mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
The live-pair uniqueness is a partial index (WHERE revoked_at IS NULL), which cannot read the clock: an expired but never-revoked grant kept occupying the slot, so re-inviting the same person after expiry always failed as a duplicate though they had no access. Close the lapsed row at the moment of re-invite — conditionally, the expiry state in the WHERE — so revocation still never deletes and the fresh invitation mints its row. The revoker is stamped GRANTOR because the paired revoked-by check requires both columns set and the enum has no expiry member. An audit row records the close. Proven against the real index: the guard was watched fail with a duplicate before the fix landed.