENTS.filter((e) => e.guild_id === '71' && e.client_id === cid('lapsed') && e.kind === 'apply');
+  assert.equal(rows.length, 1);
+  assert.ok(rows[0].created_at > was);
+});
+
+test('the body is strict: a smuggled field is refused before any SQL', async () => {
+  const r = await call('POST', '/api/bongos/guilds/guild-a/engagements', { origin: 'https://pub.example', github_id: MEMBER });
+  assert.equal(r.status, 400);
+  assert.equal(calls.length, 0);
+});
+
+// ===========================================================================
+// 3. The inbox (GET /me/guild-engagements)
+// ===========================================================================
+
+const inbox = async (who) => { as(who); return call('GET', '/api/bongos/me/guild-engagements'); };
+const keyOf = (e) => `${e.guild.slug}|${e.project.origin.replace('https://', '').replace('.example', '')}|${e.kind}`;
+
+test('the inbox: my guilds only, inside the window, the naming rule, the exclusions — newest first, client_id never crossing', async () => {
+  const r = await inbox(MEMBER);
+  assert.equal(r.status, 200);
+  assert.equal(r.headers['cache-control'], 'no-store');
+  assert.deepEqual(r.json.engagements.map(keyOf), [
+    'quiet-guild|pub|apply',
+    'guild-a|pub|apply',
+    'guild-a|pub|invited',
+    'guild-a|lapsed|apply',
+    'guild-a|stale-echo|apply',
+  ]);
+  assert.equal(r.json.count, r.json.engagements.length, 'count is the array\'s own length');
+  for (const e of r.json.engagements) {
+    assert.deepEqual(Object.keys(e).sort(), ['created_at', 'guild', 'kind', 'project']);
+    assert.deepEqual(Object.keys(e.guild).sort(), ['name', 'slug']);
+    assert.deepEqual(Object.keys(e.project).sort(), ['name', 'origin']);
+  }
+  assert.ok(!r.text.includes('SENTINEL') && !/client_id|guild_id|visibility/.test(r.text),
+    'a literal whitelist: no client_id, no guild row id, no guild visibility');
+});
+
+test('the inbox drops every project it may not name, and each dropped row is in the world (not vacuous)', async () => {
+  const r = await inbox(MEMBER);
+  const seen = new Set(r.json.engagements.map((e) => e.project.origin));
+  for (const k of ['priv', 'stealth', 'dark', 'unreported', 'dead']) {
+    assert.ok(ENGAGEMENTS.some((e) => e.client_id === cid(k)), `${k} has an engagement row`);
+    assert.ok(!seen.has(`https://${k}.example`), `${k}: not on the map AND Public, so not named — and not shown anonymised either`);
+  }
+  assert.ok(!r.text.includes('Project priv') && !r.text.includes('priv.example'), 'a private project\'s invite reaches its own invitees and nobody else');
+  assert.ok(!seen.has('https://old.example'), 'a 31-day-old engagement has aged out (read-time)');
+  assert.ok(!r.json.engagements.some((e) => e.guild.slug === 'other-guild'), 'a guild I am not in is not mine to read');
+});
+
+test('the inbox excludes a project I build on, hold a LIVE invite notice for, or applied to inside the window — and only those', async () => {
+  const seen = new Set((await inbox(MEMBER)).json.engagements.map((e) => e.project.origin));
+  assert.ok(!seen.has('https://member.example'), 'already a member');
+  assert.ok(!seen.has('https://pending.example'), 'already invited (a live pending notice)');
+  assert.ok(!seen.has('https://echoed.example'), 'already applied (a live echo)');
+  assert.ok(seen.has('https://lapsed.example'), 'a LAPSED invite notice is no invite: the card shows');
+  assert.ok(seen.has('https://stale-echo.example'), 'an echo outside its window is no application: the card shows');
+  // the same rows for someone with no such history are all visible
+  const late = new Set((await inbox(LATE)).json.engagements.map((e) => e.project.origin));
+  for (const k of ['member', 'pending', 'echoed']) assert.ok(late.has(`https://${k}.example`), `${k} shows to a member with no history there`);
+});
+
+test('a member who joined AFTER a project invited the guild does not see that invite — but does see an apply', async () => {
+  const late = (await inbox(LATE)).json.engagements.map(keyOf);
