@bongos/core 1.21.62 → 1.21.63

package/tests/guilds_api.mjs

@@ -578,6 +578,37 @@ test('the owner\'s invite list names only invitees THIS owner could address (a t
     'public, or connected to the viewing owner — the addressableAccount rule, reusing the one symmetric-edge fragment');
 });
 
+test('GET /me/guild-requests carries the requests to EVERY guild I own in one statement keyed on the session, each naming its guild (task 1004583)', async () => {
+  const OWNED = (t) => /WHERE r\.kind = 'request' AND r\.status = 'pending'/.test(t);
+  on(base((t) => (OWNED(t) && /^\s*SELECT/.test(t)
+    ? result([{ id: '601', created_at: 'c', seen_at: null, slug: 'night-shift', name: 'Night Shift', handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null },
+      { id: '602', created_at: 'c', seen_at: 's', slug: 'lamp-room', name: 'Lamp Room', handle: 'kai-lowe', display_name: null, avatar_url: null }])
+    : null)));
+  const res = await call('GET', '/api/bongos/me/guild-requests');
+  assert.equal(res.status, 200);
+  assert.equal(res.headers['cache-control'], 'no-store');
+  assert.deepEqual(res.json.owner_incoming[0], { id: '601', created_at: 'c', seen_at: null, handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null, guild: { slug: 'night-shift', name: 'Night Shift' } });
+  assert.equal(res.json.owner_incoming_count, res.json.owner_incoming.length);
+  assert.equal(res.json.incoming_count, res.json.incoming.length, 'the invite half is unchanged');
+
+  const reads = calls.filter((c) => OWNED(c.text) && /^\s*SELECT/.test(c.text));
+  assert.equal(reads.length, 1, 'one statement for every guild I own — never one per guild');
+  const [read] = reads;
+  assert.equal(read.params[0], ME, 'keyed on the SESSION’s github_id');
+  assert.equal(read.params[2], guilds.LIST_MAX, 'capped as every queue is');
+  assert.ok(read.text.includes(require('../modules/platform-identity/account-visibility.js').accountActiveSql('pa')),
+    'a requester floors on an active account, as the per-guild queue does');
+  assert.match(read.text, /o\.guild_id = r\.guild_id AND o\.github_id = \$1::bigint\s+AND o\.membership_kind = 'owner'/, 'the owner test, per row, in the statement');
+  assert.match(read.text, /JOIN platform_identity_accounts pa ON pa\.github_id = r\.github_id/);
+  assert.doesNotMatch(read.text, /github_login|pa\.github_id AS|r\.github_id AS/, 'no GitHub identity leaves the module');
+  assert.match(read.text, /pa\.handle, pa\.display_name, pa\.avatar_url/, 'the person columns a guild list carries, no more');
+
+  const stamp = calls.find((c) => /^\s*UPDATE platform_identity_guild_requests r SET seen_at = now\(\)/.test(c.text));
+  assert.ok(stamp, 'the unseen request is stamped, as the per-guild read stamps it');
+  assert.deepEqual(stamp.params, [['601'], ME], 'only the unseen row, by the same owner');
+  assert.match(stamp.text, /r\.kind = 'request'[\s\S]*o\.github_id = \$2::bigint\s+AND o\.membership_kind = 'owner'/, 'the stamp re-asserts the owner test');
+});
+
 // ===========================================================================
 // 7. Nothing here is authority; counts are lengths
 // ===========================================================================

package/tests/guilds_db.mjs

@@ -160,6 +160,13 @@ try {
     'the requester\'s own counted_in_totals choice rides the request — the owner cannot override it');
 
   ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'created', 'Bob asks');
+  const ownerQ = await guilds.listOwnedRequests({ githubId: OWNER }, { pool });
+  const bobAsk = ownerQ.find((r) => r.handle === 'r24bob');
+  ok(bobAsk && bobAsk.guild.slug === 'r24-pub' && !('github_id' in bobAsk) && !('kind' in bobAsk),
+    'the owner\'s ONE read across every guild they own carries Bob\'s request, naming its guild, by handle never github_id (task 1004583)');
+  ok((await guilds.listOwnedRequests({ githubId: ALICE }, { pool })).every((r) => r.guild.slug !== 'r24-pub'),
