@bongos/core 1.19.1024 → 1.19.1026

package/tests/application_lifecycle.mjs

@@ -65,11 +65,14 @@ let nextId = 100;
 // comparing them rather than by reading the code and believing it.
 function seed() {
   const now = Date.now();
+  // `kind`/`created_by` carry core_255's column default on every seeded row:
+  // each of these is an application, and cy's is an APPROVED one.
+  const app = { kind: 'application', created_by: null };
   rows = [
-    { id: 1, github_login: 'ada', display_name: 'Ada', note: 'I build tools', status: 'pending', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR },
-    { id: 2, github_login: 'bo', display_name: 'Bo', note: 'I build tools', status: 'pending', applicant_github_id: '9002', vouched_at: now - 3 * HOUR, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR },
-    { id: 3, github_login: 'cy', display_name: 'Cy', note: null, status: 'invited', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - 2 * HOUR, created_at: now - 4 * HOUR },
-    { id: 4, github_login: 'dee', display_name: 'Dee', note: null, status: 'dismissed', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - HOUR, created_at: now - 5 * HOUR },
+    { id: 1, github_login: 'ada', display_name: 'Ada', note: 'I build tools', status: 'pending', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR, ...app },
+    { id: 2, github_login: 'bo', display_name: 'Bo', note: 'I build tools', status: 'pending', applicant_github_id: '9002', vouched_at: now - 3 * HOUR, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR, ...app },
+    { id: 3, github_login: 'cy', display_name: 'Cy', note: null, status: 'invited', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - 2 * HOUR, created_at: now - 4 * HOUR, ...app },
+    { id: 4, github_login: 'dee', display_name: 'Dee', note: null, status: 'dismissed', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - HOUR, created_at: now - 5 * HOUR, ...app },
   ];
   builders = [{ github_login: 'existing' }];
   statements = [];
@@ -102,6 +105,15 @@ function predicateFor(rawWhere, params) {
     where = where.replace(transition[0], ' TRUE ');
   }
 
+  // The outstanding-invite list's member exclusion (task 1002814): an invitee who
+  // has signed in is a member, not an outstanding invite. Stripped as one unit,
+  // like the transition guard, so its inner `lower(...)` is not re-read.
+  const notMember = /NOT EXISTS \(SELECT 1 FROM builders b WHERE lower\(b\.github_login\) = lower\(ar\.github_login\)\)/.exec(where);
+  if (notMember) {
+    tests.push((r) => !isBuilder(r.github_login));
+    where = where.replace(notMember[0], ' TRUE ');
+  }
+
   let m;
   const eat = () => { where = where.replace(m[0], ' TRUE '); };
   if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
@@ -112,6 +124,8 @@ function predicateFor(rawWhere, params) {
   }
   if ((m = /\b(?:ar\.)?status = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => r.status === v); eat(); }
   if ((m = /\b(?:ar\.)?status = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
+  if ((m = /\b(?:ar\.)?kind = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.kind === v); eat(); }
+  if ((m = /\b(?:ar\.)?created_by = \$(\d+)/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.created_by) === String(v)); eat(); }
   if ((m = /\bapplicant_github_id IS NULL\b/.exec(where))) { tests.push((r) => r.applicant_github_id == null); eat(); }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
@@ -181,11 +195,47 @@ const pool = {
         applicant_github_id: applicantGithubId, applicant_handle: applicantHandle, vouched_at: vouchedAt,
         resolved_by_builder_id: null, resolved_at: null,
         created_at: Date.now(),
+        kind: 'application', created_by: null, // the column defaults — the public write names neither
       };
       rows.push(fresh);
       return { rows: [{ id: fresh.id, github_login: fresh.github_login, status: fresh.status, created_at: fresh.created_at }] };
     }
 
+    // The invite route's fresh row (task 1002814, ADR 0335 D2). Matched EXACTLY,
+    // like the public write above, so `kind` or `created_by` cannot be dropped
+    // from the real statement with every test still green.
