@bongos/core 1.19.1045 → 1.19.1046

package/tests/hall_roster_world.mjs

@@ -5,10 +5,10 @@
 // in the open and the rest behind the kit's disclosure, the readiness is the
 // family's figure band in the same dot language as the roll line, the view
 // toggle is a view and not a filter, the accent lands on the one live door; the
-// legacy /scouting door is deleted and its URL redirects onto the one directory
-// page (task 1003440), which shows the avatar, the name and the login
-// the API returns; the session ledger drops the nowrap + wrapper pair that broke
-// its sticky header, makes every id a door, and names its floor from the pack.
+// cross-project directory is gone from the hall — /scouting was deleted by task
+// 1003440 and /people by task 1003444, and both URLs now land on /roster; the
+// session ledger drops the nowrap + wrapper pair that broke its sticky header,
+// makes every id a door, and names its floor from the pack.
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
@@ -156,8 +156,8 @@ test('goals: the card is the row folded — no box, one fact source, the subtitl
   assert.match(read('goals-page.js'), /gr-row gr-row--skel/, 'the boot skeleton is row-shaped');
 });
 
-test('goals.css and people.css spend only the fifteen, and every token they name exists', () => {
-  for (const f of ['goals.css', 'people.css']) {
+test('goals.css and roster.css spend only the fifteen, and every token they name exists', () => {
+  for (const f of ['goals.css', 'roster.css']) {
     const css = read(f);
     noAlias(css, f);
     tokensDefined(css, f);
@@ -165,89 +165,61 @@ test('goals.css and people.css spend only the fifteen, and every token they name
 });
 
 // =========================================================================
-// PEOPLE — one directory, one door
+// PEOPLE — deleted from the hall; both old doors land on /roster
 // =========================================================================
 
-// Task 1003470 made /scouting render people.html byte-for-byte; task 1003440
-// removes the door itself. Two URLs onto one directory is a surface to keep in
-// sync that no reader ever asked for — but the URL still has to answer, or a
-// bookmark on the old door 404s.
-test('the legacy /scouting door is deleted, and nothing scouting-shaped is left in the hall', () => {
-  for (const f of ['scouting.html', 'scouting.js', 'scouting.states.json', 'scouting.css']) {
-    assert.ok(!fs.existsSync(path.join(PUB, f)), f + ' is gone — one directory, one door');
+// Task 1003440 deleted the legacy /scouting door; task 1003444 deleted /people
+// itself (owner call, 2026-09-25 evening — ADR 0337 D5): cross-project discovery
+// belongs to the hub, and the hall's directory is /roster. Both URLs still have
+// to answer, or a bookmark 404s.
+test('the /people page and its legacy /scouting door are deleted, and nothing of either is left in the hall', () => {
+  for (const f of ['scouting.html', 'scouting.js', 'scouting.states.json', 'scouting.css',
+    'people.html', 'people.js', 'people.states.json', 'people.css']) {
+    assert.ok(!fs.existsSync(path.join(PUB, f)), f + ' is gone — the hall carries no cross-project directory');
   }
 });
 
