@bongos/core 1.21.81 → 1.21.83

package/release-notes.json

@@ -9312,5 +9312,17 @@
       "id": "1004442",
       "text": "When the board turns someone's idea into a goal, every task later finished under that goal now pays the idea's author, as promised. Before this, only work promoted straight from the idea paid them, so a goal full of finished w"
     }
+  ],
+  "1.21.82": [
+    {
+      "id": "1004481",
+      "text": "Custom ranks can now be deleted from the Government page, so trying a recommended rank set is no longer a permanent choice. A rank someone still holds can't be deleted, and the page says who holds it. The four built-in ranks c"
+    }
+  ],
+  "1.21.83": [
+    {
+      "id": "1004646",
+      "text": "Project invites now reach people on cloudbongos.com. Before, an invite sent by GitHub username was silently lost if the person had never signed in to a project through cloudbongos.com, which is almost every new invitee, so the"
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -261,6 +261,7 @@ const GOVERNMENT_PINS = {
   'PUT /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
   'DELETE /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
   'POST /government/ranks/:rankKey/reset': 'perm:government.manage',
+  'DELETE /government/ranks/:rankKey': 'perm:government.manage',
   'POST /government/rank-sets/apply': 'perm:government.manage',
   'POST /government/assignments': 'perm:government.manage',
   'DELETE /government/assignments/:builderId/:rankKey': 'perm:government.manage',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.81'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.83'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_routes.mjs

@@ -35,6 +35,7 @@ const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
+const governmentConfig = require(path.join(ROOT, 'modules', 'government', 'config.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 const express = require('express');
@@ -58,6 +59,7 @@ test('the routes file declares the full R110 surface', () => {
     'PUT /government/ranks/:rankKey/permissions/:permissionKey',
     'DELETE /government/ranks/:rankKey/permissions/:permissionKey',
     'POST /government/ranks/:rankKey/reset',
+    'DELETE /government/ranks/:rankKey',
     'POST /government/assignments',
     'DELETE /government/assignments/:builderId/:rankKey',
     'POST /government/rank-sets/apply',
@@ -125,6 +127,7 @@ test('checkRouteRanks passes over the real tree (no governance findings)', () =>
 
 // The db stub: every function the routes call, recording args. Reset per test.
 const calls = [];
+let deleteAnswer = { deleted: true, holders: [] };
 const stub = {
   listRanksWithGrants: async () => [{ rank_key: 'metic', label: 'Metic', description: null, is_system: true, seeded_rank: 'metic', created_by: null, created_at: 't', permissions: ['task.create'] }],
   listAssignments: async () => [{ builder_id: 7, github_login: 'x', display_name: 'X', rank: 'metic', rank_key: 'metic', role_label: 'Metic', is_system: true, seeded_rank: 'metic', assigned_by: null, assigned_at: 't' }],
@@ -141,6 +144,8 @@ const stub = {
   grantRankPermission: async () => true,
   revokeRankPermission: async () => true,
   resetRankGrants: async ({ permissionKeys }) => permissionKeys.length,
+  // task 1004481: `deleteAnswer` scripts what the locked delete found.
+  deleteCustomRank: async () => deleteAnswer,
   assignRank: async () => true,
   unassignRank: async () => true,
   // task 1004529: who decides at People. [] = the as-today default row.
@@ -412,6 +417,73 @@ test('POST reset: refused on a custom role (no catalog default to return to)', a
   assert.equal(calls.filter(([k]) => k === 'resetRankGrants').length, 0);
 });
 
