@bongos/core 1.19.1045 → 1.19.1047

package/modules/platform-identity/routes/sso.js

@@ -174,9 +174,10 @@ function registerSeams() {
       // which a database error must never be allowed to say.
       hiddenGithubIds: (githubIds) => pi.hiddenGithubIds(githubIds, { pool }),
       // task 1002290 (ADR 0210): "does this hub account own a project?", the
-      // second audience the /people page gate admits beside `project.curate`.
-      // The ownership fact lives in this module, so the answer does too; core
-      // asks through the port and treats an absent one as a denial.
+      // second audience a page gate's `alsoAdmits` door admits — today the /deploy
+      // shell (requireCorePinPage, ADR 0339); /people, its first user, is deleted
+      // (task 1003444). The ownership fact lives in this module, so the answer does
+      // too; core asks through the port and treats an absent one as a denial.
       isProjectOwner: (githubId) => scoutingAuthz.hasOwnerMembership(githubId, { pool }),
       // task 1002347 (BV1.R28, ADR 0251): the names behind `invites.seeking` —
       // the creation wizard's "who is worth inviting" list. Consent-filtered by

package/modules/platform-identity/scouting-authz.js

@@ -1,6 +1,6 @@
 // modules/platform-identity/scouting-authz.js — WHO may read the cross-project
-// recruiting directory (GET /scouting; the hall's /people page renders the same
-// data). ADR 0210, task 1002290 — goal 1000045 C5: "project owners (not only
+// recruiting directory (GET /scouting; the hall's /people page that rendered it
+// was deleted in task 1003444). ADR 0210, task 1002290 — goal 1000045 C5: "project owners (not only
 // Archons) browse builder profiles to recruit".
 //
 // TWO DOORS, DELIBERATELY DIFFERENT KINDS — the modules/lifecycle/goal-authz.js

package/modules/platform-identity/tests/platform-identity.mjs

@@ -680,7 +680,7 @@ await ta('listScoutingRollup scalar aggregation is fan-out-free (task 1002911)',
 });
 
 await ta('listScoutingRollup enforces consent IN the query (ADR 0171 D2/D3)', async () => {
-  // /people and /scouting must honor hide BY CONSTRUCTION: the predicate lives
+  // /scouting must honor hide BY CONSTRUCTION: the predicate lives
   // in the scalar-aggregation CTE, not in any caller. Semantics proven against
   // real SQL by tests/profile_rollup_consent.mjs.
   const pool = mockPool([{ rows: [] }]);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1045",
+  "version": "1.19.1047",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1045",
+      "version": "1.19.1047",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1045",
+  "version": "1.19.1047",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7571,5 +7571,17 @@
       "id": "1003458",
       "text": "The Tasks board and the Goals page now claim and release work through one shared piece of code instead of two copies that had already drifted apart — the same refusal was worded differently on each page, and one had lost its \""
     }
+  ],
+  "1.19.1046": [
+    {
+      "id": "1003444",
+      "text": "The hall's People page is gone, as you asked. An old People link now opens the Builders page instead, and People is no longer in the side menu. Searching for builders across projects comes back when the hub's community page is"
+    }
+  ],
+  "1.19.1047": [
+    {
+      "id": "1004306",
+      "text": "An update that would be refused no longer takes a database backup first, and the server keeps only the ten newest pre-update backups, so frequent update checks can't fill the disk."
+    }
   ]
 }

