@bongos/core 1.19.1018 → 1.19.1020

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1018'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1020'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/connection_suggestions.mjs

@@ -0,0 +1,225 @@
+// tests/connection_suggestions.mjs — "builders you may know" (R21, task
+// 1002297, goal 1000045 criterion C6; ADR 0202 D5).
+//
+// WHAT THIS PINS:
+//
+//   1. THE SCORE — D5's exact weights (3 × min(mutuals, 10) + 2 × shared
+//      projects + 1 for recency inside 30 days), including the mutual cap.
+//   2. THE REASON — the PRIMARY signal (whichever weighs more) produces the
+//      sentence, and a shared project is named only when the row the source
+//      query returned actually carried a name (the caller's naming gate,
+//      `onMapSql(...) AND visibility = 'public'`, is asserted separately by
+//      the SQL-shape test below).
+//   3. SILENT EXCLUSION — a candidate with an open or in-cooldown row is
+//      dropped before scoring, with no trace and no "N more" counter.
+//   4. THE SHORT-CIRCUIT — no candidates means no further queries at all
+//      (an empty union costs nothing beyond the three source reads).
+//   5. THE VISIBILITY FLOOR IS IN THE SQL — every statement this file issues
+//      against platform_identity_accounts carries the shared predicate,
+//      which is what lets tests/effective_visibility_predicate.mjs classify
+//      it as an adopter rather than a new unclassified read.
+//
+// DB-free by construction: a recording fake pool that replays queued
+// responses in call order, no Postgres, no server.
+//
+// Run:  node tests/connection_suggestions.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+// ESM named import off the CJS module (the tests/project_invite_suggestions.mjs
+// precedent): a createRequire() import reads as unused to knip, and
+// MAX_SUGGESTIONS has no other caller.
+import { listConnectionSuggestions, MAX_SUGGESTIONS } from '../modules/platform-identity/connection-suggestions.js';
+
+// A pool that replays queued responses IN CALL ORDER and records what it saw.
+// listConnectionSuggestions issues, in order: mutualFrontier, shared-project
+// candidates, excluded ids — then, only if at least one candidate survived,
+// identities and last-active.
+function fakePool(responses) {
+  const calls = [];
+  let i = 0;
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text: String(text), params: params || [] });
+      const next = responses[i++];
+      return { rows: next || [] };
+    },
+  };
+}
+
+const VIEWER = 4242;
+const now = Date.now();
+const RECENT = new Date(now - 5 * 24 * 60 * 60 * 1000).toISOString();  // 5 days ago
+const STALE = new Date(now - 90 * 24 * 60 * 60 * 1000).toISOString(); // 90 days ago
+
+test('scores mutuals and shared projects per D5\'s weights, caps mutuals at 10, and picks the primary-signal reason', async () => {
+  // Arrange — 2001 is mutual-heavy and recent; 2002 is shared-project-heavy
+  // and stale; 2003 shares a project too but is excluded (open request).
+  const pool = fakePool([
+    [{ github_id: '2001', mutual_count: 3 }, { github_id: '2002', mutual_count: 1 }], // mutualFrontier
+    [{ github_id: '2002', shared_projects: 2, named_project: 'Acme' },                 // sharedProjectCandidates
+     { github_id: '2003', shared_projects: 1, named_project: null }],
+    [{ github_id: '2003' }],                                                           // excludedSuggestionIds
+    [{ github_id: '2001', handle: 'ada', display_name: 'Ada', avatar_url: 'a.png' },   // identityById
+     { github_id: '2002', handle: 'grace', display_name: 'Grace', avatar_url: 'g.png' }],
+    [{ github_id: '2001', last_active: RECENT }, { github_id: '2002', last_active: STALE }], // lastActiveById
+  ]);
+
+  // Act
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  // Assert — score is RANKING, never RESPONSE (it never crosses the wire, so
+  // it is verified through ORDER and REASON, not a returned number): ada's
+  // 3 mutuals (weight 9, +1 recency = 10) outranks grace's 1 mutual + 2
+  // shared projects (weight 3 + 4 = 7, stale so no recency point).
