@bongos/core 1.19.1016 → 1.19.1017

package/tests/people_name_only.mjs

@@ -0,0 +1,262 @@
+// tests/people_name_only.mjs — the People directory lists a hidden builder by
+// name alone (task 1002291 / R15, ADR 0334; privacy spec D2's recruiter column:
+// "listed name-only (if not opted out)").
+//
+// GET /scouting now answers two tiers: `builders`, ranked on the cross-project
+// record, and `name_only`, the builders who hid that record but are still open
+// to recruiting. The server decides who is in each (tests/scouting_owner_access_-
+// and_reach.mjs); this file holds the PAGE to the rules that keep the second
+// tier honest on screen:
+//   - it is its own panel, revealed only when the server sends a row
+//   - a row is the identity cell and nothing else — no figure, no role, no date
+//   - it is never ranked: alphabetical whatever the sort lens says
+//   - search reads a name; a role filter never matches (the role is part of the
+//     record the builder hid)
+//   - the page still makes ONE read
+//
+// It runs the REAL people.js and the REAL kit in a vm, over a DOM fake one step
+// deeper than tests/people_directory_clip.mjs's: an element keeps the node it
+// hands out for a selector, so the <tbody> the kit fills is the one read back.
+//
+// Run:  node tests/people_name_only.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const KIT_JS = read('modules/hall-ui/public/hall-kit.js');
+const PEOPLE_JS = read('modules/hall-ui/public/people.js');
+const PEOPLE_HTML = read('modules/hall-ui/public/people.html');
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+function makeEl(id) {
+  const kids = new Map();
+  const listeners = {};
+  return {
+    id,
+    innerHTML: '', textContent: '', value: '',
+    hidden: false, disabled: false, className: '',
+    options: [], style: {}, dataset: {},
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild() {}, setAttribute() {}, removeAttribute() {},
+    addEventListener(type, fn) { (listeners[type] ||= []).push(fn); },
+    fire(type) { (listeners[type] || []).forEach((fn) => fn({ target: { matches: () => true } })); },
+    querySelector(sel) {
+      if (!kids.has(sel)) kids.set(sel, makeEl(sel));
+      return kids.get(sel);
+    },
+    querySelectorAll() { return []; },
+  };
+}
+
+function realRoleLabel() {
+  const src = read('modules/hall-ui/public/dom-utils.js');
+  const win = { location: { search: '', hash: '', pathname: '/' }, addEventListener() {}, localStorage: null };
+  const doc = { addEventListener() {}, querySelector: () => null, querySelectorAll: () => [], documentElement: { dataset: {} } };
+  new Function('window', 'document', src)(win, doc);
+  return win.OTB.roleLabel;
+}
+
+// Ranked rows carry a record; the sentinels are what a name-only row must never show.
+const RANKED = [
+  { github_id: 1, github_login: 'zed-ranked', display_name: 'Zed', avatar_url: null, project_count: 2,
+    total_credits: 900, total_tasks_shipped: 9, total_karma: 4, last_active: '2026-09-01T00:00:00Z', disciplines: ['engineer'] },
+  { github_id: 2, github_login: 'amy-ranked', display_name: 'Amy', avatar_url: null, project_count: 1,
+    total_credits: 100, total_tasks_shipped: 1, total_karma: 1, last_active: '2026-09-02T00:00:00Z', disciplines: ['artist'] },
+];
+// Alphabetical by login, as the server sends them.
+const NAMED = [
+  { github_login: 'bea-hidden', display_name: 'Bea', avatar_url: null },
+  { github_login: 'cal-hidden', display_name: null, avatar_url: 'https://avatars.githubusercontent.com/u/7?v=4' },
+];
+
+function harness(payload) {
+  const els = new Map();
+  const getEl = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById: getEl,
+    querySelector(sel) { return getEl(String(sel).replace(/^#/, '')); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+  const requests = [];
+  const store = new Map();
+  const windowObj = {
+    location: { assign() {}, href: '/people', search: '' },
+    localStorage: {
+      getItem: (k) => (store.has(k) ? store.get(k) : null),
+      setItem: (k, v) => store.set(k, String(v)),
+      removeItem: (k) => store.delete(k),
+    },
+    addEventListener() {},
+    OTBBranding: { currencyLabel: () => 'Credits' },
+    OTB: {
