@bongos/core 1.21.61 → 1.21.63

package/modules/lifecycle/merge-lock.js

@@ -10,7 +10,7 @@
 // ship-vs-merge-mode, and merge-mode-vs-merge-mode are all serialized.
 // (V3.R50 / #269, criterion C6.)
 //
-// The lock is a plain file at <repoRoot>/.git/otb-automerge.lock. We don't use
+// The lock is a plain file at <common git dir>/otb-automerge.lock (see lockPath). We don't use
 // flock(2): ships and merge runs happen on macOS, where flock over an
 // iCloud-synced filesystem is unreliable, and the holder may be a short-lived
 // CLI process (the manual /merge-mode case has no long-lived owner). The file
@@ -43,14 +43,54 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { execSync } = require('node:child_process');
+const { execSync, execFileSync } = require('node:child_process');
 
 const AUTO_STALE_MS = 10 * 60 * 1000; // crashed automated ship
 const MANUAL_STALE_MS = 30 * 60 * 1000; // operator walked away mid-merge-mode
 const INDEX_LOCK_GRACE_MS = 60 * 1000; // a git index.lock younger than this may be a LIVE op
 
+// lockPath — the lockfile lives in the repo's COMMON git dir (task 1004584).
+// When `main` is checked out in a LINKED worktree, <root>/.git is a FILE (a
+// `gitdir:` pointer), so the old <root>/.git/otb-automerge.lock was an ENOENT
+// on every acquire. The common dir is the same folder from every worktree, so
+// a ship from any of them and the merge-lock CLI all contend for ONE file.
+// A primary checkout (.git is a directory) short-circuits without spawning git;
+// when git cannot answer, the historical path is kept.
 function lockPath(repoRoot) {
-  return path.join(repoRoot, '.git', 'otb-automerge.lock');
+  return path.join(commonGitDir(repoRoot), 'otb-automerge.lock');
+}
+
+function isDir(p) {
+  try { return fs.statSync(p).isDirectory(); } catch (_) { return false; }
+}
+
+// Ask git for a path inside the repo's git dirs, absolute. `args` is the
+// rev-parse tail (['--git-common-dir'] or ['--git-path', 'index.lock']). Null
+// when the root is not a repo or git is unavailable.
+function gitRevParsePath(repoRoot, args) {
+  try {
+    const out = execFileSync('git', ['rev-parse', ...args], {
+      cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    if (!out) return null;
+    return path.isAbsolute(out) ? out : path.resolve(repoRoot, out);
+  } catch (_) {
+    return null;
+  }
+}
+
+function commonGitDir(repoRoot) {
+  const dotGit = path.join(repoRoot, '.git');
+  if (isDir(dotGit)) return dotGit;
+  return gitRevParsePath(repoRoot, ['--git-common-dir']) || dotGit;
+}
+
+// The worktree's OWN index.lock — per-worktree, so a linked main keeps it in
+// .git/worktrees/<name>/, not under the common dir.
+function indexLockPath(repoRoot) {
+  const dotGit = path.join(repoRoot, '.git');
+  if (isDir(dotGit)) return path.join(dotGit, 'index.lock');
+  return gitRevParsePath(repoRoot, ['--git-path', 'index.lock']) || path.join(dotGit, 'index.lock');
 }
 
 // Synchronous sleep without spawning a process (ship.js is execSync-style and
@@ -76,9 +116,11 @@ function pidAlive(pid) {
 }
 