package/scripts/gds/go-live.js

@@ -571,7 +571,23 @@ function renderReport(r) {
   L.push(`  Go-live · ${r.targetName}`);
   L.push(BAR);
   L.push(`  ${r.from} → ${r.to}`);
-  for (const step of r.steps || []) L.push(`  ${step.ok ? '✓' : '✖'} ${step.name}${step.detail ? ` — ${step.detail}` : ''}`);
+  for (const step of r.steps || []) L.push(`  ${step.ok ? (step.warn ? '⚠' : '✓') : '✖'} ${step.name}${step.detail ? ` — ${step.detail}` : ''}`);
+
+  // A refused rehearsal moved nothing, so the pin and read-back lines below would only
+  // alarm: "pin committed NO — the next reset will revert this bump" about a bump that
+  // never started (task 1004306).
+  if (r.failedAt === 'PREFLIGHT') {
+    const ex = failureExcerpt(r.raw);
+    if (ex.length) {
+      L.push('');
+      L.push('  what the upgrade said:');
+      for (const l of ex) L.push(`    ${l}`);
+    }
+    L.push('');
+    L.push(`  Nothing changed — still on ${r.from || 'the current core'}. No timer was stopped and no backup was written.`);
+    L.push('');
+    return L.join('\n');
+  }
 
   if (!r.ok) {
     const ex = failureExcerpt(r.raw);
@@ -681,24 +697,96 @@ function pinStep(mode, pinDirty, head) {
   };
 }
 
+// How many pre-upgrade dumps a backupDir keeps (task 1004306). Nothing pruned them, so
+// the directory grew by one dump per attempt for as long as the lane ran: 37 dumps and
+// 1.7 GB on cloudbongos.com by 2026-09-26, at about ONE attempt a day. The count, not an age,
+// is the bound because the cadence is what varies — ten is ten at daily or at every
+// fifteen minutes. These are the extra copies taken right before a pin move; the
+// nightly backup (db-backup-nightly.sh, 30 days) is the history and is not touched.
+const PRE_UPGRADE_KEEP = 10;
+// Exactly the name Phase A writes: pre-<version>-<YYYYMMDDTHHMMSSZ>.sql.gz. A looser
+// `pre-*` would also take a dump an operator named by hand — the box has a
+// `pre-lane-sweep-<ts>.sql.gz` in that directory, and it is not ours to delete.
+const D8 = '[0-9]'.repeat(8);
+const D6 = '[0-9]'.repeat(6);
+const PRE_UPGRADE_GLOB = `pre-[0-9]*-${D8}T${D6}Z.sql.gz`;
+
+// Delete all but the newest PRE_UPGRADE_KEEP pre-upgrade dumps and print how many went.
+// Newest by mtime, never by name: the name sorts 1.19.99 after 1.19.100. It runs only
+// after a dump succeeded, so a run of failures can never empty the directory, and the
+// dump just written is always the newest and always kept. No `$` anywhere, so the
+// outer shell that feeds this to `bash -c` expands nothing in it.
+function pruneCommand(dir, keep = PRE_UPGRADE_KEEP) {
+  return `bash -c "cd ${dir} && ls -1t -- ${PRE_UPGRADE_GLOB} 2>/dev/null | tail -n +${keep + 1} | xargs -r rm -v -- | wc -l"`;
+}
+
+// Read the prune section back into a step. A prune that could not run is a WARNING,
+// not a failure: the dump it follows is good, and refusing the upgrade over a full
+// cleanup would trade a real deploy for tidiness. It still says so on screen.
+function pruneStep(section, keep = PRE_UPGRADE_KEEP) {
+  const name = `prune old pre-upgrade backups (keep the newest ${keep})`;
+  const s = String(section == null ? '' : section).trim();
+  if (/^\d+$/.test(s)) return { name, ok: true, detail: s === '0' ? 'nothing to remove' : `removed ${s}` };
+  return { name, ok: true, warn: true, detail: `could not prune${s ? ` (${s.split('\n').pop()})` : ''} — the directory will keep growing until this is fixed` };
+}
+
 function applyGoLive(target, targetName, targetVersion, from, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
   const pinMode = pinModeOf(target);
   const steps = [];
+  const upgrade = upgradeCommand(target, targetVersion);
+
+  // Phase 0 — ask the upgrade whether it WILL go, before anything is stopped or copied
+  // (task 1004306). `bongos upgrade --dry-run` runs every refusal the real bump has —
+  // the artist gate, module compatibility, the database identity, the downgrade guard —
+  // and returns before it changes anything. Phase A used to come first, so on
+  // cloudbongos.com (2026-09-26 17:10 and 17:15 UTC) each attempt the artist gate
+  // refused had already stopped the deploy timer and written a 65 MB dump: one a day at
+  // the daily cadence, a full disk in about three days at every fifteen minutes.
+  // runGoLive's own gate read did not stop those runs either, and left no trace of what
+  // it saw: on --apply a plan with no halts is never printed, notes included. The bump's
+  // pre-flight asks the instance directly, and it was the first thing to say no.
+  const rehearsal = remote(target, `
+set -uo pipefail
+${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade} --dry-run"`)}
+`, opts);
+  steps.push({
+    name: 'pre-flight (the upgrade, rehearsed with --dry-run)',
+    ok: rehearsal.ok,
+    detail: rehearsal.ok ? null : 'refused — nothing was stopped and nothing was backed up',
+  });
+  if (!rehearsal.ok) return { ok: false, steps, from, to: targetVersion, targetName, pinMode, failedAt: 'PREFLIGHT', refused: true, raw: rehearsal };
 