+    'a member who is not the owner reads none of its requests (the owner gate is in the statement)');
+  ok((await openRows('r24-pub', BOB))[0].seen_at !== null, 'reading it stamps seen_at on the request, as the per-guild queue does');
   ok(await guilds.declineRequest({ id: await pendingId('r24-pub', BOB), githubId: OWNER }, { pool }), 'the owner declines');
   const before = (await openRows('r24-pub', BOB)).length;
   ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'swallowed',

package/tests/hub_engagement_cards.mjs

@@ -37,11 +37,13 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
-// the rows region: mineEl/mineRow, the two lists, the section, and the guild cards
+// the rows region: mineEl/mineRow, the lists, the section, and the guild cards —
+// through the guild invite and request cards (task 1004583), which loadInvites
+// also reads; tests/hub_guild_cards.mjs drives those
 const START = SCRIPT.indexOf('  function mineEl(tag, cls)');
-const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadEngagements() {')) + 5;
+const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadGuildQueue() {')) + 5;
 assert.ok(START > 0, 'the region starts at mineEl');
-assert.ok(END > START, 'and ends with loadEngagements');
+assert.ok(END > START, 'and ends with loadGuildQueue');
 const REGION = SCRIPT.slice(START, END);
 for (const fn of ['function mineRow(', 'function renderInvitesList(', 'function paintInvitesSection(', 'function loadInvites(',
   'function engageLine(', 'function engageRow(', 'function renderEngagements(', 'function loadEngagements(']) {
@@ -81,7 +83,7 @@ const REQUESTED = { ok: true, status: 200, body: { ok: true, status: 'requested'
 
 function boot({ answers = [] } = {}) {
   const ids = new Map();
-  for (const id of ['mineInvites', 'invitesList', 'engageList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
+  for (const id of ['mineInvites', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
   ids.get('mineInvites').hidden = true;
   const requests = [];
   const queued = answers.slice();
@@ -173,7 +175,8 @@ test('loadInvites reads both lists, and a guild read that fails is silent', asyn
   ] });
   await ui.sandbox.loadInvites();
   await ui.settle();
-  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(), ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/my-projects/invites']);
+  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(),
+    ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/me/guild-requests', 'GET /api/bongos/my-projects/invites']);
   for (const r of ui.requests) assert.equal(r.credentials, 'same-origin', 'own-scope reads, on the cookie session');
   assert.equal(ui.cards().length, 0);
   assert.equal(ui.section().hidden, true);
@@ -291,7 +294,7 @@ test('the cards are a real list inside the Invitations section, built with creat
   assert.doesNotMatch(CARDS, /innerHTML|insertAdjacentHTML|outerHTML/, 'no markup built from strings');
   assert.match(SCRIPT, /if \(v === 'mine' && me\) \{ refreshList\(\); loadMemberships\(\); loadInvites\(\); \}/, 'the mine view re-reads both lists on entry, through loadInvites');
   const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
-  assert.match(COSMOS, /\.mineRows:not\(:empty\)\+\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between the two lists when both have rows');
+  assert.match(COSMOS, /\.mineRows:not\(:empty\)~\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between any two lists that have rows');
   assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>')), /engageRow/, 'styled in cosmos.css, not in the page head');
 });
 

package/tests/hub_guild_cards.mjs

@@ -0,0 +1,392 @@
+// tests/hub_guild_cards.mjs — a guild's invite to you and a join request to a guild
+// you own, in /projects?view=mine's Invitations, EXECUTED (task 1004583; ADR 0336
+// D3/D4 §3, ADR 0337 D4.4).