+  assert.deepEqual(out.map((s) => s.handle), ['ada', 'grace'], '2003 is excluded and never appears; 2001 outranks 2002');
+  assert.deepEqual(Object.keys(out[0]).sort(), ['avatar_url', 'display_name', 'handle', 'reason'],
+    'an explicit whitelist — no score, no github_id');
+  assert.equal(out[0].reason, '3 mutual connections', 'mutuals is the primary (and only) signal for ada');
+  assert.equal(out[1].reason, 'You both build on Acme', 'shared projects outweighs the single mutual, and the project is named');
+});
+
+test('a shared project with no publicly-named catalogue row falls back to the generic reason', async () => {
+  const pool = fakePool([
+    [], // mutualFrontier
+    [{ github_id: '3001', shared_projects: 1, named_project: null }], // sharedProjectCandidates
+    [], // excludedSuggestionIds
+    [{ github_id: '3001', handle: 'linus', display_name: 'Linus', avatar_url: null }],
+    [{ github_id: '3001', last_active: null }],
+  ]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.equal(out.length, 1);
+  assert.equal(out[0].reason, 'A project you both build on', 'the aggregate is not the leak, the name is — D5');
+});
+
+test('the mutual weight is capped at MUTUAL_CAP mutuals, however many the frontier found', async () => {
+  // 4002 has 40 raw mutuals, 4001 has exactly the cap (10) — if the cap did
+  // NOT apply, 4002's higher raw count would outrank 4001 outright. Both
+  // capping at the same weight (30) is what puts them in a TIE, which the
+  // github_id tie-break then resolves — so 4001 sorting first, despite its
+  // smaller raw count, is the proof the cap actually fired.
+  const pool = fakePool([
+    [{ github_id: '4002', mutual_count: 40 }, { github_id: '4001', mutual_count: 10 }],
+    [],
+    [],
+    [{ github_id: '4001', handle: 'ten', display_name: null, avatar_url: null },
+     { github_id: '4002', handle: 'forty', display_name: null, avatar_url: null }],
+    [],
+  ]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.deepEqual(out.map((s) => s.handle), ['ten', 'forty'], 'weight stops growing past 10 mutuals (D5)');
+});
+
+test('no candidates from either signal costs nothing beyond the three source reads', async () => {
+  const pool = fakePool([[], [], []]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.deepEqual(out, []);
+  assert.equal(pool.calls.length, 3, 'identity and last-active are never queried for an empty candidate set');
+});
+
+test('a candidate the identity read drops (gone private mid-request) is silently absent from the output', async () => {
+  const pool = fakePool([
+    [{ github_id: '5001', mutual_count: 2 }],
+    [],
+    [],
+    [], // identityById returns nothing for 5001
+    [{ github_id: '5001', last_active: null }],
+  ]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.deepEqual(out, [], 'a candidate absent from the identity read never reaches the caller');
+});
+
+test('the list is capped at MAX_SUGGESTIONS, highest score first', async () => {
+  const N = MAX_SUGGESTIONS + 5;
+  const mutuals = Array.from({ length: N }, (_, i) => ({ github_id: String(6000 + i), mutual_count: N - i }));
+  const identities = mutuals.map((m) => ({ github_id: m.github_id, handle: `b${m.github_id}`, display_name: null, avatar_url: null }));
+  const pool = fakePool([mutuals, [], [], identities, []]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.equal(out.length, MAX_SUGGESTIONS, 'D3: "ranked, LIMIT 20"');
+  assert.equal(out[0].handle, 'b6000', 'the highest mutual_count sorts first');
+});
+
+test('a tie on score breaks on last_active, then github_id — the list is stable (D5)', async () => {
+  const pool = fakePool([
+    [{ github_id: '7002', mutual_count: 1 }, { github_id: '7001', mutual_count: 1 }],
+    [],
+    [],
+    [{ github_id: '7001', handle: 'a', display_name: null, avatar_url: null },
+     { github_id: '7002', handle: 'b', display_name: null, avatar_url: null }],
+    [{ github_id: '7001', last_active: null }, { github_id: '7002', last_active: null }],
+  ]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.deepEqual(out.map((s) => s.handle), ['a', 'b'], 'equal score and last_active — the lower github_id sorts first');