+      roleAxisLabel: () => 'Role',
+      roleLabel: realRoleLabel(),
+      fmtInt: (n) => String(Number(n) || 0),
+      rankLabel: (r) => String(r ?? ''),
+    },
+  };
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    CSS: { escape: (s) => String(s) },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON,
+    fetch: (url) => {
+      requests.push(String(url));
+      return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(payload) });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(PEOPLE_JS, sandbox, { filename: 'people.js' });
+
+  const filters = () => getEl('people-filters');
+  return {
+    getEl,
+    requests,
+    rankedRows: () => getEl('people-body').querySelector('tbody').innerHTML,
+    namedRows: () => getEl('people-named-body').querySelector('tbody').innerHTML,
+    // Drive the kit's filter bar the way a reader does: set the control, fire.
+    setFilter(id, value) {
+      filters().querySelector(`#${id}`).value = value;
+      filters().fire(id === 'people-q' ? 'input' : 'change');
+    },
+  };
+}
+
+const loginsIn = (html) => [...html.matchAll(/class="dir-login">@([^<]+)</g)].map((m) => m[1]);
+
+// ---------------------------------------------------------------------------
+
+await test('the page carries the name-only panel, hidden until the server sends a row', () => {
+  const tag = PEOPLE_HTML.match(/<section[^>]*id="people-named-scroll"[^>]*>/);
+  assert.ok(tag, 'a panel of its own — a hidden builder is not a row in the ranked ledger');
+  assert.match(tag[0], /class="scroll"/, "the shell's panel, not a fourth card level");
+  assert.match(tag[0], /\bhidden\b/, 'it ships hidden: an instance with no such builder shows nothing');
+  assert.match(PEOPLE_HTML, /id="people-named-h"[^>]*>[^<]+<span class="count-pill" id="people-named-count" hidden>/,
+    'a heading with its own count');
+  const lede = (PEOPLE_HTML.match(/<p class="scroll__lede" id="people-named-lede">([^<]+)<\/p>/) || [])[1] || '';
+  assert.match(lede, /private/i, 'the lede says why these builders show no record');
+  assert.match(lede, /ranked/i, 'and that they are never ranked');
+  assert.match(lede, /filter/i, 'and that a role filter never finds them');
+  assert.match(PEOPLE_HTML, /id="people-named-body"/, 'and a mount for the ledger');
+});
+
+await test('name-only rows render the identity cell and nothing else', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-named-scroll').hidden, false, 'revealed once a row arrives');
+  assert.equal(h.getEl('people-named-count').textContent, '2');
+  assert.equal(h.getEl('people-named-count').hidden, false);
+  const rows = h.namedRows();
+  assert.deepEqual(loginsIn(rows), ['bea-hidden', 'cal-hidden'], 'each builder, by login');
+  assert.match(rows, /<a class="lb-name dir-name" href="https:\/\/github\.com\/bea-hidden"/,
+    'the same door the ranked row has — the one page every listed builder has');
+  assert.match(rows, /<img class="dir-avatar" src="https:\/\/avatars\.githubusercontent\.com\/u\/7\?v=4"/, 'and the picture');
+  assert.match(rows, />cal-hidden</, 'a builder with no display name reads as their login');
+  assert.doesNotMatch(rows, /ledger__num|ledger__date|fact-chip/,
+    'no figure, no date and no role cell: every one of those is the record the builder hid');
+});
+
+await test('the ranked ledger is untouched by the second tier', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  assert.deepEqual(loginsIn(h.rankedRows()), ['zed-ranked', 'amy-ranked'],
+    'ranked in the server order, as before — and no hidden builder among them');
+  assert.equal(h.getEl('people-count').textContent, '2', 'its count is the ranked count');
+  assert.match(h.getEl('people-sub').textContent, /2 more .*by name only/,
+    'the subtitle counts both tiers, so it does not claim the ranked list is everyone');
+});
+
+await test('a sort lens never re-orders the name-only list — it is not ranked', async () => {
+  const h = harness({ builders: RANKED, name_only: [...NAMED].reverse() });
+  await tick(); await tick();
+  const before = loginsIn(h.namedRows());
+  for (const lens of ['ships', 'credits', 'karma', 'projects', 'recent']) {
+    h.setFilter('people-sort', lens);
