@bongos/core 1.21.62 → 1.21.64

package/modules/hall-ui/public/watch.css

@@ -71,3 +71,18 @@
 /* A link inside a ledger cell (a session's tasks) is a control at a 13.5px line
    box: the padding buys the 24px floor and the negative margin hands it back. */
 .ledger td a:not(.lb-name) { display: inline-block; min-height: 24px; padding: 3px 0; margin: -3px 0; line-height: 18px; }
+
+/* A guild's applicants under one head (task 1002304, ADR 0365 D5): the guild's
+   name, the count, and "Invite all" at the inline end. The head wraps at phone
+   width so the button drops under the name rather than overflowing, and centres
+   because a pill on the label's baseline sits low. */
+.gate-guild .ov-group__head { flex-wrap: wrap; align-items: center; row-gap: 8px; }
+.gate-guild .ov-group__head .btn-ghost { margin-left: auto; }
+/* The name is a link to the guild's hub page when it has one — a control, so it
+   owes the 24px floor: the padding buys the box, the margin hands it back. */
+a.gate-guild__link { display: inline-block; min-height: 24px; min-width: 24px; padding: 3px 0; margin: -3px 0; text-decoration: none; }
+a.gate-guild__link:hover { color: var(--accent-ink); text-decoration: underline; text-underline-offset: 3px; }
+/* The profile block's sentences ("Private account — …", "hides their record")
+   ride .ov-row__when, which never wraps; at 320px they pushed the page 54px
+   sideways. Inside the profile they are prose, so they wrap. */
+.ov-row__profile .ov-row__when { white-space: normal; }

package/modules/hall-ui/public/watch.html

@@ -5,6 +5,9 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Watch — {{worldName}}</title>
   <meta name="description" content="Archon oversight for {{worldName}} — access requests, security, roster, reviews, and repo health.">
+  <!-- The hub's origin, for the link from a guild's head in the applications queue to
+       its page on the hub (task 1002304). Empty on a vanilla instance: no link. -->
+  <meta name="hub-origin" content="{{hubOrigin}}">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

