@bongos/core 1.19.169 → 1.19.171

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.169",
-  "core_contract": "1.19.169",
-  "source_commit": "21b29b58735b3e1407e5a32314e6e163928aa766",
+  "core_version": "1.19.171",
+  "core_contract": "1.19.171",
+  "source_commit": "d102a0205fd62edcc81a804a8c439af4cde60606",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T18:29:19.872Z",
+  "built_at": "2026-08-16T19:20:36.950Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1267,
+    "functional_verbatim": 1269,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1593,
-  "tree_sha256": "8457440205714a5e435a88d3ec027ba850403a9e1a079d9b42280393f7d287d5",
+  "file_count": 1595,
+  "tree_sha256": "1596294ffbb9fe146a18ced51823d4b074c23b5dd47601619bcd16752c5eaf04",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "c8143e170b5ac87e7cdd243eb83edb8b22ad252382c86544f96e7a38311e0380"
+      "sha256": "d6d6163164f98c96a8e25dfe84825669bf8324f1f1b98adb0674781ad235ad10"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "dd11d5decd14af95cc23c2bef8dfe8c477132fb07d671682b228107fe69d7ea4"
+      "sha256": "386706d0ef3d09c5e074bdc45bfc0de869d732eb1cb2a2280472f02f797f2b74"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "257ac54c66f7969090065a34c29e2874fa6f9d111b6e75f0510ab1a2fcb3ef17"
+      "sha256": "7d462b5b80c9db9159981406398fc62c5ba71043c6a3b9433852d06d612bf2b0"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "afbaacddff0e422658021543825155933c49527b78f6e2693a23a62cfe97fe83"
+      "sha256": "4acb1dde6f894ba37cff7e27e0110f12ae30c7cb6e4d972d6e85d2877489b6d0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "4889c6c70c1f58d90006800cf2bd363b4c2cc546c69042a1faae5106c16aab03"
+      "sha256": "4c7679ef258644ab12db1b8fe412b388f96f4296c6aae45d6ab637a8f3b9a037"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "879ef6fd06bde11c040c5ef67ccf495f0be6eb95e11be6f8979c9d560a33da64"
+      "sha256": "ccf59372e0456f36d83154d6dff4dbf5382e8d69023bee82b318b8e9cfb2c50b"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "2da0e769d0f7f1af2ea503104a66f254cbc925dc1266908f4aeb6b933406cf18"
+      "sha256": "4deac83a1d7c12e1a24109e856d9a6fef6b539afafdca55a525ab6786fe4e235"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2662,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "257ac54c66f7969090065a34c29e2874fa6f9d111b6e75f0510ab1a2fcb3ef17"
+      "sha256": "7d462b5b80c9db9159981406398fc62c5ba71043c6a3b9433852d06d612bf2b0"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3317,12 +3317,12 @@
     {
       "path": "modules/hall-ui/public/profile.html",
       "mode": "0000644",
-      "sha256": "cd3148ae6a22d7e7fff8e0b4a07aed2fe6d27b4e0b6e5b450bd2a63b3f078713"
+      "sha256": "b8d5fb31d92f6d65e8f257d10c77f4ee0aa0ebec50d977d4c7d918ff2253da1e"
     },
     {
       "path": "modules/hall-ui/public/profile.js",
       "mode": "0000644",
-      "sha256": "be57f192368280ac1ae2b0b820f89daf59512f9f89d9ad23414c42cbf09a462e"
+      "sha256": "a4cf0c4c2d088fd1fb84c41c93cc28e2acd2b656b0bc995cd46043881b3611fa"
     },
     {
       "path": "modules/hall-ui/public/ranks.html",
@@ -3382,12 +3382,12 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "eaea5b3ca78fa89fbff71bb0209f24afd010e064dec5e4b4803edc2bdd07e1c1"
