@bongos/core 1.19.1015 → 1.19.1017

package/docs/api/openapi.json

@@ -89,6 +89,10 @@
       "name": "closeness",
       "description": "Endpoints under `/api/bongos/closeness`."
     },
+    {
+      "name": "community",
+      "description": "Endpoints under `/api/bongos/community`."
+    },
     {
       "name": "connections",
       "description": "Endpoints under `/api/bongos/connections`."
@@ -4391,6 +4395,34 @@
         ]
       }
     },
+    "/community/search": {
+      "get": {
+        "operationId": "get_community_search",
+        "tags": [
+          "community"
+        ],
+        "summary": "GET /community/search",
+        "description": "a name/discipline search under EXACTLY the public-profile visibility rules (D4): a hide_stats account is findable by name but drops out of a discipline-filtered result (disciplines are rollup-derived, and the rollup is what hide_stats suppresses); private and provisional accounts never appear. no-store: the same hide-must-beat-the-cache posture as /profiles/:handle (ADR 0171 D5) — this reads the identical predicate and a flip must be reflected on the very next request.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/community-search.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetCommunitySearchResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/connections": {
       "get": {
         "operationId": "get_connections",
@@ -19808,6 +19840,23 @@
           "why"
         ]
       },
+      "GetCommunitySearchResponse": {
+        "type": "object",
+        "properties": {
+          "query": {},
+          "discipline": {},
+          "count": {},
+          "results": {},
+          "page": {}
+        },
+        "required": [
+          "query",
+          "discipline",
+          "count",
+          "results",
+          "page"
+        ]
+      },
       "GetConnectionsDegreeHandleResponse": {
         "type": "object",
         "properties": {
@@ -20934,10 +20983,12 @@
       "GetScoutingResponse": {
         "type": "object",
         "properties": {
-          "builders": {}
+          "builders": {},
+          "name_only": {}
         },
         "required": [
-          "builders"
+          "builders",
+          "name_only"
         ]
       },
       "GetSecurityDocsResponse": {
@@ -24157,6 +24208,10 @@
           "recommendation": {
             "type": "string",
             "maxLength": 16
+          },
+          "filed_via": {
+            "type": "string",
+            "maxLength": 16
           }
         },
         "required": [
@@ -26414,9 +26469,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 416,
-  "x-schema-count": 453,
+  "x-endpoint-count": 417,
+  "x-schema-count": 454,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 308,
+  "x-response-schemas": 309,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 416 endpoints across 70 route files.
+> **Generated from the live route files** — the route file is authoritative. 417 endpoints across 71 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -187,6 +187,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/closeness/weights` | `any-builder` | — | the MODEL is not private, and publishing it is the whole point of the weights being data. |
 | GET | `/api/bongos/closeness/with/:builderId` | `any-builder` | — | One pair — "why am I close to THEM", asked directly rather than by paging the graph. |
 
+## `community` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/community/search` | `public` | — | a name/discipline search under EXACTLY the public-profile visibility rules (D4): a hide_stats account is findable by name but drops out o… |
+
 ## `connections` (7)
 
 | Method | Path | Rank | Body | Description |
@@ -347,7 +353,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/inbox` | `any-builder` | — | read open ideas; skill-friction rows filtered by viewer rank. |
-| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `goal_id`, `grade`, `template_key`, `field_values`, `recommendation` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
+| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `goal_id`, `grade`, `template_key`, `field_values`, `recommendation`, `filed_via` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` |  |
 | PATCH | `/api/bongos/inbox/:id/body` | `any-builder` | `body_md` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |

package/docs/architecture.md

@@ -166,9 +166,12 @@ idea_inbox(id, title, body_md, kind, suggested_version, suggested_priority, capt
            merged_into_idea_id? FK idea_inbox, triage_note?,   -- mig core_195 (task 1002447): what a
            -- triage VERDICT decided -- which idea a merge folded into, and why a discard happened.
            -- CHECK (merged_into_idea_id IS NULL OR status = 'merged') -- no merge chains.
-           suggested_goal_id? FK goals ON DELETE SET NULL)  -- mig core_222 (task 1003060, goal 1000071):
+           suggested_goal_id? FK goals ON DELETE SET NULL,  -- mig core_222 (task 1003060, goal 1000071):
            -- an ADVISORY routing hint for rows that did NOT convert (homeless/soft-landed/Discord).
            -- The binding home for routed work is tasks.goal_id; nothing may gate on this column.
+           filed_via? text CHECK IN ('hall'|'cli'|'discord'|'planning'|'api'))  -- mig core_253_idea_filed_via (task 1004233, sky part 5):
+           -- WHICH DOOR filed it, read off the SESSION (web=hall, cli=cli, else api; 'planning' by capture.js
+           -- --via planning; the Discord bot names 'discord'). NULL = older than the column; never backfilled.
 done_when_criteria(id, version_id, criterion_id, criterion_md, satisfied bool, satisfied_by_task_id,
                    checked_at, sort_order, UNIQUE(version_id, criterion_id))  -- 13 seeded (V1 + PMS-V2)
 task_criteria(task_id FK tasks, criterion_id FK done_when_criteria, source 'backfill'|'manual'|'planning',

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2035 strings** across 3 surfaces · 1736 distinct pieces of copy · 2035 certain, 0 heuristic · 212 shown in more than one place.
+**2037 strings** across 3 surfaces · 1738 distinct pieces of copy · 2037 certain, 0 heuristic · 212 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 102 | 1544 |
+| `builders-hall` | `modules/hall-ui/public` | 102 | 1546 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 391 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7926e30955d2` | 3x | ← Back to goal | modules/hall-ui/public/goals.html:199, modules/hall-ui/public/goals.html:210, modules/hall-ui/public/goals.html:222 |
 | … | | _172 more in the JSON registry_ | |
 
-## `builders-hall` — 1544 strings
+## `builders-hall` — 1546 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -618,6 +618,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a53e0cde7ff7` | certain | Link first — your rank role is set the moment you join. | `modules/hall-ui/public/settings.js:840` |
 | `64e85f1691f9` | certain | Link your Discord account and you're added to the {{worldName}} server with your rank role already set — no in | `modules/hall-ui/public/settings.html:61` |
 | `9a31cf5fe05b` | certain | Linking opens Discord's consent screen; unlinking applies at once. | `modules/hall-ui/public/settings.html:66` |
+| `8e067a257eed` | certain | Listed by name only | `modules/hall-ui/public/people.html:53` |
 | `daf84bba41b1` | certain | Loading goals… | `modules/hall-ui/public/goals.html:44` |
 | `93ceeaa4e226` | certain | Loading idea | `modules/hall-ui/public/idea.html:32` |
 | `2b5826012538` | certain | Loading profile… | `modules/hall-ui/public/profile.html:34` |
@@ -1114,6 +1115,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1492` |
 | `25794c439321` | certain | Then copy the project onto your machine and run the one-shot bootstrap (it checks your setup, installs depende | `modules/hall-ui/public/hall-render.js:890` |
 | `df316c3484de` | certain | Then drive it however you like: | `modules/hall-ui/public/hall-render.js:825` |
+| `48ace42c55ef` | certain | These builders are open to recruiting but keep their cross-project record private, so only who they are is sho | `modules/hall-ui/public/people.html:54` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1303` |
 | `5151cf635644` | certain | They have asked to connect. | `modules/hall-ui/public/profile-connections.js:203` |
 | `10219b02433e` | certain | They join as a member once they accept — you can change that afterwards. Nobody is added until they do. | `modules/hall-ui/public/goals-render.js:1235` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2035,
-    "unique_ids": 1736,
-    "certain": 2035,
+    "strings": 2037,
+    "unique_ids": 1738,
+    "certain": 2037,
     "heuristic": 0,
     "duplicate_ids": 212
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 102,
-      "strings": 1544
+      "strings": 1546
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -7071,6 +7071,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "8e067a257eed",
+      "surface": "builders-hall",
+      "text": "Listed by name only",
+      "file": "modules/hall-ui/public/people.html",
+      "line": 53,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "daf84bba41b1",
       "surface": "builders-hall",
@@ -11535,6 +11544,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "48ace42c55ef",
+      "surface": "builders-hall",
+      "text": "These builders are open to recruiting but keep their cross-project record private, so only who they are is shown. They are never ranked, and a role filter never finds them.",
+      "file": "modules/hall-ui/public/people.html",
+      "line": 54,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "a0140098c0e0",
       "surface": "builders-hall",