package/modules/hall-ui/public/watch.js

@@ -523,6 +523,90 @@
     );
   }
 
+  // ---- a guild's applicants, together (task 1002304, ADR 0365 D5) ----------
+  //
+  // An applicant who applied WITH their guild carries the hub's label for it,
+  // { slug, name } (slug null for an unlisted guild), and the queue gathers those
+  // rows under the guild's name so an owner reads a guild's application as one
+  // thing. "Invite all" is N ordinary invites — one PATCH per row, the same
+  // write the row's own button sends — because admission stays per person on the
+  // project (ADR 0365: N clicks, not one, is the honest cost; this only makes the
+  // N clicks one gesture). Nothing here is authority (ADR 0016): every row keeps
+  // its own pill, profile and buttons.
+  //
+  // The label counts only on a VOUCHED row. The server resolves it from the vouch
+  // alone, and an unvouched row wearing a guild would be the impersonation shape
+  // the vouch pill exists to expose. When no row carries a guild (an older hub, no
+  // hub, nobody applied with one) the list is exactly what it always was: one
+  // list, no group heads.
+  function guildOf(r) {
+    const g = r && r.vouched ? r.guild : null;
+    return g && typeof g.name === 'string' && g.name ? g : null;
+  }
+
+  // Groups in the order their newest applicant arrived; rows keep the server's
+  // order inside each. Two unlisted guilds that share a name share a head — the
+  // hub names an unlisted guild without an address, so the name is all there is.
+  function groupByGuild(requests) {
+    const groups = new Map();
+    const solo = [];
+    for (const r of requests) {
+      const g = guildOf(r);
+      if (!g) { solo.push(r); continue; }
+      const key = g.slug ? `slug:${g.slug}` : `name:${g.name}`;
+      if (!groups.has(key)) groups.set(key, { guild: g, rows: [] });
+      groups.get(key).rows.push(r);
+    }
+    return { groups: [...groups.values()], solo };
+  }
+
+  // The guild's own page on the hub when it has one. An unlisted guild has no
+  // slug and a vanilla instance has no hub; either way the name is plain text,
+  // never a link to nowhere.
+  function guildNameHtml(g) {
+    const hub = typeof window.OTB.hubOrigin === 'function' ? window.OTB.hubOrigin() : null;
+    const name = escapeHtml(g.name);
+    return hub && g.slug
+      ? `<a class="ov-group__name gate-guild__link" href="${escapeHtml(`${hub}/g/${encodeURIComponent(g.slug)}`)}">${name}</a>`
+      : `<span class="ov-group__name">${name}</span>`;
+  }
+
+  // "Invite all" covers the rows still waiting, and only two or more of them —
+  // a lone applicant already has their own Invite. The decided views offer no
+  // bulk move at all: a mass rescind is not a gesture this queue makes.
+  function bulkInviteHtml(rows) {
+    if (gateView !== 'pending') return '';
+    const ids = rows.filter((r) => r.status === 'pending').map((r) => r.id);
+    if (ids.length < 2) return '';
+    return ghost(`data-gate-bulk="invited" data-ids="${escapeHtml(ids.join(','))}"`, `Invite all ${ids.length}`);
+  }
+
+  function gateListHtml(requests) {
+    const list = (rows) => '<ul class="ov-rows">' + rows.map(gateRowHtml).join('') + '</ul>';
+    const { groups, solo } = groupByGuild(requests);
+    if (!groups.length) return list(solo);
+    const head = (name, n, extra) => `<div class="ov-group__head">${name}<span class="ov-group__n">${n}</span>${extra}</div>`;
+    return groups.map(({ guild, rows }) => (
+      `<section class="ov-group gate-guild">${head(guildNameHtml(guild), rows.length, bulkInviteHtml(rows))}${list(rows)}</section>`
+    )).join('') + (solo.length
+      ? `<section class="ov-group">${head('<span class="ov-group__name">On their own</span>', solo.length, '')}${list(solo)}</section>`
+      : '');
+  }
+
+  // Each invite settles on its own, so one refusal cannot strand the rest; the
+  // toast says how many landed, and the re-read shows exactly which.
+  async function inviteAll(ids) {
+    const settled = await Promise.allSettled(ids.map((id) =>
+      patchJson(`/access-requests/${encodeURIComponent(id)}`, { status: 'invited' })));
+    const failed = settled.filter((s) => s.status === 'rejected').map((s) => s.reason);
+    if (failed.some((e) => e && e.kind === '401')) throw failed.find((e) => e && e.kind === '401');
+    if (failed.length === ids.length) throw failed[0];
+    toast(failed.length
+      ? `Invited ${ids.length - failed.length} of ${ids.length} — ${failed[0].message || failed[0]}`
+      : `Invited all ${ids.length}.`);
+    await loadGate();
+  }
+
   function renderGate(data, target) {
     const requests = Array.isArray(data.requests) ? data.requests : [];
     // The attention tile counts WAITING work, never whatever list is on screen:
@@ -531,10 +615,12 @@
     if (gateView === 'pending') setAttention('att-access', requests.length);
     const head = inviteFormHtml() + '<div id="gate-view"></div>';
     target.innerHTML = requests.length
-      ? head + '<ul class="ov-rows">' + requests.map(gateRowHtml).join('') + '</ul>'
+      ? head + gateListHtml(requests)
       : head + emptyStateHtml(gateEmptyMsg());
 
     if (requests.length) {
+      wireActions(target, '[data-gate-bulk]', (btn) =>
+        inviteAll(String(btn.getAttribute('data-ids') || '').split(',').filter(Boolean)), 'Could not invite');
       wireActions(target, '[data-gate-action]', async (btn) => {
         const id = btn.getAttribute('data-id');
         const status = btn.getAttribute('data-gate-action');

package/modules/hall-ui/records/oversight-family.md

@@ -16,4 +16,10 @@ Also gone, and the one rule in that list: a sealed state is a `.scroll` panel wh
 - **The three lifecycle states sit behind one `makeFilterBar` switch**, so the decided history is readable and the RESCIND (`invited → dismissed`) the route has always taken is finally offered — ADR 0208 recorded that nothing on this page did. A declined row offers no button: reviving one is the invite form above, which is what the server's own 409 names. The switch is rebuilt each render (the same lifecycle `wireInviteForm` lives with, since `section` replaces the whole body).
 - **The `att-access` tile counts pending only.** Its sub line says "pending", so the count is guarded on the pending view — reading the history must not repaint the board with a number that means something else.
 