+});
+
+test('every SQL statement carries the shared visibility predicate — never a hand-rolled variant', async () => {
+  const pool = fakePool([
+    [{ github_id: '8001', mutual_count: 1 }],
+    [{ github_id: '8002', shared_projects: 1, named_project: null }],
+    [],
+    [{ github_id: '8001', handle: 'a', display_name: null, avatar_url: null }],
+    [{ github_id: '8001', last_active: null }],
+  ]);
+
+  await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  const accountReads = pool.calls.filter((c) => /platform_identity_accounts/.test(c.text));
+  assert.ok(accountReads.length >= 2, 'the frontier, the shared-project read and the identity read all touch accounts');
+  for (const c of accountReads) {
+    assert.match(c.text, /account_visibility = 'public'/, `every account read floors on existence — saw: ${c.text.slice(0, 120)}`);
+  }
+});
+
+test('a co-membership query requires the hub\'s own sign-in witness, not bare row existence (ADR 0205 D4)', async () => {
+  const pool = fakePool([[], [], []]);
+  await listConnectionSuggestions({ githubId: VIEWER, pool });
+  const membershipReads = pool.calls.filter((c) => /platform_identity_project_memberships/.test(c.text));
+  assert.ok(membershipReads.length >= 1, 'sharedProjectCandidates must have run');
+  for (const c of membershipReads) {
+    assert.match(c.text, /signin_verified_at IS NOT NULL/,
+      `a membership row a federated client wrote for someone unproven must not surface — saw: ${c.text.slice(0, 160)}`);
+  }
+});
+
+test('hide_stats blinds the recency signal — a hidden candidate\'s real activity never affects score or order, and never crosses the wire', async () => {
+  // Both candidates score identically on mutuals alone (3×2=6); 9001 is
+  // hide_stats and genuinely more recent, 9002 is public and stale. If
+  // hide_stats were NOT honoured, 9001's recency point would break the tie
+  // and put it first. It must not: hidden or not, the github_id tie-break
+  // decides, so 9002 (the lower id) sorts first despite being the stale one.
+  const pool = fakePool([
+    [{ github_id: '9002', mutual_count: 2 }, { github_id: '9001', mutual_count: 2 }],
+    [],
+    [],
+    [{ github_id: '9001', handle: 'hidden', display_name: null, avatar_url: null, hide_stats: true },
+     { github_id: '9002', handle: 'plain', display_name: null, avatar_url: null, hide_stats: false }],
+    [{ github_id: '9001', last_active: RECENT }, { github_id: '9002', last_active: STALE }],
+  ]);
+
+  const out = await listConnectionSuggestions({ githubId: VIEWER, pool });
+
+  assert.deepEqual(out.map((s) => s.handle), ['plain', 'hidden'],
+    'the hidden builder\'s real recency must not win it the tie');
+  for (const s of out) assert.ok(!('score' in s) && !('hide_stats' in s), 'neither the ranking scalar nor the flag itself ever reaches the wire');
+});
+
+test('the mutual frontier\'s 2-hop expansion is capped, not just its output (D3\'s FANOUT_2 bound)', async () => {
+  const pool = fakePool([[], [], []]);
+  await listConnectionSuggestions({ githubId: VIEWER, pool });
+  const frontier = pool.calls[0].text;
+  assert.match(frontier, /LIMIT \$4/, 'the raw edges CTE carries its own LIMIT, distinct from the output LIMIT $3');
+  assert.equal(pool.calls[0].params[3], 5000, 'defaults to FANOUT_2 — the same bound degreeBetween puts on its own 2-hop frontier');
+});

package/tests/connections_api.mjs

@@ -533,6 +533,57 @@ test('the caps are the ADR 0202 D3 numbers, and DEGREE_MAX really is 3', () => {
   assert.equal(conn.DECLINE_COOLDOWN_DAYS, 90);
 });
 
+// ===========================================================================
+// 4b. "Builders you may know" (R21, task 1002297 — ADR 0202 D5)
+// ===========================================================================
+//
+// The SCORING itself (weights, the mutual cap, the reason string, exclusion)
+// is pinned DB-free against the domain function directly in
+// tests/connection_suggestions.mjs. This is the ROUTE wrapper: own-scope,
+// the response envelope, and the consent floor every other read here shares.