   // Phase A — stop the pull-deploy timer, then back up. The timer's `reset --hard`
   // is the hazard: it would revert an uncommitted pin mid-flight. A co-tenant has no
   // such timer (see REQUIRED_FIELDS), so there is nothing to stop and no hazard.
+  //
+  // The dump must FAIL when pg_dump fails. `pg_dump | gzip > f` without pipefail
+  // reports gzip's success, leaving a 20-byte file that reads as a backup — harmless
+  // while nothing pruned, but the prune below keeps the newest ten, so a streak of
+  // those would retire every real dump (task 1004306). A failed dump removes its file
+  // and fails the phase, which stops the go-live before the pin moves: a bump with no
+  // backup behind it is not one to make unattended. $TS is expanded once by this
+  // script so the dump and its cleanup name the same file.
+  const backupDir = target.backupDir || '~/backups';
+  const dumpFile = `${backupDir}/pre-${targetVersion}-$TS.sql.gz`;
   const backup = target.backupDb
-    ? asOwner(target, `bash -c "mkdir -p ${target.backupDir || '~/backups'} && pg_dump ${target.backupDb} | gzip > ${target.backupDir || '~/backups'}/pre-${targetVersion}-$(date -u +%Y%m%dT%H%M%SZ).sql.gz"`)
+    ? asOwner(target, `bash -c "set -o pipefail; mkdir -p ${backupDir} && { pg_dump ${target.backupDb} | gzip > ${dumpFile} || { rm -f ${dumpFile}; exit 1; }; }"`)
     : 'echo "(no backupDb configured — skipping)"';
+  // `|| echo`: under `set -e` a failed prune would otherwise fail the whole phase and
+  // stop a deploy whose backup is already safely on disk (see pruneStep).
+  const prune = target.backupDb
+    ? `echo "##PRUNE##"; ${asOwner(target, pruneCommand(backupDir))} || echo "prune exited non-zero"`
+    : '';
   const phaseA = remote(target, `
 set -euo pipefail
 ${SUDO_PREAMBLE}
 echo "##TIMER##"; ${target.deployTimer
     ? `$SUDO systemctl stop ${target.deployTimer} && $SUDO systemctl is-active ${target.deployTimer} || true`
     : 'echo "(no deployTimer configured — no pull-deploy to stop)"'}
+TS="$(date -u +%Y%m%dT%H%M%SZ)"
 echo "##BACKUP##"; ${backup}
+${prune}
 echo "##END##"
 `, opts);
   steps.push({
@@ -706,11 +794,19 @@ echo "##END##"
     ok: phaseA.ok,
     detail: phaseA.ok ? null : (phaseA.stderr || '').trim().split('\n').pop(),
   });
-  if (!phaseA.ok) return { ok: false, steps, from, to: targetVersion, targetName, pinMode, failedAt: 'PREPARE', raw: phaseA };
+  if (!phaseA.ok) {
+    // The timer may already be stopped — Phase A stops it before the dump, and a dump
+    // can now fail on its own (above). Put it back, as a failed upgrade does below.
+    if (target.deployTimer) remote(target, `${SUDO_PREAMBLE}\n$SUDO systemctl start ${target.deployTimer} || true`, opts);
+    return { ok: false, steps, from, to: targetVersion, targetName, pinMode, failedAt: 'PREPARE', raw: phaseA };
+  }
+  if (target.backupDb) {
+    const m = (phaseA.stdout || '').split('##PRUNE##')[1];
+    steps.push(pruneStep(m === undefined ? null : m.split('##')[0]));
+  }
 