+**The queue gathers a guild's applicants under the guild's name (task 1002304, R28; ADR 0365 D5).** Rows carry the hub's `guild` label beside `profile`, and `gateListHtml` groups the VOUCHED rows that have one into `.ov-group` sections — the guild's name (a link to `<hub>/g/<slug>` when the page carries a hub origin and the guild is public), the count, and, on the pending view with two or more waiting, an "Invite all N" that sends N ordinary `PATCH {status:'invited'}`s and re-reads once. Three rules it keeps:
+
+- **No guild anywhere means no group heads at all** — an older hub, no hub, or nobody applying with a guild renders the one list it always did. The rest sit under "On their own" only when at least one guild group exists.
+- **An unvouched row is never filed under a guild**, even if it carries one: the server resolves the label from the vouch alone, and a guild head over an unvouched name would be the impersonation shape the pill exists to expose.
+- **Admission stays per person.** Every grouped row keeps its own pill, profile and buttons; "Invite all" is N clicks made one gesture, never a new write, and the decided views offer no bulk move. `tests/watch_applications_queue.mjs` drives all of it; the harness fixture `access-requests.json` carries a three-member public guild and a one-member unlisted one.
+
 Also gone: harbor's 280px card deck with a 4px coloured "roof" band per box and gate's crate with a verdict band (state is a `.fact-pill`; the fleet reads in three grouped runs — running, parked or in transition, no box); government's bordered `.gov-section` boxes and the one `.gov-assign-row` five unrelated lists shared (each renders as the row it is); watch's third copy of the stat tile, its `table.watch`, its `.watch-btn`; three bare `<p>` sealed states (each is a `.scroll` panel whose lede is written from `OTB.rankLabel('metic')`, so the floor cannot drift from ADR 0157). The harness gained fixtures for `/boxes`, `/gate-approvals` and five session rows, because a page that only ever renders its error state cannot be redesigned by looking.

package/modules/onboarding/routes/access-requests.js

@@ -139,6 +139,12 @@ const MAX_LIVE_PROFILE_READS = 25;
 //
 // Each read fails soft to null independently (the doorway port swallows), so one
 // slow or missing account cannot fail the others or the listing.
+//
+// THE GUILD LABEL RIDES THE SAME READ (ADR 0365 D5, task 1002304): `guild` is
+// { slug, name } when the applicant applied with their guild, else null — so it
+// is keyed on the vouch and budgeted by the cap exactly as the profile is, and
+// the queue groups a guild's applicants by it. An older hub sends no guild, and
+// every row then carries `guild: null` and renders as it always did.
 async function attachApplicantProfiles(rows) {
   // The budget is spent UP FRONT, by index, rather than by decrementing a shared
   // counter inside the concurrent callbacks. Both are correct today — `.map`
@@ -151,10 +157,10 @@ async function attachApplicantProfiles(rows) {
   rows.forEach((r, i) => {
     if (r.applicant_github_id && resolvable.size < MAX_LIVE_PROFILE_READS) resolvable.add(i);
   });
-  return Promise.all(rows.map(async (r, i) => ({
-    ...r,
-    profile: resolvable.has(i) ? await api.readApplicantProfileFromHub(r.applicant_github_id) : null,
-  })));
+  return Promise.all(rows.map(async (r, i) => {
+    const view = resolvable.has(i) ? await api.readApplicantViewFromHub(r.applicant_github_id) : null;
+    return { ...r, profile: view ? view.profile : null, guild: view ? view.guild : null };
+  }));
 }
 
 // THE HUB'S NOTICE OF THIS PROJECT'S INVITES (task 1002818, ADR 0353). On a hosted

package/modules/platform-identity/guilds.js

@@ -647,6 +647,37 @@ async function listGuildRequests({ guildId, ownerGithubId }, { pool = defaultPoo
   return { incoming, outgoing };
 }
 