 // Parse the lockfile into { pid, ts, mode } or null if absent/unreadable.
-function readLock(repoRoot) {
+// `file` lets a caller that already resolved lockPath skip re-resolving it (for
+// a linked worktree that is a git spawn per call).
+function readLock(repoRoot, file = lockPath(repoRoot)) {
   try {
-    const [p, t, m] = fs.readFileSync(lockPath(repoRoot), 'utf8').split('\n');
+    const [p, t, m] = fs.readFileSync(file, 'utf8').split('\n');
     const pid = parseInt(p, 10);
     const ts = parseInt(t, 10) || 0;
     const mode = m && m.trim() === 'manual' ? 'manual' : 'auto';
@@ -118,7 +160,7 @@ function recoverWorktree(repoRoot, { now = Date.now, runner = execSync } = {}) {
   //    live git process could still own it. A fresh lock means a live op
   //    (possibly a holder that just acquired after us); never yank that.
   try {
-    const lk = path.join(repoRoot, '.git', 'index.lock');
+    const lk = indexLockPath(repoRoot);
     const st = fs.statSync(lk); // throws ENOENT when absent → nothing to clear
     if (now() - st.mtimeMs > INDEX_LOCK_GRACE_MS) fs.unlinkSync(lk);
   } catch (_) {
@@ -176,7 +218,7 @@ function acquire(repoRoot, opts = {}) {
       return true;
     } catch (e) {
       if (e.code !== 'EEXIST') throw e;
-      const rec = readLock(repoRoot);
+      const rec = readLock(repoRoot, p); // p resolved once, before the loop
       if (isStale(rec, now())) {
         let reclaimed = false;
         try {
@@ -206,10 +248,11 @@ function acquire(repoRoot, opts = {}) {
 function release(repoRoot, opts = {}) {
   const { pid = process.pid, force = false } = opts;
   try {
-    const rec = readLock(repoRoot);
+    const file = lockPath(repoRoot);
+    const rec = readLock(repoRoot, file);
     if (!rec) return;
     if (force || rec.mode === 'manual' || rec.pid === pid) {
-      fs.unlinkSync(lockPath(repoRoot));
+      fs.unlinkSync(file);
     }
   } catch (_) {
     /* already gone */
@@ -251,6 +294,7 @@ module.exports = {
   MANUAL_STALE_MS,
   INDEX_LOCK_GRACE_MS,
   lockPath,
+  indexLockPath,
   pidAlive,
   readLock,
   isStale,

package/modules/lifecycle/ship-preflight.js

@@ -245,6 +245,31 @@ function cleanupMacFinderDupRefs(cwd) {
   return deleted;
 }
 
+// worktreeBlocks — `git worktree list --porcelain` as [{ dir, branch, bare }], in
+// git's order (the primary checkout first). Null when git can't answer. The one
+// parser behind findMainWorktree and findPrimaryWorktree.
+function worktreeBlocks(cwd) {
+  try {
+    const out = execSync('git worktree list --porcelain', {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return out.split('\n\n').filter(Boolean).map((block) => {
+      const wt = { dir: null, branch: null, bare: false };
+      for (const raw of block.split('\n')) {
+        const line = raw.trim();
+        if (line.startsWith('worktree ')) wt.dir = line.slice('worktree '.length);
+        else if (line.startsWith('branch refs/heads/')) wt.branch = line.slice('branch refs/heads/'.length);
+        else if (line === 'bare') wt.bare = true;
+      }
+      return wt;
+    });
+  } catch (_) {
+    return null; // not a git repo, or git not available — caller falls back
+  }
+}
+
 function findMainWorktree(cwd) {
   // The auto-merge in ship.js runs git on the worktree that has `main`
   // checked out. Feature work happens in linked worktrees under
@@ -260,28 +285,20 @@ function findMainWorktree(cwd) {
   //   branch refs/heads/claude/feature
   //
   // Returns the worktree path whose branch is `main`, or null if none.
-  try {
-    const out = execSync('git worktree list --porcelain', {
-      cwd,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    const blocks = out.split('\n\n').filter(Boolean);
-    for (const block of blocks) {
-      let dir = null;
-      let branch = null;
-      for (const line of block.split('\n')) {
-        if (line.startsWith('worktree ')) dir = line.slice('worktree '.length);
-        else if (line.startsWith('branch refs/heads/')) {
-          branch = line.slice('branch refs/heads/'.length);
-        }
-      }
-      if (branch === 'main' && dir) return dir;
-    }
-  } catch (_) {
-    // Not a git repo or git not available — caller will fall back.
-  }
-  return null;
+  const main = (worktreeBlocks(cwd) || []).find((wt) => wt.branch === 'main' && wt.dir);
+  return main ? main.dir : null;
+}
+
+// findPrimaryWorktree — the repo's primary checkout (the first block of
+// `git worktree list --porcelain`), whatever branch it is on. The fallback merge
+// target when NO worktree has `main` checked out (task 1004584): it is still the
+// instance's own checkout, so ship can say "this is on X, not main" instead of
+// falling back to the core package folder — which in a vendored instance is
+// node_modules/@bongos/core, not a repo at all. Null for a bare primary or when
+// git can't answer.
+function findPrimaryWorktree(cwd) {
+  const first = (worktreeBlocks(cwd) || [])[0];
+  return first && !first.bare && first.dir ? first.dir : null;
 }
 