+    if (/^INSERT INTO access_requests \(github_login, note, kind, created_by, status, resolved_by_builder_id, resolved_at\) VALUES \(\$1, \$2, 'invite', \$3, 'invited', \$3, now\(\)\) RETURNING id, github_login, status, kind, resolved_at$/.test(sql)) {
+      const [login, note, sender] = params;
+      const at = Date.now();
+      const fresh = {
+        id: nextId++, github_login: login, display_name: null, note, status: 'invited',
+        applicant_github_id: null, applicant_handle: null, vouched_at: null,
+        resolved_by_builder_id: sender, resolved_at: at, created_at: at,
+        kind: 'invite', created_by: sender,
+      };
+      rows.push(fresh);
+      return { rows: [{ id: fresh.id, github_login: login, status: 'invited', kind: 'invite', resolved_at: at }] };
+    }
+
+    // The invite route resolving a PENDING application in place. The SET list is
+    // matched exactly: it must never touch kind, created_by or the applicant's note.
+    if ((m = /^UPDATE access_requests SET status = 'invited', resolved_by_builder_id = \$1, resolved_at = now\(\) WHERE (.+?) RETURNING id, github_login, status, kind, resolved_at$/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1], params));
+      for (const r of hit) { r.status = 'invited'; r.resolved_by_builder_id = params[0]; r.resolved_at = Date.now(); }
+      return { rows: hit.map((r) => ({ id: r.id, github_login: r.github_login, status: r.status, kind: r.kind, resolved_at: r.resolved_at })) };
+    }
+
+    // The outstanding-invite list. Its sender is joined through created_by.
+    if ((m = /^SELECT ar\.id, ar\.github_login, ar\.note, ar\.created_at, ib\.github_login AS invited_by_login FROM access_requests ar LEFT JOIN builders ib ON ib\.id = ar\.created_by WHERE (.+?) ORDER BY ar\.created_at DESC LIMIT 200$/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
+      return {
+        rows: hit.map((r) => ({
+          id: r.id, github_login: r.github_login, note: r.note, created_at: r.created_at,
+          invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null,
+        })),
+      };
+    }
+
     // The owner's queue.
     if ((m = /^SELECT ar\.id, .* FROM access_requests ar .* WHERE (.+?) ORDER BY/.exec(sql))) {
       const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
@@ -197,6 +247,9 @@ const pool = {
           // Returned only when the real SELECT names it, so the queue test below
           // proves the route reads the column rather than that this fake invents it.
           ...(/\bar\.applicant_handle\b/.test(sql) ? { applicant_handle: r.applicant_handle ?? null } : {}),
+          ...(/\bar\.kind\b/.test(sql) ? { kind: r.kind } : {}),
+          ...(/\bib\.github_login AS invited_by_login\b/.test(sql) && /\bON ib\.id = ar\.created_by\b/.test(sql)
+            ? { invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null } : {}),
           vouched: r.applicant_github_id !== null,
           resolved_by_login: null,
         })),
@@ -280,6 +333,9 @@ const dbKernel = require('../src/bongos/db-kernel.js');
 // Who is calling, and at what LIVE rank. The rank is resolved through the real
 // government port on every request — never cached — exactly as production does.
 let actingRank = 'archon';
+// Which builder is acting — switched only to prove an invite keeps its SENDER
+// when a different archon rescinds it.
+let actingId = 42;
 
 require.cache[apiPath].exports = {
   ...realApi,
@@ -287,7 +343,7 @@ require.cache[apiPath].exports = {
   joinabilityMode: () => 'apply',
   projectJoinDoor: () => 'apply',
   logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
-  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'owner' }; next(); },
+  requireBuilder: (req, _res, next) => { req.builder = { id: actingId, github_login: 'owner' }; next(); },
   // requirePermission is NOT stubbed: realApi's own gate is used, so the denial
   // below is the production denial.
   readApplicationVouch: (token, { githubLogin } = {}) =>
@@ -336,7 +392,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -692,6 +748,118 @@ test('only invited|dismissed are accepted, and a rejected status writes nothing'
   assert.equal(JSON.stringify(rows), snapshot);
 });
 
+// ===========================================================================
+// Invite — a pre-approved row the gate already reads (task 1002814, ADR 0335 D2)
+// ===========================================================================
+
+// The two archons the invite tests act as. Only their ids matter: the sender is
+// joined through created_by → builders.id.