+      "sha256": "ae68a26d5d37ac75968ac11335b7062a448798cb3af0e0a4f81963f3382f204d"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "9b6c826e4c444ff68a7dcc0df1a76122ead297220685e701dc0d45edafa6ca4b"
+      "sha256": "2b69d258218e92b9fe2922496632e43d4bdb81f641f09469f5f6df85494a9fca"
     },
     {
       "path": "modules/hall-ui/public/shell.js",
@@ -3792,12 +3792,12 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "71bd26b5e4ba6012e3119a99c1aa1046d61b12b17e1018f55c9ee11b6ec29895"
+      "sha256": "e993fb26e61249bf89c0b0a5977c60e9d974810ffe1b67e94d909e8b52e00d5e"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "cf354fb34732141cb9a0774d11f1b344a3bc15e90814a80496a2024c941fcb77"
+      "sha256": "96907af1af78c472118ecf5ed9f269d6d2ce940b09535aae3b3df4de4d2337c1"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3814,6 +3814,11 @@
       "mode": "0000644",
       "sha256": "7fdb5a107e1ad84214c0d07507a7fd14b9234c9907224fddc0f6a70c850f460a"
     },
+    {
+      "path": "modules/platform-identity/routes/profile.js",
+      "mode": "0000644",
+      "sha256": "6ea29b4f07417fa925b7987dd7fbe8a0262b7fec83ceffade9fccbc220289bba"
+    },
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
@@ -3832,7 +3837,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "bff11d1f5ed3cadeccdb22c2754649ba281f43462fe4732d40f3ef011fe51af2"
+      "sha256": "18bf8d0cb42d76bc5413c760b13837fe439a6e719b88a84db96f143b829e67d5"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4207,12 +4212,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5a6c2bc1f2f6522a312cf2d980ff8fad527711139b2c8c0e5d4a32df9f91e697"
+      "sha256": "90e1fc07f655eb2874620b5a85f965e4f32cc20aeddb552dbc8885c4681150d9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e29a81671e4d241ceca9cdcc9ebb0a94d5c0012b216c4a2b66fd54c934e1ed8c"
+      "sha256": "2b1408849261b93418e448820da8081a7ec83fa6b5c2a51b9e1aa5dca7456efb"
     },
     {
       "path": "public-docs/index.html",
@@ -5472,7 +5477,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "b6550cee568d8e8082c30512979256872d71d0d7f1810d061f5dbffad8a76979"
+      "sha256": "1cd66475d610b107b0f3b7f19688133e7c482b41b034e2cef6009d552df31cb2"
     },
     {
       "path": "scripts/migrate.sh",
@@ -5817,7 +5822,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "723ed0f74974f36f8db1ae45eabf0a51679b6f6892f0b26e6275d99d9ace0f62"
+      "sha256": "17202c8572c75ca1af5cd2eee1c8dd1ba4b6ea4c5fd7cd757eaf97907d26a268"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7377,13 +7382,18 @@
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
-      "sha256": "4db6fc34b52ed55c1e21bc3c8b7d9a63ef08f13571283a06393662d6e1468d40"
+      "sha256": "b926ffa5d4e96ef223e4057ecc3e64d678ca1e16ec4afe79cb90cbf3e35e65e0"
     },
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
       "sha256": "3b3045a6143d67c963516ed5703b5dabb9b8945a392118721e6a0a56258f1732"
     },
+    {
+      "path": "tests/profile_ui_cross_project.mjs",
+      "mode": "0000644",
+      "sha256": "6a7a223a678b56333befaed017429e5b9d8a81e4405efae72a23355902517d9d"
+    },
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 271 operations across 45 resource groups
+- 273 operations across 45 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -409,6 +409,10 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/clients/bongos-client/index.cjs

