[rudycelekli]

What this changes

A group can appear in both a Bot's published audience and assigned groups. Approving the resulting shared-app request currently inserts the same exact membership twice and fails its primary-key constraint. The same happens with repeated members in an explicit approval.

Ignore conflicts only on the complete approval-member primary key. Repeated exact (kind, value) pairs store once; a user and group with the same value remain separate. Other insert errors still fail the existing transaction.

Where it runs

• New state that outlives a request? No new state; approvals and decisions remain in shared Postgres.
• What happens on the second replica? It reads the same committed membership and decision rows.
• Anything serialised? Existing conditional decision claim and approval transaction retain their roles; database constraints remain authoritative.
• Anything fanned out to a browser? No new fan-out.
• New listener, port, or schedule? None.

Boundary and audit

• Acting tool calls still pass through the existing gateway and shared-use gate.
• No new refusal/failure path is introduced; existing route audit behavior remains.
• No new client trust or additional audience.

Changelog

• Added an Unreleased entry.

Proof

Base 743649efc3f21d7bf0badbe6af2bcd5daedd97ce, head d0c5bc1fceac2084660d8e465a178d84ea07ff4c.

Two new real-database regressions fail before with SQL 23505. After: the entire 18-test shared-use integration file passes (91 assertions), including organic publication/assignment overlap, repeated users/groups, distinct user/group names, retained access and outsider refusal.

Format, lint, workspace typecheck, the test-typecheck baseline guard, and build pass on this exact head. A separate routing candidate (d428f669f10e21700b6d5eb1fb14e90c9cc59cfe) on this same upstream base ran full test:ci: 11,017 passed, 210 skipped, two failed (routine-sweep concurrency expectation and recorder held-steps service-worker timing). Both isolated cases passed on unchanged base and that routing candidate; suite-order/timing causality remains unresolved. The full suite was not rerun on this head and no full green result is claimed.

Real integration tests use a dedicated disposable Postgres 15 database (hosted CI uses 17), with no live vendor calls or application data.

AI assistance: implemented and locally validated with OpenAI Codex. Hosted CI and maintainer review remain required.