+const ARCHONS = [{ id: 42, github_login: 'owner' }, { id: 43, github_login: 'second' }];
+
+test('invite: a login that never applied signs straight in, and the row says it is an invite and who sent it', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), false, 'precondition: eve never applied');
+  const r = await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve', note: 'Come build the parser' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.kind, 'invite');
+  const eve = rows.find((x) => x.github_login === 'eve');
+  assert.equal(eve.kind, 'invite');
+  assert.equal(eve.created_by, 42, 'the sender');
+  assert.equal(eve.note, 'Come build the parser', 'the inviter’s words, and kind says whose');
+  statements = [];
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), true, 'the REAL admission read admits her — signing in is the acceptance act');
+  assert.ok(statements.length > 0 && statements.every(({ sql }) => !/\bkind\b|\bcreated_by\b/.test(sql)),
+    'and it admitted her without reading either new column (D2.5)');
+});
+
+test('rescind: an invite keeps its sender through a rescind by a different archon, and the door re-locks', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  const sent = await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+  actingId = 43;
+  const r = await call('PATCH', `/api/gds/access-requests/${sent.json.request.id}`, { status: 'dismissed' });
+  assert.equal(r.status, 200);
+  const eve = rows.find((x) => x.github_login === 'eve');
+  assert.equal(eve.status, 'dismissed');
+  assert.equal(eve.resolved_by_builder_id, 43, 'resolved_by records whoever acted last (ADR 0201 D4.2)…');
+  assert.equal(eve.created_by, 42, '…so the sender needs its own column, and the rescind does not touch it (D2.2)');
+  assert.equal(eve.kind, 'invite', 'a rescinded invite is still an invite in the history');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), false, 'the door is shut again');
+});
+
+test('invites list: outstanding only — not an approved application, a rescinded invite, or an invitee who signed in', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve', note: 'hi' });
+  actingId = 43;
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  const gus = await call('POST', '/api/gds/access-requests/invite', { github_login: 'gus' });
+  await call('PATCH', `/api/gds/access-requests/${gus.json.request.id}`, { status: 'dismissed' });
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'hal' });
+  builders.push({ id: 90, github_login: 'HAL' }); // hal accepted: he signed in
+  const r = await call('GET', '/api/gds/access-requests/invites');
+  assert.equal(r.status, 200);
+  const byLogin = Object.fromEntries(r.json.invites.map((x) => [x.github_login, x]));
+  assert.deepEqual(Object.keys(byLogin).sort(), ['eve', 'fay'],
+    'cy (an approved application), gus (rescinded) and hal (signed in, case-insensitively) are not outstanding');
+  assert.equal(byLogin.eve.invited_by_login, 'owner');
+  assert.equal(byLogin.fay.invited_by_login, 'second', 'each names its own sender');
+  assert.equal(byLogin.eve.note, 'hi');
+
+  const mine43 = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(mine43.json.invites.map((x) => x.github_login), ['fay'], '?mine=1: the sender lists their own outstanding invites');
+  actingId = 42;
+  const mine42 = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(mine42.json.invites.map((x) => x.github_login), ['eve']);
+});
+
+test('the queue history tells an invite from an approved application, and names the sender', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve', note: 'Come build the parser' });
+  await call('PATCH', '/api/gds/access-requests/1', { status: 'invited' }); // approve ada's application
+  const r = await call('GET', '/api/gds/access-requests?status=invited');
+  const byLogin = Object.fromEntries(r.json.requests.map((x) => [x.github_login, x]));
+  assert.equal(byLogin.cy.kind, 'application', 'cy applied and was approved');
+  assert.equal(byLogin.cy.invited_by_login, null);
+  assert.equal(byLogin.eve.kind, 'invite', 'eve never applied — an archon invited her');
+  assert.equal(byLogin.eve.invited_by_login, 'owner');
+  // `note` on this read has always meant the APPLICANT's words (the hall quotes it
+  // as theirs), so an inviter's note must never arrive in it.