   // Phase B — the upgrade itself. --commit-pin makes the bump durable against the
   // pull-deploy reset; auto-rollback stays ON (do NOT pass --no-rollback-on-failure).
-  const upgrade = upgradeCommand(target, targetVersion);
   const phaseB = remote(target, `
 set -uo pipefail
 ${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`)}
@@ -970,6 +1066,6 @@ module.exports = {
   loadConfig, selectTarget, validateTarget, planGoLive, artistGateEntries, readArtistGate, ARTIST_GATE_PATH, ARTIST_GATE_LEVELS,
   parseMarker, parseMarkerHits,
   renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
-  applyGoLive, upgradeCommand, pinStep, pinModeOf,
+  applyGoLive, upgradeCommand, pinStep, pinModeOf, pruneCommand, pruneStep, PRE_UPGRADE_KEEP, PRE_UPGRADE_GLOB,
   CONFIG_TEMPLATE, HALTS, SEMVER_RE, PIN_MODES, DEFAULT_PIN_MODE,
 };

package/src/bongos/auth.js

@@ -425,17 +425,14 @@ function signInWithReturn(req) {
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireGovernmentPage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
-  // `alsoAdmits` — a SECOND, non-rank audience this page's DATA ROUTE admits, so
-  // the page can follow it (ADR 0210, task 1002290). /people fronts GET /scouting,
-  // which since R14 admits a `project.curate` holder OR a PROJECT OWNER; a page
-  // gate that could only ever ask about a permission would leave the widened
-  // audience staring at a redirect. The value names a function on the
-  // `platform-identity.hub` port — the module that owns the ownership fact — and
-  // is consulted ONLY after the permission check has already refused, so it can
-  // widen and never narrow. Absent port, absent function, or a throw: no admit.
-  requireProjectCuratePage: Object.freeze({
-    permission: 'project.curate', deniedTo: '/builders', alsoAdmits: 'isProjectOwner',
-  }),
+  // `alsoAdmits` (on requireCorePinPage below) — a SECOND, non-rank audience a
+  // page's DATA ROUTE admits, so the page can follow it (ADR 0210). A page gate that
+  // could only ever ask about a permission would leave the widened audience staring
+  // at a redirect. The value names a function on the `platform-identity.hub` port —
+  // the module that owns the ownership fact — and is consulted ONLY after the
+  // permission check has already refused, so it can widen and never narrow. Absent
+  // port, absent function, or a throw: no admit. Its first user, the hall's /people
+  // page, was deleted by task 1003444 (ADR 0337 D5).
   // The /board-room page (ADR 0266) — gated on `board.vote.cast`, the SAME atom
   // the vote route checks, so the surface's reach equals the right to vote.
   //
@@ -464,7 +461,7 @@ const PAGE_GATES = Object.freeze({
   //
   // SINCE ADR 0339 (task 1004174) its routes admit a SECOND audience — a hosted
   // project's own owner, for that project only — so the shell follows through the same
-  // `alsoAdmits` door /people uses (ADR 0210). It admits the SHELL for an owner of any
+  // `alsoAdmits` door (ADR 0210). It admits the SHELL for an owner of any
   // live project; which project they may read or move is still the routes' question,
   // asked per request against that project's row.
   requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders', alsoAdmits: 'isProjectOwner' }),
@@ -619,17 +616,6 @@ async function requireGovernmentPage(req, res, next) {
   return runPageGate('requireGovernmentPage', req, res, next);
 }
 
