@bongos/core 1.19.1015 → 1.19.1017

package/tests/community_search_route.mjs

@@ -0,0 +1,385 @@
+// tests/community_search_route.mjs
+//
+// Guards GET /community/search — the PUBLIC builder search (D4,
+// docs/specs/bongos-v1-community-tab.md; task 1002979). DB-free: a fake pool
+// asserts the REAL query text literally contains the shared predicates
+// (accountVisibleSql('pa') / rollupVisibleSql('pa2'), read from
+// account-visibility.js — never re-implemented), so deleting either predicate
+// from builder-search.js fails THIS test, not just the separate structural
+// guard. The fake's own row-matching (which rows pass) is then a fixture
+// simulation layered on top, applying the same JS-twin predicates to decide
+// what the query WOULD return — it is not, on its own, proof of the SQL, and
+// isn't presented as such; the predicate-presence assertions above are what
+// actually pins the SQL.
+//
+// What this pins, in order:
+//   1. the pure helpers (clampLimit/clampOffset/escapeLikePrefix) — no DB.
+//   2. the D4 matrix, end to end through the real router + real domain fn:
+//      - a hide_stats account is findable BY NAME (name-only search).
+//      - the SAME account drops out of a DISCIPLINE-filtered search (a
+//        discipline is rollup-derived, and hide_stats suppresses the rollup).
+//      - private and provisional accounts never appear, filtered or not.
+//      - a plain active+public account is findable by name and by its real
+//        discipline, and absent under a discipline it does not hold.
+//   3. input validation (400 on missing/too-short/oversized q, oversized
+//      discipline), the 500 path, the rate limiter, and the response shape
+//      (github_id never crosses, MAX_OFFSET clamp echoed in `page`).
+//
+// Run:  node tests/community_search_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+// ---- pure helpers ----------------------------------------------------------
+
+const builderSearch = require('../modules/platform-identity/builder-search.js');
+
+await t('clampLimit: default, clamp to MAX_LIMIT, ignore garbage', () => {
+  assert.equal(builderSearch.clampLimit(undefined), builderSearch.DEFAULT_LIMIT);
+  assert.equal(builderSearch.clampLimit('not a number'), builderSearch.DEFAULT_LIMIT);
+  assert.equal(builderSearch.clampLimit(0), builderSearch.DEFAULT_LIMIT);
+  assert.equal(builderSearch.clampLimit(-5), builderSearch.DEFAULT_LIMIT);
+  assert.equal(builderSearch.clampLimit(5), 5);
+  assert.equal(builderSearch.clampLimit(9999), builderSearch.MAX_LIMIT);
+});
+
+await t('clampOffset: default 0, ignore negatives/garbage', () => {
+  assert.equal(builderSearch.clampOffset(undefined), 0);
+  assert.equal(builderSearch.clampOffset(-1), 0);
+  assert.equal(builderSearch.clampOffset('nope'), 0);
+  assert.equal(builderSearch.clampOffset(40), 40);
+});
+
+await t('escapeLikePrefix: escapes %, _ and backslash so a query cannot widen its own prefix', () => {
+  assert.equal(builderSearch.escapeLikePrefix('50%'), '50\\%');
+  assert.equal(builderSearch.escapeLikePrefix('a_b'), 'a\\_b');
+  assert.equal(builderSearch.escapeLikePrefix('a\\b'), 'a\\\\b');
+  assert.equal(builderSearch.escapeLikePrefix('plain'), 'plain');
+});
+
+await t('clampOffset: capped at MAX_OFFSET (deep pagination on a public route is a free scan-and-discard knob)', () => {
+  assert.equal(builderSearch.clampOffset(builderSearch.MAX_OFFSET), builderSearch.MAX_OFFSET);
+  assert.equal(builderSearch.clampOffset(builderSearch.MAX_OFFSET + 1), builderSearch.MAX_OFFSET);
+  assert.equal(builderSearch.clampOffset(999999999), builderSearch.MAX_OFFSET);
+});
+
+await t('the fuzzy trigram leg case-folds BOTH sides (a bug class: pg_trgm % is case-sensitive, unlike ILIKE)', () => {
+  // Static, source-level pin — the fake pool below cannot reproduce Postgres's
+  // real case sensitivity, so this is the guard that actually catches a
+  // regression to the raw (unlowered) form the bug report named.
+  const fs = require('fs');
+  const src = fs.readFileSync(require.resolve('../modules/platform-identity/builder-search.js'), 'utf8');
+  assert.match(src, /lower\(pa\.handle\) % lower\(\$1\)/, 'the handle fuzzy leg must compare lower() on both sides');
+  assert.match(src, /lower\(pa\.display_name\) % lower\(\$1\)/, 'the display_name fuzzy leg must compare lower() on both sides');
+  assert.ok(!src.includes('pa.handle % $1'), 'the raw (unlowered) form must not reappear');
+  assert.ok(!src.includes('pa.display_name % $1'), 'the raw (unlowered) form must not reappear');