+//
+// R24 (task 1002300) shipped the routes — GET /me/guild-requests, POST
+// /guild-requests/:id/accept|decline, GET /guilds/:slug/requests — and nothing in
+// any UI called them. These cards do. What this pins:
+//   • an invite card tells the member, BEFORE they accept, that their numbers count
+//     toward the guild's rounded totals, in guild.html's own words (the two pages
+//     are held to one sentence here), and offers the counted switch right there;
+//     picking "Leave them out" repaints the notice and sends nothing
+//   • it says what joining shows (a public guild lists you; an unlisted one has no
+//     page) and links a public guild's page only
+//   • Accept sends exactly { visibility (the card's), counted_in_totals } on the
+//     cookie session; a 409 guild_visibility_changed re-draws the card for the
+//     guild as it is now, and the next accept sends that
+//   • an ended invite or request leaves nothing pressable; an expired session and a
+//     dead network are said as such, and the card stays re-tryable
+//   • Decline is a body-less POST whose 204 drops the row (the section hides with
+//     its last row); a failure keeps the row and says so
+//   • the owner's card names who asked, with the handle once, and accepts with no
+//     body — the requester's switch rode their request
+//   • ONE read feeds both lists — GET /me/guild-requests's incoming and
+//     owner_incoming — never one request per guild you own; a failed read is silent
+//   • a row the page cannot answer is dropped, never drawn with a button that fails
+//   • textContent / createElement only
+//
+// The idiom is tests/hub_engagement_cards.mjs: lift the region out of
+// projects.html, run it in a node:vm under a DOM stub, drive real clicks, and
+// assert the slice boundaries so a rename can never leave this executing nothing.
+//
+// DB-free. Run:  node --test tests/hub_guild_cards.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const GUILD_PAGE = fs.readFileSync(path.join(LANDING, 'guild.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// the rows region, mineEl through the guild cards' loaders
+const START = SCRIPT.indexOf('  function mineEl(tag, cls)');
+const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadGuildQueue() {')) + 5;
+assert.ok(START > 0, 'the region starts at mineEl');
+assert.ok(END > START, 'and ends with loadGuildQueue');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function paintInvitesSection(', 'function sessionExpired(', 'function guildPost(', 'function guildDecline(',
+  'function guildInviteRow(', 'function renderGuildInvites(', 'function guildRequestRow(', 'function renderGuildRequests(',
+  'function loadGuildQueue(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+const CARDS = REGION.slice(REGION.indexOf('var GUILD_COUNTED_ON'));
+assert.ok(CARDS.length > 1000, 'the guild cards are findable');
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+function el(tag) {
+  const n = { tag, children: [], _text: '', className: '', hidden: false, disabled: false, checked: false, value: '', attrs: {}, _on: {}, parent: null };
+  Object.defineProperty(n, 'textContent', {
+    get() { return n._text + n.children.map((c) => c.textContent).join(''); },
+    set(v) { n._text = String(v); n.children = []; },
+  });
+  n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
+  n.remove = () => { if (n.parent) n.parent.children = n.parent.children.filter((c) => c !== n); };
+  n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
+  n.getAttribute = (k) => (k in n.attrs ? n.attrs[k] : null);
+  n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.querySelector = (sel) => {
+    const cls = sel.replace(/^\./, '');
+    const walk = (x) => { for (const c of x.children) { if (String(c.className).split(' ').includes(cls)) return c; const d = walk(c); if (d) return d; } return null; };
+    return walk(n);
+  };
+  return n;
+}
+const all = (n, pred, out = []) => { for (const c of n.children || []) { if (pred(c)) out.push(c); all(c, pred, out); } return out; };
+