-// The /people builder-directory page (task 1002577) — gated on the
-// `project.curate` ATOM, the same key its one data route (GET /scouting,
-// modules/platform-identity) checks, so the page layer can never drift wider
-// than the API it fronts. R14 (goal 1000045, ADR 0210) widened that route to a
-// SECOND audience that is not a rank at all — a project owner — so this gate
-// carries the same OR through `alsoAdmits` above: the two doors of the page are
-// exactly the two doors of the route, and neither layer can drift from it.
-async function requireProjectCuratePage(req, res, next) {
-  return runPageGate('requireProjectCuratePage', req, res, next);
-}
-
 // The /board-room page (ADR 0266) — gated on the `board.vote.cast` ATOM, the
 // same key the vote route checks, so the page layer can never drift NARROWER
 // than the API it fronts. That is the direction that matters here: the Board
@@ -940,7 +926,6 @@ module.exports = {
   requireBuilder,
   requireBuilderPage,
   requireGovernmentPage,
-  requireProjectCuratePage,
   requireBoardVotePage,
   requireCorePinPage,
   requireFleetPage,

package/src/bongos/serve-internal.js

@@ -936,17 +936,13 @@ function mountInternalSurfaces(app) {
   // statically, and a comment in that gap drops the regex out of the map, which
   // makes the page test as UNGATED while looking gated here. Prose goes above.
   const BOARD_ROOM_PAGE_RE = /^\/builders\/board-room(?:\.html)?\/?$/;
-  // The /people builder directory (task 1002577): gated on `project.curate`, the
-  // exact permission its data route (GET /scouting) checks — same posture as the
-  // /government tab above (the page can never drift wider than the API it fronts).
-  const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
   // /deploy — the owner's deploy door (task 1003159, ADR 0293). Gated on the
   // `core.pin.move` atom, the same key its preview and its move both check, so the
   // shell's reach equals the right to press the button. Archon-floor and system:true,
   // which makes this the narrowest page gate here — correct for the one surface whose
   // button restarts the live service and changes what code the platform runs.
   //
-  // DECLARED HERE, WITH THE OTHER GATES, AND NOT BELOW: the SCOUTING_LEGACY_RE block
+  // DECLARED HERE, WITH THE OTHER GATES, AND NOT BELOW: the RETIRED_DIRECTORY_RE block
   // that follows is a matcher immediately followed by the redirect it feeds, and
   // tests/hall_roster_world.mjs reads them as one span. Wedging a declaration between
   // the two separates a matcher from its handler for a reader as well as for that test.
@@ -959,23 +955,24 @@ function mountInternalSurfaces(app) {
   const DEPLOY_PAGE_RE = /^\/builders\/deploy(?:\.html)?\/?$/;
   // The fleet cost page (task 1001949), on the atom its one read checks.
   const FLEET_PAGE_RE = /^\/builders\/fleet(?:\.html)?\/?$/;
-  // /scouting WAS the legacy twin of /people — the same /api/gds/scouting
-  // directory, left behind when task 1002577 graduated it into the hall. Task
-  // 1003470 had already made the two one page (scouting.html rendered people's
-  // body byte-for-byte and scouting.js was deleted); task 1003440 removes the
-  // door itself, because a second URL onto one directory is a surface to keep in
-  // sync for no reader. The URL survives as a 301 so an old bookmark lands on the
-  // directory instead of a 404. It carries no page gate: the redirect discloses
-  // nothing, and /people's wall applies the instant the browser follows it.
-  const SCOUTING_LEGACY_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
+  // /people and its legacy twin /scouting were the hall's cross-project builder
+  // directory. Task 1003440 deleted the /scouting door; task 1003444 deleted
+  // /people itself (owner call, 2026-09-25 — ADR 0337 D5): cross-project
+  // discovery belongs to the hub, and /roster is the hall's directory. Both URLs
+  // survive as redirects to /roster so a bookmark lands somewhere instead of a
+  // 404. 302, not 301: /roster is interim until the hub community page (task
+  // 1003363) ships, and a browser caches a 301 past any re-point. No page gate:
+  // the redirect discloses nothing, and /roster is deliberately public.
+  // GET /scouting's own gate (platform-identity) is untouched by this.
+  const RETIRED_DIRECTORY_RE = /^\/builders\/(?:people|scouting)(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (req.method !== 'GET' && req.method !== 'HEAD') return next();
-    if (!SCOUTING_LEGACY_RE.test(path.posix.normalize(req.path))) return next();
+    if (!RETIRED_DIRECTORY_RE.test(path.posix.normalize(req.path))) return next();
     const qs = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';
     // On the builders subdomain the /builders prefix is redundant (the canonical
     // redirect above strips it), so emit the clean path and save a second hop.
-    return res.redirect(301, `${isBuildersHost(req) ? '' : '/builders'}/people${qs}`);
+    return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/roster${qs}`);
   });
 