+  assert.ok(late.includes('guild-a|pub|apply'), 'an apply engagement is for every member, whenever they joined');
+  assert.ok(!late.includes('guild-a|pub|invited'), 'nobody who joins later inherits the invite (ADR 0336 D7)');
+  assert.ok((await inbox(MEMBER)).json.engagements.map(keyOf).includes('guild-a|pub|invited'), 'control: an earlier member does');
+});
+
+test('the inbox statement carries every rule, bound to the session and the named constants', async () => {
+  await inbox(MEMBER);
+  const read = calls.find((c) => /FROM platform_identity_guild_members m JOIN platform_identity_guilds g/.test(c.sql));
+  assert.match(read.sql, /\(p\.status = 'active' AND \(btrim\(coalesce\(p\.name, ''\)\) <> '' AND btrim\(coalesce\(p\.description, ''\)\) <> ''\) AND \(p\.visibility_source = 'control-plane' OR p\.visibility_reported_at IS NOT NULL\)\) AND p\.visibility = 'public'/,
+    'the naming rule: onMapSql AND Public');
+  assert.match(read.sql, /\(e\.kind = 'apply' OR m\.joined_at <= e\.created_at\)/, 'the joined_at rule, invites only');
+  assert.match(read.sql, /NOT EXISTS \(SELECT 1 FROM platform_identity_project_memberships pm/, 'member / live-invite exclusion');
+  assert.match(read.sql, /NOT EXISTS \(SELECT 1 FROM platform_identity_application_echoes ae/, 'live-echo exclusion');
+  assert.deepEqual(read.params, [MEMBER, 30, api.inviteExpiry.INVITE_EXPIRY_DAYS, APPLICATION_ECHO_WINDOW_DAYS, guilds.LIST_MAX],
+    'the session, then each window by its own constant');
+  assert.doesNotMatch(read.sql.split(' FROM ')[0], /client_id/, 'client_id is not even selected');
+});
+
+test('a provisional account reads no inbox (the guild feature\'s consent floor)', async () => {
+  const r = await inbox(PROV);
+  assert.equal(r.status, 403);
+  assert.ok(!calls.some((c) => /platform_identity_guild_engagements/.test(c.sql)));
+});
+
+// ===========================================================================
+// 4. A project invites a guild (POST /projects/invite-guild)
+// ===========================================================================
+
+const CURATOR = '6001';
+const inviteGuild = (body) => call('POST', '/api/bongos/projects/invite-guild', body);
+
+test('a non-inviter gets POST /projects/invite\'s unchanged refusal, and no guild is read', async () => {
+  as(STRANGER);
+  const guildRefusal = await inviteGuild({ client_id: cid('pub'), guild: 'guild-a' });
+  const plainRefusal = await call('POST', '/api/bongos/projects/invite', { client_id: cid('pub'), github_login: 'x' });
+  assert.equal(guildRefusal.status, 403);
+  assert.equal(guildRefusal.text, plainRefusal.text, 'the same gate, the same bytes');
+  const missing = await inviteGuild({ client_id: 'no-such-client', guild: 'guild-a' });
+  assert.equal(missing.text, guildRefusal.text, 'identical whether or not the project exists');
+  assert.ok(!calls.some((c) => /platform_identity_guild/.test(c.sql)), 'the refusal reads no guild and no roster');
+});
+
+test('an UNLISTED guild is the unknown-guild 404, byte for byte, and writes nothing', async () => {
+  as(CURATOR, { curate: true });
+  const unlisted = await inviteGuild({ client_id: cid('pub'), guild: 'quiet-guild' });
+  const unknown = await inviteGuild({ client_id: cid('pub'), guild: 'no-such-guild' });
+  const malformed = await inviteGuild({ client_id: cid('pub'), guild: 'Not A Slug!' });
+  assert.equal(unlisted.status, 404);
+  assert.equal(unlisted.json.error.code, 'guild_not_found');
+  assert.equal(unlisted.text, unknown.text, 'an unlisted guild cannot be addressed (ADR 0365 D3)');
+  assert.equal(malformed.text, unknown.text);
+  assert.equal(engagementWrites().length, 0);
+  assert.ok(!calls.some((c) => /JOIN platform_identity_accounts pa/.test(c.sql)), 'and no roster is read');
+});
+
+test('an inactive project is the invite route\'s unknown_project 404', async () => {
+  as(CURATOR, { curate: true });
+  const r = await inviteGuild({ client_id: cid('dead'), guild: 'guild-a' });
+  assert.equal(r.status, 404);