+
+test('suggestions: returns the ranked list with reasons, and costs the bounded read set', async () => {
+  expect(
+    meActive(),
+    result([{ github_id: '9001', mutual_count: 2 }]),                                         // mutualFrontier
+    result([]),                                                                                // sharedProjectCandidates
+    result([]),                                                                                // excludedSuggestionIds
+    result([{ github_id: '9001', handle: 'bob', display_name: 'Bob', avatar_url: null }]),      // identityById
+    result([{ github_id: '9001', last_active: null }]),                                        // lastActiveById
+  );
+  const res = await call('GET', '/api/bongos/connections/suggestions');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json.suggestions.map((s) => s.handle), ['bob']);
+  assert.equal(res.json.suggestions[0].reason, '2 mutual connections');
+  assert.equal(res.json.count, res.json.suggestions.length, 'the count is the array\'s own length');
+  assert.equal(calls.length, 6, 'own account, then the three candidate reads, then identity + last-active');
+});
+
+test('suggestions: the candidate pool is bound to the SESSION account, never a request parameter', async () => {
+  expect(meActive(), result([]), result([]), result([]));
+  const res = await call('GET', '/api/bongos/connections/suggestions?github_id=99999999');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json, { suggestions: [], count: 0 });
+  // The mutualFrontier query (calls[1]) binds $1 to the SESSION id — a
+  // query-string parameter this route never reads cannot reach it.
+  assert.equal(calls[1].params[0], ME.github_id);
+});
+
+test('suggestions: an empty candidate pool costs no identity or last-active read', async () => {
+  expect(meActive(), result([]), result([]), result([]));
+  const res = await call('GET', '/api/bongos/connections/suggestions');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json.suggestions, []);
+  assert.equal(calls.length, 4, 'own account plus the three source reads — nothing more for an empty union');
+});
+
+test('suggestions: a provisional account is refused before any candidate read runs', async () => {
+  expect(result([{ github_id: String(ME.github_id), profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', handle: 'octo' }]));
+  const res = await call('GET', '/api/bongos/connections/suggestions');
+  assert.equal(res.status, 403);
+  assert.equal(calls.length, 1, 'refused at the consent floor (D4 §1), before any candidate read');
+});
+
 // ===========================================================================
 // 5. Nothing here is authority (ADR 0016 / ADR 0141)
 // ===========================================================================

package/tests/offboarding_secret_scrub.mjs

@@ -0,0 +1,115 @@
+// tests/offboarding_secret_scrub.mjs — deactivateBuilder scrubs stored secrets
+// (task 1003338 / ADR 0332).
+//
+// DB-free, mirroring the withTx-stub pattern in tests/government_rank_sync.mjs:
+// kernel.withTx is stubbed to hand deactivateBuilder/reactivateBuilder a single
+// recording fake client BEFORE src/bongos/db.js is required (it destructures
+// withTx at load time). No government seam is registered, so
+// syncGovernanceRankRole's optional port resolves to nothing and no-ops —
+// out of scope for this file.
+//
+// Two secrets, two different guarantees under test:
+//   1. github_oauth_tokens (core-owned) — deleteGithubToken must be called
+//      INSIDE deactivateBuilder's transaction (a real DELETE, not an event).
+//   2. the module-owned Gemini BYOK key — core never touches those columns;
+//      it emits builder.secrets-scrub-needed and a listening module (not
+//      vendored in this checkout) clears its own store. Asserted here by
+//      registering a stub listener and checking the payload.
+// reactivateBuilder must do neither — restoring a stored secret on return is
+// exactly the behaviour ADR 0332 rules out.
+//
+// Run:  node --test tests/offboarding_secret_scrub.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const kernel = require(path.join(ROOT, 'src/bongos/db-kernel.js'));
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+
+// A minimal recording client: answers just enough of deactivateBuilder's /
+// reactivateBuilder's queries to run to completion, and records every call so
+// tests can assert on what was (or wasn't) issued.