+});
+
+// ---- fake engine ------------------------------------------------------------
+//
+// Reads the SAME predicates the module reads — imported from
+// account-visibility.js, never restated — so this test cannot pass by
+// agreeing with a hand-rolled copy of the rule under proof.
+const {
+  isAccountVisible, isRollupVisible, accountVisibleSql, rollupVisibleSql,
+} = require('../modules/platform-identity/account-visibility.js');
+
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+
+// One row per matrix cell D4 names, plus a plain control.
+const ACCOUNTS = [
+  // active + public + NOT hidden — the plain control.
+  { github_id: '100', handle: 'plain-vis', github_login: 'plainvis', display_name: 'Plain Visible',
+    avatar_url: null, profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false,
+    disciplines: ['engineer'] },
+  // active + public + HIDDEN — findable by name, not by discipline.
+  { github_id: '101', handle: 'hidden-builder', github_login: 'hiddenbuilder', display_name: 'Hidden Builder',
+    avatar_url: null, profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true,
+    disciplines: ['artist'] },
+  // active + PRIVATE — absent entirely, findable or not.
+  { github_id: '102', handle: 'private-builder', github_login: 'privatebuilder', display_name: 'Private Builder',
+    avatar_url: null, profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false,
+    disciplines: ['engineer'] },
+  // PROVISIONAL — absent entirely.
+  { github_id: '103', handle: 'provisional-builder', github_login: 'provbuilder', display_name: 'Provisional Builder',
+    avatar_url: null, profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false,
+    disciplines: ['engineer'] },
+  // active + public + NOT hidden, but 'octocat' sits mid-handle — a query for
+  // it is NOT a prefix match, so this fixture exercises the FUZZY (`%`) leg
+  // specifically, not the LIKE prefix leg.
+  { github_id: '104', handle: 'jax-octocat', github_login: 'jaxoctocat', display_name: 'Jax Octocat',
+    avatar_url: null, profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false,
+    disciplines: ['ui'] },
+];
+
+const engine = {
+  calls: [],
+  query: async (text, params = []) => {
+    const sql = String(text);
+    engine.calls.push({ sql, params });
+    if (engine.throwOnQuery) throw engine.throwOnQuery;
+    assert.match(sql, /WITH matches AS/, 'the query shape moved — update this fake alongside it');
+    assert.match(sql, /platform_identity_builder_project_activity/, 'the discipline CTE moved — update this fake alongside it');
+    // THE load-bearing assertions (the code-review finding this test now
+    // closes): the REAL statement text must literally contain the shared
+    // predicates, not merely SOME predicate — deleting accountVisibleSql from
+    // the 'matches' CTE, or rollupVisibleSql from the 'disc' CTE, fails HERE,
+    // independent of the fixture simulation below and independent of
+    // tests/effective_visibility_predicate.mjs's function-body-level check.
+    assert.ok(sql.includes(accountVisibleSql('pa')),
+      "the 'matches' CTE must join accountVisibleSql('pa') — the NAME-match existence floor");
+    assert.ok(sql.includes(rollupVisibleSql('pa2')),
+      "the 'disc' CTE must join rollupVisibleSql('pa2') — the DISCIPLINE-match rollup floor");
+
+    const [rawQ, likePattern, discipline, limit, offset] = params;
+    const q = String(rawQ || '').toLowerCase();
+    const like = String(likePattern || '').replace(/\\(.)/g, '$1').replace(/%$/, '').toLowerCase();
+
+    // The NAME predicate: real accountVisibleSql via its JS twin, applied to
+    // the fixture — never a hand-rolled restatement.
+    let rows = ACCOUNTS.filter(isAccountVisible).filter((a) => {
+      const handle = a.handle.toLowerCase();
+      const name = (a.display_name || '').toLowerCase();
+      return handle.startsWith(like) || name.startsWith(like) || handle.includes(q) || name.includes(q);
+    });
+
+    // The DISCIPLINE predicate: rollup-derived, so it floors on isRollupVisible
+    // (existence AND NOT hidden) exactly as the disc CTE's EXISTS clause does.
+    const disciplinesFor = (a) => (isRollupVisible(a) ? a.disciplines : null);
+
+    if (discipline) {
+      rows = rows.filter((a) => {
+        const d = disciplinesFor(a);
+        return Array.isArray(d) && d.includes(discipline);
+      });
+    }
+
+    const shaped = rows