   // /deploy EXISTS ONLY WHERE THE DOOR DOES (task 1004296). The owner, 2026-09-25: /deploy is
@@ -1019,9 +1016,6 @@ function mountInternalSurfaces(app) {
     if (BOARD_ROOM_PAGE_RE.test(norm)) {
       return gdsAuth.requireBoardVotePage(req, res, next);
     }
-    if (PEOPLE_PAGE_RE.test(norm)) {
-      return gdsAuth.requireProjectCuratePage(req, res, next);
-    }
     // ADR 0293: the deploy door, on the same atom its two routes check.
     if (DEPLOY_PAGE_RE.test(norm)) {
       return gdsAuth.requireCorePinPage(req, res, next);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1045'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1047'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -418,7 +418,7 @@ test('the recruiting surface really is exactly two reads, and each one joins REA
   const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
   // The directory reads TWO tiers since task 1002291 — ranked, and the hidden
   // builders it lists by name — and the opt-out must empty both, or "removes you
-  // from the People directory" is false for a builder who also hid their record.
+  // from the recruiting directory" is false for a builder who also hid their record.
   for (const composed of ['scoutingListableSql', 'scoutingNameOnlySql', 'recruiterSliverVisibleSql']) {
     const body = av.slice(av.indexOf(`function ${composed}(`));
     assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,

package/tests/auth_resolve_failure.mjs

@@ -93,22 +93,22 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   // rot: a NEW bare `async function require*` added later fails this test.
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
   //   requireBuilderPage        \
-  //   requireGovernmentPage      \ all FOUR delegate to runPageGate, guarded by
-  //   requireProjectCuratePage   /  BV1.R107 (the /people curate gate; the
-  //   requireBoardVotePage      /   ADR 0266 /board-room vote gate)
+  //   requireGovernmentPage      \ all delegate to runPageGate, guarded by
+  //   requireBoardVotePage       /  BV1.R107 (and the ADR 0266 /board-room vote gate)
   //   requireCorePinPage        /   ADR 0293's /deploy door — the narrowest of them,
   //                                 on the archon-floor `core.pin.move` atom.
   //   requireFleetPage            — task 1001949's /fleet cost page, same delegation.
   // Task 1003450 removed two more — requireNonXenosPage and the R113
   // requireGovernmentManagePage — which had both ended up dispatched from no
-  // route at all; tests/hall_page_gate_map.mjs now fails if that recurs.
+  // route at all; tests/hall_page_gate_map.mjs now fails if that recurs. Task
+  // 1003444 removed requireProjectCuratePage with the /people page it fronted.
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireCorePinPage', 'requireFleetPage', 'requireGovernmentPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireCorePinPage', 'requireFleetPage', 'requireGovernmentPage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage', 'requireBoardVotePage', 'requireCorePinPage', 'requireFleetPage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireBoardVotePage', 'requireCorePinPage', 'requireFleetPage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/core_upgrade_owner_door.mjs