+// The join requests waiting on the caller as an OWNER, across every guild they
+// own, in ONE statement (task 1004583): the hub's Invitations reads this rather
+// than one queue per owned guild. listGuildRequests' request leg keyed on the
+// caller instead of one guild — a requester floors on consent alone, the owner
+// test re-asserted per row — and its seen_at stamp. Each row names its guild.
+async function listOwnedRequests({ githubId }, { pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT r.id::text AS id, r.created_at, r.seen_at, g.slug, g.name, ${PERSON_COLUMNS}
+       FROM platform_identity_guild_requests r
+       JOIN platform_identity_guilds g ON g.id = r.guild_id
+       JOIN platform_identity_accounts pa ON pa.github_id = r.github_id
+      WHERE r.kind = 'request' AND r.status = 'pending'
+        AND r.created_at > now() - make_interval(days => $2::int)
+        AND ${ownerExistsSql('r.guild_id', '$1')}
+        AND ${accountActiveSql('pa')}
+      ORDER BY r.created_at DESC, r.id DESC
+      LIMIT $3`,
+    [githubId, REQUEST_EXPIRY_DAYS, LIST_MAX],
+  );
+  const unseen = rows.filter((r) => !r.seen_at).map((r) => r.id);
+  if (unseen.length) {
+    await pool.query(
+      `UPDATE platform_identity_guild_requests r SET seen_at = now()
+        WHERE r.id = ANY($1::bigint[]) AND r.kind = 'request' AND r.seen_at IS NULL
+          AND ${ownerExistsSql('r.guild_id', '$2')}`,
+      [unseen, githubId],
+    );
+  }
+  return rows.map(({ slug, name, ...r }) => ({ ...r, guild: { slug, name } }));
+}
+
 // ---------------------------------------------------------------------------
 // The public read (D4)
 // ---------------------------------------------------------------------------
@@ -707,5 +738,6 @@ module.exports = {
   cancelRequest,
   listMyRequests,
   listGuildRequests,
+  listOwnedRequests,
   getPublicGuild,
 };

package/modules/platform-identity/routes/guilds.js

@@ -12,6 +12,7 @@
 //   POST   /guilds                         create {slug, name, description?, visibility}
 //   GET    /me/guilds                      my guilds, with my own two switches
 //   GET    /me/guild-requests              invites to me (the card) + requests I sent
+//                                           + requests to the guilds I own (owner_incoming)
 //   GET    /guilds/:slug/members           the members' roster (members only; 404 else)
 //   PATCH  /guilds/:slug/membership        my switches {shown_publicly?, counted_in_totals?}
 //   DELETE /guilds/:slug/membership        leave (the owner transfers first, or is last and dissolves)
@@ -154,13 +155,19 @@ module.exports = function guildRoutes() {
   }));
 
   // rank: any-builder — MY queue: invites addressed to me, each carrying the
-  // card (the guild's current visibility, which an accept must echo back), and
-  // the join requests I sent. Stamps seen_at on the invites.
+  // card (the guild's current visibility, which an accept must echo back), the
+  // join requests I sent, and the join requests waiting on me as the owner of a
+  // guild, each naming its guild (task 1004583 — one read for the hub, never one
+  // per owned guild). Stamps seen_at on the invites and on those requests.
   router.get('/me/guild-requests', requireBuilder, handle('GET /me/guild-requests', 'guild_requests_read_failed', async (req, res) => {
     const me = await actingAccount(req.builder);
     if (me.fail) return res.fail(...me.fail);
     const { incoming, outgoing } = await guilds.listMyRequests({ githubId: me.githubId }, { pool });
-    res.json({ incoming, outgoing, incoming_count: incoming.length, outgoing_count: outgoing.length });
+    const ownerIncoming = await guilds.listOwnedRequests({ githubId: me.githubId }, { pool });
+    res.json({
+      incoming, outgoing, owner_incoming: ownerIncoming,
+      incoming_count: incoming.length, outgoing_count: outgoing.length, owner_incoming_count: ownerIncoming.length,
+    });
   }));
 