package/docs/file-map.md

@@ -283,7 +283,6 @@
 │   │   ├── world/                  ← the six production plates + <file>.json provenance sidecars (embed-prompt.mjs --scan clean): r2-chrome-blobs-set.jpg, r2-chrome-blob-one.jpg, r2-bongos-chrome-b.jpg (black plates, dark mode, lighten) and their -cut.webp alpha twins (light mode); og-card.jpg (the social card, captured from the page)
 │   │   ├── cosmos.css              ← the HUB component sheet (task 1002696): contract tier synced to the pack, its own derived + dark tiers, the .btn/.chip/.strip/.proj/.tbl vocabulary; measured by tests/cosmos_token_contrast.mjs
 │   │   └── verro-medallion.png     ← the Verro Labs mark (apex-only block)
-│   └── world/assets/               ← the RETIRED gate's clouds/creatures/plates (task 1002407; the gate folded into / in 1003233) — not the chrome plates
 │
 ├── public/                         ← example.com — the game (product)
 │   ├── index.html
@@ -376,7 +375,7 @@ tests/
 ├── canonical_profile_url.mjs      ← (task 1002804, goal 1000045 criterion C1, ADR 0214): the P08 proof — the canonical profile URL is resolved in ONE place, `handle` reaches `GET /builders/:id/profile` under the EXISTENCE predicate (so a hidden builder keeps their address), absent/provisional/private are BYTE-IDENTICAL so the numeric-id redirect cannot become an existence oracle, and the widened response still leaks no private column. Real core router over a WHERE-derived fake pool on a real socket; the real browser script in a vm above a stub DOM, run twice — as shipped (every surface dark, because `/u/<handle>` still 404s) and with the liveness constant flipped, so the three live behaviours are proved rather than deferred. Asserts its own DB-free lane membership. DB-free `unit` lane.
 ├── application_lifecycle.mjs     ← (task 1002284, goal 1000045, ADR 0201 D1/D3.2/D4 + ADR 0208): the application lifecycle EXECUTED — apply, list-pending, approve, decline, RESCIND (`invited → dismissed`), idempotency on the state already held, and the two things that must never happen: a builder without `access_request.review` moving the queue, and a VOUCH buying admission. Real router, REAL `requirePermission` resolving against the real government catalog's rank seed, and the REAL `hasInvitedAccessRequest` from `src/bongos/db-kernel.js` pointed at the same in-memory `access_requests` table (a stubbed `./pool`), whose filter is built from each statement's own WHERE clause and which refuses a predicate it cannot read. The no-authority proof seeds a vouched row and asserts the approve path and the admission read are byte-identical to the unvouched twin, and that no statement on either path names `applicant_github_id`/`vouched_at`. DB-free `unit` lane.
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
-├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
+├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Since task 1002291 (R15, ADR 0334) it also proves the directory's NAME-ONLY tier: a hidden, reachable builder is listed by login, name and avatar alone, never ranked, and none of their record reaches the body. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked five ways. DB-free `unit` lane. The page half is `people_name_only.mjs` (the real people.js + kit in a vm).
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 ├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.

