Raise error slugs from the database and translate them client-side.

Postgres functions no longer raise user-facing sentences: every `raise
exception` now carries a stable slug, with values that used to be interpolated
into the message appended as `:value` segments (`capacity-exceeded:7`). The app
is translated, so English raised from the DB could never be localized.

20260813000000_error_message_slugs.sql redefines the 20 functions that raised
prose. Each body is its previous definition with only the raised literals
changed, so behaviour is untouched and `create or replace` keeps the existing
grants.

Client side: `parseDbError` splits slug and params, `dbErrorMessage` resolves
the `db.*` catalog key (en + fr) and ErrorState / InlineError / the rem screen /
onboarding go through it. An unknown slug falls back to the generic copy, so a
raw slug is never shown. The pending-invite redeemer classifies the seat-limit
failure through `classifyInviteError` instead of matching English.

Also fixes the join bounce race: the app gate reads the profile from the shared
linked-query cache, which only moves on its own round trip, so navigating right
after `completeOnboarding` let the gate see `onboarded: false` and redirect back
to onboarding with the invite already consumed. Onboarding now refreshes that
query before it navigates.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Herklos

apps/mobile/src/app/(app)/reports/rem.tsx

@@ -15,7 +15,8 @@ import {
   useRemMutations,
 } from '@/lib/hooks/use-rem';
 import { RemBreakdown } from '@/components/reports/RemBreakdown';
-import { InlineError } from '@/components/common/ErrorState';
+import { InlineError, describeError } from '@/components/common/ErrorState';
+import { dbErrorMessage } from '@/lib/db-error';
 import { ScreenLoader } from '@/components/common/ScreenLoader';
 
 export default function RemMonthScreen() {
@@ -54,7 +55,7 @@ export default function RemMonthScreen() {
       await refetchMonth();
       await refetchLines();
     } catch (e) {
-      setError(e instanceof Error ? e.message : t('rem.computeFail'));
+      setError(dbErrorMessage(e, t) ?? describeError(e, { fallback: t('rem.computeFail') }));
     } finally {
       setBusy(false);
     }
@@ -68,7 +69,7 @@ export default function RemMonthScreen() {
       await lock(companyId, month);
       await refetchMonth();
     } catch (e) {
-      setError(e instanceof Error ? e.message : t('rem.lockFail'));
+      setError(dbErrorMessage(e, t) ?? describeError(e, { fallback: t('rem.lockFail') }));
     } finally {
       setBusy(false);
     }

apps/mobile/src/app/(onboarding)/role.tsx

@@ -3,14 +3,16 @@ import { useRouter } from 'expo-router';
 import { Button, Segmented, TextField, Txt } from '@chrono/ui';
 
 import { useAppAuth } from '@/lib/supabase-stores';
-import { useProfileMutations } from '@/lib/hooks/use-profile';
+import { useProfile, useProfileMutations } from '@/lib/hooks/use-profile';
 import { useCompanyMutations } from '@/lib/hooks/use-companies';
 import { useInviteMutations } from '@/lib/hooks/use-invites';
 import { classifyInviteError, fetchMyCompanies, tokenFromInput } from '@chrono/sdk';
 import type { InviteErrorKind } from '@chrono/sdk';
 import { globalSupabaseClient } from '@/lib/supabase';
 import { useActiveCompany } from '@/lib/active-company-context';
 import { AuthCard } from '@/components/common/AuthCard';
+import { describeError } from '@/components/common/ErrorState';
+import { dbErrorMessage } from '@/lib/db-error';
 import { useT } from '@/lib/i18n';
 
 function inviteJoinError(kind: InviteErrorKind | null, t: ReturnType<typeof useT>): string {
@@ -48,6 +50,7 @@ export default function RoleSetup() {
   const router = useRouter();
   const { user } = useAppAuth();
   const { completeOnboarding } = useProfileMutations();
+  const { refetch: refetchProfile } = useProfile();
   const { create } = useCompanyMutations();
   const { accept } = useInviteMutations();
   const { refresh, setCompanyId } = useActiveCompany();
@@ -60,6 +63,14 @@ export default function RoleSetup() {
   const [error, setError] = useState<string | undefined>();
 