   // rank: any-builder — the members' roster, for members only (the own-scope

package/modules/public-landing/public/assets/cosmos.css

@@ -1325,13 +1325,39 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .mineJoinRow input::placeholder{color:var(--ink-faint);}
 .mineJoinNote{display:block;width:100%;box-sizing:border-box;margin-top:10px;min-height:64px;padding:12px 16px;font:inherit;font-size:14px;line-height:1.5;color:var(--ink);background:var(--bg-card);border:1px solid var(--ctl-line);border-radius:14px;resize:vertical;}
 .mineJoinNote::placeholder{color:var(--ink-faint);}
-/* the guild cards (task 1002303, R27): a second list under the invitations, one
-   hairline between the two when both have rows; each card's note waits behind
+/* the guild cards (task 1002303, R27): more lists under the invitations, one
+   hairline between any two that have rows; each card's note waits behind
    "Add a note", and its status line takes no room until it has something to say */
-.mineRows:not(:empty)+.mineRows .mineRow:first-child{border-top:1px solid var(--rule-soft);}
+.mineRows:not(:empty)~.mineRows .mineRow:first-child{border-top:1px solid var(--rule-soft);}
 .engageRow .mineJoinNote{max-width:62ch;}
 .engageRow .projMsg{margin-top:6px;min-height:0;}
 .engageRow .projMsg:empty{margin:0;}
+/* a guild's invite to you and a join request to your guild (task 1004583). The
+   invite carries the guild page's counted pair (guild.html's .aOpt voice, set
+   tighter for a row) with the D4.4 notice under it, said before accept. */
+.guildRow .projMsg{margin-top:6px;min-height:0;}
+.guildRow .projMsg:empty{margin:0;}
+/* the invite's buttons sit at its foot, after the notice they answer */
+.guildRow--invite .mineRow__actions{align-self:flex-end;}
+.guildRow__desc{margin:4px 0 0;font-size:14px;line-height:1.5;color:var(--ink-soft);max-width:62ch;}
+.guildCount{display:grid;gap:8px;margin-top:12px;max-width:66ch;}
+.guildCount__label{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);text-transform:uppercase;color:var(--ink-faint);}
+.guildCount__opts{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);}
+.guildCount__opt{position:relative;display:block;margin:0;padding:12px 16px 14px;border-left:1px solid var(--rule-soft);cursor:pointer;}
+.guildCount__opt:first-child{border-left:0;padding-left:0;}
+.guildCount__opt input{position:absolute;width:1px;height:1px;margin:0;overflow:hidden;clip-path:inset(50%);}
+.guildCount__opt>span{display:block;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+.guildCount__opt b{display:flex;align-items:center;gap:10px;margin-bottom:4px;font-family:var(--font-body);font-weight:500;font-size:14.5px;color:var(--ink);}
+.guildCount__opt b::before{content:"";width:7px;height:7px;border-radius:50%;border:1px solid var(--rule);background:var(--bg);flex:none;}
+.guildCount__opt:has(input:checked) b::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+.guildCount__opt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
+.guildCount__opt:has(input:disabled){cursor:default;}
+.guildCount__what{margin:0;font-size:13px;line-height:1.5;color:var(--ink-soft);max-width:70ch;}
+@media (max-width:480px){
+  .guildCount__opts{grid-template-columns:1fr;}
+  .guildCount__opt{padding:10px 0 12px;border-left:0;border-top:1px solid var(--rule-soft);}
+  .guildCount__opt:first-child{border-top:0;}
+}
 
 /* ── the ledger row: planet · name and chip · the facts · the rail · the
    doors. The planet and the doors are fixed widths; the three middle tracks

package/modules/public-landing/public/projects.html

@@ -963,11 +963,18 @@ summary{min-height:24px;padding:3px 0;}
           <section id="mineInvites" hidden aria-labelledby="mineInvitesH">
             <h2 id="mineInvitesH">Invitations</h2>
             <ul class="mineRows" id="invitesList"></ul>
+            <!-- a guild inviting you (task 1004583; ADR 0336 D4 §3, ADR 0337 D4.4):
+                 each card says, BEFORE you accept, that your numbers count toward the
+                 guild's rounded totals, and offers the switch right there. -->
+            <ul class="mineRows" id="guildInviteList"></ul>
             <!-- a guild you are in, engaging a project (task 1002303, R27; ADR 0365):
                  "G is applying to P" and "P invited G", from GET /me/guild-engagements.
                  Each card's Apply is the ordinary join request with `guild` added, so
                  you apply as yourself, never as the guild. -->
             <ul class="mineRows" id="engageList"></ul>
+            <!-- someone asking to join a guild you own (task 1004583): Accept / Decline.
+                 Their own counted switch rode their request, so this card has none. -->
+            <ul class="mineRows" id="guildRequestList"></ul>
           </section>
 
           <section aria-labelledby="mineBuildingH">
@@ -3689,10 +3696,12 @@ summary{min-height:24px;padding:3px 0;}
     paintInvitesSection();
   }
 
-  /* the Invitations section holds two lists — the projects' own invites and the
-     guild cards below — and shows while either has a row */
+  /* the Invitations section holds four lists — the projects' own invites, a
+     guild's invites to you, your guilds' engagements, and the join requests to a
+     guild you own — and shows while any of them has a row */
+  var INVITE_LISTS = ['invitesList', 'guildInviteList', 'engageList', 'guildRequestList'];
   function paintInvitesSection() {
-    $('mineInvites').hidden = !$('invitesList').children.length && !$('engageList').children.length;
+    $('mineInvites').hidden = !INVITE_LISTS.some(function (id) { return $(id).children.length; });
   }
 
   function loadInvites() {
@@ -3701,7 +3710,8 @@ summary{min-height:24px;padding:3px 0;}
         .then(function (res) { return res.ok ? res.json() : { invites: [] }; })
         .then(function (d) { renderInvitesList(d.invites || []); })
         .catch(function () { renderInvitesList([]); }),
-      loadEngagements()
+      loadEngagements(),
+      loadGuildQueue()
     ]);
   }
 