+      .sort((a, b) => (a.handle.toLowerCase() === q ? -1 : b.handle.toLowerCase() === q ? 1 : 0))
+      .slice(offset, offset + limit)
+      .map((a) => ({
+        handle: a.handle,
+        github_login: a.github_login,
+        display_name: a.display_name,
+        avatar_url: a.avatar_url,
+        disciplines: disciplinesFor(a),
+      }));
+    return { rows: shaped };
+  },
+};
+
+// Pin the module doorway (ADR 0083) BEFORE the route loads, so its pool is the
+// fake engine above and its auth-adjacent exports satisfy the router factory.
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool: engine,
+    corsPublicGet: () => (_req, _res, next) => next(),
+    logger: () => ({ error: () => {}, info: () => {}, warn: () => {} }),
+  },
+};
+
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildCommunitySearchRoutes = require('../modules/platform-identity/routes/community-search.js');
+
+function buildApp() {
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildCommunitySearchRoutes());
+  return app;
+}
+
+function listen(app) {
+  return new Promise((resolve) => {
+    const server = app.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port }));
+  });
+}
+
+function get(port, path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch (_) {}
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const { server, port } = await listen(buildApp());
+
+// ---- D4 matrix, end to end --------------------------------------------------
+
+await t('name-only search finds the plain visible account', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=plain-vis');
+  assert.equal(r.status, 200);
+  const logins = r.json.results.map((x) => x.github_login);
+  assert.ok(logins.includes('plainvis'), 'the plain control must be found');
+});
+
+await t('a hide_stats account IS findable by NAME (D4: hiding removes the rollup, not the page)', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=hidden-builder');
+  assert.equal(r.status, 200);
+  const hit = r.json.results.find((x) => x.github_login === 'hiddenbuilder');
+  assert.ok(hit, 'the hidden account must still be found by name');
+  assert.equal(hit.disciplines, null, 'but its disciplines never attach — the rollup stays suppressed');
+});
+
+await t('the SAME hide_stats account drops out of a DISCIPLINE-filtered search', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=hidden-builder&discipline=artist');
+  assert.equal(r.status, 200);
+  const hit = r.json.results.find((x) => x.github_login === 'hiddenbuilder');
+  assert.ok(!hit, 'a discipline filter must exclude the hidden account even though it genuinely holds that discipline');
+});
+
+await t('a private account never appears — by name or by its real discipline', async () => {
+  const byName = await get(port, '/api/bongos/community/search?q=private-builder');
+  assert.ok(!byName.json.results.some((x) => x.github_login === 'privatebuilder'));
+  const byDiscipline = await get(port, '/api/bongos/community/search?q=private&discipline=engineer');
+  assert.ok(!byDiscipline.json.results.some((x) => x.github_login === 'privatebuilder'));
+});
+
+await t('a provisional account never appears', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=provisional-builder');
+  assert.ok(!r.json.results.some((x) => x.github_login === 'provbuilder'));
+});
+
+await t('a case-differing, NON-PREFIX query hits the fuzzy leg (not just the LIKE prefix leg)', async () => {
+  // 'OCTOCAT' is upper-case and is NOT a prefix of 'jax-octocat' — only the
+  // trigram `%` leg (never the prefix LIKE leg) can find it.
+  const r = await get(port, '/api/bongos/community/search?q=OCTOCAT');
+  assert.equal(r.status, 200);
+  const hit = r.json.results.find((x) => x.github_login === 'jaxoctocat');
+  assert.ok(hit, 'a case-differing, non-prefix query must still find it via the fuzzy leg');
+});
+
+await t('the plain visible account IS found under its real discipline, and ABSENT under another', async () => {
+  const hit = await get(port, '/api/bongos/community/search?q=plain-vis&discipline=engineer');
+  assert.ok(hit.json.results.some((x) => x.github_login === 'plainvis'), 'engineer is its real discipline');
+  const miss = await get(port, '/api/bongos/community/search?q=plain-vis&discipline=artist');
+  assert.ok(!miss.json.results.some((x) => x.github_login === 'plainvis'), 'artist is not its discipline');
+});
+
+await t('github_id never crosses the wire', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=plain-vis');
+  assert.ok(!r.text.includes('github_id'), 'the internal join key must not appear in the response');