+  assert.equal(r.json.error.code, 'unknown_project');
+  assert.equal(engagementWrites().length, 0);
+});
+
+test('a public guild: one hall link per member on its PUBLIC roster, the `invited` row recorded, the contract shape', async () => {
+  as(CURATOR, { curate: true });
+  const r = await inviteGuild({ client_id: cid('pub'), guild: 'Guild-A' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(Object.keys(r.json).sort(), ['count', 'guild', 'invited', 'invites']);
+  assert.equal(r.json.invited, false, 'the hub wrote no invite (ADR 0353)');
+  assert.deepEqual(r.json.guild, { slug: 'guild-a', name: 'Guild A' });
+  assert.equal(r.json.count, r.json.invites.length);
+  assert.deepEqual(r.json.invites.map((i) => i.handle), ['gowner', 'glate', 'gmember'],
+    'owner first, then by handle — the public roster exactly; private, unshown and provisional members are absent');
+  for (const i of r.json.invites) {
+    assert.deepEqual(Object.keys(i).sort(), ['display_name', 'handle', 'invite_url']);
+    const acct = ACCOUNTS.find((a) => a.handle === i.handle);
+    assert.equal(i.invite_url, hallInviteUrl('https://pub.example', acct.github_login), 'the project\'s own hall, the login pre-filled');
+  }
+  for (const hidden of [PRIV, SHY, PROV]) {
+    const a = ACCOUNTS.find((x) => x.github_id === hidden);
+    assert.ok(!r.text.includes(a.handle) && !r.text.includes(a.github_login), `${a.handle} is not on the public roster, so no link`);
+  }
+  assert.ok(!/github_id|SENTINEL/.test(r.text), 'no account id and no client_id cross');
+  assert.ok(ENGAGEMENTS.some((e) => e.guild_id === '71' && e.client_id === cid('pub') && e.kind === 'invited' && e.created_at > NOW),
+    'the invited engagement is recorded (re-inviting restarts its window)');
+  const roster = calls.find((c) => /JOIN platform_identity_accounts pa/.test(c.sql));
+  assert.match(roster.sql, /WHERE m\.guild_id = \$1 AND m\.shown_publicly AND \(\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\) AND pa\.account_visibility = 'public'\)/,
+    'shown_publicly AND accountVisibleSql — getPublicGuild\'s own roster predicate');
+  assert.deepEqual(roster.params, ['71', guilds.LIST_MAX], 'capped at the guild LIST_MAX');
+});
+
+test('a PRIVATE project may invite a guild\'s public roster, but leaves no notice for the members it could not see', async () => {
+  as(CURATOR, { curate: true });
+  ENGAGEMENTS = ENGAGEMENTS.filter((e) => e.client_id !== cid('priv'));
+  const r = await inviteGuild({ client_id: cid('priv'), guild: 'guild-a' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.count, 3, 'the inviter still gets the people it could see');
+  assert.ok(!ENGAGEMENTS.some((e) => e.client_id === cid('priv')),
+    'no `invited` row: nothing could surface later, even if P went public inside the window (ADR 0365 D4)');
+  const write = engagementWrites()[0];
+  assert.match(write.sql, /AND p\.visibility = 'public'/, 'the naming rule rides the INSERT itself');
+  assert.match(write.sql, /EXISTS \(SELECT 1 FROM platform_identity_guilds pg WHERE pg\.id = \$1 AND pg\.visibility = 'public'\)/,
+    'and the guild must still be public at the moment of writing');
+});
+
+// ===========================================================================
+// 5. The join: apply WITH a guild (POST /my-projects/join { guild })
+// ===========================================================================
+
+const joinWith = (origin, guild) => call('POST', '/api/bongos/my-projects/join', guild === undefined ? { origin } : { origin, guild });
+
+test('a guild that no longer resolves is a 409 guild_engagement_gone, and NOTHING is relayed or echoed', async () => {
+  as(MEMBER);
+  const cases = [
+    ['https://lapsed.example', 'other-guild'],   // a guild I am not in
+    ['https://old.example', 'guild-a'],          // aged out
+    ['https://priv.example', 'guild-a'],         // the project stopped being named
+    ['https://lapsed.example', 'Not A Slug!'],   // cannot even be a slug
+  ];
+  for (const [origin, guild] of cases) {
+    const r = await joinWith(origin, guild);