@@ -3826,6 +3836,286 @@ summary{min-height:24px;padding:3px 0;}
       .catch(function () { renderEngagements([]); });
   }
 
+  /* ── a guild inviting you, and a join request to a guild you own (task 1004583;
+     ADR 0336 D3/D4 §3, ADR 0337 D4.4) ──
+     GET /me/guild-requests names the invites addressed to you, each carrying its
+     card: the guild's name, description and CURRENT visibility. Accept echoes back
+     the visibility this card showed — the consent is to what the card said, so a
+     guild that changed since is a 409 and the card re-draws for a fresh decision —
+     and the counted_in_totals choice made on the card. The D4.4 notice is said for
+     the choice as it stands, BEFORE accept, in guild.html's own words (the test
+     holds the two pages to one sentence). The guilds you OWN answer their join
+     requests here too, from the same read's owner_incoming — one request for
+     every guild you own, never one per guild. The requester's own switch rode
+     their request, so the owner's card has none. A decline is silent on both sides (204, the other side is never
+     told). textContent / createElement only. Proof: tests/hub_guild_cards.mjs */
+  var GUILD_COUNTED_ON = 'Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. ' +
+    'They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. ' +
+    'Leave them out of any guild you’d rather not share them with.';
+  var GUILD_COUNTED_OFF = 'Your numbers are left out of this guild’s totals, from its next weekly count.';
+  var GUILD_SHOWN = {
+    public: 'It’s public: joining lists your name and picture on its page while your account is public. You can turn that off there.',
+    unlisted: 'It’s unlisted: it has no public page, so joining lists you nowhere.'
+  };
+  var GUILD_OFFLINE = 'Couldn’t reach the platform — check your connection and try again.';
+  /* a POST on the cookie session; a 204 (decline) has no body to read */
+  function guildPost(path, body) {
+    var init = { method: 'POST', credentials: 'same-origin' };
+    if (body) { init.headers = { 'Content-Type': 'application/json' }; init.body = JSON.stringify(body); }
+    return fetch(API + path, init).then(function (res) {
+      return (res.status === 204 ? Promise.resolve({}) : jsonOrEmpty(res)).then(function (data) {
+        return { ok: res.ok, status: res.status, data: data };
+      });
+    });
+  }
+  function guildButton(label, cls) {
+    var b = document.createElement('button');
+    b.type = 'button';
+    b.className = cls;
+    b.textContent = label;
+    return b;
+  }
+  /* the row's status line, quiet until it has something to say */
+  function guildMsg(main) {
+    var msg = mineEl('p', 'projMsg');
+    msg.setAttribute('role', 'status');
+    msg.setAttribute('aria-live', 'polite');
+    main.appendChild(msg);
+    return msg;
+  }
+  /* Decline: silent to the other side. The row goes; a failure keeps it and says so. */
+  function guildDecline(row, id, btns, msg) {
+    btns.forEach(function (b) { b.disabled = true; });
+    msg.className = 'projMsg';
+    msg.textContent = '';
+    guildPost('/guild-requests/' + encodeURIComponent(id) + '/decline').then(function (res) {
+      if (res.ok) { row.remove(); paintInvitesSection(); return; }
+      btns.forEach(function (b) { b.disabled = false; });
+      if (res.status === 401) { sessionExpired(msg); return; }
+      msg.className = 'projMsg err';
+      msg.textContent = res.status === 404 ? 'That has already been answered, or it ran out.' : 'Couldn’t decline just now — try again in a moment.';
+    }).catch(function () {
+      btns.forEach(function (b) { b.disabled = false; });
+      msg.className = 'projMsg err';
+      msg.textContent = GUILD_OFFLINE;
+    });
+  }
+
+  function guildInviteRow(inv) {
+    var name = inv.name || inv.slug;
+    var vis = inv.visibility;
+    var row = mineRow({ name: 'You’re invited to join ' + name });
+    row.className = 'mineRow guildRow guildRow--invite';
+    var main = row.querySelector('.mineRow__main');
+    if (inv.description) {
+      var desc = mineEl('p', 'guildRow__desc');
+      desc.textContent = inv.description;
+      main.appendChild(desc);
+    }
+    var shown = mineEl('p', 'mineRow__hint');
+    main.appendChild(shown);
+    /* the counted switch — the guild page's pair, in its words, defaulting on as
+       the membership does; the notice under it is said for the choice as it stands */