+function exitTxClient({ builderId, rank, status, newRank, newStatus }) {
+  const calls = [];
+  return {
+    calls,
+    find: (re) => calls.find((c) => re.test(c.sql)),
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (/FROM builders WHERE id = \$1 FOR UPDATE/.test(sql)) {
+        return { rows: [{ id: builderId, rank, status }] };
+      }
+      if (/FROM claims/.test(sql)) return { rows: [] };
+      if (/UPDATE builders/.test(sql)) {
+        return { rows: [{ id: builderId, rank: newRank, status: newStatus }] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+
+let txClient = null;
+kernel.withTx = async (fn) => fn(txClient);
+const coreDb = require(path.join(ROOT, 'src/bongos/db.js'));
+
+test('deactivateBuilder deletes the github_oauth_tokens row inside its transaction', async () => {
+  txClient = exitTxClient({
+    builderId: 9001, rank: 'metic', status: 'active', newRank: 'xenos', newStatus: 'inactive',
+  });
+  await coreDb.deactivateBuilder({ builderId: 9001, reason: 'left the team', actorBuilderId: 3 });
+
+  const del = txClient.find(/DELETE FROM github_oauth_tokens/);
+  assert.ok(del, 'deactivateBuilder must delete the stored GitHub token in-transaction');
+  assert.deepEqual(del.params, [9001]);
+
+  const sessionRevokeIdx = txClient.calls.findIndex((c) => /UPDATE builder_sessions SET revoked_at/.test(c.sql));
+  const tokenDeleteIdx = txClient.calls.findIndex((c) => /DELETE FROM github_oauth_tokens/.test(c.sql));
+  assert.ok(tokenDeleteIdx > sessionRevokeIdx, 'the token delete must be inside the same transaction, after the session revoke');
+});
+
+test('deactivateBuilder emits builder.secrets-scrub-needed with { builderId, actor }', async () => {
+  txClient = exitTxClient({
+    builderId: 9002, rank: 'metic', status: 'active', newRank: 'xenos', newStatus: 'inactive',
+  });
+  let received = null;
+  const off = seams.on('builder.secrets-scrub-needed', async (payload) => { received = payload; });
+  try {
+    await coreDb.deactivateBuilder({ builderId: 9002, reason: null, actorBuilderId: 5 });
+  } finally {
+    off();
+  }
+  assert.ok(received, 'the module teardown event must fire post-commit');
+  assert.equal(received.builderId, 9002);
+  assert.equal(received.actor, 'builder-exit:builder#5');
+});
+
+test('a listener-free instance (no module installed) still completes deactivation cleanly', async () => {
+  // No seams.on registered here — mirrors a vanilla instance with art-pipeline off.
+  txClient = exitTxClient({
+    builderId: 9003, rank: 'xenos', status: 'active', newRank: 'xenos', newStatus: 'inactive',
+  });
+  const result = await coreDb.deactivateBuilder({ builderId: 9003, reason: null, actorBuilderId: 3 });
+  assert.equal(result.builder.status, 'inactive');
+  assert.ok(txClient.find(/DELETE FROM github_oauth_tokens/), 'the core-owned delete still runs with no module listening');
+});
+
+test('reactivateBuilder does not delete the github token row or emit the scrub event', async () => {
+  txClient = exitTxClient({
+    builderId: 9004, rank: 'xenos', status: 'inactive', newRank: 'xenos', newStatus: 'active',
+  });
+  let scrubFired = false;
+  const off = seams.on('builder.secrets-scrub-needed', async () => { scrubFired = true; });
+  try {
+    await coreDb.reactivateBuilder({ builderId: 9004, actorBuilderId: 3 });
+  } finally {
+    off();
+  }
+  assert.ok(!txClient.find(/DELETE FROM github_oauth_tokens/), 'reactivation must not touch the token table');
+  assert.ok(!scrubFired, 'reactivation must not re-trigger the secrets scrub');
+});

package/tests/profile_connections_ui.mjs

@@ -913,6 +913,93 @@ test('removing a connection takes it out of the list', async () => {
   assert.match(page.html(), /1 connection\./);
 });
 
+// ===========================================================================
+// 7b. "Builders you may know" (R21, task 1002297 — ADR 0202 D5)
+// ===========================================================================
+//
+// The SCORING (weights, the mutual cap, exclusion, the reason string) is
+// pinned DB-free against the domain function in
+// tests/connection_suggestions.mjs, and the route wrapper in
+// tests/connections_api.mjs. This is the RENDER: canned suggestions data
+// over a real `boot()`, because modelling the frontier/co-membership SQL in
+// this file's in-memory graph would duplicate that coverage rather than add
+// to it — the same reason the degree tests above use a canned transport for
+// "a degree the API never promised" and "the mutual count is the length…".