   const finish = async (activeCompanyId?: string) => {
+    // The app gate (app/(app)/_layout) reads the profile from the shared
+    // linked-query cache when it mounts, and that cache only moves on its own
+    // round trip — a store write is not enough. Navigating straight after
+    // `completeOnboarding` made the gate read the pre-write `onboarded: false`
+    // and redirect back here with the invite already consumed. Refresh the
+    // query (which writes the `profile:<id>` cache entry the gate will read)
+    // before leaving the screen.
+    await refetchProfile();
     await refresh();
     if (activeCompanyId) setCompanyId(activeCompanyId);
     router.replace('/(app)/(tabs)/home');
@@ -114,7 +125,7 @@ export default function RoleSetup() {
         await finish();
       }
     } catch (e) {
-      setError(e instanceof Error ? e.message : t('onboarding.role.errGeneric'));
+      setError(dbErrorMessage(e, t) ?? describeError(e, { fallback: t('onboarding.role.errGeneric') }));
       setBusy(false);
     }
   };

apps/mobile/src/app/_layout.tsx

@@ -13,6 +13,7 @@ import { I18nProvider } from '@/lib/i18n';
 import { useAppAuth } from '@/lib/supabase-stores';
 import { usePushRegistration } from '@/lib/hooks/use-push';
 import { useInviteMutations } from '@/lib/hooks/use-invites';
+import { classifyInviteError } from '@chrono/sdk';
 import { clearPendingInvite, getPendingInvite } from '@/lib/pending-invite';
 import { companyAppUserId } from '@/lib/revenuecat-constants';
 import { configureRevenueCat, subscribeCustomerInfo } from '@/lib/revenuecat';
@@ -121,8 +122,7 @@ function PendingInviteRedeemer() {
         // on next launch instead of discarding an otherwise-valid invite.
         // Any other failure (used/expired/invalid) is not recoverable, so
         // clear it — a bad token must not retry every launch.
-        const message = e instanceof Error ? e.message : '';
-        if (!message.includes('seat limit')) {
+        if (classifyInviteError(e) !== 'seat_limit') {
           await clearPendingInvite();
         }
       }

apps/mobile/src/components/common/ErrorState.tsx

@@ -2,6 +2,7 @@ import { StyleSheet, View } from 'react-native';
 import { Button, EmptyState, Txt, spacing } from '@chrono/ui';
 
 import { useT } from '@/lib/i18n';
+import { dbErrorMessage } from '@/lib/db-error';
 
 function extractMessage(error: unknown): string {
   if (!error) return '';
@@ -83,7 +84,7 @@ export function ErrorState({
     <EmptyState
       icon="alert-circle-outline"
       title={title ?? t('compb.error.title')}
-      subtitle={message ?? describeError(error, describe)}
+      subtitle={message ?? dbErrorMessage(error, t) ?? describeError(error, describe)}
       action={onRetry ? <Button title={t('common.retry')} variant="secondary" onPress={onRetry} /> : undefined}
       tone="danger"
     />
@@ -104,14 +105,15 @@ export interface InlineErrorProps {
  * validation string, or an `error` to have it described.
  */
 export function InlineError({ error, message, describe, center = false }: InlineErrorProps) {
+  const t = useT();
   // A non-empty `message` wins; otherwise describe an `error` if one was given.
   // An absent/empty `message` with no `error` renders nothing — it must NOT fall
   // through to describeError(undefined), which would show a generic fallback on
   // a pristine form that simply passed `message={maybeUndefinedString}`.
   const text = message != null && message !== ''
     ? message
     : error != null
-      ? describeError(error, describe)
+      ? dbErrorMessage(error, t) ?? describeError(error, describe)
       : '';
   if (!text) return null;
   return (

apps/mobile/src/lib/db-error.ts

@@ -0,0 +1,20 @@
+import { parseDbError } from '@chrono/sdk';
+import type { TFn } from '@/lib/i18n';
+
+/**
+ * Translate an error raised by a DB function. Those raise stable slugs, never
+ * copy (see the error-slug migration), so the sentence lives in the `db.*`
+ * catalog and any values the DB appended arrive as `{0}`, `{1}`, …
+ *
+ * Returns null when the error is not a known slug — a PostgREST/network
+ * failure, or a slug this app version has no copy for — so callers fall back to
+ * their own generic message rather than showing a raw slug.
+ */
+export function dbErrorMessage(error: unknown, t: TFn): string | null {
+  const parsed = parseDbError(error);
+  if (!parsed) return null;
+  const key = `db.${parsed.slug}`;
+  const params = Object.fromEntries(parsed.params.map((value, i) => [String(i), value]));
+  const message = t(key, params);
+  return message === key ? null : message;
+}