package/docs/module-api-changelog.md

@@ -2503,6 +2503,10 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.1014 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1013 with no explicit bump. run 36076310606. (task 1002620)
   1.19.1015 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.1014 with no explicit bump. run 36078214605. (task 1002620)
+        landed since 1.19.1014 with no explicit bump. run 36078624472. (task 1002620)
+  1.19.1016 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1015 with no explicit bump. run 36080388706. (task 1002620)
+  1.19.1017 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1016 with no explicit bump. run 36081753087. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_253_idea_filed_via.sql

@@ -0,0 +1,59 @@
+-- core_253_idea_filed_via.sql — WHERE AN IDEA WAS FILED FROM (task 1004233, sky part 5 of 5;
+-- goal 1000095; ADR 0331 §4).
+--
+-- The sky draws a thought differently when a session filed it under a person's
+-- name rather than the person filing it themselves (the "claude layer", off by
+-- default). The prototype GUESSED that from the idea's text; this column makes
+-- it a ledger fact, written by every door an idea can come through:
+--   'hall'     — the hall's ideas form or the sky's composer (a web session)
+--   'cli'      — scripts/gds/capture.js and spark.js (a CLI session)
+--   'discord'  — the Discord inbound bot (#ideas, #bugs)
+--   'planning' — a planning session's captures (capture.js --via planning)
+--   'api'      — anything else through POST /inbox, or a program on the port
+-- The closed set lives in modules/ideas/projection.js (FILED_VIA_VALUES); the
+-- CHECK mirrors it so a bad value is a named 400 at the route and never a
+-- constraint-violation 500 (the ideas_grades recommendation precedent). The
+-- server reads the value off the SESSION that filed (a web cookie is the hall,
+-- a device-flow token is the CLI, anything else the API); the one value a body
+-- may add is 'planning', which no session can tell from 'cli'.
+--
+-- NULLABLE, NO DEFAULT, NO BACKFILL — and that is the point. Every row that
+-- predates this column was filed before the ledger recorded where, and the sky
+-- says exactly that ("filed before the ledger recorded where"; such rows SHOW
+-- by default — owner, 2026-09-24). NULL is not 'cli'. Guessing a value for
+-- historic rows from their text would put the prototype's heuristic INTO the
+-- ledger, which is precisely what this part exists to end.
+--
+-- CORE, not modules/ideas/migrations/: idea_inbox is a core table and a module
+-- migration may touch only its own ideas_-prefixed objects (ADR 0083 §Decision
+-- #5; the core_195 / core_222 precedent). Forward-safe by construction: an
+-- additive nullable column every existing reader selects by explicit list
+-- (tests/migrations_forward_safe.mjs).
+
+BEGIN;
+
+ALTER TABLE idea_inbox
+  ADD COLUMN IF NOT EXISTS filed_via text;
+
+-- CHECK constraints have no ADD ... IF NOT EXISTS, so guard the add (the
+-- migration 042 / core_195 idiom) and keep the file replay-safe.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conrelid = 'idea_inbox'::regclass
+       AND conname = 'idea_inbox_filed_via_known'
+  ) THEN
+    ALTER TABLE idea_inbox
+      ADD CONSTRAINT idea_inbox_filed_via_known
+      CHECK (filed_via IS NULL OR filed_via IN ('hall', 'cli', 'discord', 'planning', 'api'));
+  END IF;
+END $$;
+
+COMMENT ON COLUMN idea_inbox.filed_via IS
+  'Which door filed this idea: hall | cli | discord | planning | api. NULL = filed before the column existed; never backfilled by guessing.';
+
+INSERT INTO schema_migrations (version) VALUES ('core_253_idea_filed_via')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;

package/modules/agents/pollers/event-router.js

@@ -385,6 +385,8 @@ async function deliverToInbox(deliver, parts) {
     title: parts.title,
     bodyMd: `${parts.provenance}\n\n${parts.body}`,
     capturedBy: null,
+    // task 1004233 (sky part 5): a poller is a program on the port — 'api'.
+    filedVia: 'api',
   });
   const id = idea && idea.id;
   return id !== null && id !== undefined ? `idea:${id}` : null;