 // task 932: post-ship working-tree CLOSE-OUT plan (pure). The mirror image of
@@ -308,5 +325,6 @@ module.exports = {
   cleanupMacFinderDupRefs,
   gitDirFor,
   findMainWorktree,
+  findPrimaryWorktree,
   closeoutPlan,
 };

package/modules/platform-identity/guilds.js

@@ -647,6 +647,37 @@ async function listGuildRequests({ guildId, ownerGithubId }, { pool = defaultPoo
   return { incoming, outgoing };
 }
 
+// The join requests waiting on the caller as an OWNER, across every guild they
+// own, in ONE statement (task 1004583): the hub's Invitations reads this rather
+// than one queue per owned guild. listGuildRequests' request leg keyed on the
+// caller instead of one guild — a requester floors on consent alone, the owner
+// test re-asserted per row — and its seen_at stamp. Each row names its guild.
+async function listOwnedRequests({ githubId }, { pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT r.id::text AS id, r.created_at, r.seen_at, g.slug, g.name, ${PERSON_COLUMNS}
+       FROM platform_identity_guild_requests r
+       JOIN platform_identity_guilds g ON g.id = r.guild_id
+       JOIN platform_identity_accounts pa ON pa.github_id = r.github_id
+      WHERE r.kind = 'request' AND r.status = 'pending'
+        AND r.created_at > now() - make_interval(days => $2::int)
+        AND ${ownerExistsSql('r.guild_id', '$1')}
+        AND ${accountActiveSql('pa')}
+      ORDER BY r.created_at DESC, r.id DESC
+      LIMIT $3`,
+    [githubId, REQUEST_EXPIRY_DAYS, LIST_MAX],
+  );
+  const unseen = rows.filter((r) => !r.seen_at).map((r) => r.id);
+  if (unseen.length) {
+    await pool.query(
+      `UPDATE platform_identity_guild_requests r SET seen_at = now()
+        WHERE r.id = ANY($1::bigint[]) AND r.kind = 'request' AND r.seen_at IS NULL
+          AND ${ownerExistsSql('r.guild_id', '$2')}`,
+      [unseen, githubId],
+    );
+  }
+  return rows.map(({ slug, name, ...r }) => ({ ...r, guild: { slug, name } }));
+}
+
 // ---------------------------------------------------------------------------
 // The public read (D4)
 // ---------------------------------------------------------------------------
@@ -707,5 +738,6 @@ module.exports = {
   cancelRequest,
   listMyRequests,
   listGuildRequests,
+  listOwnedRequests,
   getPublicGuild,
 };

package/modules/platform-identity/routes/guilds.js

@@ -12,6 +12,7 @@
 //   POST   /guilds                         create {slug, name, description?, visibility}
 //   GET    /me/guilds                      my guilds, with my own two switches
 //   GET    /me/guild-requests              invites to me (the card) + requests I sent
+//                                           + requests to the guilds I own (owner_incoming)
 //   GET    /guilds/:slug/members           the members' roster (members only; 404 else)
 //   PATCH  /guilds/:slug/membership        my switches {shown_publicly?, counted_in_totals?}
 //   DELETE /guilds/:slug/membership        leave (the owner transfers first, or is last and dissolves)
@@ -154,13 +155,19 @@ module.exports = function guildRoutes() {
   }));
 