+    assert.deepEqual(loginsIn(h.namedRows()), before, `the ${lens} lens has nothing to sort a hidden record by`);
+  }
+  assert.deepEqual(loginsIn(h.rankedRows()), ['amy-ranked', 'zed-ranked'],
+    'CONTROL: the ranked list DID re-order — the last lens, most recently active, puts Amy first');
+});
+
+await test('search reads a name; a role filter never matches a hidden builder', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  h.setFilter('people-q', 'bea');
+  assert.deepEqual(loginsIn(h.namedRows()), ['bea-hidden'], 'a hidden builder is findable by name');
+  assert.deepEqual(loginsIn(h.rankedRows()), [], 'and the ranked list filters the same search');
+  h.setFilter('people-q', '');
+  h.setFilter('people-craft', 'engineer');
+  assert.deepEqual(loginsIn(h.namedRows()), [], 'the role is part of the hidden record, so a role filter finds no one here');
+  assert.match(h.namedRows(), /ledger__empty/, 'and says so in the panel rather than leaving it blank');
+  assert.deepEqual(loginsIn(h.rankedRows()), ['zed-ranked'], 'CONTROL: the role filter does apply to the ranked list');
+});
+
+await test('no name-only rows — or an older server that sends no such key — leaves the panel hidden', async () => {
+  for (const payload of [{ builders: RANKED, name_only: [] }, { builders: RANKED }]) {
+    const h = harness(payload);
+    await tick(); await tick();
+    assert.equal(h.getEl('people-named-scroll').hidden, true, 'never revealed');
+    assert.deepEqual(loginsIn(h.rankedRows()), ['zed-ranked', 'amy-ranked'], 'and the directory renders as before');
+  }
+});
+
+await test('only hidden builders listed: the page renders them rather than the empty-directory notice', async () => {
+  const h = harness({ builders: [], name_only: NAMED });
+  await tick(); await tick();
+  assert.doesNotMatch(h.getEl('people-body').textContent, /Nobody is publicly listed/,
+    'the directory is not empty — two builders are listed by name');
+  assert.deepEqual(loginsIn(h.namedRows()), ['bea-hidden', 'cal-hidden']);
+  assert.match(h.rankedRows(), /ledger__empty/, 'the ranked ledger states its own empty case');
+  const sub = h.getEl('people-sub').textContent;
+  assert.match(sub, /^2 builders listed across hosted projects by name only\./,
+    'the subtitle counts who IS listed');
+  assert.doesNotMatch(sub, /\b0 builders|more by name only/, 'not "0 builders … 2 more" — a count of nothing');
+});
+
+await test('a FULL name-only response is hedged, and says a search cannot reach past it', async () => {
+  const CEILING = 500;
+  const full = Array.from({ length: CEILING }, (_, i) => ({ github_login: `h${String(i).padStart(3, '0')}`, display_name: null, avatar_url: null }));
+  let h = harness({ builders: RANKED, name_only: full });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-named-count').textContent, `${CEILING}+`, 'the pill may not state a total the page cannot know');
+  const foot = h.getEl('people-named-foot');
+  assert.equal(foot.hidden, false, 'the footnote shows on a clipped list');
+  assert.match(foot.textContent, /clipped at the first 500 by login/);
+  assert.match(foot.textContent, /Search only reads what this page loaded/, 'naming the one lens that reads this list');
+  assert.match(PEOPLE_HTML, /<p class="ledger__note" id="people-named-foot" hidden><\/p>/, 'the slot ships hidden');
+  h = harness({ builders: RANKED, name_only: full.slice(0, CEILING - 1) });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-named-foot').hidden, true, 'one short of the ceiling is a complete list');
+  assert.equal(h.getEl('people-named-count').textContent, String(CEILING - 1));
+});
+
+await test('both tiers empty: the consent-boundary notice still explains the empty page', async () => {
+  const h = harness({ builders: [], name_only: [] });
+  await tick(); await tick();
+  assert.match(h.getEl('people-body').textContent, /Nobody is publicly listed/);
+  assert.equal(h.getEl('people-named-scroll').hidden, true, 'and the second panel stays hidden');
+});
+
+await test('the page still makes ONE read for both tiers', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  assert.equal(h.requests.length, 1);
+  assert.match(h.requests[0], /^\/api\/bongos\/scouting\?limit=/);
+});
+
+summary();