package/modules/discord/discord-bugs.js

@@ -242,6 +242,8 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       bodyMd: description,
       kind: 'bug',
       capturedBy: builder ? builder.id : null,
+      // task 1004233 (sky part 5): the door — a port caller names its own.
+      filedVia: 'discord',
       filerRank,
       goalId: goal ? goal.id : null,
       suggestedPriority: 3,

package/modules/discord/discord-inbound.js

@@ -175,6 +175,9 @@ async function recordInboundIdea({ discordUserId, content, imageUrls = [], messa
       title: derived.title,
       bodyMd,
       capturedBy: builder ? builder.id : null,
+      // task 1004233 (sky part 5): the door, named here because this path calls
+      // the port, not the route — there is no session to read it off.
+      filedVia: 'discord',
       // kind left null → inbox.captureIdea auto-classifies. We never pass
       // 'criterion-proposal' (the rank-gated kind) from this path.
       // suggestedGoalId/suggestedVersion are ADVISORY-ONLY columns — this call

package/modules/hall-ui/public/people.html

@@ -44,6 +44,17 @@
                rollup offers; people.js writes it. -->
           <p class="ledger__note" id="people-foot" hidden></p>
         </section>
+
+        <!-- task 1002291 (ADR 0334): builders who hid their cross-project record
+             but are still open to recruiting, listed by name alone (privacy spec
+             D2). Its own panel because they are never ranked; hidden unless the
+             response carries a row, and people.js writes it. -->
+        <section class="scroll" id="people-named-scroll" aria-labelledby="people-named-h" hidden>
+          <h2 id="people-named-h" class="scroll__h">Listed by name only<span class="count-pill" id="people-named-count" hidden></span></h2>
+          <p class="scroll__lede" id="people-named-lede">These builders are open to recruiting but keep their cross-project record private, so only who they are is shown. They are never ranked, and a role filter never finds them.</p>
+          <div id="people-named-body"></div>
+          <p class="ledger__note" id="people-named-foot" hidden></p>
+        </section>
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>

package/modules/hall-ui/public/people.js

@@ -16,6 +16,13 @@
 // exists); then the four figures in tabular columns, the crafts as chips, and
 // when they were last seen. Search, a sort and a craft lens are the kit's
 // filter bar; the rows page through the kit's pager.
+//
+// THE SECOND TIER (task 1002291, ADR 0334). The response also carries
+// `name_only`: builders who hid their cross-project record but are still open to
+// recruiting, which privacy spec D2 lists "name-only". They get their own panel
+// of identity cells because they have no record to rank, sort or filter by role:
+// the lenses below leave them alphabetical, a search reads their name, and a
+// role filter never matches them.
 // All network values render through OTBKit.esc — never raw innerHTML.
 (function () {
   'use strict';
@@ -26,6 +33,10 @@
   var sub = document.getElementById('people-sub');
   var countPill = document.getElementById('people-count');
   var foot = document.getElementById('people-foot');
+  var namedScroll = document.getElementById('people-named-scroll');
+  var namedCount = document.getElementById('people-named-count');
+  var namedBody = document.getElementById('people-named-body');
+  var namedFoot = document.getElementById('people-named-foot');
 
   function fmtRecency(iso) {
     if (!iso) return '—';
@@ -97,6 +108,7 @@
   var DIRECTORY_LIMIT = 500;
 