   // rank: any-builder — MY queue: invites addressed to me, each carrying the
-  // card (the guild's current visibility, which an accept must echo back), and
-  // the join requests I sent. Stamps seen_at on the invites.
+  // card (the guild's current visibility, which an accept must echo back), the
+  // join requests I sent, and the join requests waiting on me as the owner of a
+  // guild, each naming its guild (task 1004583 — one read for the hub, never one
+  // per owned guild). Stamps seen_at on the invites and on those requests.
   router.get('/me/guild-requests', requireBuilder, handle('GET /me/guild-requests', 'guild_requests_read_failed', async (req, res) => {
     const me = await actingAccount(req.builder);
     if (me.fail) return res.fail(...me.fail);
     const { incoming, outgoing } = await guilds.listMyRequests({ githubId: me.githubId }, { pool });
-    res.json({ incoming, outgoing, incoming_count: incoming.length, outgoing_count: outgoing.length });
+    const ownerIncoming = await guilds.listOwnedRequests({ githubId: me.githubId }, { pool });
+    res.json({
+      incoming, outgoing, owner_incoming: ownerIncoming,
+      incoming_count: incoming.length, outgoing_count: outgoing.length, owner_incoming_count: ownerIncoming.length,
+    });
   }));
 
   // rank: any-builder — the members' roster, for members only (the own-scope

package/modules/public-landing/public/assets/cosmos.css

@@ -1325,13 +1325,39 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .mineJoinRow input::placeholder{color:var(--ink-faint);}
 .mineJoinNote{display:block;width:100%;box-sizing:border-box;margin-top:10px;min-height:64px;padding:12px 16px;font:inherit;font-size:14px;line-height:1.5;color:var(--ink);background:var(--bg-card);border:1px solid var(--ctl-line);border-radius:14px;resize:vertical;}
 .mineJoinNote::placeholder{color:var(--ink-faint);}
-/* the guild cards (task 1002303, R27): a second list under the invitations, one
-   hairline between the two when both have rows; each card's note waits behind
+/* the guild cards (task 1002303, R27): more lists under the invitations, one
+   hairline between any two that have rows; each card's note waits behind
    "Add a note", and its status line takes no room until it has something to say */
-.mineRows:not(:empty)+.mineRows .mineRow:first-child{border-top:1px solid var(--rule-soft);}
+.mineRows:not(:empty)~.mineRows .mineRow:first-child{border-top:1px solid var(--rule-soft);}
 .engageRow .mineJoinNote{max-width:62ch;}
 .engageRow .projMsg{margin-top:6px;min-height:0;}
 .engageRow .projMsg:empty{margin:0;}
+/* a guild's invite to you and a join request to your guild (task 1004583). The
+   invite carries the guild page's counted pair (guild.html's .aOpt voice, set
+   tighter for a row) with the D4.4 notice under it, said before accept. */
+.guildRow .projMsg{margin-top:6px;min-height:0;}
+.guildRow .projMsg:empty{margin:0;}
+/* the invite's buttons sit at its foot, after the notice they answer */
+.guildRow--invite .mineRow__actions{align-self:flex-end;}
+.guildRow__desc{margin:4px 0 0;font-size:14px;line-height:1.5;color:var(--ink-soft);max-width:62ch;}
+.guildCount{display:grid;gap:8px;margin-top:12px;max-width:66ch;}
+.guildCount__label{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);text-transform:uppercase;color:var(--ink-faint);}
+.guildCount__opts{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);}
+.guildCount__opt{position:relative;display:block;margin:0;padding:12px 16px 14px;border-left:1px solid var(--rule-soft);cursor:pointer;}
+.guildCount__opt:first-child{border-left:0;padding-left:0;}
+.guildCount__opt input{position:absolute;width:1px;height:1px;margin:0;overflow:hidden;clip-path:inset(50%);}
+.guildCount__opt>span{display:block;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+.guildCount__opt b{display:flex;align-items:center;gap:10px;margin-bottom:4px;font-family:var(--font-body);font-weight:500;font-size:14.5px;color:var(--ink);}
+.guildCount__opt b::before{content:"";width:7px;height:7px;border-radius:50%;border:1px solid var(--rule);background:var(--bg);flex:none;}
+.guildCount__opt:has(input:checked) b::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+.guildCount__opt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
+.guildCount__opt:has(input:disabled){cursor:default;}
+.guildCount__what{margin:0;font-size:13px;line-height:1.5;color:var(--ink-soft);max-width:70ch;}
+@media (max-width:480px){
+  .guildCount__opts{grid-template-columns:1fr;}
+  .guildCount__opt{padding:10px 0 12px;border-left:0;border-top:1px solid var(--rule-soft);}
+  .guildCount__opt:first-child{border-top:0;}
+}
 