package/tests/profile_route.mjs

@@ -420,6 +420,17 @@ const engine = {
       if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
       return { rows: rows.map((r) => ({ ...r.row })) };
     }
+    // listScoutingNameOnly — the directory's name-only tier (task 1002291). The
+    // same literal-minded rule: only the predicates it declares. Each row comes
+    // back WHOLE, numbers included, so the route's projection has to drop them.
+    if (/^\s*SELECT github_login, display_name, avatar_url\s+FROM platform_identity_accounts/.test(sql)) {
+      let rows = SCOUTING_TABLE;
+      if (/profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/terms_accepted_at IS NOT NULL/.test(sql)) rows = rows.filter((r) => r.terms_accepted_at != null);
+      if (/account_visibility = 'public'/.test(sql)) rows = rows.filter((r) => r.account_visibility === 'public');
+      if (/AND hide_stats\)/.test(sql)) rows = rows.filter((r) => r.hide_stats);
+      return { rows: rows.map((r) => ({ ...r, ...r.row })) };
+    }
     // setAccountHideStats — the own-scoped write behind PATCH /me/cross-project.
     if (/INSERT INTO platform_identity_accounts/.test(sql)) {
       hubAccount.hide_stats = !!params[4];
@@ -635,16 +646,23 @@ scoutApp.use(attachFail);
 scoutApp.use('/api/bongos', buildScoutingRoutes());
 const scout = await listen(scoutApp);
 
-await t('R06.3 GET /scouting drops the hidden, the provisional AND the private builder', async () => {
+await t('R06.3 GET /scouting ranks the visible builder, lists the HIDDEN one by name alone, and drops the provisional AND the private', async () => {
   engine.calls.length = 0;
   const r = await get(scout.port, '/api/bongos/scouting');
   assert.equal(r.status, 200);
   const logins = r.json.builders.map((b) => b.github_login);
   assert.deepEqual(logins, ['r06-visible'],
-    'only the consented, publicly-visible, non-hidden builder is listed (task 1002967 added the visibility axis)');
-  assert.equal(engine.calls.length, 1, 'exactly ONE read — nothing can re-enter via a second, unfiltered query');
-  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, PRIVATE_LOGIN, '88817', '6613', '5519', '71713', '63127', '4409', '2287']) {
-    assert.ok(!r.text.includes(s), `the excluded builder leaks nothing — found "${s}"`);
+    'only the consented, publicly-visible, non-hidden builder is RANKED (task 1002967 added the visibility axis)');
+  // Task 1002291 (privacy spec D2): a hidden builder is "listed name-only", not
+  // dropped. Hide takes the record away; the name stays findable.
+  assert.deepEqual(r.json.name_only, [{ github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null }],
+    'the hidden builder is listed by login, name and avatar — and nothing else');
+  assert.equal(engine.calls.length, 2, 'exactly TWO reads — the ranked tier and the name-only tier');
+  for (const c of engine.calls) {
+    assert.match(c.sql, /profile_state = 'active'/, 'and each carries the consent predicate — nothing re-enters unfiltered');
+  }
+  for (const s of [PROV_LOGIN, PRIVATE_LOGIN, '88817', '6613', '5519', '71713', '63127', '4409', '2287']) {
+    assert.ok(!r.text.includes(s), `the excluded builder, and the hidden builder's record, leak nothing — found "${s}"`);
   }
 });
 