+const OPEN_HANDS = { id: '501', created_at: '2026-10-04T15:10:00.000Z', seen_at: null, slug: 'open-hands', name: 'Open Hands', description: 'A newer guild for first-time builders.', visibility: 'public' };
+const QUIET_ROOM = { id: '502', created_at: '2026-10-03T08:45:00.000Z', seen_at: null, slug: 'quiet-room', name: 'Quiet Room', description: '', visibility: 'unlisted' };
+const TOMAS = { id: '601', created_at: '2026-10-04T19:20:00.000Z', seen_at: null, handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null, guild: { slug: 'night-shift', name: 'Night Shift' } };
+const KAI = { id: '602', created_at: '2026-10-02T11:05:00.000Z', seen_at: null, handle: 'kai-lowe', display_name: null, avatar_url: null, guild: { slug: 'night-shift', name: 'Night Shift' } };
+const OK = { ok: true, status: 200, body: { status: 'accepted' } };
+const GONE = { ok: false, status: 204, body: undefined };
+
+function boot({ answers = [] } = {}) {
+  const ids = new Map();
+  for (const id of ['mineInvites', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
+  ids.get('mineInvites').hidden = true;
+  const requests = [];
+  const queued = answers.slice();
+  const fetch = (url, init = {}) => {
+    requests.push({ url, method: init.method || 'GET', body: init.body, headers: init.headers, credentials: init.credentials });
+    const a = typeof queued[0] === 'function' ? queued.shift()(url) : (queued.shift() || OK);
+    if (a.reject) return Promise.reject(new Error('offline'));
+    const status = a === GONE ? 204 : a.status;
+    return Promise.resolve({ ok: status >= 200 && status < 300, status, json: () => (a.body === undefined ? Promise.reject(new SyntaxError('no body')) : Promise.resolve(a.body)) });
+  };
+  const document = { createElement: el, createTextNode: (t) => ({ tag: '#text', textContent: String(t), children: [], className: '' }) };
+  const sandbox = {
+    document, fetch, console, Promise, JSON, String, Object, Array, URL,
+    $: (id) => ids.get(id) || null,
+    API: '/api/bongos',
+    hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase(),
+    safeHttpUrl: (raw) => { try { const u = new URL(String(raw)); return (u.protocol === 'https:' || u.protocol === 'http:') ? u.href : ''; } catch (e) { return ''; } },
+    jsonOrEmpty: (res) => res.json().catch(() => ({})),
+    apiError: (data, status) => { const e = (data && data.error) || {}; return { code: e.code || ('http_' + status), message: e.message || '', details: e.details || e || {} }; },
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#mine-rows' });
+  const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
+  const invites = () => ids.get('guildInviteList').children;
+  const asks = () => ids.get('guildRequestList').children;
+  const part = (card, cls) => card.querySelector('.' + cls);
+  const actions = (card) => part(card, 'mineRow__actions').children;
+  const button = (card, label) => actions(card).find((b) => b.tag === 'button' && b.textContent === label);
+  const radios = (card) => all(card, (n) => n.tag === 'input' && n.type === 'radio');
+  const msg = (card) => part(card, 'projMsg');
+  const click = async (b) => { for (const f of b._on.click || []) f({}); await settle(); };
+  const pick = async (card, value) => {
+    for (const r of radios(card)) r.checked = r.value === value;
+    for (const f of radios(card).find((r) => r.value === value)._on.change || []) f({});
+    await settle();
+  };
+  return { sandbox, ids, requests, settle, invites, asks, part, actions, button, radios, msg, click, pick, section: () => ids.get('mineInvites') };
+}
+
+// ── the D4.4 notice: one sentence on two pages ───────────────────────────────
+
+test('the notice is guild.html’s own words, both ways, byte for byte', () => {
+  const said = (src, re) => { const m = src.match(re); assert.ok(m, `found ${re}`); return vm.runInNewContext(m[1]); };
+  const onGuild = said(GUILD_PAGE, /\? 'Your numbers are left out[^']*'\s*:\s*('Your numbers count[\s\S]*?share them with\.');/);
+  const offGuild = said(GUILD_PAGE, /picked\('counted'\) === 'off'\s*\?\s*('[^']*')/);
+  const onHub = said(HUB, /var GUILD_COUNTED_ON = ('[\s\S]*?share them with\.');/);