+  assert.equal(byLogin.eve.note, null, 'an inviter’s note is not the invitee’s words');
+  assert.equal(byLogin.eve.invite_note, 'Come build the parser');
+  assert.equal(byLogin.ada.note, 'I build tools', 'an applicant’s note stays where it always was');
+  assert.equal(byLogin.ada.invite_note, null);
+});
+
+test('invite: resolving a pending application in place keeps it an application, with the applicant’s own note', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  const r = await call('POST', '/api/gds/access-requests/invite', { github_login: 'ada', note: 'not their words' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.kind, 'application');
+  assert.equal(row(1).status, 'invited');
+  assert.equal(row(1).kind, 'application', 'it was an application, and its history says so (D2.1)');
+  assert.equal(row(1).created_by, null, 'created_by is set on invite rows only (D2.2)');
+  assert.equal(row(1).note, 'I build tools', 'an inviter never overwrites the applicant’s note');
+  assert.equal(rows.filter((x) => x.github_login === 'ada').length, 1, 'resolved, not duplicated');
+});
+
+for (const rank of ['thetes', 'metic']) {
+  test(`a ${rank} can neither invite nor list outstanding invites — access_request.review until R3 mints project.recruit`, async () => {
+    reset(rank);
+    const snapshot = JSON.stringify(rows);
+    const invited = await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+    assert.equal(invited.status, 403);
+    assert.deepEqual(invited.json.error.details.required, ['access_request.review']);
+    const listed = await call('GET', '/api/gds/access-requests/invites');
+    assert.equal(listed.status, 403, 'the list names logins that are not members yet');
+    assert.equal(JSON.stringify(rows), snapshot, 'nothing was written');
+    assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), false);
+  });
+}
+
 // ===========================================================================
 // Authority — "a builder cannot approve or decline for a project they don't own"
 // ===========================================================================

package/tests/community_leaderboard_db.mjs

@@ -0,0 +1,202 @@
+// tests/community_leaderboard_db.mjs — task 1002978 (community spec D2/D3; real DB).
+//
+// Proves the windowed leaderboard's arithmetic and eligibility against real
+// SQL. The window math is a LATERAL "last snapshot at-or-before the window
+// start" probe per (project, builder) plus a cross-project sum, and a fake pool
+// can only prove the statement's SHAPE (tests/community_leaderboard_route.mjs);
+// only a real Postgres can prove which snapshot becomes the baseline, that a
+// missing baseline counts as zero, and that the privacy matrix really filters.
+//
+// Every fixture carries a discipline no real builder holds, and every read
+// filters on it, so a shared database's own builders never enter the board
+// under test.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/community_leaderboard_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const { listLeaderboard, clearTotalsMemo } = require('../modules/platform-identity/community-leaderboard.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`community_leaderboard_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const A = 90297801, B = 90297802, C = 90297803, D = 90297804, OPTOUT = 90297805;
+const HIDDEN = 90297806, PRIVATE = 90297807, PROV = 90297808, LEGACY = 90297809, BIG = 90297810;
+const IDS = [A, B, C, D, OPTOUT, HIDDEN, PRIVATE, PROV, LEGACY, BIG];
+const P1 = 't1002978-p1', P2 = 't1002978-p2';
+const TAG = 't1002978-board';     // every fixture holds it; every read filters on it
+const TAG_ART = 't1002978-art';   // held by A on P2 only — the union filter
+const TAG_BIG = 't1002978-big';   // BIG's own board, so its totals stay out of the others
+const INT4_MAX = 2147483647;
+const NOW = new Date('2026-06-01T12:00:00.000Z');