+// --- delete a custom rank (task 1004481) --------------------------------------
+
+test('DELETE a rank: a custom rank nobody holds is deleted', async () => {
+  deleteAnswer = { deleted: true, holders: [] };
+  const r = await call('DELETE', '/government/ranks/triage-helper');
+  assert.equal(r.status, 200);
+  assert.equal(r.json.deleted, true);
+  const c = calls.find(([k]) => k === 'deleteCustomRank');
+  assert.equal(c[1], 'triage-helper');
+});
+
+test('DELETE a rank: refused while held, and the refusal names who holds it', async () => {
+  deleteAnswer = { deleted: false, reason: 'held', holders: [{ builder_id: 9, github_login: 'ana', display_name: 'Ana', extra: 'x' }] };
+  const r = await call('DELETE', '/government/ranks/triage-helper');
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'rank_still_held');
+  assert.deepEqual(r.json.error.details.holders, [{ builder_id: 9, github_login: 'ana', display_name: 'Ana' }], 'names them, and only those fields');
+  assert.equal(calls.filter(([k]) => k === 'unassignRank').length, 0, 'never unassigns on the way');
+  deleteAnswer = { deleted: true, holders: [] };
+});
+
+test('DELETE a rank: every seeded rank is refused before the db is asked', async () => {
+  for (const k of catalog.RANK_ORDER) {
+    const r = await call('DELETE', `/government/ranks/${k}`);
+    assert.equal(r.status, 403, k);
+    assert.equal(r.json.error.code, 'seeded_rank_immutable');
+    assert.equal(calls.filter(([n]) => n === 'deleteCustomRank').length, 0);
+  }
+});
+
+test('DELETE a rank: a missing rank 404s, from the read or from the locked delete', async () => {
+  assert.equal((await call('DELETE', '/government/ranks/missing')).status, 404);
+  deleteAnswer = { deleted: false, reason: 'not_found', holders: [] };
+  assert.equal((await call('DELETE', '/government/ranks/triage-helper')).status, 404);
+  deleteAnswer = { deleted: true, holders: [] };
+});
+
+test('DELETE a rank: refused while the board or a who-decides row seats it', async () => {
+  const realLoad = governmentConfig.loadGovernmentConfig;
+  try {
+    governmentConfig.loadGovernmentConfig = () => ({ board: { membership: 'rank:archon,triage-helper' } });
+    let r = await call('DELETE', '/government/ranks/triage-helper');
+    assert.equal(r.status, 409);
+    assert.equal(r.json.error.code, 'rank_in_use_by_government');
+    assert.deepEqual(r.json.error.details.seated_in, ['the board']);
+    assert.equal(calls.filter(([k]) => k === 'deleteCustomRank').length, 0);
+
+    governmentConfig.loadGovernmentConfig = () => ({ board: { membership: 'rank:archon' } });
+    stub.listDecisionRules = async () => [{ area: 'people', decided_by: 'rank:triage-helper' }, { area: 'treasury', decided_by: 'gate' }];
+    r = await call('DELETE', '/government/ranks/triage-helper');
+    assert.equal(r.status, 409);
+    assert.deepEqual(r.json.error.details.seated_in, ['who decides at people']);
+    r = await call('DELETE', '/government/ranks/other-rank');
+    assert.equal(r.status, 200, 'a rank nothing seats is still deletable');
+
+    // fail-closed: an unparseable predicate that spells the key still refuses
+    stub.listDecisionRules = async () => [];
+    governmentConfig.loadGovernmentConfig = () => ({ board: { membership: 'rank:triage-helper+' } });
+    r = await call('DELETE', '/government/ranks/triage-helper');
+    assert.equal(r.status, 409, 'rank:<custom>+ is unparseable, and still names the rank');
+    assert.deepEqual(r.json.error.details.seated_in, ['the board']);
+  } finally {
+    governmentConfig.loadGovernmentConfig = realLoad;
+    stub.listDecisionRules = async () => [];
+  }
+});
+
 // --- assignments -------------------------------------------------------------
 
 test('POST /government/assignments assigns a custom role, assigned_by = the session builder', async () => {