package/tests/recruiter_sliver_boundary.mjs

@@ -271,6 +271,9 @@ function accountFilter(where, params) {
   take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
   take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
   take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+  // The directory's name-only tier asks the hide flag POSITIVELY (task 1002291).
+  // After the NOT form, which consumes its own text first.
+  take(/\b(?:[a-z_]+\.)?hide_stats\b/, () => (r) => !!r.hide_stats);
 
   take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => {
     consumed.add(m[1]);

package/tests/scouting_owner_access_and_reach.mjs

@@ -70,7 +70,11 @@ import { fileURLToPath } from 'node:url';
 // importing them here safe.
 import {
   scoutingListableSql,
+  scoutingNameOnlySql,
   rollupVisibleSql,
+  accountVisibleSql,
+  accountActiveSql,
+  recruiterReachSql,
   isRecruiterDiscoverable,
 } from '../modules/platform-identity/account-visibility.js';
 import {
@@ -130,8 +134,21 @@ const ACCOUNTS = [
   // presence in the SQL provable here rather than merely asserted.
   { github_id: '3030', github_login: 'unaccepted', display_name: 'Unaccepted',
     profile_state: 'active', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // Task 1002291's two controls for the NAME-ONLY tier, each differing from `shy`
+  // in the one axis that must keep them out of it: `shyout` opted out of
+  // recruiting, `shypriv` is private (and opted in, which never buys existence).
+  { github_id: '6161', github_login: 'shyout', display_name: 'Shy Out',
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true, recruiter_discoverable: false },
+  { github_id: '6262', github_login: 'shypriv', display_name: 'Shy Private',
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: true, recruiter_discoverable: true },
 ];
 
+// The record a hidden builder keeps private. Planted on every row the name-only
+// read hands back — a real row grows columns — so a projection that spread the
+// row instead of naming its keys would carry these into the body and fail below.
+const HIDDEN_RECORD = { github_id_echo: '6060-ID-ECHO', total_credits: 773311, total_tasks_shipped: 773322,
+  total_karma: 773333, project_count: 773344, last_active: 'shy-last-active-773355', disciplines: ['shy-craft-773366'] };
+
 // Project memberships, as the hub holds them. `membership_kind` is what the
 // PROJECT reported at check-in; `signin_verified_at` is the hub's OWN witness
 // that the person really signed in (ADR 0205 D1/D2). Owner needs both.
@@ -233,6 +250,9 @@ function accountFilter(where, params) {
   take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
   take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
   take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+  // The name-only tier's term (task 1002291): the hide flag asked POSITIVELY.
+  // Tried after the NOT form, which consumes its own text first.
+  take(/\b(?:[a-z_]+\.)?hide_stats\b/, () => (r) => !!r.hide_stats);
 
   // The TERM guards run before the STRUCTURE guard, so an unreadable term is
   // reported as the unreadable term it is rather than as leftover text.
@@ -318,6 +338,22 @@ const pool = {
       return { rows, rowCount: rows.length };
     }
 
+    // The directory's NAME-ONLY tier (task 1002291): a plain read of the accounts
+    // table, judged by its own WHERE. Each row comes back WHOLE, plus the record
+    // the builder hid, so the route's projection is what has to drop them.
+    if (/^SELECT .+ FROM platform_identity_accounts WHERE /.test(sql)) {
+      assert.doesNotMatch(sql, /platform_identity_builder_project_activity/,
+        'the name-only read must not consult the rollup — presence there would say who has built');
+      const where = sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '');
+      const limit = Number(params[Number((/ LIMIT \$(\d+)/.exec(sql) || [, 0])[1]) - 1]);
+      assert.ok(limit > 0, 'the name-only read is bounded like the ranked one');
+      const rows = ACCOUNTS.filter(accountFilter(where, params))
+        .sort((a, b) => a.github_login.localeCompare(b.github_login))
+        .slice(0, limit)
+        .map((a) => ({ ...a, ...HIDDEN_RECORD }));
+      return { rows, rowCount: rows.length };
+    }
+
     throw new Error(`fake pool: unhandled statement — ${sql.slice(0, 120)}`);
   },
 };
@@ -391,6 +427,7 @@ function getScouting(caller, query = '') {
   });
 }
 const logins = (res) => JSON.parse(res.text).builders.map((b) => b.github_login).sort();
+const namedLogins = (res) => (JSON.parse(res.text).name_only || []).map((b) => b.github_login).sort();
 