+
+function suggestTransport(suggestions, { onConnect } = {}) {
+  const calls = { suggestions: 0 };
+  return {
+    calls,
+    request: async (method, path, opts = {}) => {
+      if (method === 'POST' && path === '/api/bongos/connections') {
+        if (onConnect) onConnect(opts.body && opts.body.handle);
+        return { status: 201, ok: true, data: { status: 'pending' } };
+      }
+      if (method === 'GET' && path === '/api/bongos/connections') return { status: 200, ok: true, data: { connections: [], count: 0 } };
+      if (method === 'GET' && path === '/api/bongos/connections/requests') return { status: 200, ok: true, data: { incoming: [], outgoing: [] } };
+      if (method === 'GET' && path === '/api/bongos/connections/suggestions') {
+        calls.suggestions++;
+        return { status: 200, ok: true, data: { suggestions, count: suggestions.length } };
+      }
+      return { status: 404, ok: false, data: null };
+    },
+  };
+}
+
+test('the own profile renders "builders you may know" with the server\'s own reason', async () => {
+  reset();
+  const page = boot({
+    transport: suggestTransport([
+      { handle: 'grace', display_name: 'Grace H', avatar_url: null, reason: '3 mutual connections' },
+    ]),
+  });
+  await page.render(profileOf('octo', 7), 7);
+  assert.match(page.html(), /Builders you may know/);
+  assert.match(page.html(), /3 mutual connections/, 'the server picked the reason; the page states it verbatim');
+  assert.match(page.html(), /data-act="suggest-connect"/);
+  assert.match(page.html(), /data-handle="grace"/);
+});
+
+test('an empty suggestion list renders no heading at all — never an empty shell', async () => {
+  reset();
+  const page = boot({ transport: suggestTransport([]) });
+  await page.render(profileOf('octo', 7), 7);
+  assert.doesNotMatch(page.html(), /Builders you may know/);
+});
+
+test('a failed suggestions read leaves the rest of the own-profile section intact', async () => {
+  reset();
+  const page = boot({
+    transport: {
+      request: async (_m, path) => {
+        if (path === '/api/bongos/connections') return { status: 200, ok: true, data: { connections: [], count: 0 } };
+        if (path === '/api/bongos/connections/requests') return { status: 200, ok: true, data: { incoming: [], outgoing: [] } };
+        return { status: 500, ok: false, data: null }; // suggestions read fails
+      },
+    },
+  });
+  await page.render(profileOf('octo', 7), 7);
+  assert.equal(page.$('#conn-scroll').hidden, false, 'suggestions are additive, never load-bearing for the section itself');
+  assert.doesNotMatch(page.html(), /Builders you may know/);
+  assert.match(page.html(), /0 connections\./);
+});
+
+test('clicking Connect on a suggestion sends the ask by handle and refreshes the section', async () => {
+  reset();
+  let asked = null;
+  const transport = suggestTransport(
+    [{ handle: 'grace', display_name: 'Grace H', avatar_url: null, reason: 'You both build on Acme' }],
+    { onConnect: (h) => { asked = h; } },
+  );
+  const page = boot({ transport });
+  await page.render(profileOf('octo', 7), 7);
+  assert.equal(transport.calls.suggestions, 1, 'the first render read suggestions once');
+  await click(page, { act: 'suggest-connect', handle: 'grace' });
+  assert.equal(asked, 'grace', 'the request names the SUGGESTION\'S handle, never an id');
+  assert.deepEqual(page.toasts, ['Request sent.']);
+  assert.equal(transport.calls.suggestions, 2, 'the click really did trigger a full re-render, not just a toast');
+});
+
 // ===========================================================================
 // 8. Degrade, don't 500 — an instance without the hub has no section
 // ===========================================================================