-test('the /scouting URL redirects to /people, and no dead gate dispatches to it', () => {
+test('the /people and /scouting URLs redirect to /roster, and no gate dispatches to either', () => {
   const serve = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8');
-  const i = serve.indexOf('const SCOUTING_LEGACY_RE');
-  assert.ok(i > 0, 'the retired URL keeps a matcher, so the bookmark still lands somewhere');
-  const block = serve.slice(i, i + 1200);
-  assert.ok(block.includes('res.redirect(301,'), 'and answers with a permanent redirect');
-  assert.ok(block.includes("/people"), 'pointing at the directory that replaced it');
+  const decl = 'const RETIRED_DIRECTORY_RE = ';
+  const i = serve.indexOf(decl);
+  assert.ok(i > 0, 'the retired URLs keep a matcher, so a bookmark still lands somewhere');
+  const block = serve.slice(i, i + 900);
+  // 302, not 301: /roster is the interim target until the hub community page
+  // (task 1003363) ships, and a browser caches a 301 past any re-point.
+  assert.ok(block.includes('res.redirect(302,'), 'and answers with a temporary redirect');
+  assert.ok(block.includes('/roster'), 'pointing at the in-project directory that remains');
   // RUN the shipped matcher, rather than trusting that it reads right. Anchoring
   // is the half that goes wrong: an unanchored twin would swallow the API route.
-  const decl = 'const SCOUTING_LEGACY_RE = ';
-  const j = serve.indexOf(decl);
-  const rx = eval(serve.slice(j + decl.length, serve.indexOf(';', j))); // eslint-disable-line no-eval
-  for (const p of ['/builders/scouting', '/builders/scouting/', '/builders/scouting.html']) {
+  const rx = eval(serve.slice(i + decl.length, serve.indexOf(';', i))); // eslint-disable-line no-eval
+  for (const p of ['/builders/people', '/builders/people/', '/builders/people.html',
+    '/builders/scouting', '/builders/scouting/', '/builders/scouting.html']) {
     assert.ok(rx.test(p), p + ' must reach the redirect');
   }
-  for (const p of ['/api/gds/scouting', '/api/bongos/scouting', '/builders/people',
-    '/builders/scoutingfoo', '/builders/scouting/extra']) {
-    assert.ok(!rx.test(p), p + ' must NOT be redirected — the data route and the directory are not the door');
+  for (const p of ['/api/gds/scouting', '/api/bongos/scouting', '/builders/roster',
+    '/builders/peoplefoo', '/builders/people/extra', '/builders/scoutingfoo', '/builders/scouting/extra']) {
+    assert.ok(!rx.test(p), p + ' must NOT be redirected — the data route and the roster are not the door');
   }
   // The gate is the half that would rot silently: a page-gate branch still
   // naming a deleted page is a wall guarding nothing.
-  assert.ok(!decomment(serve).includes('SCOUTING_PAGE_RE'),
-    'no page gate is left dispatching to a page that no longer exists');
-});
-
-test('the directory page loads its own script, sheet and toolkit', () => {
-  const people = read('people.html');
-  for (const html of [people]) {
-    assert.match(html, /\/builders\/people\.js/);
-    assert.match(html, /\/builders\/people\.css/);
-    assert.match(html, /\/builders\/dom-utils\.js/, 'the toolkit the rank label and the number formats come from');
-    assert.match(html, /<h1 class="page-head__h">People<\/h1>/);
+  const code = decomment(serve);
+  for (const gone of ['SCOUTING_PAGE_RE', 'PEOPLE_PAGE_RE', 'SCOUTING_LEGACY_RE', 'requireProjectCuratePage']) {
+    assert.ok(!code.includes(gone), `${gone} is gone — no gate dispatches to a page that no longer exists`);
   }
 });
 