 // The cast. `rank` is the caller's rank on the HUB; `github_id` is the hub
 // account whose project memberships decide the ownership door.
@@ -521,8 +558,8 @@ await t('and the whole matrix lands exactly where the specs put it', async () =>
   assert.deepEqual(shown, ['octo', 'optin'],
     'in: reach-unset-and-public (octo) + explicitly-opted-in (optin). '
     + 'out: optout (opted out), scout (private, and reach never buys addressability), '
-    + 'shy (hidden), newbie (provisional), unaccepted (never accepted the platform '
-    + `terms — ADR 0213) — got ${JSON.stringify(shown)}`);
+    + 'shy (hidden — ranked out, listed by name in the second tier below), newbie (provisional), '
+    + `unaccepted (never accepted the platform terms — ADR 0213) — got ${JSON.stringify(shown)}`);
 });
 
 await t('opting back IN restores them — the toggle is a toggle, not a tombstone', async () => {
@@ -613,6 +650,77 @@ await t('/people is the SAME endpoint, so "absent from /people" is true by const
     'and listScoutingRollup — the one reader behind both surfaces — joins the composed predicate');
 });
 
+// ===========================================================================
+// 2b. HIDE CHANGES THE SHAPE, NOT THE PRESENCE (task 1002291, R15)
+// ===========================================================================
+//
+// Privacy spec D2, the "active · public · hide_stats" row, recruiter column:
+// "listed name-only (if not opted out)". Until R15 the directory read hide as a
+// second opt-out and dropped the builder entirely, while the Settings row told
+// that same builder recruiters would see their name and picture. The directory
+// now has two tiers: the ranked record, and a name-only list.
+
+console.log('\nhide — a hidden builder stays findable, by name alone:');
+
+await t('a hidden, reachable builder is listed NAME-ONLY — and never in the ranked tier', async () => {
+  const res = await getScouting(OPERATOR);
+  assert.equal(res.status, 200);
+  assert.deepEqual(namedLogins(res), ['shy'],
+    'in: shy (public, hidden, reach unset). out: shyout (hidden but opted out), shypriv (hidden and private — '
+    + `reach never buys existence), and every unhidden builder, who is ranked instead — got ${JSON.stringify(namedLogins(res))}`);
+  assert.ok(!logins(res).includes('shy'), 'a hidden builder is never RANKED — rank position is derived from the record');
+  const read = calls.find((c) => /^SELECT .+ FROM platform_identity_accounts WHERE /.test(c.sql));
+  assert.ok(read, 'the name-only tier is a read of its own');
+  assert.ok(read.sql.includes(scoutingNameOnlySql()),
+    'and it joins the SHARED predicate, not a copy of it');
+});
+
+await t('the name-only row is identity and nothing else — the record the builder hid never reaches the body', async () => {
+  const res = await getScouting(OWNER);
+  const row = JSON.parse(res.text).name_only[0];
+  assert.deepEqual(Object.keys(row).sort(), ['avatar_url', 'display_name', 'github_login'],
+    'a literal whitelist: what a hidden builder\'s own public page already shows');
+  for (const [key, value] of Object.entries(HIDDEN_RECORD)) {
+    for (const v of [].concat(value)) {
+      assert.ok(!res.text.includes(String(v)), `${key} (${v}) leaked into the directory — the read spread a row it should have named`);
+    }
+  }
+  assert.ok(!res.text.includes('Shy Out') && !res.text.includes('Shy Private'),
+    'and the two hidden builders the tier refuses leave no trace either');
+});
+
+await t('un-hiding moves a builder between the tiers; opting out removes them from both', async () => {
+  const shy = ACCOUNTS.find((a) => a.github_login === 'shy');
+  try {
+    shy.hide_stats = false;
+    let res = await getScouting(OPERATOR);
+    assert.ok(logins(res).includes('shy') && !namedLogins(res).includes('shy'),
+      'shown again, the builder is ranked on their record and gone from the name-only list — never in both');
+    shy.hide_stats = true;
+    shy.recruiter_discoverable = false;
+    res = await getScouting(OPERATOR);
+    assert.ok(!logins(res).includes('shy') && !namedLogins(res).includes('shy'),
+      'hidden AND opted out: absent from the directory entirely — the opt-out is still the only thing that removes a builder');
+  } finally {
+    shy.hide_stats = true;
+    shy.recruiter_discoverable = null;
+  }
+});
+
+await t('MUTATION CHECK: drop the reach or the existence half and the wrong hidden builder walks in', async () => {
+  const admits = (clause) => ACCOUNTS.filter(accountFilter(clause, [])).map((a) => a.github_login).sort();
+  const tier = scoutingNameOnlySql();
+  assert.deepEqual(admits(tier), ['shy'], 'the real predicate');
+  const withoutReach = tier.replace(` AND ${recruiterReachSql()}`, '');
+  assert.notEqual(withoutReach, tier, 'fixture check: the reach term was really removed');
+  assert.deepEqual(admits(withoutReach), ['shy', 'shyout'],
+    'WITHOUT reach, the builder who opted out is listed — so the opt-out assertion above is load-bearing');
+  const withoutExistence = tier.replace(accountVisibleSql(), accountActiveSql());
+  assert.notEqual(withoutExistence, tier, 'fixture check: the existence axis was really removed');
+  assert.deepEqual(admits(withoutExistence), ['shy', 'shypriv'],
+    'WITHOUT the existence axis, a PRIVATE account is listed by name — the D3 sliver\'s subject, which the directory must never carry');
+});
+
 // ===========================================================================
 // 3. THE TWO AXES NEVER TOUCH (ADR 0016)
 // ===========================================================================
@@ -631,6 +739,8 @@ await t('opting out of recruiting grants and denies NO permission', async () =>
     + 'so a reader can never infer a privacy setting from whose list they got');
   assert.deepEqual(shown, logins(await getScouting(OPERATOR)),
     'byte-for-byte the same population an operator sees');
+  assert.deepEqual(namedLogins(res), namedLogins(await getScouting(OPERATOR)),
+    'and the same name-only list — neither tier varies by viewer');
 });
 