package/tests/hub_invite_badge.mjs

@@ -0,0 +1,204 @@
+// tests/hub_invite_badge.mjs — what is waiting on you, said where you already look
+// (task 1004646; the owner's report of 2026-10-08 that invitations "aren't obvious").
+//
+// The REAL assets/invite-badge.js, executed in a node:vm under a small DOM stub: the
+// count on the identity chip and on the profile band's Invitations item, the line on
+// the mine view, nothing at all when nothing waits or nobody is signed in, and no
+// read at all on a child instance (its Invitations item is stripped as apex-only).
+// Then the pages: every page that wears the hub's bar loads it.
+//
+// Run:  node --test tests/hub_invite_badge.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const BADGE = fs.readFileSync(path.join(LANDING, 'assets', 'invite-badge.js'), 'utf8');
+
+// ── a DOM just big enough for this file ──────────────────────────────────────
+
+class El {
+  constructor(tag, attrs = {}) {
+    this.tagName = tag.toUpperCase();
+    this.children = [];
+    this.parentNode = null;
+    this.attrs = { ...attrs };
+    this.className = attrs.class || '';
+    this.id = attrs.id || '';
+    this._text = '';
+  }
+  get firstChild() { return this.children[0] || null; }
+  get lastChild() { return this.children[this.children.length - 1] || null; }
+  get nextSibling() { const k = this.parentNode.children; return k[k.indexOf(this) + 1] || null; }
+  set textContent(v) { this.children = []; this._text = String(v); }
+  get textContent() { return this._text + this.children.map((c) => c.textContent).join(''); }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  set href(v) { this.attrs.href = v; }
+  get href() { return this.attrs.href; }
+  appendChild(c) { return this.insertBefore(c, null); }
+  insertBefore(c, ref) {
+    if (c.parentNode) c.remove();
+    c.parentNode = this;
+    const i = ref ? this.children.indexOf(ref) : -1;
+    if (i < 0) this.children.push(c); else this.children.splice(i, 0, c);
+    return c;
+  }
+  remove() { const p = this.parentNode; if (p) p.children.splice(p.children.indexOf(this), 1); this.parentNode = null; }
+  *walk() { for (const c of this.children) { yield c; yield* c.walk(); } }
+  matches(sel) {
+    if (sel === '.invBadge') return this.className.split(' ').includes('invBadge');
+    if (sel === '.hero') return this.className === 'hero';
+    if (sel === 'svg.cv') return this.tagName === 'SVG' && this.className === 'cv';
+    if (sel === 'a[href="/invitations"]') return this.tagName === 'A' && this.attrs.href === '/invitations';
+    throw new Error(`stub selector: ${sel}`);
+  }
+  querySelector(sel) { for (const n of this.walk()) if (n.matches(sel)) return n; return null; }
+}
+
+function world({ child = false, mineView = false } = {}) {
+  const body = new El('body');
+  const who = body.appendChild(new El('button', { id: 'who', class: 'trig who' }));
+  who.appendChild(new El('span', { class: 'whoName' }));
+  who.appendChild(new El('svg', { class: 'cv' }));
+  const band = body.appendChild(new El('div', { id: 'menuProfile' }));
+  const mine = band.appendChild(new El('a', { href: '/projects?view=mine' }));
+  mine.textContent = 'My projects';
+  let inv = null;
+  if (!child) { inv = band.appendChild(new El('a', { href: '/invitations', class: 'bandT' })); inv.textContent = 'Invitations'; }
+  let section = null;
+  if (mineView) {
+    const view = body.appendChild(new El('section', { id: 'view-mine' }));
+    section = view.appendChild(new El('div', { class: 'hero' }));
+    section.appendChild(new El('h1')).textContent = 'Your projects';
+    section.appendChild(new El('p', { class: 'lede' }));
+    view.appendChild(new El('ul', { id: 'projectsList' }));
+  }
+  const byId = (id) => { for (const n of body.walk()) if (n.id === id) return n; return null; };
+  const document = { getElementById: byId, createElement: (t) => new El(t) };
+  return { body, who, inv, section, document, byId };
+}
+
+async function run(w, answers) {
+  const asked = [];
+  const fetch = async (url) => {
+    asked.push(url);
+    const a = answers[url];
+    if (a === undefined) return { ok: false, status: 404, json: async () => ({}) };
+    if (a instanceof Error) throw a;
+    return { ok: a.status === undefined, status: a.status || 200, json: async () => a };
+  };
+  const window = {};
+  vm.runInNewContext(BADGE, { window, document: w.document, fetch, Promise });
+  await window.InviteBadge.refresh();
+  return { asked, window };
+}
+
+const INVITES = '/api/bongos/my-projects/invites';
+const GUILDS = '/api/bongos/me/guild-requests';
+const badgeOf = (el) => el && el.querySelector('.invBadge');
+
+// ── the count ────────────────────────────────────────────────────────────────
+
+test('project invites and guild asks add up, on the chip and on the Invitations item', async () => {