@@ -408,6 +408,10 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/clients/bongos-client/index.d.ts

@@ -51,6 +51,7 @@ export interface GetInboxResponse { ideas: unknown; open_count: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
+export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; cross_project: unknown }
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface GetMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
@@ -124,6 +125,8 @@ export interface PatchGoalsIdVisibilityRequest { visibility: string }
 export interface PatchGoalsIdVisibilityResponse { ok: boolean; goal: unknown }
 export interface PatchInboxIdRequest { status?: "open" | "promoted" | "discarded" | "merged"; kind?: string; promoted_to_task_id?: number; reviewed_at?: unknown; merged_into_idea_id?: number; triage_note?: string }
 export interface PatchInboxIdResponse { idea: unknown }
+export interface PatchMeCrossProjectRequest { hide_stats: boolean }
+export interface PatchMeCrossProjectResponse { hide_stats: boolean }
 export interface PatchMeDisciplinesRequest { preferred_disciplines: string[] }
 export interface PatchMeDisciplinesResponse { builder: unknown; onboarding: unknown }
 export interface PatchMeDisplayNameResponse { display_name: unknown; max_length: unknown }
@@ -645,6 +648,10 @@ export interface BongosClient {
     getMeAchievements(args?: RequestArgs): Promise<GetMeAchievementsResponse>;
     /** POST /me/anthropic-link — rank: any-builder */
     postMeAnthropicLink(args: RequestArgs & { body: PostMeAnthropicLinkRequest }): Promise<PostMeAnthropicLinkResponse>;
+    /** GET /me/cross-project — rank: any-builder */
+    getMeCrossProject(args?: RequestArgs): Promise<GetMeCrossProjectResponse>;
+    /** PATCH /me/cross-project — rank: any-builder */
+    patchMeCrossProject(args: RequestArgs & { body: PatchMeCrossProjectRequest }): Promise<PatchMeCrossProjectResponse>;
     /** PATCH /me/disciplines — rank: any-builder */
     patchMeDisciplines(args: RequestArgs & { body: PatchMeDisciplinesRequest }): Promise<PatchMeDisciplinesResponse>;
     /** GET /me/display-name — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -405,6 +405,10 @@ export function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/docs/api/openapi.json

@@ -6267,6 +6267,91 @@
         ]
       }
     },
+    "/me/cross-project": {
+      "get": {
+        "operationId": "get_me_cross_project",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/cross-project",
+        "description": "the caller's OWN cross-project record + hide flag (own data).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMeCrossProjectResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_me_cross_project",
+        "tags": [
+          "me"
+        ],
+        "summary": "PATCH /me/cross-project",
+        "description": "flip the caller's OWN hide flag (C2's self-serve opt-out; own data, keyed on the authenticated github_id).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchMeCrossProjectRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchMeCrossProjectResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/disciplines": {
       "patch": {
         "operationId": "patch_me_disciplines",
@@ -12850,6 +12935,21 @@
           "unlocked"
         ]
       },
+      "GetMeCrossProjectResponse": {
+        "type": "object",
+        "properties": {
+          "hide_stats": {
+            "type": "boolean"
+          },
+          "profile_state": {},
+          "cross_project": {}
+        },
+        "required": [
+          "hide_stats",
+          "profile_state",
+          "cross_project"
+        ]
+      },
       "GetMeDisplayNameResponse": {
         "type": "object",
         "properties": {
@@ -13808,6 +13908,29 @@
           "idea"
         ]
       },
+      "PatchMeCrossProjectRequest": {
+        "type": "object",
+        "properties": {
+          "hide_stats": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "hide_stats"
+        ],
+        "additionalProperties": false
+      },
+      "PatchMeCrossProjectResponse": {
+        "type": "object",
+        "properties": {
+          "hide_stats": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "hide_stats"
+        ]
+      },
       "PatchMeDisciplinesRequest": {
         "type": "object",
         "properties": {
@@ -17099,9 +17222,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 271,
-  "x-schema-count": 303,
+  "x-endpoint-count": 273,
+  "x-schema-count": 306,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 205,
+  "x-response-schemas": 207,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 271 endpoints across 44 route files.
+> **Generated from the live route files** — the route file is authoritative. 273 endpoints across 45 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -282,13 +282,15 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (21)
+## `me` (23)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/me` | `any-builder` | — | PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed huma… |
 | GET | `/api/bongos/me/achievements` | `any-builder` | — | The builder's unlocked achievements (joined to achievement metadata). |
 | POST | `/api/bongos/me/anthropic-link` | `any-builder` | `anthropic_email`, `anthropic_user_id` | V3.R10 (task 235), criterion C3 — link the authed builder's Anthropic account. |
+| GET | `/api/bongos/me/cross-project` | `any-builder` | — | the caller's OWN cross-project record + hide flag (own data). |
+| PATCH | `/api/bongos/me/cross-project` | `any-builder` | `hide_stats` | flip the caller's OWN hide flag (C2's self-serve opt-out; own data, keyed on the authenticated github_id). |
 | PATCH | `/api/bongos/me/disciplines` | `any-builder` | `preferred_disciplines` | Self-service edit of the authenticated builder's preferred disciplines (migrations 027 + 086 / V3.R80). |
 | GET | `/api/bongos/me/display-name` | `any-builder` | — | Per-builder DISPLAY NAME (task 1669). |
 | PATCH | `/api/bongos/me/display-name` | `any-builder` | _undocumented_ | PATCH the display name. |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -408,6 +408,10 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/modules/hall-ui/public/profile.html