-test('the directory row shows the avatar, the name and the login the API returns, and the name is a door', () => {
-  const src = read('people.js');
-  assert.match(src, /b\.avatar_url\s*\?\s*'<img class="dir-avatar" src="' \+ esc\(b\.avatar_url\)/, 'the avatar the pages dropped');
-  assert.match(src, /dir-avatar dir-avatar--initial/, 'an initial when there is none');
-  assert.match(src, /return b\.display_name \|\| b\.github_login \|\| \('#' \+ b\.github_id\);/, 'the display name reads first');
-  assert.match(src, /class="lb-name dir-name" href="https:\/\/github\.com\/' \+ encodeURIComponent\(b\.github_login\)/,
-    'the shell\'s .lb-name, to the one page every listed builder has');
-  assert.match(src, /'<span class="dir-login">@' \+ esc\(b\.github_login\)/, 'the login under the name says where the door goes');
-  // The chip is the assertion; what goes IN it is the role vocabulary, not the column
-  // (task 1004040). This line used to pin `esc(String(d))` — the raw value — so it read as
-  // a guard on the chip while actually holding the Directory to rendering 'unclassified'
-  // and a lowercase 'ui'. Pinning the wrapper and the helper keeps the original intent
-  // without pinning the defect that happened to be inside it.
-  assert.match(src, /<span class="fact-chip">' \+ esc\(roleLabel\(d\)\)/, 'roles are chips, spoken not printed');
-  assert.doesNotMatch(src, /class="num"/, 'the shell\'s ledger__num, not the bare .num scouting.js had corrected');
-  assert.match(src, /class="ledger__num"/);
-});
-
-test('the directory has a search, a sort and a craft lens on the kit bar, and pages through the kit', () => {
-  const src = read('people.js');
-  assert.match(src, /kit\.makeFilterBar\(\{/);
-  assert.match(src, /search: \{ id: 'people-q'/);
-  assert.match(src, /\{ id: 'people-sort', label: 'Sort'/);
-  // task 1003936: the axis label is read from OTB.roleAxisLabel(), never typed.
-  assert.match(src, /\{ id: 'people-craft', label: window\.OTB\.roleAxisLabel\(\)/);
-  assert.match(src, /kit\.makePager\('people'/);
-  assert.match(src, /kit\.makeLedger\(\{/);
-  assert.doesNotMatch(src, /createElement\('table'\)/, 'no hand-built table');
-});
-
-test('the directory names its floor from the pack, and never says Archon-only', () => {
-  const src = read('people.js');
-  assert.match(src, /rankLabel\('metic'\)/);
-  assert.doesNotMatch(decomment(src), /Archon-only/);
-  assert.doesNotMatch(read('people.html'), /Archon/);
+test('no hall page links to /people or loads its assets', () => {
+  const offenders = [];
+  for (const f of fs.readdirSync(PUB).filter((n) => /\.(html|js|css)$/.test(n))) {
+    const src = decomment(read(f)).replace(/<!--[\s\S]*?-->/g, '');
+    if (/['"(=]\/(builders\/)?people(\.html)?\/?['"?#)\s>]/.test(src)) offenders.push(`${f}: a /people link`);
+    if (/people\.(css|js)\b/.test(src)) offenders.push(`${f}: a people.css/people.js reference`);
+  }
+  assert.deepEqual(offenders, [], 'a link to the deleted page would bounce off the redirect for no reason');
+  // The roster's identity cell moved with it: the sheet is the roster's own now.
+  const roster = read('roster.html');
+  assert.match(roster, /\/builders\/roster\.css/, 'roster.html loads its own sheet');
+  assert.doesNotMatch(roster, /cross-project directory/, 'and no longer contrasts itself with a page the hall no longer has');
 });
 
 // =========================================================================
@@ -304,7 +276,7 @@ test('sessions: the floor is written from the pack\'s rank label, never a hardco
 // The harness carries what the pages read, and the states files ask for the new states
 // =========================================================================
 
-test('the harness feeds: rollups for every goal, the category set, avatars on the directory', () => {
+test('the harness feeds: rollups for every goal and the category set', () => {
   const goals = readJson('goals.json').goals;
   const rollups = readJson('goals__rollups.json').rollups;
   const byGoal = new Set(rollups.map((r) => String(r.goal_id)));
@@ -315,16 +287,13 @@ test('the harness feeds: rollups for every goal, the category set, avatars on th
   assert.ok(goals.some((g) => g.category && g.category.slug), 'some goals carry a category');
   const cats = readJson('work-categories.json').categories;
   assert.ok(cats.length >= 2 && cats.every((c) => c.slug && c.label));
-  const dir = readJson('scouting.json').builders;
-  assert.ok(dir.some((b) => b.avatar_url) && dir.some((b) => !b.avatar_url), 'the directory fixture has builders with and without an avatar');
+  assert.ok(!fs.existsSync(path.join(FIX, 'scouting.json')), 'the directory fixture left with the only page that read it');
 });
 