+  const w = world();
+  await run(w, {
+    [INVITES]: { invites: [{ client_id: 'a' }, { client_id: 'b' }] },
+    [GUILDS]: { incoming: [{ id: '1' }], owner_incoming: [{ id: '2' }], outgoing: [{ id: '3' }] },
+  });
+  for (const host of [w.who, w.inv]) {
+    const b = badgeOf(host);
+    assert.ok(b, 'a badge is drawn');
+    assert.equal(b.firstChild.textContent, '4', 'two project invites, a guild invite and a request to a guild you own');
+    assert.equal(b.firstChild.getAttribute('aria-hidden'), 'true');
+    assert.equal(b.lastChild.className, 'vh');
+    assert.equal(b.lastChild.textContent, ', 4 invitations waiting', 'a screen reader hears what the number means');
+  }
+  assert.equal(w.who.children.indexOf(badgeOf(w.who)), 1, 'on the chip, before its chevron');
+});
+
+test('one invitation reads in the singular, and a large count is capped', async () => {
+  let w = world();
+  await run(w, { [INVITES]: { invites: [{}] }, [GUILDS]: {} });
+  assert.equal(badgeOf(w.inv).lastChild.textContent, ', 1 invitation waiting');
+  w = world();
+  await run(w, { [INVITES]: { invites: Array.from({ length: 120 }, () => ({})) }, [GUILDS]: {} });
+  assert.equal(badgeOf(w.who).firstChild.textContent, '99+');
+});
+
+test('the mine view says it in a line that links to the invitations page', async () => {
+  const w = world({ mineView: true });
+  await run(w, { [INVITES]: { invites: [{}, {}] }, [GUILDS]: {} });
+  const p = w.byId('mineInvitesWaiting');
+  assert.ok(p, 'the line is drawn');
+  assert.equal(w.section.children[2], p, 'at the top of the view, under its heading and lede — not below a long list');
+  assert.equal(p.firstChild.tagName, 'A');
+  assert.equal(p.firstChild.href, '/invitations');
+  assert.equal(p.textContent, 'You have 2 invitations waiting →');
+});
+
+test('nothing waiting, signed out, or a failed read: nothing is drawn', async () => {
+  for (const answers of [
+    { [INVITES]: { invites: [] }, [GUILDS]: { incoming: [], owner_incoming: [] } },
+    { [INVITES]: { status: 401 }, [GUILDS]: { status: 401 } },
+    { [INVITES]: new Error('offline'), [GUILDS]: new Error('offline') },
+  ]) {
+    const w = world({ mineView: true });
+    await run(w, answers);
+    assert.equal(badgeOf(w.who), null);
+    assert.equal(badgeOf(w.inv), null);
+    assert.equal(w.byId('mineInvitesWaiting'), null);
+  }
+});
+
+test('a refresh after an answer takes the badge and the line away again', async () => {
+  const w = world({ mineView: true });
+  const answers = { [INVITES]: { invites: [{}] }, [GUILDS]: {} };
+  const { window } = await run(w, answers);
+  assert.ok(badgeOf(w.who));
+  window.InviteBadge.paint(0);
+  assert.equal(badgeOf(w.who), null);
+  assert.equal(badgeOf(w.inv), null);
+  assert.equal(w.byId('mineInvitesWaiting'), null);
+});
+
+test('a child instance, with no Invitations item, reads nothing', async () => {
+  const w = world({ child: true });
+  const { asked } = await run(w, { [INVITES]: { invites: [{}] }, [GUILDS]: {} });
+  assert.deepEqual(asked, [], 'the hub-only routes are never asked');
+  assert.equal(badgeOf(w.who), null);
+});
+
+test('the file builds nodes only and makes only its two reads', () => {
+  assert.doesNotMatch(BADGE, /innerHTML|insertAdjacentHTML|outerHTML/);
+  const calls = [...BADGE.matchAll(/readCount\('([^']+)'/g)].map((m) => m[1]);
+  assert.deepEqual(calls, ['/my-projects/invites', '/me/guild-requests']);
+});
+
+// ── the pages ────────────────────────────────────────────────────────────────
+
+test('every page that wears the hub bar loads it once, before the Artist review tag', () => {
+  for (const page of ['projects', 'account', 'invitations', 'guild', 'privacy', 'terms', 'contact']) {
+    const html = fs.readFileSync(path.join(LANDING, `${page}.html`), 'utf8');
+    const tags = html.match(/<script src="\/assets\/invite-badge\.js"><\/script>/g) || [];
+    assert.equal(tags.length, 1, `${page}: one tag`);
+    assert.ok(html.indexOf(tags[0]) < html.lastIndexOf('<script src="/assets/artist-review.js"'), `${page}: before the review button`);
+  }
+});
+
+test('the hub page repaints the count after it rebuilds the chip, and the invitations page after an answer', () => {
+  const hub = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+  assert.match(hub, /renderWho\(\);\r?\n[^\n]*\r?\n\s*if \(window\.InviteBadge\) window\.InviteBadge\.refresh\(\);/);
+  const inv = fs.readFileSync(path.join(LANDING, 'invitations.html'), 'utf8');
+  assert.equal((inv.match(/recount\(\);/g) || []).length, 4, 'a decline, a guild decline, a guild accept and a request accepted');
+});
+
+test('the badge is the accent with its own ink, the .btn pairing', () => {
+  const css = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
+  assert.match(css, /\.invBadge\{[^}]*background:var\(--accent\);color:var\(--accent-on\);/);
+});