+  const offHub = said(HUB, /var GUILD_COUNTED_OFF = ('[^']*');/);
+  assert.equal(onHub, onGuild);
+  assert.equal(offHub, offGuild);
+  assert.match(onHub, /count toward this guild’s rounded totals/, 'ADR 0337 D4.4’s words');
+  // the switch's own labels are the guild page's too
+  for (const words of ['Count my numbers', 'They add to this guild’s totals.', 'Leave them out', 'The totals add up everyone else.', 'In this guild’s totals']) {
+    assert.ok(GUILD_PAGE.includes(words) && CARDS.includes(words), `"${words}" on both pages`);
+  }
+});
+
+// ── the invite card ──────────────────────────────────────────────────────────
+
+test('an invite card says what joining shows, offers the switch set to count, and the notice BEFORE any accept', () => {
+  const ui = boot();
+  ui.sandbox.renderGuildInvites([OPEN_HANDS, QUIET_ROOM]);
+  assert.equal(ui.requests.length, 0, 'drawing sends nothing');
+  assert.equal(ui.section().hidden, false);
+  const [open, quiet] = ui.invites();
+  assert.equal(ui.part(open, 'mineRow__name').textContent, 'You’re invited to join Open Hands');
+  assert.equal(ui.part(open, 'guildRow__desc').textContent, 'A newer guild for first-time builders.');
+  assert.equal(ui.part(quiet, 'guildRow__desc'), null, 'an empty description draws nothing');
+  assert.match(ui.part(open, 'mineRow__hint').textContent, /^It’s public: joining lists your name and picture on its page/);
+  assert.match(ui.part(quiet, 'mineRow__hint').textContent, /^It’s unlisted: it has no public page/);
+  const link = ui.actions(open).find((a) => a.tag === 'a');
+  assert.equal(link.href, '/g/open-hands');
+  assert.equal(link.hidden, false);
+  assert.equal(ui.actions(quiet).find((a) => a.tag === 'a').hidden, true, 'an unlisted guild has no page to show an invitee');
+  for (const card of [open, quiet]) {
+    const r = ui.radios(card);
+    assert.deepEqual(r.map((x) => [x.value, x.checked]), [['on', true], ['off', false]], 'counted by default, as the membership is');
+    assert.equal(new Set(r.map((x) => x.name)).size, 1, 'one group per card');
+    const group = ui.part(card, 'guildCount__opts');
+    assert.equal(group.getAttribute('role'), 'radiogroup');
+    assert.equal(group.getAttribute('aria-labelledby'), ui.part(card, 'guildCount__label').id);
+    assert.match(ui.part(card, 'guildCount__what').textContent, /^Your numbers count toward this guild’s rounded totals/);
+    assert.deepEqual(ui.actions(card).filter((b) => b.tag === 'button').map((b) => b.textContent), ['Accept', 'Decline']);
+  }
+  assert.notEqual(ui.radios(open)[0].name, ui.radios(quiet)[0].name, 'two cards never share a group');
+});
+
+test('picking Leave them out says what that means before anything is sent; Count brings the notice back', async () => {
+  const ui = boot();
+  ui.sandbox.renderGuildInvites([OPEN_HANDS]);
+  const card = ui.invites()[0];
+  await ui.pick(card, 'off');
+  assert.equal(ui.part(card, 'guildCount__what').textContent, 'Your numbers are left out of this guild’s totals, from its next weekly count.');
+  await ui.pick(card, 'on');
+  assert.match(ui.part(card, 'guildCount__what').textContent, /^Your numbers count toward/);
+  assert.equal(ui.requests.length, 0);
+});
+
+test('Accept sends exactly the card’s visibility and the switch, on the cookie session', async () => {
+  const ui = boot();
+  ui.sandbox.renderGuildInvites([OPEN_HANDS, QUIET_ROOM]);
+  const [open, quiet] = ui.invites();
+  await ui.click(ui.button(open, 'Accept'));
+  await ui.pick(quiet, 'off');
+  await ui.click(ui.button(quiet, 'Accept'));
+  assert.equal(ui.requests.length, 2);
+  const [a, b] = ui.requests;
+  assert.equal(a.url, '/api/bongos/guild-requests/501/accept');
+  assert.equal(a.method, 'POST');
+  assert.equal(a.credentials, 'same-origin');
+  assert.equal(a.headers['Content-Type'], 'application/json');
+  assert.deepEqual(JSON.parse(a.body), { visibility: 'public', counted_in_totals: true });
+  assert.equal(b.url, '/api/bongos/guild-requests/502/accept');
+  assert.deepEqual(JSON.parse(b.body), { visibility: 'unlisted', counted_in_totals: false });
+});
+