 test('the states files exercise the redesign\'s new states', () => {
   const goals = JSON.parse(read('goals.states.json'));
   assert.ok(goals.states.filters && goals.states.cards, 'goals: the Filters disclosure and the cards view are measured');
   assert.deepEqual(goals.states.cards.expect.value, [['#f-goal-view', 'cards']]);
-  const people = JSON.parse(read('people.states.json'));
-  assert.ok(people.states.search, 'people: a search is measured');
   const sessions = JSON.parse(read('sessions.states.json'));
   assert.deepEqual(sessions.states.ledger.expect.visible, ['#stats-scroll', '#sessions-scroll']);
 });

package/tests/module_contributions.mjs

@@ -227,7 +227,6 @@ test('the role axis has exactly one user-facing word, and no surface types it',
   const SURFACES = [
     'modules/hall-ui/public/work.js',
     'modules/hall-ui/public/goals-page.js',
-    'modules/hall-ui/public/people.js',
     'modules/hall-ui/public/profile.js',
     'modules/hall-ui/public/builders.js',
   ];

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'ff2017aa9bbbc507';
+const SHELL_SHA = '6b28297270d1e1f0';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/{scouting_page_gate.mjs → page_gate_second_door.mjs}

@@ -1,12 +1,16 @@
-// tests/scouting_page_gate.mjs
+// tests/page_gate_second_door.mjs
 //
-// The OTHER half of R14 (task 1002290, ADR 0210 D3): the `/builders/people`
-// SHELL must admit exactly the two audiences `GET /scouting` admits.
+// The page gates' `alsoAdmits` SECOND DOOR (ADR 0210), proven on the one gate that
+// declares it: requireCorePinPage, the /deploy shell, whose routes admit a hosted
+// project's own owner beside `core.pin.move` (ADR 0339, task 1004174). The door's
+// first user was the hall's /people page; task 1003444 deleted that page (ADR 0337
+// D5) and retargeted this file (formerly tests/scouting_page_gate.mjs) here.
 //
-// WHY THIS IS ITS OWN FILE, AND ITS OWN GATE. `runPageGate` grew an optional
+// WHY THIS IS ITS OWN FILE. `runPageGate` grew an optional
 // `alsoAdmits` door — new authorization code that runs on EVERY page-gate
 // denial, for every gate. The route proof
-// (tests/scouting_owner_access_and_reach.mjs) cannot reach it: page gates are
+// (tests/core_upgrade_owner_door.mjs) proves the widening itself; this file pins
+// the door's failure modes, which a route proof cannot reach: page gates are
 // driven by a session, and that file's ESM imports pull `auth.js` in through the
 // module graph before any session double could be installed. This file installs
 // the double FIRST, exactly as tests/government_page_gates.mjs does, and so gets
@@ -21,12 +25,12 @@
 //   3. every way the second door can fail — module absent, function absent, a
 //      throw, a non-boolean, and a name that resolves only through the prototype
 //      — fails CLOSED. A fail-open default in an authz path is the bug class;
-//   4. the other four gates are untouched, and their seam is never even
+//   4. the other gates are untouched, and their seam is never even
 //      consulted, because they declare no second door.
 //
 // DB-free: a session double and a port double. No Postgres, no HTTP.
 //
-// Run:  node tests/scouting_page_gate.mjs
+// Run:  node tests/page_gate_second_door.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -53,12 +57,13 @@ async function t(name, fn) {
 }
 
 // The cast. `rank` is the caller's rank ON THE HUB; `github_id` is the account
-// whose project memberships the ownership door asks about. The whole point of
-// R14 is the first row: a project's registrant is an Archon on their OWN
-// instance and, here, very often a xenos holding nothing at all.
+// whose project memberships the ownership door asks about. The first row is the
+// point: a project's registrant is an Archon on their OWN instance and, on the
+// hub, very often a xenos holding nothing at all.
 const OWNER = { builder_id: 1, github_id: '9001', rank: 'xenos' };
 const STRANGER = { builder_id: 2, github_id: '9002', rank: 'xenos' };
-const OPERATOR = { builder_id: 5, github_id: '9005', rank: 'metic' };
+// core.pin.move is archon-floor (ADR 0293), so the permission-door control is an Archon.
+const OPERATOR = { builder_id: 5, github_id: '9005', rank: 'archon' };
 