@@ -40,6 +40,14 @@
           </div>
         </section>
 
+        <!-- Cross-project record — hub-only (ADR 0171). profile.js reveals this
+             only when the profile response carries a cross_project key; on a
+             vanilla instance the key is absent and the section never renders. -->
+        <section class="scroll" id="xp-scroll" aria-labelledby="xp-h" hidden>
+          <h2 id="xp-h" class="scroll__h">Cross-project record</h2>
+          <div id="xp-body"></div>
+        </section>
+
         <!-- Achievements — the builder's earned shelf. -->
         <section class="scroll scroll--bare" id="ach-scroll" aria-labelledby="ach-h">
           <h2 id="ach-h" class="scroll__h">Achievements</h2>
@@ -66,6 +74,10 @@
             </tbody>
           </table>
         </section>
+
+        <!-- Reserved slots — connections, guilds, and actions (profile-page
+             spec sections 6–8) mount here in later phases; keeping the order
+             fixed now means the page is not re-laid-out twice (Decision 5). -->
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>
@@ -83,6 +95,6 @@
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
-<script src="/builders/profile.js?v=2026-08-04-reward1"></script>
+<script src="/builders/profile.js?v=2026-08-16-r04"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -160,6 +160,82 @@
     }).join('');
   }
 
+  // ---- render: cross-project record (hub-only, ADR 0171 / task 1002280) ----
+  //
+  // The section reveals only when the response carries a cross_project KEY —
+  // present iff the hub port resolved; on a vanilla instance the key is absent
+  // and the section stays hidden (degrade, don't 500). A null value means "no
+  // public cross-project record" — hidden, provisional, or none, deliberately
+  // indistinguishable — so all three render the same private line and NOTHING
+  // derived from the rollup (no partial numbers; a count plus a hidden total is
+  // a leak by subtraction). The response is viewer-independent (ADR 0171 D4):
+  // self is detected client-side by comparing the /me id, and the self "toggle"
+  // is a link to the real control in Settings (R03). No caching assumptions —
+  // hub profile responses are no-store (ADR 0171 D5).
+
+  function xpProjectRow(p) {
+    const name = escapeHtml(p.name || 'Project');
+    // origin is third-party-reported; link only a well-formed https URL.
+    const origin = typeof p.origin === 'string' && /^https:\/\//.test(p.origin) ? p.origin : null;
+    const nameCell = origin ? `<a href="${escapeHtml(origin)}" rel="noopener">${name}</a>` : name;
+    // rank_held is THAT project's standing as it reported it — plain text, never
+    // the local rank badge or the instance's own rank labels (spec Decision 1).
+    const held = typeof p.rank_held === 'string' && p.rank_held
+      ? escapeHtml(p.rank_held.charAt(0).toUpperCase() + p.rank_held.slice(1))
+      : '—';
+    return `<tr><td>${nameCell}</td><td>${held}</td></tr>`;
+  }
+
+  function renderCrossProject(data, selfId) {
+    const section = $('#xp-scroll');
+    const body = $('#xp-body');
+    if (!section || !body) return;
+    if (!data || !('cross_project' in data)) {