+const DAY = 24 * 60 * 60 * 1000;
+const ago = (days, extraMs = 0) => new Date(NOW.getTime() - days * DAY + extraMs);
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+}
+
+async function account(id, handle, { state = 'active', visibility = 'public', hide = false, accepted = true, reach = null } = {}) {
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, handle, profile_state, account_visibility, hide_stats, recruiter_discoverable, terms_accepted_at)
+     VALUES ($1, $2, $2, $2, $3, $4, $5, $6, CASE WHEN $7::boolean THEN now() END)`,
+    [id, handle, state, visibility, hide, reach, accepted],
+  );
+}
+async function activity(id, client, credits, ships, karma, disciplines = [TAG]) {
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity (client_id, github_id, credits, tasks_shipped, karma, disciplines)
+     VALUES ($1, $2, $3, $4, $5, $6)`,
+    [client, id, credits, ships, karma, disciplines],
+  );
+}
+async function snapshot(id, client, credits, ships, karma, at) {
+  await q(
+    `INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at)
+     VALUES ($1, $2, $3, $4, $5, $6)`,
+    [client, id, credits, ships, karma, at],
+  );
+}
+
+const board = async (window, discipline = TAG) =>
+  (await listLeaderboard({ window, discipline, limit: 100, now: NOW, pool })).results;
+const row = (results, handle) => results.find((r) => r.handle === handle);
+const totals = (r) => r && [r.credits, r.tasks_shipped, r.karma];
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  // The module's own migrations (idempotent) — every column the NUMBERS
+  // predicate and the board read: 007 consent + hide, 008 handle, 012 privacy,
+  // 019 the terms half of consent, 005/022 the two tables the window reads.
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_005_builder_activity.sql',
+    'platform_identity_007_profile_consent.sql', 'platform_identity_008_handle.sql',
+    'platform_identity_012_account_privacy.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_022_activity_snapshots.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  await account(A, 't1002978-a');
+  await account(B, 't1002978-b');
+  await account(C, 't1002978-c');
+  await account(D, 't1002978-d');
+  await account(OPTOUT, 't1002978-optout', { reach: false });
+  await account(HIDDEN, 't1002978-hidden', { hide: true });
+  await account(PRIVATE, 't1002978-private', { visibility: 'private' });
+  await account(PROV, 't1002978-prov', { state: 'provisional', accepted: false });
+  await account(LEGACY, 't1002978-legacy', { accepted: false }); // active, but never accepted the terms
+
+  // A: two projects. P1 has history; P2 has none (a builder not seen since
+  // snapshots began — the day-one case the spec accepts).
+  await activity(A, P1, 200, 9, 3);
+  await snapshot(A, P1, 100, 5, 2, ago(40));
+  await snapshot(A, P1, 150, 7, 3, ago(10));
+  await snapshot(A, P1, 200, 9, 3, ago(2));
+  await activity(A, P2, 30, 1, 0, [TAG, TAG_ART]);
+  // B: unchanged for the last 20 days.
+  await activity(B, P1, 500, 10, 1);
+  await snapshot(B, P1, 500, 10, 1, ago(20));
+  // C: a snapshot EXACTLY at the 7d start, and one a second after it.
+  await activity(C, P1, 45, 2, 0);
+  await snapshot(C, P1, 40, 2, 0, ago(7));
+  await snapshot(C, P1, 42, 2, 0, ago(7, 1000));
+  // D: lost credits inside the week (a clawback).
+  await activity(D, P1, 90, 3, 5);
+  await snapshot(D, P1, 100, 3, 5, ago(10));
+  await activity(OPTOUT, P1, 60, 2, 0);
+  // Out of the matrix — every one would top the board if it leaked.
+  for (const id of [HIDDEN, PRIVATE, PROV, LEGACY]) await activity(id, P1, 9000, 90, 9);
+  await account(BIG, 't1002978-big');
+  await activity(BIG, P1, INT4_MAX, 1, 0, [TAG_BIG]);
+  await activity(BIG, P2, INT4_MAX, 1, 0, [TAG_BIG]);
+  await snapshot(BIG, P1, -INT4_MAX, 0, 0, ago(10));
+
+  // 1 — all-time: the live rows summed across projects, no baseline.