 /* ── the ledger row: planet · name and chip · the facts · the rail · the
    doors. The planet and the doors are fixed widths; the three middle tracks

package/modules/public-landing/public/projects.html

@@ -963,11 +963,18 @@ summary{min-height:24px;padding:3px 0;}
           <section id="mineInvites" hidden aria-labelledby="mineInvitesH">
             <h2 id="mineInvitesH">Invitations</h2>
             <ul class="mineRows" id="invitesList"></ul>
+            <!-- a guild inviting you (task 1004583; ADR 0336 D4 §3, ADR 0337 D4.4):
+                 each card says, BEFORE you accept, that your numbers count toward the
+                 guild's rounded totals, and offers the switch right there. -->
+            <ul class="mineRows" id="guildInviteList"></ul>
             <!-- a guild you are in, engaging a project (task 1002303, R27; ADR 0365):
                  "G is applying to P" and "P invited G", from GET /me/guild-engagements.
                  Each card's Apply is the ordinary join request with `guild` added, so
                  you apply as yourself, never as the guild. -->
             <ul class="mineRows" id="engageList"></ul>
+            <!-- someone asking to join a guild you own (task 1004583): Accept / Decline.
+                 Their own counted switch rode their request, so this card has none. -->
+            <ul class="mineRows" id="guildRequestList"></ul>
           </section>
 
           <section aria-labelledby="mineBuildingH">
@@ -3689,10 +3696,12 @@ summary{min-height:24px;padding:3px 0;}
     paintInvitesSection();
   }
 
-  /* the Invitations section holds two lists — the projects' own invites and the
-     guild cards below — and shows while either has a row */
+  /* the Invitations section holds four lists — the projects' own invites, a
+     guild's invites to you, your guilds' engagements, and the join requests to a
+     guild you own — and shows while any of them has a row */
+  var INVITE_LISTS = ['invitesList', 'guildInviteList', 'engageList', 'guildRequestList'];
   function paintInvitesSection() {
-    $('mineInvites').hidden = !$('invitesList').children.length && !$('engageList').children.length;
+    $('mineInvites').hidden = !INVITE_LISTS.some(function (id) { return $(id).children.length; });
   }
 
   function loadInvites() {
@@ -3701,7 +3710,8 @@ summary{min-height:24px;padding:3px 0;}
         .then(function (res) { return res.ok ? res.json() : { invites: [] }; })
         .then(function (d) { renderInvitesList(d.invites || []); })
         .catch(function () { renderInvitesList([]); }),
-      loadEngagements()
+      loadEngagements(),
+      loadGuildQueue()
     ]);
   }
 
@@ -3826,6 +3836,286 @@ summary{min-height:24px;padding:3px 0;}
       .catch(function () { renderEngagements([]); });
   }
 