+  assert.ok(!r.text.includes('"100"') && !r.text.includes('"101"'));
+});
+
+// ---- validation --------------------------------------------------------------
+
+await t('missing q → 400 bad_request', async () => {
+  const r = await get(port, '/api/bongos/community/search');
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_request');
+});
+
+await t('blank q → 400 bad_request', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=%20%20');
+  assert.equal(r.status, 400);
+});
+
+await t('too-short q → 400 query_too_short', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=a');
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'query_too_short');
+});
+
+await t('oversized q → 400 query_too_long', async () => {
+  const long = 'a'.repeat(builderSearch.MAX_QUERY_CHARS + 1);
+  const r = await get(port, `/api/bongos/community/search?q=${long}`);
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'query_too_long');
+});
+
+await t('oversized discipline → 400 discipline_too_long', async () => {
+  const long = 'a'.repeat(builderSearch.MAX_DISCIPLINE_CHARS + 1);
+  const r = await get(port, `/api/bongos/community/search?q=plain&discipline=${long}`);
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'discipline_too_long');
+});
+
+await t('response is Cache-Control: no-store (hide must beat the cache, ADR 0171 D5)', async () => {
+  const r = await get(port, '/api/bongos/community/search?q=plain-vis');
+  assert.equal(r.headers['cache-control'], 'no-store');
+});
+
+await t('page.offset echoes the MAX_OFFSET clamp through the real route', async () => {
+  const r = await get(port, `/api/bongos/community/search?q=plain-vis&offset=${builderSearch.MAX_OFFSET + 5000}`);
+  assert.equal(r.status, 200);
+  assert.equal(r.json.page.offset, builderSearch.MAX_OFFSET, 'the route must echo the CLAMPED offset, not the raw query param');
+});
+
+await t('a query engine failure → 500 search_failed (never a leaked stack/500 HTML page)', async () => {
+  engine.throwOnQuery = new Error('DO-NOT-LEAK-connection string or stack detail');
+  try {
+    const r = await get(port, '/api/bongos/community/search?q=plain-vis');
+    assert.equal(r.status, 500);
+    assert.equal(r.json.error.code, 'search_failed');
+    assert.ok(!r.text.includes('DO-NOT-LEAK'), 'the raw error message must not reach the response body');
+  } finally {
+    engine.throwOnQuery = null;
+  }
+});
+
+// ---- rate limit -------------------------------------------------------------
+
+await t('searchReadRateLimit: allows up to the cap, then 429s with Retry-After', () => {
+  const { searchReadRateLimit, READ_RATE_LIMIT } = buildCommunitySearchRoutes._internals;
+  const mkRes = () => {
+    const r = { _status: 200, _json: null, _headers: {} };
+    r.set = (k, v) => { r._headers[k] = v; return r; };
+    r.status = (s) => { r._status = s; return r; };
+    r.json = (j) => { r._json = j; return r; };
+    attachFail({}, r, () => {}); // installs res.fail() as the router does
+    return r;
+  };
+  const req = { ip: '203.0.113.77' }; // a unique test IP so the module Map bucket is clean
+  let allowed = 0;
+  for (let i = 0; i < READ_RATE_LIMIT; i++) {
+    const res = mkRes();
+    let nexted = false;
+    searchReadRateLimit(req, res, () => { nexted = true; });
+    if (nexted) allowed++;
+  }
+  assert.equal(allowed, READ_RATE_LIMIT, 'every call up to the cap must pass through');
+  const res = mkRes();
+  let nexted = false;
+  searchReadRateLimit(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'the over-cap call must NOT call next()');
+  assert.equal(res._status, 429);
+  assert.equal(res._json.error.code, 'rate_limited');
+  assert.ok(res._headers['Retry-After'], 'a Retry-After header is set');
+});
+
+await t('searchReadRateLimit keys on the request IP only — one caller cannot throttle another', () => {
+  const { searchReadRateLimit, READ_RATE_LIMIT } = buildCommunitySearchRoutes._internals;
+  const mkRes = () => ({ set() { return this; }, status() { return this; }, json() { return this; } });
+  const reqA = { ip: '203.0.113.78' };
+  for (let i = 0; i < READ_RATE_LIMIT; i++) searchReadRateLimit(reqA, mkRes(), () => {});
+  let nexted = false;
+  searchReadRateLimit({ ip: '203.0.113.79' }, mkRes(), () => { nexted = true; });
+  assert.equal(nexted, true, 'a different IP is not affected by another IP hitting the cap');
+});
+
+server.close();
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/discord_bugs.mjs