apps/mobile/src/lib/i18n/catalogs/dbErrors.ts

@@ -0,0 +1,145 @@
+import type { CatalogSlice } from '../types';
+
+/**
+ * Messages for the slugs raised by DB functions (`raise exception 'slug'`, see
+ * the error-slug migration). A slug the catalog does not know falls back to the
+ * generic error copy, so a new DB error never shows its raw slug to a user.
+ * Values the DB appends to a slug arrive as `{0}`, `{1}`, … in order.
+ */
+export const dbErrorsCatalog: CatalogSlice = {
+  en: {
+    // Roles and members
+    'db.role-admin-grant-forbidden': 'Only an admin can grant or change the admin role.',
+    'db.role-change-forbidden': 'Only an admin can change your role.',
+    'db.seat-limit-reached':
+      'This company has reached its plan seat limit ({0}). Ask an admin to upgrade.',
+
+    // Invites
+    'db.invite-identity-immutable': "An invite's email, role and company cannot be changed.",
+    'db.invite-role-forbidden': 'Only an admin can invite a manager or an admin.',
+
+    // Time entries
+    'db.time-entry-invoiced-locked': 'This time entry is already invoiced and can no longer be edited.',
+    'db.capacity-exceeded': 'Monthly capacity exceeded (22 × {0}h).',
+    'db.vacation-allowance-exceeded': 'Vacation allowance exceeded ({0} days per year).',
+    'db.time-net-negative-delete': 'Deleting this entry would leave negative net time for this project month.',
+    'db.time-net-negative-remove': 'Removing this entry would leave negative net time for this project month.',
+    'db.time-net-negative-correction': 'This correction would leave negative net time for this project month.',
+
+    // Invoices
+    'db.invoice-company-mismatch': 'This invoice does not belong to its project company.',
+    'db.invoice-foreign-user': 'You cannot write an invoice for another user.',
+    'db.invoice-invalid-project': 'That project is not valid for this invoice.',
+    'db.invoice-freelancer-status-forbidden': 'Freelancers can only draft or submit an invoice.',
+    'db.invoice-settlement-status-reserved': 'Settlement statuses are set by the monthly settlement, not by hand.',
+    'db.invoice-settled-immutable': 'A settled invoice can only be cancelled, not reverted.',
+
+    // Projects, revenue and costs
+    'db.project-not-found': 'Project not found.',
+    'db.company-not-found': 'Company not found.',
+    'db.revenue-source-not-found': 'Revenue source not found.',
+    'db.revenue-recognize-forbidden': 'Only a manager can recognize revenue.',
+    'db.revenue-correct-forbidden': 'Only a manager can correct revenue.',
+    'db.revenue-paid-forbidden': 'Only a manager can mark revenue as paid.',
+    'db.revenue-entries-not-found': 'No matching revenue entries.',
+    'db.revenue-entries-multi-company': 'Revenue entries must all belong to the same company.',
+    'db.revenue-net-negative-delete': 'Deleting this entry would leave negative net revenue for this project month.',
+    'db.revenue-net-negative-remove': 'Removing this entry would leave negative net revenue for this project month.',
+    'db.revenue-net-negative-correction': 'This correction would leave negative net revenue for this project month.',
+    'db.project-costs-not-found': 'No matching project costs.',
+    'db.project-costs-multi-company': 'Project costs must all belong to the same company.',
+    'db.project-costs-paid-forbidden': 'Only a manager can mark project costs as paid.',
+    'db.project-cost-reimbursable-not-payable':
+      'A reimbursable cost is settled by reimbursing it, not by marking it paid.',
+    'db.referral-total-exceeded': 'Referral shares cannot exceed 100% for a project (this would reach {0}%).',
+    'db.settle-forbidden': 'Only a manager can settle a project month.',
+
+    // Remuneration
+    'db.rem-compute-forbidden': 'Only a manager can compute the remuneration month.',
+    'db.rem-lock-forbidden': 'Only a manager can lock the remuneration month.',
+    'db.rem-month-locked': 'This remuneration month is locked.',
+    'db.rem-month-not-computed': 'This remuneration month has not been computed yet.',
+    'db.rem-license-recipients-invalid':
+      'License distribution needs exactly two license recipients ({0} found).',
+
+    // Company settings
+    'db.working-weekdays-empty': 'Pick at least one working day.',
+    'db.working-weekdays-out-of-range': 'Working days must be between Monday and Sunday.',
+    'db.working-weekdays-duplicate': 'A working day cannot be listed twice.',
+    'db.product-pool-project-invalid': 'Pick an active product pool project from this company.',
+  },