+  /* ── a guild inviting you, and a join request to a guild you own (task 1004583;
+     ADR 0336 D3/D4 §3, ADR 0337 D4.4) ──
+     GET /me/guild-requests names the invites addressed to you, each carrying its
+     card: the guild's name, description and CURRENT visibility. Accept echoes back
+     the visibility this card showed — the consent is to what the card said, so a
+     guild that changed since is a 409 and the card re-draws for a fresh decision —
+     and the counted_in_totals choice made on the card. The D4.4 notice is said for
+     the choice as it stands, BEFORE accept, in guild.html's own words (the test
+     holds the two pages to one sentence). The guilds you OWN answer their join
+     requests here too, from the same read's owner_incoming — one request for
+     every guild you own, never one per guild. The requester's own switch rode
+     their request, so the owner's card has none. A decline is silent on both sides (204, the other side is never
+     told). textContent / createElement only. Proof: tests/hub_guild_cards.mjs */
+  var GUILD_COUNTED_ON = 'Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. ' +
+    'They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. ' +
+    'Leave them out of any guild you’d rather not share them with.';
+  var GUILD_COUNTED_OFF = 'Your numbers are left out of this guild’s totals, from its next weekly count.';
+  var GUILD_SHOWN = {
+    public: 'It’s public: joining lists your name and picture on its page while your account is public. You can turn that off there.',
+    unlisted: 'It’s unlisted: it has no public page, so joining lists you nowhere.'
+  };
+  var GUILD_OFFLINE = 'Couldn’t reach the platform — check your connection and try again.';
+  /* a POST on the cookie session; a 204 (decline) has no body to read */
+  function guildPost(path, body) {
+    var init = { method: 'POST', credentials: 'same-origin' };
+    if (body) { init.headers = { 'Content-Type': 'application/json' }; init.body = JSON.stringify(body); }
+    return fetch(API + path, init).then(function (res) {
+      return (res.status === 204 ? Promise.resolve({}) : jsonOrEmpty(res)).then(function (data) {
+        return { ok: res.ok, status: res.status, data: data };
+      });
+    });
+  }
+  function guildButton(label, cls) {
+    var b = document.createElement('button');
+    b.type = 'button';
+    b.className = cls;
+    b.textContent = label;
+    return b;
+  }
+  /* the row's status line, quiet until it has something to say */
+  function guildMsg(main) {
+    var msg = mineEl('p', 'projMsg');
+    msg.setAttribute('role', 'status');
+    msg.setAttribute('aria-live', 'polite');
+    main.appendChild(msg);
+    return msg;
+  }
+  /* Decline: silent to the other side. The row goes; a failure keeps it and says so. */
+  function guildDecline(row, id, btns, msg) {
+    btns.forEach(function (b) { b.disabled = true; });
+    msg.className = 'projMsg';
+    msg.textContent = '';
+    guildPost('/guild-requests/' + encodeURIComponent(id) + '/decline').then(function (res) {
+      if (res.ok) { row.remove(); paintInvitesSection(); return; }
+      btns.forEach(function (b) { b.disabled = false; });
+      if (res.status === 401) { sessionExpired(msg); return; }
+      msg.className = 'projMsg err';
+      msg.textContent = res.status === 404 ? 'That has already been answered, or it ran out.' : 'Couldn’t decline just now — try again in a moment.';
+    }).catch(function () {
+      btns.forEach(function (b) { b.disabled = false; });
+      msg.className = 'projMsg err';
+      msg.textContent = GUILD_OFFLINE;
+    });
+  }
+
+  function guildInviteRow(inv) {
+    var name = inv.name || inv.slug;
+    var vis = inv.visibility;
+    var row = mineRow({ name: 'You’re invited to join ' + name });
+    row.className = 'mineRow guildRow guildRow--invite';
+    var main = row.querySelector('.mineRow__main');
+    if (inv.description) {
+      var desc = mineEl('p', 'guildRow__desc');
+      desc.textContent = inv.description;
+      main.appendChild(desc);
+    }
+    var shown = mineEl('p', 'mineRow__hint');
+    main.appendChild(shown);
+    /* the counted switch — the guild page's pair, in its words, defaulting on as
+       the membership does; the notice under it is said for the choice as it stands */
+    var band = mineEl('div', 'guildCount');
+    var label = mineEl('span', 'guildCount__label');