+test('accepted: Joined and no longer the accent, nothing left to press, and the line says where your numbers went', async () => {
+  const ui = boot();
+  ui.sandbox.renderGuildInvites([QUIET_ROOM]);
+  const card = ui.invites()[0];
+  await ui.pick(card, 'off');
+  await ui.click(ui.button(card, 'Accept'));
+  const joined = ui.button(card, 'Joined');
+  assert.ok(joined, 'the button says so');
+  assert.equal(joined.disabled, true);
+  assert.equal(joined.className, 'btn small ghost');
+  assert.equal(ui.button(card, 'Decline').hidden, true);
+  assert.ok(ui.radios(card).every((r) => r.disabled), 'the switch is set; it moves on the guild page now');
+  assert.equal(ui.actions(card).find((a) => a.tag === 'a').hidden, false, 'a member reaches even an unlisted guild’s page');
+  assert.equal(ui.msg(card).className, 'projMsg ok');
+  assert.equal(ui.msg(card).textContent, 'You’ve joined Quiet Room, and your numbers are left out of its totals.');
+});
+
+test('409 guild_visibility_changed: the card re-draws for the guild as it is now, and the next accept sends that', async () => {
+  const ui = boot({ answers: [
+    { ok: false, status: 409, body: { error: { code: 'guild_visibility_changed', message: 'guild_visibility_changed', details: { visibility: 'public' } } } },
+    OK,
+  ] });
+  ui.sandbox.renderGuildInvites([QUIET_ROOM]);
+  const card = ui.invites()[0];
+  await ui.click(ui.button(card, 'Accept'));
+  assert.match(ui.part(card, 'mineRow__hint').textContent, /^It’s public:/, 'the card now says what joining shows');
+  assert.equal(ui.actions(card).find((a) => a.tag === 'a').hidden, false);
+  assert.equal(ui.msg(card).textContent, 'This guild changed since the card was drawn: it’s public now. Read it again, then accept.');
+  assert.equal(ui.button(card, 'Accept').disabled, false, 'a fresh decision, not a dead end');
+  await ui.click(ui.button(card, 'Accept'));
+  assert.deepEqual(JSON.parse(ui.requests[1].body), { visibility: 'public', counted_in_totals: true });
+  assert.ok(ui.button(card, 'Joined'));
+});
+
+test('an ended invite leaves nothing pressable; an expired session offers a way back; a dead network is said, and both stay re-tryable', async () => {
+  const gone = boot({ answers: [{ ok: false, status: 404, body: { error: { code: 'guild_request_not_found' } } }] });
+  gone.sandbox.renderGuildInvites([OPEN_HANDS]);
+  let card = gone.invites()[0];
+  await gone.click(gone.button(card, 'Accept'));
+  assert.ok(gone.actions(card).filter((b) => b.tag === 'button').every((b) => b.hidden));
+  assert.ok(gone.radios(card).every((r) => r.disabled));
+  assert.equal(gone.msg(card).textContent, 'That invite has ended — it was withdrawn, or it ran out.');
+
+  const out = boot({ answers: [{ ok: false, status: 401, body: { error: { code: 'unauthenticated' } } }, { reject: true }] });
+  out.sandbox.renderGuildInvites([OPEN_HANDS]);
+  card = out.invites()[0];
+  await out.click(out.button(card, 'Accept'));
+  const a = out.msg(card).children.find((c) => c.tag === 'a');
+  assert.ok(a, 'a sign-in link, built as an element');
+  assert.equal(a.href, '/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine&repos=1');
+  assert.equal(out.button(card, 'Accept').disabled, false);
+  await out.click(out.button(card, 'Accept'));
+  assert.equal(out.msg(card).textContent, 'Couldn’t reach the platform — check your connection and try again.');
+  assert.equal(out.button(card, 'Accept').disabled, false);
+  assert.equal(out.button(card, 'Decline').disabled, false);
+});
+
+test('Decline is a body-less POST whose 204 drops the row, and the last one hides the section; a failure keeps it', async () => {
+  const ui = boot({ answers: [GONE, { ok: false, status: 500, body: {} }] });
+  ui.sandbox.renderGuildInvites([OPEN_HANDS]);
+  ui.sandbox.renderGuildRequests([TOMAS]);
+  await ui.click(ui.button(ui.invites()[0], 'Decline'));
+  assert.equal(ui.requests[0].url, '/api/bongos/guild-requests/501/decline');
+  assert.equal(ui.requests[0].method, 'POST');
+  assert.equal(ui.requests[0].body, undefined, 'nothing to send');
+  assert.equal(ui.invites().length, 0);