+  fr: {
+    // Rôles et membres
+    'db.role-admin-grant-forbidden': 'Seul un admin peut attribuer ou modifier le rôle admin.',
+    'db.role-change-forbidden': 'Seul un admin peut modifier votre rôle.',
+    'db.seat-limit-reached':
+      'Cette entreprise a atteint la limite de sièges de son forfait ({0}). Demandez à un admin de le faire évoluer.',
+
+    // Invitations
+    'db.invite-identity-immutable':
+      "L'e-mail, le rôle et l'entreprise d'une invitation ne peuvent pas être modifiés.",
+    'db.invite-role-forbidden': 'Seul un admin peut inviter un manager ou un admin.',
+
+    // Saisies de temps
+    'db.time-entry-invoiced-locked': 'Cette saisie est déjà facturée et ne peut plus être modifiée.',
+    'db.capacity-exceeded': 'Capacité mensuelle dépassée (22 × {0} h).',
+    'db.vacation-allowance-exceeded': 'Solde de congés dépassé ({0} jours par an).',
+    'db.time-net-negative-delete':
+      'Supprimer cette saisie rendrait le temps net négatif pour ce mois de projet.',
+    'db.time-net-negative-remove':
+      'Retirer cette saisie rendrait le temps net négatif pour ce mois de projet.',
+    'db.time-net-negative-correction':
+      'Cette correction rendrait le temps net négatif pour ce mois de projet.',
+
+    // Factures
+    'db.invoice-company-mismatch': "Cette facture n'appartient pas à l'entreprise de son projet.",
+    'db.invoice-foreign-user': 'Vous ne pouvez pas créer de facture pour un autre utilisateur.',
+    'db.invoice-invalid-project': "Ce projet n'est pas valide pour cette facture.",
+    'db.invoice-freelancer-status-forbidden':
+      'Un freelance peut seulement mettre une facture en brouillon ou la soumettre.',
+    'db.invoice-settlement-status-reserved':
+      'Les statuts de règlement sont définis par le règlement mensuel, pas manuellement.',
+    'db.invoice-settled-immutable': 'Une facture réglée peut seulement être annulée, pas rétablie.',
+
+    // Projets, revenus et coûts
+    'db.project-not-found': 'Projet introuvable.',
+    'db.company-not-found': 'Entreprise introuvable.',
+    'db.revenue-source-not-found': 'Source de revenu introuvable.',
+    'db.revenue-recognize-forbidden': 'Seul un manager peut constater du revenu.',
+    'db.revenue-correct-forbidden': 'Seul un manager peut corriger un revenu.',
+    'db.revenue-paid-forbidden': 'Seul un manager peut marquer un revenu comme payé.',
+    'db.revenue-entries-not-found': 'Aucune écriture de revenu correspondante.',
+    'db.revenue-entries-multi-company':
+      'Les écritures de revenu doivent toutes appartenir à la même entreprise.',
+    'db.revenue-net-negative-delete':
+      'Supprimer cette écriture rendrait le revenu net négatif pour ce mois de projet.',
+    'db.revenue-net-negative-remove':
+      'Retirer cette écriture rendrait le revenu net négatif pour ce mois de projet.',
+    'db.revenue-net-negative-correction':
+      'Cette correction rendrait le revenu net négatif pour ce mois de projet.',
+    'db.project-costs-not-found': 'Aucun coût de projet correspondant.',
+    'db.project-costs-multi-company':
+      'Les coûts de projet doivent tous appartenir à la même entreprise.',
+    'db.project-costs-paid-forbidden':
+      'Seul un manager peut marquer des coûts de projet comme payés.',
+    'db.project-cost-reimbursable-not-payable':
+      'Un coût remboursable se règle par un remboursement, pas en le marquant payé.',
+    'db.referral-total-exceeded':
+      "Les parts d'apport d'affaires ne peuvent pas dépasser 100 % sur un projet (ce changement atteindrait {0} %).",
+    'db.settle-forbidden': 'Seul un manager peut clôturer un mois de projet.',
+
+    // Rémunération
+    'db.rem-compute-forbidden': 'Seul un manager peut calculer le mois de rémunération.',
+    'db.rem-lock-forbidden': 'Seul un manager peut verrouiller le mois de rémunération.',
+    'db.rem-month-locked': 'Ce mois de rémunération est verrouillé.',
+    'db.rem-month-not-computed': "Ce mois de rémunération n'a pas encore été calculé.",
+    'db.rem-license-recipients-invalid':
+      'La répartition de licence nécessite exactement deux bénéficiaires ({0} trouvés).',
+
+    // Paramètres d'entreprise
+    'db.working-weekdays-empty': 'Choisissez au moins un jour travaillé.',
+    'db.working-weekdays-out-of-range': 'Les jours travaillés doivent être compris entre lundi et dimanche.',
+    'db.working-weekdays-duplicate': 'Un jour travaillé ne peut pas être listé deux fois.',
+    'db.product-pool-project-invalid': 'Choisissez un projet de pool produit actif de cette entreprise.',
+  },
+};