package/tests/hub_invite_notices.mjs

@@ -55,6 +55,8 @@ const pool = {
     }
     if (/^\s*INSERT INTO platform_identity_project_memberships/.test(sql)) return { rows: [{ id: '1', membership_kind: 'pending' }] };
     if (/^\s*DELETE FROM platform_identity_project_memberships/.test(sql)) return { rowCount: 1, rows: [] };
+    if (/^\s*INSERT INTO platform_identity_parked_invite_notices/.test(sql)) return { rowCount: 1, rows: [] };
+    if (/^\s*DELETE FROM platform_identity_parked_invite_notices/.test(sql)) return { rowCount: 0, rows: [] };
     throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
   },
 };
@@ -119,13 +121,15 @@ test('clear drops ONLY a pending row on the calling project', async () => {
   assert.equal(res.status, 200);
   assert.deepEqual(res.body, { ok: true });
   const w = writes();
-  assert.equal(w.length, 1);
-  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
+  assert.equal(w.length, 2, 'the parked notice under the login, then the pending row on the account');
+  assert.match(w[0].sql, /^\s*DELETE FROM platform_identity_parked_invite_notices WHERE client_id = \$1 AND login_lower = \$2/);
+  assert.deepEqual(w[0].params, ['mercury', 'octo']);
+  assert.match(w[1].sql, /^\s*DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/,
     'a rescind can never remove someone who has signed in');
-  assert.deepEqual(w[0].params, ['mercury', '4242']);
+  assert.deepEqual(w[1].params, ['mercury', '4242']);
 });
 