 // The ownership answer, as the platform-identity.hub port supplies it.
 const OWNS = new Set(['9001']);
@@ -94,33 +99,33 @@ async function runGate(gate, session, hub) {
   return { res, nexted };
 }
 
-const DENIED_CURATE = { code: 302, loc: '/builders?denied=project.curate' };
+const DENIED_PIN = { code: 302, loc: '/builders?denied=core.pin.move' };
 
-console.log('the /people shell follows its data route:');
+console.log('the /deploy shell follows its data routes:');
 
 await t('a PROJECT OWNER reaches the shell, holding no permission at all', async () => {
-  const { nexted } = await runGate('requireProjectCuratePage', OWNER, workingHub);
+  const { nexted } = await runGate('requireCorePinPage', OWNER, workingHub);
   assert.ok(nexted,
     'the page gate must admit the audience its data route admits — otherwise the widening is real in the API and unreachable in the product');
 });
 
 await t('CONTROL: the permission door still opens the shell on its own', async () => {
-  const { nexted } = await runGate('requireProjectCuratePage', OPERATOR, workingHub);
-  assert.ok(nexted, 'ADR 0157 put project.curate at the metic floor; R14 did not move it');
+  const { nexted } = await runGate('requireCorePinPage', OPERATOR, workingHub);
+  assert.ok(nexted, 'core.pin.move admits an Archon (ADR 0293); ADR 0339 did not move it');
   // ...and it does not need the second door at all.
-  const { nexted: noHub } = await runGate('requireProjectCuratePage', OPERATOR, null);
+  const { nexted: noHub } = await runGate('requireCorePinPage', OPERATOR, null);
   assert.ok(noHub, 'an operator gets in on a vanilla instance with no hub module');
 });
 
 await t('a builder who is neither gets the byte-identical redirect the gate always sent', async () => {
-  const { res, nexted } = await runGate('requireProjectCuratePage', STRANGER, workingHub);
-  assert.equal(nexted, false, 'building on a project is not owning one');
-  assert.deepEqual(res._redirect, DENIED_CURATE,
+  const { res, nexted } = await runGate('requireCorePinPage', STRANGER, workingHub);
+  assert.equal(nexted, false, 'a xenos who owns no project stays out');
+  assert.deepEqual(res._redirect, DENIED_PIN,
     'the denial keeps naming the permission (task 1002613), so the hall shell can still render WHY');
 });
 
 await t('an unauthenticated visitor is still bounced into sign-in, never to the second door', async () => {
-  const { res, nexted } = await runGate('requireProjectCuratePage', null, workingHub);
+  const { res, nexted } = await runGate('requireCorePinPage', null, workingHub);
   assert.equal(nexted, false);
   assert.match(res._redirect.loc, /auth\/web\/start/, 'no session means sign-in, not a denial page');
 });
@@ -139,12 +144,12 @@ await t('every way the second door can fail, it fails CLOSED', async () => {
     ['the function resolves only through the prototype', Object.create({ isProjectOwner: () => true })],
   ];
   for (const [why, hub] of cases) {
-    const { res, nexted } = await runGate('requireProjectCuratePage', OWNER, hub);
+    const { res, nexted } = await runGate('requireCorePinPage', OWNER, hub);
     assert.equal(nexted, false, `${why}: must not admit`);
-    assert.deepEqual(res._redirect, DENIED_CURATE,
+    assert.deepEqual(res._redirect, DENIED_PIN,
       `${why}: must still redirect rather than hang, throw, or answer JSON`);
   }
-  const { nexted } = await runGate('requireProjectCuratePage', OWNER, workingHub);
+  const { nexted } = await runGate('requireCorePinPage', OWNER, workingHub);
   assert.ok(nexted, 'CONTROL: the same caller IS admitted when the door works — the six refusals are the door, not the caller');
 });
 