@@ -115,6 +115,7 @@ await t('recordInboundBug: linked Metic → filed at ready, kind=bug, attributed
   assert.equal(calls.create[0].kind, 'bug', 'the channel IS the classification');
   assert.equal(calls.create[0].filerRank, 'metic', 'the LIVE rank is handed to the matrix');
   assert.equal(calls.create[0].capturedBy, 9, 'and the reporter is attached to the capture');
+  assert.equal(calls.create[0].filedVia, 'discord', 'the door is a fact on the row (task 1004233)');
   assert.equal(calls.create[0].goalId, 7, 'the suggester found it a home');
   // task 1003067: no versionId is passed AT ALL. It used to be the hardcoded
   // 'GDS-V3' — a shipped version, which is idea 1000771. The goal carries it now.

package/tests/discord_inbound.mjs

@@ -83,6 +83,7 @@ await t('recordInboundIdea: linked author → idea attributed to builder + audit
   assert.equal(r.outcome, 'filed');
   assert.equal(r.ideaId, 77);
   assert.equal(calls.capture[0].capturedBy, 9);
+  assert.equal(calls.capture[0].filedVia, 'discord', 'the door is a fact on the row (task 1004233): this path calls the port, so it names it');
   assert.match(calls.capture[0].bodyMd, /filed from Discord #ideas by mona/);
   assert.equal(calls.audit[0].surface, 'discord_bot');
   assert.equal(calls.audit[0].builderId, 9);

package/tests/effective_visibility_predicate.mjs

@@ -79,6 +79,7 @@ import {
   isRecruiterDiscoverable,
   recruiterReachSql,
   scoutingListableSql,
+  scoutingNameOnlySql,
   recruiterSliverVisibleSql,
   isRecruiterSliverVisible,
 } from '../modules/platform-identity/account-visibility.js';
@@ -353,8 +354,11 @@ function accountStatements(code) {
  * That is a decision recorded in the owner file and asserted above — not a
  * reader quietly dropping a term, which is what this regex would otherwise let
  * through unnoticed.
+ * scoutingNameOnlySql (task 1002291) is the directory's second tier: it floors on
+ * existence like every public answer, but it admits HIDDEN accounts, so it is
+ * pinned below to one reader that selects identity columns and nothing else.
  */
-const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|recruiterSliverVisibleSql|isAccountVisible|isAccountActive|isRollupVisible|isRecruiterSliverVisible)\s*\(/;
+const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|scoutingNameOnlySql|recruiterSliverVisibleSql|isAccountVisible|isAccountActive|isRollupVisible|isRecruiterSliverVisible)\s*\(/;
 
 // ===========================================================================
 // Self-tests — the machinery is the guard, so it gets proved too.
@@ -458,12 +462,36 @@ t('scoutingListableSql is COMPOSED from the rollup AND the reach halves (task 10
     + 'leaderboards join rollupVisibleSql and the opt-out must not empty them');
 });
 
+t('scoutingNameOnlySql is the directory\'s SECOND tier: existence AND hidden AND reach (task 1002291)', () => {
+  // Privacy spec D2, the "active · public · hide_stats" row's recruiter column:
+  // "listed name-only (if not opted out)". Hide decides the SHAPE of a directory
+  // row, the reach axis decides whether there is a row at all.
+  for (const alias of ['pa', undefined]) {
+    const tier = scoutingNameOnlySql(alias);
+    assert.ok(tier.includes(accountVisibleSql(alias)),
+      'it floors on EXISTENCE like every public read — a private account is never listed, not even by name');
+    assert.ok(tier.includes(recruiterReachSql(alias)),
+      'and on reach: opting out removes a hidden builder from the directory too');
+    assert.match(tier, new RegExp(`AND ${alias ? `${alias}\\.` : ''}hide_stats\\)`),
+      'and admits exactly the HIDDEN accounts — the ones the ranked tier leaves out');
+    assert.doesNotMatch(tier, /NOT (?:\w+\.)?hide_stats/, 'never the unhidden ones, or a builder would be listed twice');
+  }
+  // The two tiers PARTITION the reachable, visible accounts: they differ in the
+  // hide term and in nothing else, so no builder can fall between them or sit
+  // in both.
+  const ranked = scoutingListableSql('pa').replace('AND NOT pa.hide_stats)', 'AND <HIDE>)');
+  const named = scoutingNameOnlySql('pa').replace('AND pa.hide_stats)', 'AND <HIDE>)');
+  assert.ok(ranked.includes('<HIDE>') && named.includes('<HIDE>'), 'both tiers carry the hide term where it is expected');
+  assert.equal(named, ranked, 'the name-only tier is the ranked predicate with the hide term flipped — nothing more');
+});
+
 t('the alias is the one interpolated thing, and every builder refuses a non-identifier', () => {
   const inject = "pa; DROP TABLE platform_identity_accounts --";
   assert.throws(() => accountVisibleSql(inject), /bare SQL identifier/);
   assert.throws(() => rollupVisibleSql(inject), /bare SQL identifier/);
   assert.throws(() => recruiterReachSql(inject), /bare SQL identifier/);
   assert.throws(() => scoutingListableSql(inject), /bare SQL identifier/);
+  assert.throws(() => scoutingNameOnlySql(inject), /bare SQL identifier/);
 });
 