+  assert.equal(ui.section().hidden, false, 'the owner’s card still stands');
+  const ask = ui.asks()[0];
+  await ui.click(ui.button(ask, 'Decline'));
+  assert.equal(ui.asks().length, 1, 'kept on a failure');
+  assert.equal(ui.msg(ask).textContent, 'Couldn’t decline just now — try again in a moment.');
+  assert.equal(ui.button(ask, 'Decline').disabled, false);
+  ui.sandbox.renderGuildRequests([]);
+  assert.equal(ui.section().hidden, true, 'no row in any list hides the section');
+});
+
+// ── the owner's card ─────────────────────────────────────────────────────────
+
+test('a join request names who asked, with the handle once, and accepts with no body', async () => {
+  const ui = boot();
+  ui.sandbox.renderGuildRequests([TOMAS, KAI]);
+  const [tomas, kai] = ui.asks();
+  assert.equal(ui.part(tomas, 'mineRow__name').textContent, 'Tomás Ek asked to join Night Shift');
+  assert.equal(ui.part(tomas, 'mineRow__host').textContent, '@tomas-ek');
+  assert.equal(ui.part(kai, 'mineRow__name').textContent, '@kai-lowe asked to join Night Shift');
+  assert.equal(ui.part(kai, 'mineRow__host'), null, 'never the handle twice');
+  assert.equal(ui.part(tomas, 'guildCount'), null, 'the requester’s switch rode their request: none here');
+  assert.equal(ui.part(tomas, 'mineRow__hint').textContent, 'Accepting makes them a member. A decline is never told to them.');
+  await ui.click(ui.button(tomas, 'Accept'));
+  assert.equal(ui.requests[0].url, '/api/bongos/guild-requests/601/accept');
+  assert.equal(ui.requests[0].body, undefined, 'an owner cannot set the requester’s switch');
+  assert.equal(ui.requests[0].credentials, 'same-origin');
+  assert.equal(ui.button(tomas, 'Accepted').className, 'btn small ghost');
+  assert.equal(ui.button(tomas, 'Decline').hidden, true);
+  assert.equal(ui.msg(tomas).textContent, 'Tomás Ek is in Night Shift now.');
+});
+
+test('an ended request leaves nothing pressable; an expired session and a dead network keep the card re-tryable', async () => {
+  const ui = boot({ answers: [{ ok: false, status: 404, body: {} }, { ok: false, status: 401, body: {} }, { reject: true }] });
+  ui.sandbox.renderGuildRequests([TOMAS, KAI]);
+  const [tomas, kai] = ui.asks();
+  await ui.click(ui.button(tomas, 'Accept'));
+  assert.ok(ui.actions(tomas).every((b) => b.hidden));
+  assert.equal(ui.msg(tomas).textContent, 'That request has ended — it was withdrawn, it ran out, or their account is closed.');
+  await ui.click(ui.button(kai, 'Accept'));
+  assert.ok(ui.msg(kai).children.find((c) => c.tag === 'a'), 'sign in again');
+  assert.equal(ui.button(kai, 'Accept').disabled, false);
+  await ui.click(ui.button(kai, 'Accept'));
+  assert.equal(ui.msg(kai).textContent, 'Couldn’t reach the platform — check your connection and try again.');
+  assert.equal(ui.button(kai, 'Accept').disabled, false);
+});
+
+// ── the reads ────────────────────────────────────────────────────────────────
+
+test('ONE read feeds both lists — the invites to you and the requests to every guild you own — never one per guild', async () => {
+  const ui = boot({ answers: [{ ok: true, status: 200, body: {
+    incoming: [OPEN_HANDS], outgoing: [{ id: '9', slug: 'x' }], owner_incoming: [TOMAS, KAI],
+    incoming_count: 1, outgoing_count: 1, owner_incoming_count: 2,
+  } }] });
+  await ui.sandbox.loadGuildQueue();
+  await ui.settle();
+  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`), ['GET /api/bongos/me/guild-requests']);
+  assert.equal(ui.requests[0].credentials, 'same-origin');
+  assert.equal(ui.invites().length, 1, 'incoming only: the requests YOU sent are not cards here');
+  assert.equal(ui.asks().length, 2);
+  assert.equal(ui.part(ui.asks()[0], 'mineRow__name').textContent, 'Tomás Ek asked to join Night Shift', 'each row names its own guild');
+  assert.doesNotMatch(CARDS, /\/me\/guilds'|\/requests'/, 'no per-guild queue read anywhere in the cards');
+});
+
+test('a failed or empty read is silent: no cards, and the section stays hidden', async () => {
+  for (const answer of [{ ok: false, status: 500, body: {} }, { reject: true }, { ok: true, status: 200, body: {} }]) {