   var all = [];
+  var named = [];
   var query = '';
   var craft = '';
   var sortBy = '';
@@ -108,6 +120,17 @@
       (Array.isArray(b.disciplines) ? b.disciplines.join(' ') : '')).toLowerCase();
     return hay.indexOf(query) !== -1;
   }
+  // A name-only row carries no roles (they are part of the hidden record), so a
+  // role filter never matches it; a search reads the name.
+  function matchesNamed(b) {
+    if (craft) return false;
+    if (!query) return true;
+    return ((b.github_login || '') + ' ' + (b.display_name || '')).toLowerCase().indexOf(query) !== -1;
+  }
+  // A count that cannot overstate a clipped read: a full response means "at least".
+  function countText(n) {
+    return n >= DIRECTORY_LIMIT ? fmtInt(DIRECTORY_LIMIT) + '+' : fmtInt(n);
+  }
   // The server's order IS "track record" (ADR 0141 §4 ranks the rollup); the
   // other lenses re-order the loaded set client-side, ties keeping that order.
   var SORTS = {
@@ -128,6 +151,8 @@
 
   var pager = kit.makePager('people', 'hall-people-per-page');
   var ledger = null;
+  var namedPager = kit.makePager('people-named', 'hall-people-named-per-page');
+  var namedLedger = null;
 
   function rowHtml(b) {
     return '<tr>' +
@@ -141,12 +166,45 @@
       '</tr>';
   }
 
+  // The identity cell and nothing else: every other column is the record hidden.
+  function namedRowHtml(b) {
+    return '<tr><td>' + whoHtml(b) + '</td></tr>';
+  }
+
   function rerender() {
     if (ledger) ledger.render(ordered(all.filter(matches)));
+    if (namedLedger) namedLedger.render(named.filter(matchesNamed));
+  }
+
+  function mountNamed() {
+    if (!namedScroll || !named.length) return;
+    namedScroll.hidden = false;
+    if (namedCount) {
+      namedCount.textContent = countText(named.length);
+      namedCount.hidden = false;
+    }
+    // The ranked footnote's rule, for the one lens that reads this list: a full
+    // response is clipped, and a search cannot find a builder it never loaded.
+    var namedClipped = named.length >= DIRECTORY_LIMIT;
+    if (namedFoot) {
+      namedFoot.textContent = namedClipped
+        ? 'This list is clipped at the first ' + fmtInt(DIRECTORY_LIMIT) + ' by login. Search only reads what this page loaded, so a builder past that ' + fmtInt(DIRECTORY_LIMIT) + ' will not appear in it.'
+        : '';
+      namedFoot.hidden = !namedClipped;
+    }
+    namedLedger = kit.makeLedger({
+      mount: namedBody,
+      columns: ['Builder'],
+      rowHtml: namedRowHtml,
+      emptyMsg: 'No builder listed by name only matches these filters.',
+      pager: namedPager,
+    });
   }
 