+  const all = await board('all');
+  same(all.map((r) => r.handle), ['t1002978-b', 't1002978-a', 't1002978-d', 't1002978-optout', 't1002978-c'],
+    'all-time ranks by summed credits');
+  same(totals(row(all, 't1002978-a')), [230, 10, 3], 'all-time sums a builder across both projects');
+  same(all.map((r) => r.place), [1, 2, 3, 4, 5], 'place numbers the board from 1');
+
+  // 2 — the privacy matrix, against the real predicate.
+  for (const window of ['all', '7d', '30d', '365d']) {
+    const handles = (await board(window)).map((r) => r.handle);
+    for (const h of ['t1002978-hidden', 't1002978-private', 't1002978-prov', 't1002978-legacy']) {
+      assert.ok(!handles.includes(h), `${h} leaked onto the ${window} board`);
+    }
+  }
+  pass++; console.log('  ok - hidden, private, provisional and never-accepted builders are absent from every window');
+  ok(row(all, 't1002978-optout'), 'a builder who opted out of RECRUITING still appears (spec D3)');
+
+  // 3 — 7d: live minus the last snapshot at-or-before the start, summed.
+  const week = await board('7d');
+  same(totals(row(week, 't1002978-a')), [80, 3, 0],
+    '7d: P1 counts from the 10-day-old snapshot, P2 (no history) counts in full');
+  same(totals(row(week, 't1002978-c')), [5, 0, 0],
+    '7d: a snapshot exactly at the window start IS the baseline; one a second later is not');
+  same(totals(row(week, 't1002978-d')), [-10, 0, 0], '7d: a loss inside the window is a negative delta, not hidden');
+  ok(!row(week, 't1002978-b'), '7d: a builder with no movement in the window is left off the board');
+  same(week.map((r) => r.handle), ['t1002978-a', 't1002978-optout', 't1002978-c', 't1002978-d'],
+    '7d ranks by the window delta, a loss last');
+
+  // 4 — 30d and 365d.
+  const month = await board('30d');
+  same(totals(row(month, 't1002978-a')), [130, 5, 1], '30d: P1 counts from the 40-day-old snapshot');
+  same(totals(row(month, 't1002978-b')), [500, 10, 1],
+    '30d: a builder whose first snapshot is inside the window has no baseline, so counts in full');
+  const year = await board('365d');
+  same(totals(row(year, 't1002978-a')), [230, 10, 3], '365d: no snapshot is old enough, so everything counts');
+
+  // 5 — the discipline filter is the builder's union across projects.
+  const art = await board('all', TAG_ART);
+  same(art.map((r) => r.handle), ['t1002978-a'], 'a discipline held on ONE project admits the builder');
+  same(totals(art[0]), [230, 10, 3], 'the filter picks builders, not projects — totals stay whole');
+  same(art[0].disciplines, [TAG_ART, TAG].sort(), 'disciplines is the de-duplicated union');
+
+  // 6 — instance-reported int4 totals cannot overflow the board into a 500.
+  same(totals((await board('all', TAG_BIG))[0]), [2 * INT4_MAX, 2, 0], 'all-time: two int4-max projects sum past int4');
+  same(totals((await board('7d', TAG_BIG))[0]), [3 * INT4_MAX, 2, 0], '7d: int4-max minus a negative baseline does not overflow');
+
+  // 7 — paging keeps the board's own place numbers.
+  const page2 = (await listLeaderboard({ window: 'all', discipline: TAG, limit: 2, offset: 2, now: NOW, pool })).results;
+  same(page2.map((r) => [r.place, r.handle]), [[3, 't1002978-d'], [4, 't1002978-optout']], 'offset pages keep place');
+
+  // 8 — the memoized path (no `now`) against real SQL: hiding beats the memo.
+  clearTotalsMemo();
+  const memo = async () => (await listLeaderboard({ window: 'all', discipline: TAG, limit: 100, pool })).results;
+  ok(row(await memo(), 't1002978-a'), 'the memoized all-time board lists A');
+  await q(`UPDATE platform_identity_accounts SET hide_stats = true WHERE github_id = $1`, [A]);
+  ok(!row(await memo(), 't1002978-a'), 'A hides inside the memo TTL and is gone on the very next request');
+  clearTotalsMemo();
+
+  console.log(`\ncommunity_leaderboard_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}