+    assert.equal(r.status, 409, `${origin} with ${guild}`);
+    assert.equal(r.json.error.code, 'guild_engagement_gone');
+  }
+  assert.equal(relayed.length, 0, 'the applicant chose to apply WITH the guild — the hub never files it without one');
+  assert.equal(ECHOES.length, 2, 'no echo written');
+});
+
+test('a later joiner cannot apply with an invite they never saw — the join and the inbox share one rule (no oracle)', async () => {
+  as(LATE);
+  ENGAGEMENTS = ENGAGEMENTS.filter((e) => !(e.guild_id === '71' && e.client_id === cid('pub') && e.kind === 'apply'));
+  const r = await joinWith('https://pub.example', 'guild-a');
+  assert.equal(r.status, 409, 'only the invited row is left, and LATE joined after it');
+  assert.equal(relayed.length, 0);
+});
+
+test('a guild that resolves is relayed as the caller\'s OWN application, and the echo carries the guild', async () => {
+  as(MEMBER);
+  const r = await joinWith('https://lapsed.example', 'guild-a');
+  assert.equal(r.status, 200);
+  assert.equal(r.json.status, 'requested');
+  assert.equal(relayed.length, 1);
+  assert.equal(relayed[0].body.github_login, `${MEMBER}-login`, 'the session\'s own login — nobody else\'s');
+  const check = calls.find((c) => /lower\(g\.slug\) = \$2/.test(c.sql));
+  assert.deepEqual(check.params, [MEMBER, 'guild-a', cid('lapsed'), 30], 'the session, the canonical slug, the resolved client');
+  const echo = ECHOES.find((e) => e.github_id === MEMBER && e.client_id === cid('lapsed'));
+  assert.equal(echo.guild_id, '71', 'the label the reviewer will see');
+  assert.ok(!r.text.includes('SENTINEL'));
+});
+
+test('a later SOLO application clears the label: the most recent application decides', async () => {
+  as(MEMBER);
+  await joinWith('https://lapsed.example', 'guild-a');
+  assert.equal(ECHOES.find((e) => e.client_id === cid('lapsed')).guild_id, '71');
+  await joinWith('https://lapsed.example');
+  assert.equal(ECHOES.find((e) => e.client_id === cid('lapsed')).guild_id, null);
+});
+
+test('an application the project REFUSED at the door leaves no echo, guild or not', async () => {
+  as(MEMBER);
+  relayAnswer = { status: 403, body: { error: { code: 'invite_only' } } };
+  const r = await joinWith('https://lapsed.example', 'guild-a');
+  assert.equal(r.json.status, 'invite_only');
+  assert.ok(!ECHOES.some((e) => e.client_id === cid('lapsed')));
+});
+
+// ===========================================================================
+// 6. The label the reviewer reads (echoGuildLabel; the route is proved in
+//    tests/applicant_profile_boundary.mjs)
+// ===========================================================================
+
+test('the label: { slug, name } while still a member, slug null for an unlisted guild, null once they left', async () => {
+  ECHOES.push({ github_id: MEMBER, client_id: cid('pub'), applied_at: ago(1), guild_id: '71' });
+  assert.deepEqual(await engagements.echoGuildLabel({ githubId: MEMBER, clientId: cid('pub') }, { pool }), { slug: 'guild-a', name: 'Guild A' });
+  ECHOES.find((e) => e.client_id === cid('pub')).guild_id = '72';
+  assert.deepEqual(await engagements.echoGuildLabel({ githubId: MEMBER, clientId: cid('pub') }, { pool }), { slug: null, name: 'Quiet Guild' },
+    'an unlisted guild has no public page for the reviewer to open');
+  ECHOES.push({ github_id: STRANGER, client_id: cid('pub'), applied_at: ago(1), guild_id: '71' });
+  assert.equal(await engagements.echoGuildLabel({ githubId: STRANGER, clientId: cid('pub') }, { pool }), null,
+    'an applicant who is not (or no longer) in the guild carries no label');
+  assert.equal(await engagements.echoGuildLabel({ githubId: 'system:bfg', clientId: cid('pub') }, { pool }), null);
+});
+
+test('nothing here is authority (ADR 0016): no rank, permission, credit or admission symbol in the domain', () => {
+  const code = DOMAIN_SRC.replace(/\/\/.*$/gm, '');
+  assert.doesNotMatch(code, /requireRank|requirePermission|total_credits|\bkarma\b|builders\.rank|access_requests/);
+});