@@ -152,7 +157,7 @@ await t('the second door is consulted only where the AUTHORITY answer was no', a
   // A permission holder must not pay for it, and — more important — the seam
   // must never be able to NARROW a caller the permission already admitted.
   const spy = { isProjectOwner: () => { throw new Error('the seam must not be consulted for a caller the permission already admitted'); } };
-  const { nexted } = await runGate('requireProjectCuratePage', OPERATOR, spy);
+  const { nexted } = await runGate('requireCorePinPage', OPERATOR, spy);
   assert.ok(nexted, 'the atom holder is admitted before the second door is reached');
 });
 
@@ -176,14 +181,14 @@ await t('the OTHER page gates are untouched — their seam is never consulted at
 
 await t('only the gates WITH A PROOF declare a second door (a widening must be opted into, one gate at a time)', () => {
   const src = require('node:fs').readFileSync(new URL('../src/bongos/auth.js', import.meta.url), 'utf8');
-  // Keyed by GATE, not just the door's name, so a third gate borrowing 'isProjectOwner'
+  // Keyed by GATE, not just the door's name, so a second gate borrowing 'isProjectOwner'
   // fails here instead of hiding behind an unchanged list of names. Each entry names the
   // file that proves its widening:
-  //   requireProjectCuratePage — this file (ADR 0210 D3);
-  //   requireCorePinPage       — tests/core_upgrade_owner_door.mjs (ADR 0339, task 1004174).
+  //   requireCorePinPage — tests/core_upgrade_owner_door.mjs (ADR 0339, task 1004174).
+  // (requireProjectCuratePage, the /people gate, was deleted with its page — task 1003444.)
   const declarations = [...src.matchAll(/(require\w+Page):\s*Object\.freeze\(\{[^}]*alsoAdmits:\s*'([^']+)'/g)]
     .map((m) => `${m[1]}:${m[2]}`);
-  assert.deepEqual(declarations, ['requireProjectCuratePage:isProjectOwner', 'requireCorePinPage:isProjectOwner'],
+  assert.deepEqual(declarations, ['requireCorePinPage:isProjectOwner'],
     'a second alsoAdmits appearing without its own proof is how a page gate quietly widens');
   const plain = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].length;
   assert.equal(plain, declarations.length, 'every alsoAdmits sits on a named page gate this test can see');

package/tests/profile_rollup_consent.mjs

@@ -4,7 +4,7 @@
 // unnest(), so the rollup queries need a live Postgres (the task-1002911
 // precedent). Replays the module's actual migrations, then asserts:
 //   1. listScoutingRollup lists ONLY consented + not-hidden builders (D2/D3) —
-//      provisional, hidden and never-accepted accounts drop out of /people +
+//      provisional, hidden and never-accepted accounts drop out of
 //      /scouting by construction. Consent is TWO columns since ADR 0213
 //      (profile_state='active' AND terms_accepted_at IS NOT NULL), and the
 //      LEGACY fixture is the pre-terms row that proves the second one.
@@ -151,7 +151,7 @@ try {
     [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV, LEGACY],
   );
 
-  // 1 — the scouting/people predicate (D2/D3).
+  // 1 — the scouting predicate (D2/D3).
   const listed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
   ok(listed.includes(ACTIVE), 'active + accepted + visible builder is listed');
   ok(!listed.includes(HIDDEN), 'hide_stats builder drops out of the scouting rollup');
@@ -209,11 +209,11 @@ try {
 
   // 4b — the live hide toggle (R03, task 1002279): flipping hide_stats takes
   // effect IMMEDIATELY on every public read — the profile port and the
-  // /people + /scouting rollup — while the self view keeps serving.
+  // /scouting rollup — while the self view keeps serving.
   await pi.setAccountHideStats({ githubId: ACTIVE, githubLogin: 'active-b', hide: true }, { pool });
   ok(await pi.getPublicProfileExtras(ACTIVE, { pool }) === null, 'hide ON → public read drops to null immediately');
   const hiddenListed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
-  ok(!hiddenListed.includes(ACTIVE), 'hide ON → the builder drops out of /people + /scouting immediately');
+  ok(!hiddenListed.includes(ACTIVE), 'hide ON → the builder drops out of /scouting immediately');
   const stillOwn = await pi.getOwnProfileExtras(ACTIVE, { pool });
   ok(stillOwn && stillOwn.totals.credits === 175, 'hide ON → the self view still serves their own numbers');
   let hiddenAcct = await pi.getAccount(ACTIVE, { pool });