+    label.id = 'guildCount-' + inv.id;
+    label.textContent = 'In this guild’s totals';
+    band.appendChild(label);
+    var group = mineEl('div', 'guildCount__opts');
+    group.setAttribute('role', 'radiogroup');
+    group.setAttribute('aria-labelledby', label.id);
+    var radios = [['on', 'Count my numbers', 'They add to this guild’s totals.'], ['off', 'Leave them out', 'The totals add up everyone else.']].map(function (o) {
+      var opt = mineEl('label', 'guildCount__opt');
+      var input = document.createElement('input');
+      input.type = 'radio';
+      input.name = 'guildCounted-' + inv.id;
+      input.value = o[0];
+      input.checked = o[0] === 'on';
+      var text = mineEl('span');
+      var b = mineEl('b');
+      b.textContent = o[1];
+      text.appendChild(b);
+      text.appendChild(document.createTextNode(o[2]));
+      opt.appendChild(input);
+      opt.appendChild(text);
+      group.appendChild(opt);
+      return input;
+    });
+    band.appendChild(group);
+    var what = mineEl('p', 'guildCount__what');
+    band.appendChild(what);
+    main.appendChild(band);
+    var msg = guildMsg(main);
+    function counted() { return !radios[1].checked; }
+    function paintWhat() { what.textContent = counted() ? GUILD_COUNTED_ON : GUILD_COUNTED_OFF; }
+    radios.forEach(function (r) { r.addEventListener('change', paintWhat); });
+    paintWhat();
+
+    var actions = mineEl('div', 'mineRow__actions');
+    var page = document.createElement('a');
+    page.className = 'linklike';
+    page.href = '/g/' + encodeURIComponent(inv.slug);
+    page.textContent = 'See its page';
+    function paintShown() { shown.textContent = GUILD_SHOWN[vis]; page.hidden = vis !== 'public'; }
+    paintShown();
+    var accept = guildButton('Accept', 'btn small');
+    var decline = guildButton('Decline', 'btn small ghost');
+    function idle() {
+      accept.disabled = false;
+      decline.disabled = false;
+      accept.textContent = 'Accept';
+    }
+    /* an invite that is gone (withdrawn, run out, answered elsewhere) cannot be
+       answered again: say so and leave nothing pressable */
+    function ended() {
+      accept.hidden = true;
+      decline.hidden = true;
+      radios.forEach(function (r) { r.disabled = true; });
+      msg.className = 'projMsg';
+      msg.textContent = 'That invite has ended — it was withdrawn, or it ran out.';
+    }
+    accept.addEventListener('click', function () {
+      var on = counted();
+      accept.disabled = true;
+      decline.disabled = true;
+      accept.textContent = 'Joining…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      guildPost('/guild-requests/' + encodeURIComponent(inv.id) + '/accept', { visibility: vis, counted_in_totals: on }).then(function (res) {
+        if (res.ok) {
+          /* no longer pressable, so no longer the accent (the One Warm Thing rule) */
+          accept.className = 'btn small ghost';
+          accept.textContent = 'Joined';
+          decline.hidden = true;
+          radios.forEach(function (r) { r.disabled = true; });
+          page.hidden = false;
+          msg.className = 'projMsg ok';
+          msg.textContent = 'You’ve joined ' + name + (on ? ', and your numbers count toward its totals.' : ', and your numbers are left out of its totals.');
+          return;
+        }
+        if (res.status === 401) { idle(); sessionExpired(msg); return; }
+        var err = apiError(res.data, res.status);
+        if (res.status === 409 && err.code === 'guild_visibility_changed' && err.details && GUILD_SHOWN[err.details.visibility]) {
+          vis = err.details.visibility;
+          paintShown();
+          idle();
+          msg.className = 'projMsg err';
+          msg.textContent = 'This guild changed since the card was drawn: it’s ' + vis + ' now. Read it again, then accept.';
+          return;
+        }
+        if (res.status === 404) { ended(); return; }
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t accept just now — try again in a moment.';
+      }).catch(function () {
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = GUILD_OFFLINE;
+      });
+    });
+    decline.addEventListener('click', function () { guildDecline(row, inv.id, [accept, decline], msg); });
+    actions.appendChild(page);
+    actions.appendChild(accept);
+    actions.appendChild(decline);
+    row.appendChild(actions);