-test('a login with no hub account writes nothing — and the answer is byte-identical', async () => {
+test('a login with no hub account is PARKED by login — and the answer is byte-identical (task 1004646)', async () => {
   // The project must not learn from this route which GitHub logins have platform accounts.
   for (const route of ['/sso/invites/notify', '/sso/invites/clear']) {
     calls = [];
@@ -133,9 +137,60 @@ test('a login with no hub account writes nothing — and the answer is byte-iden
     const unknown = await notice(route, { github_login: 'nobody-here' });
     assert.deepEqual(unknown, known, `${route}: same status, same body`);
   }
+  // Before task 1004646 this wrote nothing, so a new invitee — no account until they sign
+  // in to a project through the hub — never saw the invite. Now it waits under the login.
   calls = [];
-  await notice('/sso/invites/notify', { github_login: 'nobody-here' });
-  assert.equal(writes().length, 0);
+  await notice('/sso/invites/notify', { github_login: '@Nobody-Here' });
+  const w = writes();
+  assert.equal(w.length, 1);
+  assert.match(w[0].sql, /^\s*INSERT INTO platform_identity_parked_invite_notices \(client_id, login_lower\)/);
+  assert.match(w[0].sql, /ON CONFLICT \(client_id, login_lower\) DO UPDATE SET noted_at = now\(\)/, 'a re-invite restarts its 30 days in place');
+  assert.deepEqual(w[0].params, ['mercury', 'nobody-here'], 'the calling project, and the login folded: no @, lower case');
+  assert.equal(w.filter((x) => /project_memberships/.test(x.sql)).length, 0, 'no membership row for a login with no account');
+});
+
+test('the invitations read lists a parked notice for whoever signs in with that login', async () => {
+  const seen = [];
+  const readPool = {
+    async query(text, params = []) {
+      const sql = String(text);
+      seen.push({ sql, params });
+      if (/FROM platform_identity_project_memberships m\s+LEFT JOIN/.test(sql)) {
+        return { rows: [{ client_id: 'mercury', invited_at: 't2', project_name: 'Mercury', project_origin: 'https://mercury.test' }] };
+      }
+      if (/FROM platform_identity_parked_invite_notices n/.test(sql)) {
+        return { rows: [
+          { client_id: 'mercury', invited_at: 't1', project_name: 'Mercury', project_origin: 'https://mercury.test' },
+          { client_id: 'venus', invited_at: 't0', project_name: 'Venus', project_origin: 'https://venus.test' },
+        ] };
+      }
+      throw new Error(`unexpected statement: ${sql.trim().slice(0, 60)}`);
+    },
+  };
+  const out = await inviteNotices.listInvitesForBuilder({ githubId: '4242', githubLogin: 'Octo' }, { pool: readPool });
+  assert.deepEqual(out.map((r) => r.client_id), ['mercury', 'venus'], 'one row per project: the pending row wins over its parked twin');
+  const parked = seen.find((c) => /parked_invite_notices/.test(c.sql));
+  assert.deepEqual(parked.params, ['octo', 30, '4242'], 'keyed on the SESSION login, folded; the 30 days; the session account');
+  assert.match(parked.sql, /n\.noted_at > now\(\) - make_interval\(days => \$2\)/, 'a lapsed invite is not shown (ADR 0356)');
+  assert.match(parked.sql, /NOT EXISTS \([\s\S]*m\.github_id = \$3 AND m\.membership_kind <> 'pending'\)/,
+    'a project the reader already builds on is not listed: signing in there accepted it');
+});
+
+test('a decline drops the parked notice too, keyed on the session login', async () => {
+  const seen = [];
+  const p = { async query(text, params) { seen.push({ sql: String(text), params }); return { rowCount: 1, rows: [] }; } };
+  const out = await inviteNotices.removeParkedInvite({ clientId: 'venus', githubLogin: 'Octo' }, { pool: p });
+  assert.deepEqual(out, { removed: true });
+  assert.deepEqual(seen[0].params, ['venus', 'octo']);
+  assert.deepEqual(await inviteNotices.removeParkedInvite({ clientId: 'venus', githubLogin: '' }, { pool: p }), { removed: false });
+  assert.equal(seen.length, 1, 'no login, no statement');
+});
+
+test('the invitations routes read and decline through the parked notices', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/my-projects.js'), 'utf8');
+  assert.match(src, /inviteNotices\.listInvitesForBuilder\(\s*\{ githubId: req\.builder\.github_id, githubLogin: req\.builder\.github_login \}/);
+  assert.match(src, /inviteNotices\.removeParkedInvite\(\{ clientId, githubLogin: req\.builder\.github_login \}/);
+  assert.match(src, /if \(!out\.removed && !parked\.removed\) return res\.fail\('no_pending_invite', 404\)/);
 });
 
 test('only an authenticated, active, credentialed project may speak — and writes nothing otherwise', async () => {

package/tests/landing_legal_pages.mjs

@@ -207,7 +207,7 @@ for (const p of PAGES) {
     const styles = [...html.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
     assert.doesNotMatch(styles, /\.(shell|bar|barMark|barLeft|barRight|trig|who|signinDoor|menuBand|band[A-Z]\w*)\b[^{}]*\{/, 'no bar or band rule in the page');
     // then the Artist review button's loader (task 1004499), the page's last tag
-    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
+    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<script src="\/assets\/invite-badge\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'the shared bar and its waiting count (task 1004646), after the markup they drive');
     assert.doesNotMatch(html, /<script>/, 'and no inline copy of the bands');
     assert.match(html, /<a data-link-hall href="\{\{buildersOrigin\}\}">Builders' hall<\/a><\/nav><\/footer>/, 'the hall keeps a door in the footer row now the bar has no Hall pill, as on /account');
   });