apps/mobile/src/lib/i18n/catalogs/index.ts

@@ -8,6 +8,7 @@ import { detailsCatalog } from './details';
 import { componentsACatalog } from './componentsA';
 import { componentsBCatalog } from './componentsB';
 import { remCatalog } from './rem';
+import { dbErrorsCatalog } from './dbErrors';
 
 const slices = [
   commonCatalog,
@@ -19,6 +20,7 @@ const slices = [
   componentsACatalog,
   componentsBCatalog,
   remCatalog,
+  dbErrorsCatalog,
 ];
 
 function merge(locale: Locale): Catalog {

backend/supabase/migrations/20260812000000_invite_accept_if_already_member.sql

@@ -0,0 +1,82 @@
+-- If an invite is already marked accepted but the caller is an active member of
+-- that company, treat accept as success. Covers: soft-delete revive races,
+-- null accepted_by, and onboarding retries after a prior partial join.
+--
+-- Errors are raised as stable slugs, never user-facing copy: the client maps
+-- them to a translated message (see classifyInviteError in @chrono/sdk).
+
+create or replace function public.accept_company_invite(p_token text)
+returns uuid
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_invite public.company_invites;
+  v_uid uuid := (select auth.uid());
+  v_token text := nullif(btrim(p_token), '');
+begin
+  if v_uid is null then
+    raise exception 'invite-unsigned';
+  end if;
+
+  if v_token is null then
+    raise exception 'invite-not-found';
+  end if;
+
+  select * into v_invite
+  from public.company_invites
+  where token = v_token
+  for update;
+
+  if v_invite.id is null then
+    raise exception 'invite-not-found';
+  end if;
+  if v_invite.revoked_at is not null then
+    raise exception 'invite-revoked';
+  end if;
+  if v_invite.accepted_at is not null then
+    if v_invite.accepted_by is not distinct from v_uid
+       or exists (
+         select 1
+         from public.company_members cm
+         where cm.company_id = v_invite.company_id
+           and cm.user_id = v_uid
+           and cm.deleted = false
+       ) then
+      perform public.internal_insert_member_from_invite(
+        v_invite.company_id,
+        v_uid,
+        v_invite.role
+      );
+      -- Ensure accepted_by is stamped when reclaiming a used invite as a member.
+      if v_invite.accepted_by is null then
+        update public.company_invites
+        set accepted_by = v_uid, updated_at = now()
+        where id = v_invite.id;
+      end if;
+      return v_invite.company_id;
+    end if;
+    raise exception 'invite-used';
+  end if;
+  if v_invite.expires_at < now() then
+    raise exception 'invite-expired';
+  end if;
+
+  perform public.internal_insert_member_from_invite(
+    v_invite.company_id,
+    v_uid,
+    v_invite.role
+  );
+
+  update public.company_invites
+  set accepted_at = now(), accepted_by = v_uid, updated_at = now()
+  where id = v_invite.id;
+
+  return v_invite.company_id;
+end;
+$$;
+
+revoke all on function public.accept_company_invite(text) from public;
+revoke all on function public.accept_company_invite(text) from anon;
+grant execute on function public.accept_company_invite(text) to authenticated;