 await t('being scoutable buys nothing either — the response is the same descriptive whitelist', async () => {

package/tests/ui_design_styles.mjs

@@ -120,6 +120,19 @@ test('every mock passes the platform rules under its own colours and its own DES
   }
 });
 
+test("the expedition's halftone screen renders: it sits on a fixed body::before layer, never body's own background-image (task 1003633)", () => {
+  const html = read(path.join(STYLES_DIR, 'expedition', 'mock.html'));
+  const bodyRule = html.match(/\bbody\s*\{[^}]*\}/);
+  assert.ok(bodyRule, 'the mock declares a body rule');
+  assert.doesNotMatch(bodyRule[0], /background-image/, "body's own rule carries no background-image — the branding pack's backdrop emits body{background:...} after the page's sheet (themeMarkup, serve-internal.js) and that shorthand resets it to none");
+  const before = html.match(/body::before\s*\{[^}]*\}/);
+  assert.ok(before, 'the halftone moved onto a body::before layer');
+  assert.match(before[0], /position:\s*fixed/, 'the layer is fixed, not in flow');
+  assert.match(before[0], /pointer-events:\s*none/, 'the layer never intercepts input');
+  assert.match(before[0], /background-image:\s*radial-gradient\(var\(--dots\)/, 'the halftone dots ride the layer, keyed to the pack-derived --dots var');
+  assert.match(before[0], /background-size:\s*var\(--dot-pitch\)/, 'the dot pitch moved with it');
+});
+
 test('the world, hub and hall sheets clear AA under every alternate in both modes: the three token suites run once per pack', () => {
   // relative, forward-slash paths: `node --test <path>` reads its positionals as globs, and a
   // Windows absolute path matches nothing (zero tests, exit 0 — a silent pass)