 t('the JS ports answer exactly what the SQL asks, row for row', () => {
@@ -697,6 +725,26 @@ t('the EXISTENCE-LESS predicate has exactly one reader, and it is the sliver (ta
     'the pre-accept predicate is the recruiting sliver\'s alone — every other read must floor on the existence axis');
 });
 
+t('the NAME-ONLY tier has exactly one reader, and it selects identity and nothing else (task 1002291)', () => {
+  // scoutingNameOnlySql admits HIDDEN accounts by design. Joined by a read that
+  // returned a number, it would hand out exactly the record hide_stats withholds,
+  // while looking adopted to the classification rule above. So the predicate is
+  // pinned to its one reader, and that reader's statement to three identity
+  // columns and no rollup table.
+  const readers = scanned
+    .filter((f) => f.rel !== PREDICATE_OWNER && /\bscoutingNameOnlySql\s*\(/.test(f.code))
+    .map((f) => f.rel);
+  assert.deepEqual(readers, ['modules/platform-identity/scouting-name-only.js'],
+    'the name-only tier is the recruiting directory\'s alone');
+  const reader = scanned.find((f) => f.rel === readers[0]);
+  const statements = accountStatements(reader.code);
+  assert.equal(statements.length, 1, 'one statement');
+  assert.match(statements[0].sql, /^SELECT github_login, display_name, avatar_url FROM platform_identity_accounts WHERE /,
+    'selecting the three identity columns a hidden builder\'s public page already shows — never an id, a count or a date');
+  assert.doesNotMatch(reader.code, /platform_identity_builder_project_activity/,
+    'and never touching the rollup table: presence in this tier must not depend on activity, or it would say who has built');
+});
+
 t('getPublicProfileExtras gates on the shared JS port (its SQL carries no predicate to join)', () => {
   const pi = scanned.find((f) => f.rel === 'modules/platform-identity/platform-identity.js');
   const span = functionSpans(pi.code).find((s) => s.name === 'getPublicProfileExtras');

package/tests/goal_map_page.mjs

@@ -354,6 +354,20 @@ await test('the tour walks all three lenses here too, and hands the sky back to
   assert.equal(first.timers.pending(), 1, 'a first visit schedules the tour here as well');
 });
 
+// ═══ born of a thought (part 5) ══════════════════════════════════════════════
+
+await test('a well born of a thought wears it in the ledger and the panel — the fact from GET /sky\'s born, never a guess', async () => {
+  const sk = FOUR(); sk.born = { goals: { 9: 21 }, criteria: {} };
+  const p = await boot({ sky: sk, versions: versions() });
+  assert.equal(goal(p, '9').bornOf, '21');
+  assert.equal(goal(p, '7').bornOf, null);
+  p.key('l');
+  const row = (new RegExp('data-id="9"[\\s\\S]*?</button>').exec(p.rows()) || [''])[0];
+  assert.match(row, /born of a thought/);
+  p.SKY().pick({ kind: 'goal', ref: goal(p, '9') }, false);
+  assert.match(p.panel(), /born of a thought/);
+});
+
 // ═══ the words are never markup ══════════════════════════════════════════════
 
 await test('a goal title never becomes markup — in the ledger, the panel or the hover card', async () => {