package/tests/profile_route.mjs

@@ -18,7 +18,7 @@
 //   2. flipping hide_stats removes it on the IMMEDIATE next load, and the
 //      response is `Cache-Control: no-store` — the old `public, max-age=60`
 //      would keep serving the pre-hide body for a minute (ADR 0171 D5);
-//   3. `/scouting` (the endpoint the hall's /people page renders) drops the
+//   3. `/scouting` (the recruiting directory's endpoint) drops the
 //      hidden builder too — enforcement is on every read path, not the profile;
 //   4. the leak guard BITES: planting a private field turns the key-list and
 //      sentinel assertions red (a leak test that cannot fail is not a test);
@@ -35,14 +35,9 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import http from 'node:http';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const express = require('express');
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
-const sourceOf = (rel) => readFileSync(join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
 
 let passed = 0;
 let failed = 0;
@@ -410,8 +405,8 @@ const engine = {
     const sql = String(text);
     engine.calls.push({ sql, params });
 
-    // listScoutingRollup — the ONE read behind GET /scouting and the hall's
-    // /people page. Honors exactly the predicates the query declares.
+    // listScoutingRollup — the ONE read behind GET /scouting. Honors exactly
+    // the predicates the query declares.
     if (/AS project_count/.test(sql)) {
       let rows = SCOUTING_TABLE;
       if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
@@ -666,24 +661,6 @@ await t('R06.3 GET /scouting ranks the visible builder, lists the HIDDEN one by
   }
 });
 
-await t('R06.3 the /people page reads /scouting and nothing else', async () => {
-  // /people is the hall's render of the same endpoint, so whatever /scouting
-  // drops, /people drops. Pin that it has no second data source.
-  //
-  // MATCHED AS AN EXPRESSION, NOT A STRING LITERAL. This used to capture the
-  // whole URL out of `fetch('…')` and compare it to one hardcoded string, which
-  // pinned the row limit as a side effect of pinning the ENDPOINT — so task
-  // 1003110 naming that limit (`DIRECTORY_LIMIT`, the one constant that feeds
-  // both the request and the "showing the first N" copy) failed a test about
-  // data sources. What is load-bearing here is the count and the destination:
-  // ONE read, and it goes to the scouting rollup. How the query string is
-  // assembled is the page's business.
-  const args = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/\bfetch\(\s*([^,)]+)/g)].map((m) => m[1].trim());
-  assert.equal(args.length, 1, '/people has exactly one data source');
-  assert.match(args[0], /^'\/api\/bongos\/scouting\?limit='/,
-    'and it is the scouting rollup — nothing may re-enter through a second endpoint');
-});
-
 scout.server.close();
 server.close();
 

package/tests/scouting_owner_access_and_reach.mjs

@@ -12,9 +12,8 @@
 //   WHO APPEARS IN IT.  The recruiting opt-out (`recruiter_discoverable`, privacy
 //     spec D1) gated nothing until this task: a public account that had opted out
 //     still appeared. listScoutingRollup now joins scoutingListableSql, so an
-//     opted-out builder is absent from /scouting AND from the hall's /people —
-//     which is the SAME endpoint, proved from source below rather than asserted
-//     twice — and flipping the toggle back restores them.
+//     opted-out builder is absent from /scouting — its one reader's predicate is
+//     proved from source below — and flipping the toggle back restores them.
 //
 //   AND NEITHER AXIS TOUCHES THE OTHER (ADR 0016).  Being scoutable is not
 //     authority and opting out is not a punishment: an opted-out builder who owns
@@ -641,13 +640,10 @@ await t('CALIBRATION: the interpreter refuses what it cannot model, rather than
   ));
 });
 