+    const ui = boot({ answers: [answer] });
+    await ui.sandbox.loadGuildQueue();
+    await ui.settle();
+    assert.equal(ui.invites().length + ui.asks().length, 0);
+    assert.equal(ui.section().hidden, true);
+  }
+});
+
+test('a row the page cannot answer is dropped, never drawn with a button that fails', () => {
+  const ui = boot();
+  ui.sandbox.renderGuildInvites([
+    { ...OPEN_HANDS, id: 'abc' }, { ...OPEN_HANDS, id: undefined }, { ...OPEN_HANDS, slug: '' },
+    { ...OPEN_HANDS, visibility: 'secret' }, null, QUIET_ROOM,
+  ]);
+  assert.deepEqual(ui.invites().map((c) => ui.part(c, 'mineRow__name').textContent), ['You’re invited to join Quiet Room']);
+  ui.sandbox.renderGuildRequests([{ ...TOMAS, id: '1x' }, { ...TOMAS, handle: '' }, { ...TOMAS, guild: null }, KAI]);
+  assert.equal(ui.asks().length, 1);
+  // within the bigint range the route checks (routes/guilds.js requestId), and no further
+  ui.sandbox.renderGuildRequests([{ ...TOMAS, id: '9223372036854775808' }, { ...KAI, id: '9223372036854775807' }]);
+  assert.deepEqual(ui.asks().map((c) => ui.part(c, 'mineRow__name').textContent), ['@kai-lowe asked to join Night Shift']);
+});
+
+// ── the markup, the region's rules, the kit ──────────────────────────────────
+
+test('the cards are real lists in the Invitations section, built with createElement / textContent only', () => {
+  const section = (HUB.match(/<section id="mineInvites" hidden aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
+  const order = ['invitesList', 'guildInviteList', 'engageList', 'guildRequestList'].map((id) => section.indexOf(`<ul class="mineRows" id="${id}"></ul>`));
+  assert.ok(order.every((i) => i > 0), 'each list ships as real markup the script only fills');
+  assert.deepEqual([...order].sort((a, b) => a - b), order, 'invites to you first, the requests to your guilds last');
+  assert.doesNotMatch(CARDS, /innerHTML|insertAdjacentHTML|outerHTML/);
+  assert.match(REGION, /function loadInvites\(\) \{[\s\S]*?loadEngagements\(\),\s*loadGuildQueue\(\)\s*\]\);/, 'the mine view reads them with the other invitations');
+  const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
+  for (const rule of ['.guildCount__opts{', '.guildCount__opt:has(input:checked) b::before{', '.guildCount__opt:focus-within{', '.guildRow--invite .mineRow__actions{align-self:flex-end;}']) {
+    assert.ok(COSMOS.includes(rule), `cosmos.css carries ${rule}`);
+  }
+  assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>')), /guildCount|guildRow/, 'styled in cosmos.css, not in the page head');
+});
+
+test('the kit pictures the cards, and the stub answers the four calls as the routes do', () => {
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
+  for (const s of ['in-mine-guild-cards', 'in-mine-guild-count-off', 'in-mine-guild-joined']) assert.ok(states[s], `kit state ${s}`);
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes.map((p) => p.name);
+  assert.ok(probes.some((n) => /guild invite/.test(n)) && probes.some((n) => /join request/.test(n)), 'probes drive both cards');
+  const serve = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(serve, /rest === '\/me\/guild-requests' && req\.method === 'GET'\) return AUTH \? myGuildRequests\(res\)/);
+  assert.match(serve, /owner_incoming: owner, owner_incoming_count: owner\.length/, 'the route’s one-read shape, owner rows included');
+  assert.match(serve, /'guild_card_visibility_required'/, 'an invitee accept with no visibility is refused, as the route does');
+  assert.match(serve, /code: 'guild_visibility_changed'[^\n]*details: \{ visibility: now \}/, 'and one that differs is the 409 with the guild as it is now');
+  assert.match(serve, /res\.writeHead\(204/, 'a decline is a silent 204');
+  const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'me__guild-requests.json'), 'utf8'));
+  for (const r of fixture.incoming) {
+    assert.deepEqual(Object.keys(r).sort(), ['created_at', 'description', 'id', 'name', 'seen_at', 'slug', 'visibility'], 'listMyRequests’s row shape');
+  }
+  assert.deepEqual(fixture.incoming.map((r) => r.visibility).sort(), ['public', 'unlisted']);
+});