+    var band = mineEl('div', 'guildCount');
+    var label = mineEl('span', 'guildCount__label');
+    label.id = 'guildCount-' + inv.id;
+    label.textContent = 'In this guild’s totals';
+    band.appendChild(label);
+    var group = mineEl('div', 'guildCount__opts');
+    group.setAttribute('role', 'radiogroup');
+    group.setAttribute('aria-labelledby', label.id);
+    var radios = [['on', 'Count my numbers', 'They add to this guild’s totals.'], ['off', 'Leave them out', 'The totals add up everyone else.']].map(function (o) {
+      var opt = mineEl('label', 'guildCount__opt');
+      var input = document.createElement('input');
+      input.type = 'radio';
+      input.name = 'guildCounted-' + inv.id;
+      input.value = o[0];
+      input.checked = o[0] === 'on';
+      var text = mineEl('span');
+      var b = mineEl('b');
+      b.textContent = o[1];
+      text.appendChild(b);
+      text.appendChild(document.createTextNode(o[2]));
+      opt.appendChild(input);
+      opt.appendChild(text);
+      group.appendChild(opt);
+      return input;
+    });
+    band.appendChild(group);
+    var what = mineEl('p', 'guildCount__what');
+    band.appendChild(what);
+    main.appendChild(band);
+    var msg = guildMsg(main);
+    function counted() { return !radios[1].checked; }
+    function paintWhat() { what.textContent = counted() ? GUILD_COUNTED_ON : GUILD_COUNTED_OFF; }
+    radios.forEach(function (r) { r.addEventListener('change', paintWhat); });
+    paintWhat();
+
+    var actions = mineEl('div', 'mineRow__actions');
+    var page = document.createElement('a');
+    page.className = 'linklike';
+    page.href = '/g/' + encodeURIComponent(inv.slug);
+    page.textContent = 'See its page';
+    function paintShown() { shown.textContent = GUILD_SHOWN[vis]; page.hidden = vis !== 'public'; }
+    paintShown();
+    var accept = guildButton('Accept', 'btn small');
+    var decline = guildButton('Decline', 'btn small ghost');
+    function idle() {
+      accept.disabled = false;
+      decline.disabled = false;
+      accept.textContent = 'Accept';
+    }
+    /* an invite that is gone (withdrawn, run out, answered elsewhere) cannot be
+       answered again: say so and leave nothing pressable */
+    function ended() {
+      accept.hidden = true;
+      decline.hidden = true;
+      radios.forEach(function (r) { r.disabled = true; });
+      msg.className = 'projMsg';
+      msg.textContent = 'That invite has ended — it was withdrawn, or it ran out.';
+    }
+    accept.addEventListener('click', function () {
+      var on = counted();
+      accept.disabled = true;
+      decline.disabled = true;
+      accept.textContent = 'Joining…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      guildPost('/guild-requests/' + encodeURIComponent(inv.id) + '/accept', { visibility: vis, counted_in_totals: on }).then(function (res) {
+        if (res.ok) {
+          /* no longer pressable, so no longer the accent (the One Warm Thing rule) */
+          accept.className = 'btn small ghost';
+          accept.textContent = 'Joined';
+          decline.hidden = true;
+          radios.forEach(function (r) { r.disabled = true; });
+          page.hidden = false;
+          msg.className = 'projMsg ok';
+          msg.textContent = 'You’ve joined ' + name + (on ? ', and your numbers count toward its totals.' : ', and your numbers are left out of its totals.');
+          return;
+        }
+        if (res.status === 401) { idle(); sessionExpired(msg); return; }
+        var err = apiError(res.data, res.status);
+        if (res.status === 409 && err.code === 'guild_visibility_changed' && err.details && GUILD_SHOWN[err.details.visibility]) {
+          vis = err.details.visibility;
+          paintShown();
+          idle();
+          msg.className = 'projMsg err';
+          msg.textContent = 'This guild changed since the card was drawn: it’s ' + vis + ' now. Read it again, then accept.';
+          return;
+        }
+        if (res.status === 404) { ended(); return; }
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t accept just now — try again in a moment.';
+      }).catch(function () {
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = GUILD_OFFLINE;
+      });
+    });
+    decline.addEventListener('click', function () { guildDecline(row, inv.id, [accept, decline], msg); });
+    actions.appendChild(page);
+    actions.appendChild(accept);
