bud page sea-btn cascade: live-invite window + accept-on-GET + glow handoff; my-buds tooltip clamp + row hover/lock — TDD

Fixes the Bill Bud invite cascade so the sea sub-btn actually lights + leads
to the bud's my_sea, and gives the My Buds row tooltip viewport clamping +
hover/lock styling.

SeaInvite.invitee_access_open (gameboard/models.py): new invitee-facing
access window — a non-terminal invite (PENDING/ACCEPTED) within 24h of being
proffered OR within 24h of the invitee's last gate token deposit. Re-arms on
each deposit; DECLINED/LEFT/EXPIRED stay shut. Distinct from is_expired
(which only models the PENDING lapse). 8 UTs.

bud_page (billboard/views.py): sea_btn_active / sea_first_draw_pending now key
on invitee_access_open across PENDING + ACCEPTED, not PENDING-only. Old design
darkened the btn the instant the user accepted, so they could never reach the
bud's sea from here post-accept — that was the red .fa-ban the user saw. ITs
updated: accepted-within-window now lights; added stale-accepted-dark +
recent-deposit-relights cases.

my_sea_visit (gameboard/views.py): accept-on-GET — a still-pending, non-expired
invite from the owner to the visitor is accepted implicitly on arrival (the
sea-btn cascade + @mailman post-attribution anchor both land here, so the click
IS the acceptance). Previously PENDING → 403, so the cascade dead-ended. ITs:
pending-invitee now auto-accepts (200); expired-pending still 403s; stranger
still 403s.

bud.html: burger → sea_btn glow-handoff machine (the my_sea.html cascade minus
the spread-modal stage) so the glow rides the affordance chain to the click
target; active sea click clears glow, preserves .active, navigates.

my-buds-tooltip.js: clamp the position:fixed #id_tooltip_portal to the viewport
on row-lock — same 1rem-inset shape as game-kit.js / sky-wheel.js / wallet.js
(measure after .active, clamp left, prefer above / flip below). Reset on clear.

_billboard.scss: .bud-entry hover + .row-locked highlight (rows aren't
.row-3col so the existing rule missed them) — fill --secUser, flip the
--terUser handle to --quiUser, trailing title to readable --priUser.

520 billboard+gameboard ITs/UTs green; affected sea-btn-cascade FT green.

Code architected by Disco DeDisco <discodedisco@outlook.com>
Git commit message Co-Authored-By:
Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/apps/gameboard/tests/integrated/test_sea_visit.py

@@ -43,10 +43,29 @@ class MySeaVisitGuardTest(TestCase):
         self.client.force_login(stranger)
         self.assertEqual(self.client.get(self.url).status_code, 403)
 
-    def test_pending_invitee_is_forbidden(self):
+    def test_pending_invitee_is_auto_accepted_on_visit(self):
+        # Accept-on-GET (user-spec 2026-05-29): following the bud-page sea-btn
+        # cascade — or the @mailman post-attribution anchor — to the spectator
+        # table implicitly accepts a still-pending invite, so the page renders
+        # instead of 403ing the legitimately-invited user.
         self.invite.status = SeaInvite.PENDING
+        self.invite.accepted_at = None
         self.invite.save()
         self.client.force_login(self.bud)
+        self.assertEqual(self.client.get(self.url).status_code, 200)
+        self.invite.refresh_from_db()
+        self.assertEqual(self.invite.status, SeaInvite.ACCEPTED)
+        self.assertIsNotNone(self.invite.accepted_at)
+
+    def test_expired_pending_invitee_is_forbidden(self):
+        # A lapsed PENDING invite (no deposit, past 24h) is NOT auto-accepted.
+        self.invite.status = SeaInvite.PENDING
+        self.invite.accepted_at = None
+        self.invite.save()
+        SeaInvite.objects.filter(pk=self.invite.pk).update(
+            created_at=timezone.now() - timedelta(hours=48),
+        )
+        self.client.force_login(self.bud)
         self.assertEqual(self.client.get(self.url).status_code, 403)
 
     def test_left_invitee_is_forbidden(self):