package/tests/guild_namespace_reserved.mjs

@@ -0,0 +1,76 @@
+// tests/guild_namespace_reserved.mjs — the guild URL namespace is RESERVED where
+// project slugs are decided (task 1002299, R23 guild design; task 1002912's rule).
+//
+// Project profiles live at the top level (`cloudbongos.com/<slug>`), so every
+// top-level segment the hub uses for another kind of page must be on the reserved
+// project-slug list in the SEO spec, or a project can register the word and shadow
+// the namespace. `u` guards `/u/<handle>`; the guild design names its own segment,
+// and task 1002912 asked for the word to be reserved there, not a route squatted.
+//
+// No slug validator exists yet (the SEO goal's R02 builds it from that list), so the
+// spec IS the contract today. This pins the one property that can drift silently:
+// the segment the guild ADR declares and the segment the spec reserves are the same.
+//
+// Run:  node tests/guild_namespace_reserved.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ADR_DIR = path.join(ROOT, 'docs', 'adr');
+const SEO_SPEC = path.join(ROOT, 'docs', 'specs', 'bongos-v1-seo-public-discoverability.md');
+const GUILD_TASK = '1002299';
+
+const { test, summary } = makeRunner();
+
+// The guild design ADR, found by the task it records rather than by number: ADR
+// numbers get renumbered when two sessions collide, the task id never changes.
+function guildAdr() {
+  const hits = fs.readdirSync(ADR_DIR)
+    .filter((f) => /^\d{4}-.*\.md$/.test(f))
+    .filter((f) => {
+      const head = fs.readFileSync(path.join(ADR_DIR, f), 'utf8').replace(/\r\n/g, '\n').split('\n').slice(0, 12).join('\n');
+      return new RegExp(`^- \\*\\*Task:\\*\\*.*task ${GUILD_TASK}\\b`, 'm').test(head);
+    });
+  assert.equal(hits.length, 1, `exactly one ADR records task ${GUILD_TASK}; found ${JSON.stringify(hits)}`);
+  return fs.readFileSync(path.join(ADR_DIR, hits[0]), 'utf8').replace(/\r\n/g, '\n');
+}
+
+// The segment the ADR declares on its machine-readable `Namespace:` line.
+function declaredSegment(adr) {
+  const m = adr.match(/^- \*\*Namespace:\*\* `\/([a-z0-9-]+)\/<slug>`/m);
+  assert.ok(m, 'the guild ADR carries a `- **Namespace:** `/<segment>/<slug>`` header line');
+  return m[1];
+}
+
+// The reserved words in the SEO spec's Routing bullet: the backticked list after "Reserved:".
+function reservedWords() {
+  const spec = fs.readFileSync(SEO_SPEC, 'utf8').replace(/\r\n/g, '\n');
+  const routing = spec.split('\n').find((l) => l.startsWith('- **Routing:**'));
+  assert.ok(routing, 'the SEO spec still has its Routing bullet');
+  const m = routing.match(/Reserved: `([^`]+)`/);
+  assert.ok(m, 'the Routing bullet still names its reserved list as `Reserved: `…``');
+  return m[1].split(',').map((w) => w.trim()).filter(Boolean);
+}
+
+await test('the guild ADR declares one top-level namespace segment', () => {
+  const seg = declaredSegment(guildAdr());
+  assert.match(seg, /^[a-z0-9-]+$/);
+});
+
+await test('the SEO spec reserves the segment the guild ADR declares', () => {
+  const seg = declaredSegment(guildAdr());
+  const reserved = reservedWords();
+  assert.ok(reserved.includes(seg),
+    `a project could register "${seg}" and shadow /${seg}/<slug>; reserved list is ${JSON.stringify(reserved)}`);
+});
+
+await test('the builder-profile segment it was modelled on is still reserved', () => {
+  // The precedent the task names. If `u` ever leaves the list, the guild reservation
+  // above has lost the rule it was copied from, and both need a second look.
+  assert.ok(reservedWords().includes('u'));
+});
+
+summary();

package/tests/hall_sky.mjs

@@ -303,27 +303,44 @@ await test('the claude layer is HIDDEN until filed_via exists, and every thought
   assert.ok(p.S().ideas.every((i) => i.origin === 'human'));
 });
 