-  function mountDirectory(builders) {
+  function mountDirectory(builders, nameOnly) {
     all = Array.isArray(builders) ? builders : [];
+    named = Array.isArray(nameOnly) ? nameOnly : [];
+    if (namedScroll) namedScroll.hidden = true;
     // An EMPTY directory is almost never missing data — it is ADR 0171's
     // fail-closed consent boundary doing exactly what it was ratified to do.
     // `listScoutingRollup` filters on `profile_state = 'active'`, every account
@@ -160,7 +218,7 @@
     // leaderboard; the accounts simply are not publicly listed — and that wrong
     // explanation is why an empty directory got filed as a bug (task 1002937).
     // Say which of the two it is, so the page is never mistaken for broken.
-    if (!all.length) {
+    if (!all.length && !named.length) {
       notice('Nobody is publicly listed here yet. A builder joins this directory once they have '
         + 'signed in on the main platform site at least once — accounts stay unlisted until then, '
         + 'and none are listed without it. Their work still shows on each project’s own ledger.');
@@ -169,16 +227,21 @@
     // A FULL PAGE IS A CLIPPED PAGE. Every sentence below has to hedge when this
     // is true, because each of them otherwise states a total the page cannot know.
     var clipped = all.length >= DIRECTORY_LIMIT;
+    // The second tier, named in the same sentence so the ranked count is never
+    // read as everyone the directory lists.
+    var namedPart = named.length ? '; ' + countText(named.length) + ' more by name only' : '';
     if (countPill) {
       countPill.textContent = clipped ? fmtInt(DIRECTORY_LIMIT) + '+' : String(all.length);
       countPill.hidden = false;
     }
     if (sub) {
-      sub.textContent = clipped
-        ? 'Showing the first ' + fmtInt(DIRECTORY_LIMIT) + ' builders across hosted projects, ranked by track record — there are more than this page can load. '
-          + 'Descriptive only — cross-project numbers never carry authority here.'
-        : fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record. '
-          + 'Descriptive only — cross-project numbers never carry authority here.';
+      var listed = clipped
+        ? 'Showing the first ' + fmtInt(DIRECTORY_LIMIT) + ' builders across hosted projects, ranked by track record — there are more than this page can load' + namedPart
+        : all.length
+          ? fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record' + namedPart
+          // Nobody ranked yet: "0 builders ranked; 2 more by name only" would read as a count of nothing.
+          : countText(named.length) + ' builder' + (named.length === 1 ? '' : 's') + ' listed across hosted projects by name only';
+      sub.textContent = listed + '. Descriptive only — cross-project numbers never carry authority here.';
     }
     // THE LENSES LIE HARDER THAN THE COUNT DOES, and that is worth its own
     // sentence. Search, sort and the craft filter all re-order the set this page
@@ -214,6 +277,7 @@
         craft = String(vals['people-craft'] || '');
         sortBy = String(vals['people-sort'] || '');
         pager.page = 1;
+        namedPager.page = 1;
         rerender();
       },
     });
@@ -224,11 +288,13 @@
       columns: ['Builder', { label: 'Projects', class: 'ledger__num' }, { label: 'Ships', class: 'ledger__num' },
         { label: currencyLabel(), class: 'ledger__num' }, { label: 'Karma', class: 'ledger__num' }, `${window.OTB.roleAxisLabel()}s`, 'Last active'],
       rowHtml: rowHtml,
-      // Reached only when the directory HAS builders and the lenses excluded them
-      // all — the empty-API case returns above with its own explanation.
-      emptyMsg: 'No listed builder matches that search.',
+      // With ranked builders, reached only when the lenses excluded them all;
+      // without, the directory lists hidden builders alone (the panel below) —
+      // the fully empty case returns above with its own explanation.
+      emptyMsg: all.length ? 'No listed builder matches that search.' : 'No builder with a public track record is listed yet.',
       pager: pager,
     });
+    mountNamed();
     rerender();
   }
 
@@ -244,7 +310,7 @@
       if (!r.ok) throw new Error('http ' + r.status);
       return r.json();
     })
-    .then(function (data) { mountDirectory(data && data.builders); })
+    .then(function (data) { mountDirectory(data && data.builders, data && data.name_only); })
     .catch(function (e) {
       // The floor is the pack's label for metic, never a hardcoded rank name —
       // and the page used to say "Archon-only", which was wrong since ADR 0210.

package/modules/hall-ui/public/people.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "People — the cross-project directory behind requireProjectCuratePage (metic+ via project.curate, or a project owner). Descriptive only; it grants no authority, and the page says so above the fold. Written with the re-skin (task 1003307); the redesign (task 1003470) added the identity cell, the sort and craft lenses, and the `search` state. Its legacy door /scouting was deleted in task 1003440; the URL 301s here. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/scouting.json carries five builders, three with avatars).",
+  "_": "People — the cross-project directory behind requireProjectCuratePage (metic+ via project.curate, or a project owner). Descriptive only; it grants no authority, and the page says so above the fold. Written with the re-skin (task 1003307); the redesign (task 1003470) added the identity cell, the sort and craft lenses, and the `search` state. Its legacy door /scouting was deleted in task 1003440; the URL 301s here. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/scouting.json carries five builders, three with avatars, plus two listed by name only — task 1002291 added that second panel; the `search` state shows its empty case).",
   "page": "/builders/people",
   "surface": "hall-ui",
   "stub": {