-await t('/people is the SAME endpoint, so "absent from /people" is true by construction', async () => {
-  const page = fs.readFileSync(path.join(repo, 'modules/hall-ui/public/people.js'), 'utf8');
-  assert.match(page, /fetch\('\/api\/bongos\/scouting/,
-    'the hall directory reads GET /scouting; if it ever grows its own query, this proof stops covering it');
+await t('listScoutingRollup, the one reader behind GET /scouting, joins the composed predicate', async () => {
   const source = fs.readFileSync(path.join(repo, 'modules/platform-identity/platform-identity.js'), 'utf8');
   assert.match(source, /scoutingListableSql\('pa'\)/,
-    'and listScoutingRollup — the one reader behind both surfaces — joins the composed predicate');
+    'the reader joins scoutingListableSql, so "absent from /scouting" holds by construction');
 });
 
 // ===========================================================================

package/modules/hall-ui/public/people.html

@@ -1,79 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>People — {{worldName}}</title>
-  <meta name="description" content="The builder directory: everyone building across {{worldName}} projects, searchable and ranked by track record.">
-  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <!-- task 1003470: the identity cell (avatar, name, login) is the one thing the
-       directory adds to the shell's ledger. -->
-  <link rel="stylesheet" href="/builders/people.css">
-</head>
-<body data-page="people" data-page-title="People">
-
-<div class="app">
-  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
-  <div class="app-scrim" id="app-scrim" hidden></div>
-  <div class="app-body">
-    <header class="app-topbar" id="app-topbar"></header>
-    <div class="app-content">
-      <!-- The board page head (task 1003307): the label voice, because on a
-           working surface the page's own name is the least interesting thing on
-           it. The sub is rewritten by people.js once the directory has loaded. -->
-      <div class="page-head page-head--board">
-        <h1 class="page-head__h">People</h1>
-        <p class="page-head__sub" id="people-sub">Everyone building across hosted projects, ranked by track record. Descriptive only — cross-project numbers never carry authority here.</p>
-      </div>
-
-      <main id="hall-main">
-        <!-- task 1003470: ONE directory. Its legacy door /scouting rendered this
-             same page from the same script, and task 1003440 deleted it — the same
-             /api/bongos/scouting rollup used to be drawn three different ways. -->
-        <section class="scroll" id="people-scroll" aria-labelledby="people-h">
-          <h2 id="people-h" class="scroll__h">Builder directory<span class="count-pill" id="people-count" hidden></span></h2>
-          <div id="people-filters"></div>
-          <div id="people-body">
-            <div class="profile__placeholder">Loading the directory…</div>
-          </div>
-          <!-- task 1003110: the clipped-directory footnote. Hidden unless the
-               response came back FULL, which is the only truncation signal the
-               rollup offers; people.js writes it. -->
-          <p class="ledger__note" id="people-foot" hidden></p>
-        </section>
-
-        <!-- task 1002291 (ADR 0334): builders who hid their cross-project record
-             but are still open to recruiting, listed by name alone (privacy spec
-             D2). Its own panel because they are never ranked; hidden unless the
-             response carries a row, and people.js writes it. -->
-        <section class="scroll" id="people-named-scroll" aria-labelledby="people-named-h" hidden>
-          <h2 id="people-named-h" class="scroll__h">Listed by name only<span class="count-pill" id="people-named-count" hidden></span></h2>
-          <p class="scroll__lede" id="people-named-lede">These builders are open to recruiting but keep their cross-project record hidden, so only who they are is shown. They are never ranked, and a role filter never finds them.</p>
-          <div id="people-named-body"></div>
-          <p class="ledger__note" id="people-named-foot" hidden></p>
-        </section>
-      </main>
-
-      <footer class="app-foot" id="app-foot"></footer>
-    </div>
-  </div>
-</div>
-
-<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
-
-<!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
-     chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
-<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
-<script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE people.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
-<script src="/builders/brand-apply.js"></script>
-<script src="/builders/hall-kit.js"></script>
-<script src="/builders/people.js"></script>
-</body>
-</html>