-await test('once filed_via is on a row the pill appears, that thought waits behind it, and historic rows still show', async () => {
-  const p = await boot({ mine: mine([star(), idea({ id: 2, title: 'A session filed this', filed_via: 'session' }), idea({ id: 3, title: 'A person filed this', filed_via: 'person' })]) });
+await test('filed_via IS A LEDGER FACT (part 5): cli / api / discord wait behind the claude layer, hall / planning always show, and a row from before the column shows and says so', async () => {
+  const p = await boot({ mine: mine([star(), idea({ id: 2, title: 'A session filed this', filed_via: 'cli' }), idea({ id: 3, title: 'A person filed this', filed_via: 'hall' }), idea({ id: 4, title: 'Planned', filed_via: 'planning' }), idea({ id: 5, title: 'A poller filed this', filed_via: 'api' }), idea({ id: 6, title: 'From Discord', filed_via: 'discord' })]), sky: sky([well()]) });
   assert.equal(p.S().hasFiledVia, true);
   assert.equal(p.el('claudeBtn').hidden, false);
   const SKY = p.SKY();
-  assert.equal(SKY.inLayer(findIdea(p, 2)), false, 'off by default: only what a person filed');
-  assert.equal(SKY.inLayer(findIdea(p, 10)), true, 'a historic row with no filed_via shows (the owner\'s rule)');
-  assert.equal(SKY.inLayer(findIdea(p, 3)), true);
+  same(SKY.SESSION_VIAS, ['cli', 'api', 'discord'], 'the doors a session files through');
+  for (const id of [2, 5, 6]) assert.equal(SKY.inLayer(findIdea(p, id)), false, `${id} waits behind the pill — off by default`);
+  for (const id of [10, 3, 4]) assert.equal(SKY.inLayer(findIdea(p, id)), true, `${id} shows`);
+  assert.equal(findIdea(p, 10).filedVia, null, 'a historic row carries NULL, not a guess');
   p.click('claudeBtn');
-  assert.equal(SKY.inLayer(findIdea(p, 2)), true, 'the pill reveals it');
-});
-
-await test('NO BORN-OF MARK IS DRAWN — the read does not exist yet, so nothing is guessed', async () => {
-  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]) });
-  const S = p.S();
-  assert.equal(S.becameGoal.size, 0);
-  assert.equal(S.becameCrit.size, 0);
-  assert.ok(S.ideas.every((i) => i.shaped === null));
-  assert.ok(S.goals.every((g) => g.bornOf === null && g.crit.every((c) => c.bornOf === null)));
+  for (const id of [2, 5, 6]) assert.equal(SKY.inLayer(findIdea(p, id)), true, 'the pill reveals them');
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 10) }, false);
+  assert.match(p.panel(), /filed before the ledger recorded where/, 'and the panel says so, in those words');
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 3) }, false);
+  assert.match(p.panel(), /from the hall/);
+  SKY.pick({ kind: 'idea', ref: findIdea(p, 2) }, false);
+  assert.match(p.panel(), /from the command line · by a session, under your name/);
+});
+
+await test('BORN OF A THOUGHT IS READ FROM GET /sky (part 5), never guessed: the goal wears the nucleus, the ring the notch, and the thought sits where it became', async () => {
+  const sk = sky([well()]); sk.born = { goals: { 7: 10 }, criteria: { 70: 12 } };
+  const p = await boot({ mine: mine([star(), coldBody({ id: 12, title: 'It became a ring' })]), sky: sk });
+  const S = p.S(); const SKY = p.SKY(); const g = S.goalById.get('7');
+  same(S.BORN, { goals: { 7: '10' }, criteria: { 70: '12' } }, 'ids are strings whatever the wire sent');
+  assert.equal(g.bornOf, '10'); assert.equal(g.crit[0].bornOf, '12');
+  assert.equal(S.becameGoal.get('10'), '7'); assert.equal(S.becameCrit.get('12'), g.crit[0]);
+  const shaped = findIdea(p, 10); assert.equal(shaped.shaped.kind, 'goal'); assert.equal(shaped.x, g.x); assert.equal(shaped.y, g.y);
+  const ring = findIdea(p, 12); assert.equal(ring.shaped.kind, 'ring');
+  assert.ok(Math.abs(Math.hypot(ring.x - g.x, ring.y - g.y) - SKY.ringR(g, 0, 2)) < 1e-6, 'on the first ring');
+  assert.equal(SKY.became(shaped), 'a goal — it shaped the space');
+  assert.match(SKY.became(ring), /^a criterion — a ring in /);
   p.key('l');
-  assert.doesNotMatch(p.rows(), /born of a thought/);
+  assert.match(p.rows(), /shaped the space/);
+  SKY.pick({ kind: 'goal', ref: g }, false);
+  assert.match(p.panel(), /born of a thought/);
+  const none = await boot({ mine: mine(FIVE()), sky: sky([well()]) });
+  assert.equal(none.S().becameGoal.size, 0, 'no born read, no mark — nothing is guessed');
+  assert.ok(none.S().goals.every((x) => x.bornOf === null && x.crit.every((c) => c.bornOf === null)));
 });
 
 // ═══ the bands — derived, never named by hand ════════════════════════════════