+    return row;
+  }
+  /* a row id is a bigserial (digits, within the bigint range the route checks);
+     a card with no id, no slug or a visibility this page cannot say is dropped
+     rather than drawn with a button that fails */
+  function guildRowId(r) {
+    return !!r && typeof r.id === 'string' && /^\d{1,19}$/.test(r.id) && (r.id.length < 19 || r.id <= '9223372036854775807');
+  }
+  function renderGuildInvites(rows) {
+    var ul = $('guildInviteList');
+    ul.textContent = '';
+    (rows || []).forEach(function (inv) {
+      if (!guildRowId(inv) || typeof inv.slug !== 'string' || !inv.slug || !GUILD_SHOWN[inv.visibility]) return;
+      ul.appendChild(guildInviteRow(inv));
+    });
+    paintInvitesSection();
+  }
+
+  function guildRequestRow(r) {
+    var who = r.display_name || '@' + r.handle;
+    var row = mineRow({ name: who + ' asked to join ' + (r.guild.name || r.guild.slug) });
+    row.className = 'mineRow guildRow';
+    var main = row.querySelector('.mineRow__main');
+    /* the handle under a display name, never twice */
+    if (r.display_name) {
+      var handle = mineEl('span', 'mineRow__host');
+      handle.textContent = '@' + r.handle;
+      main.appendChild(handle);
+    }
+    var hint = mineEl('p', 'mineRow__hint');
+    hint.textContent = 'Accepting makes them a member. A decline is never told to them.';
+    main.appendChild(hint);
+    var msg = guildMsg(main);
+    var actions = mineEl('div', 'mineRow__actions');
+    var accept = guildButton('Accept', 'btn small');
+    var decline = guildButton('Decline', 'btn small ghost');
+    accept.addEventListener('click', function () {
+      accept.disabled = true;
+      decline.disabled = true;
+      accept.textContent = 'Accepting…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      guildPost('/guild-requests/' + encodeURIComponent(r.id) + '/accept').then(function (res) {
+        if (res.ok) {
+          accept.className = 'btn small ghost';
+          accept.textContent = 'Accepted';
+          decline.hidden = true;
+          hint.hidden = true;
+          msg.className = 'projMsg ok';
+          msg.textContent = who + ' is in ' + (r.guild.name || r.guild.slug) + ' now.';
+          return;
+        }
+        accept.textContent = 'Accept';
+        if (res.status === 404) {
+          accept.hidden = true;
+          decline.hidden = true;
+          msg.className = 'projMsg';
+          msg.textContent = 'That request has ended — it was withdrawn, it ran out, or their account is closed.';
+          return;
+        }
+        accept.disabled = false;
+        decline.disabled = false;
+        if (res.status === 401) { sessionExpired(msg); return; }
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t accept just now — try again in a moment.';
+      }).catch(function () {
+        accept.disabled = false;
+        decline.disabled = false;
+        accept.textContent = 'Accept';
+        msg.className = 'projMsg err';
+        msg.textContent = GUILD_OFFLINE;
+      });
+    });
+    decline.addEventListener('click', function () { guildDecline(row, r.id, [accept, decline], msg); });
+    actions.appendChild(accept);
+    actions.appendChild(decline);
+    row.appendChild(actions);
+    return row;
+  }
+  function renderGuildRequests(rows) {
+    var ul = $('guildRequestList');
+    ul.textContent = '';
+    (rows || []).forEach(function (r) {
+      if (!guildRowId(r) || typeof r.handle !== 'string' || !r.handle) return;
+      if (!r.guild || typeof r.guild.slug !== 'string' || !r.guild.slug) return;
+      ul.appendChild(guildRequestRow(r));
+    });
+    paintInvitesSection();
+  }
+  /* ONE read for both lists: the invites to you, and the requests waiting on you
+     as the owner of a guild; a read that fails is silent, as the other lists' are */
+  function loadGuildQueue() {
+    return fetch(API + '/me/guild-requests', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : {}; })
+      .then(function (d) { renderGuildInvites(d.incoming || []); renderGuildRequests(d.owner_incoming || []); })
+      .catch(function () { renderGuildInvites([]); renderGuildRequests([]); });
+  }
+
   /* the one relay both the map's per-card Apply (submitApply) and the
      address-typed join field drive — POST /my-projects/join, the 401 case and
      the 'requested' echo update kept in ONE place (task 1003774). Keys the