@@ -28,7 +28,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 // The session double must be installed BEFORE auth.js loads: auth.js destructures
-// lookupSession at require time (the tests/scouting_page_gate.mjs precedent).
+// lookupSession at require time (the tests/page_gate_second_door.mjs precedent).
 const dbKernel = require('../src/bongos/db-kernel.js');
 let nextSession = null;
 dbKernel.lookupSession = async () => nextSession;

package/tests/edit_hints.mjs

@@ -21,7 +21,7 @@ const hints = require(HOOK);
 
 test('each generator input maps to its generator; unrelated paths map to nothing', () => {
   const cases = [
-    ['modules/hall-ui/public/people.js', 'copy-inventory.js'],
+    ['modules/hall-ui/public/roster.js', 'copy-inventory.js'],
     ['modules/status-ui/public/index.html', 'copy-inventory.js'],
     ['src/bongos/auth.js', 'gen-repo-map.js'],
     ['modules/lifecycle/routes/claims.js', 'gen-api-docs.js'],
@@ -39,12 +39,12 @@ test('each generator input maps to its generator; unrelated paths map to nothing
 });
 
 test('rel() reconciles C:\\, C:/ and /c/ shapes between CLAUDE_PROJECT_DIR and file_path', () => {
-  const want = 'modules/hall-ui/public/people.js';
-  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\people.js', 'C:\\r\\repo'), want);
-  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\people.js', 'C:/r/repo'), want);
-  assert.equal(hints.rel('/c/r/repo/modules/hall-ui/public/people.js', 'C:\\r\\repo'), want);
-  assert.equal(hints.rel('c:/r/repo/modules/hall-ui/public/people.js', 'C:/r/repo/'), want);
-  assert.equal(hints.rel('/home/u/repo/modules/hall-ui/public/people.js', '/home/u/repo'), want);
+  const want = 'modules/hall-ui/public/roster.js';
+  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\roster.js', 'C:\\r\\repo'), want);
+  assert.equal(hints.rel('C:\\r\\repo\\modules\\hall-ui\\public\\roster.js', 'C:/r/repo'), want);
+  assert.equal(hints.rel('/c/r/repo/modules/hall-ui/public/roster.js', 'C:\\r\\repo'), want);
+  assert.equal(hints.rel('c:/r/repo/modules/hall-ui/public/roster.js', 'C:/r/repo/'), want);
+  assert.equal(hints.rel('/home/u/repo/modules/hall-ui/public/roster.js', '/home/u/repo'), want);
 });
 
 test('run as a hook: prints one hint for a generator input, nothing for an unrelated file, exit 0 both times', () => {
@@ -53,7 +53,7 @@ test('run as a hook: prints one hint for a generator input, nothing for an unrel
     input: JSON.stringify({ tool_input: { file_path: path.join(projectDir, ...relPath.split('/')) } }),
     encoding: 'utf8', timeout: 15000, env: { ...process.env, CLAUDE_PROJECT_DIR: projectDir },
   });
-  const a = run('modules/hall-ui/public/people.js');
+  const a = run('modules/hall-ui/public/roster.js');
   assert.equal(a.status, 0, a.stderr);
   assert.match(a.stdout, /copy-registry\.json is now stale/);
   assert.match(a.stdout, /copy-inventory\.js/);

package/tests/effective_visibility_predicate.mjs

@@ -1122,7 +1122,7 @@ await ta('private accounts are absent from the leaderboard/directory rollup', as
   const rows = await pi.listScoutingRollup({ limit: 50, pool });
   const shown = rows.map((r) => r.github_login).sort();
   assert.deepEqual(shown, ['octo', 'shifted'],
-    'only active, publicly-visible, unhidden accounts reach /people and /scouting — '
+    'only active, publicly-visible, unhidden accounts reach /scouting — '
     + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private, legacy never accepted the terms (ADR 0213)`);
 });