+    actions.appendChild(decline);
+    row.appendChild(actions);
+    return row;
+  }
+  /* a row id is a bigserial (digits, within the bigint range the route checks);
+     a card with no id, no slug or a visibility this page cannot say is dropped
+     rather than drawn with a button that fails */
+  function guildRowId(r) {
+    return !!r && typeof r.id === 'string' && /^\d{1,19}$/.test(r.id) && (r.id.length < 19 || r.id <= '9223372036854775807');
+  }
+  function renderGuildInvites(rows) {
+    var ul = $('guildInviteList');
+    ul.textContent = '';
+    (rows || []).forEach(function (inv) {
+      if (!guildRowId(inv) || typeof inv.slug !== 'string' || !inv.slug || !GUILD_SHOWN[inv.visibility]) return;
+      ul.appendChild(guildInviteRow(inv));
+    });
+    paintInvitesSection();
+  }
+
+  function guildRequestRow(r) {
+    var who = r.display_name || '@' + r.handle;
+    var row = mineRow({ name: who + ' asked to join ' + (r.guild.name || r.guild.slug) });
+    row.className = 'mineRow guildRow';
+    var main = row.querySelector('.mineRow__main');
+    /* the handle under a display name, never twice */
+    if (r.display_name) {
+      var handle = mineEl('span', 'mineRow__host');
+      handle.textContent = '@' + r.handle;
+      main.appendChild(handle);
+    }
+    var hint = mineEl('p', 'mineRow__hint');
+    hint.textContent = 'Accepting makes them a member. A decline is never told to them.';
+    main.appendChild(hint);
+    var msg = guildMsg(main);
+    var actions = mineEl('div', 'mineRow__actions');
+    var accept = guildButton('Accept', 'btn small');
+    var decline = guildButton('Decline', 'btn small ghost');
+    accept.addEventListener('click', function () {
+      accept.disabled = true;
+      decline.disabled = true;
+      accept.textContent = 'Accepting…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      guildPost('/guild-requests/' + encodeURIComponent(r.id) + '/accept').then(function (res) {
+        if (res.ok) {
+          accept.className = 'btn small ghost';
+          accept.textContent = 'Accepted';
+          decline.hidden = true;
+          hint.hidden = true;
+          msg.className = 'projMsg ok';
+          msg.textContent = who + ' is in ' + (r.guild.name || r.guild.slug) + ' now.';
+          return;
+        }
+        accept.textContent = 'Accept';
+        if (res.status === 404) {
+          accept.hidden = true;
+          decline.hidden = true;
+          msg.className = 'projMsg';
+          msg.textContent = 'That request has ended — it was withdrawn, it ran out, or their account is closed.';
+          return;
+        }
+        accept.disabled = false;
+        decline.disabled = false;
+        if (res.status === 401) { sessionExpired(msg); return; }
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t accept just now — try again in a moment.';
+      }).catch(function () {
+        accept.disabled = false;
+        decline.disabled = false;
+        accept.textContent = 'Accept';
+        msg.className = 'projMsg err';
+        msg.textContent = GUILD_OFFLINE;
+      });
+    });
+    decline.addEventListener('click', function () { guildDecline(row, r.id, [accept, decline], msg); });
+    actions.appendChild(accept);
+    actions.appendChild(decline);
+    row.appendChild(actions);
+    return row;
+  }
+  function renderGuildRequests(rows) {
+    var ul = $('guildRequestList');
+    ul.textContent = '';
+    (rows || []).forEach(function (r) {
+      if (!guildRowId(r) || typeof r.handle !== 'string' || !r.handle) return;
+      if (!r.guild || typeof r.guild.slug !== 'string' || !r.guild.slug) return;
+      ul.appendChild(guildRequestRow(r));
+    });
+    paintInvitesSection();
+  }
+  /* ONE read for both lists: the invites to you, and the requests waiting on you
+     as the owner of a guild; a read that fails is silent, as the other lists' are */
+  function loadGuildQueue() {
+    return fetch(API + '/me/guild-requests', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : {}; })
+      .then(function (d) { renderGuildInvites(d.incoming || []); renderGuildRequests(d.owner_incoming || []); })
+      .catch(function () { renderGuildInvites([]); renderGuildRequests([]); });
+  }
+
   /* the one relay both the map's per-card Apply (submitApply) and the
      address-typed join field drive — POST /my-projects/join, the 401 case and
      the 'requested' echo update kept in ONE place (task 1003774). Keys the