+      section.hidden = true;
+      return;
+    }
+    // ids may serialize as strings (pg bigint) — compare canonicalized.
+    const isSelf = selfId != null && data.builder && String(data.builder.id) === String(selfId);
+    const manage = isSelf
+      ? `<p class="scroll__lede">This is you — <a href="/settings#cross-project">manage its visibility in Settings → Cross-project record</a>.</p>`
+      : '';
+    const cp = data.cross_project;
+    if (!cp) {
+      body.innerHTML = `<p class="scroll__lede">This builder keeps their track record private.</p>${manage}`;
+      section.hidden = false;
+      return;
+    }
+    const t = cp.totals || {};
+    const tiles =
+      `<div class="stat-row">` +
+      tile('Projects', fmtNum(t.projects)) +
+      tile('Works shipped', fmtNum(t.works_shipped)) +
+      tile('Credits', fmtNum(t.credits)) +
+      tile('Karma', fmtNum(t.karma)) +
+      `</div>`;
+    const discs = Array.isArray(cp.disciplines) ? cp.disciplines.filter((d) => typeof d === 'string') : [];
+    const metaBits = [];
+    if (discs.length) metaBits.push(`Disciplines: ${discs.join(', ')}`);
+    if (cp.last_active) metaBits.push(`Last active ${fmtDate(cp.last_active)}`);
+    const meta = metaBits.length ? `<p class="scroll__lede">${escapeHtml(metaBits.join(' · '))}</p>` : '';
+    const named = Array.isArray(cp.projects) ? cp.projects : [];
+    const moreCount = Number(cp.more_projects) || 0;
+    const projectsTable = named.length
+      ? `<table class="ledger">
+           <thead><tr><th>Project</th><th title="That project's own standing, as reported by that project.">Standing there</th></tr></thead>
+           <tbody>${named.map(xpProjectRow).join('')}</tbody>
+         </table>`
+      : '';
+    const more = moreCount > 0
+      ? `<p class="scroll__lede">+ ${fmtNum(moreCount)} more project${moreCount === 1 ? '' : 's'} not publicly listed.</p>`
+      : '';
+    const none = !named.length && !moreCount
+      ? `<p class="scroll__lede">No cross-project activity reported yet.</p>`
+      : '';
+    body.innerHTML = tiles + meta + projectsTable + more + none + manage;
+    section.hidden = false;
+  }
+
   // ---- states -------------------------------------------------------------
 
   function showMessage(text) {
@@ -167,13 +243,14 @@
     if (sub) sub.textContent = text;
   }
 
-  function renderProfile(data) {
+  function renderProfile(data, selfId) {
     const builder = data.builder || {};
     const name = builder.display_name || builder.github_login || 'Builder';
     const shipped = Number(data.shipped_count) || 0;
     showMessage(`${name} — ${rankLabel(normalizeRank(builder.rank))} · ${fmtNum(shipped)} work${shipped === 1 ? '' : 's'} shipped`);
     renderHead(builder);
     renderNumbers(data.shipped_count, data.achievements);
+    renderCrossProject(data, selfId);
     renderAchievements(data.achievements);
     renderWorks(data.recent_ships);
   }
@@ -197,23 +274,39 @@
     const ach = $('#ach-grid'); if (ach) ach.innerHTML = '';
     const works = $('#works-table tbody'); if (works) works.innerHTML = '';
     const worksLede = $('#works-lede'); if (worksLede) worksLede.hidden = true;
+    const xp = $('#xp-scroll'); if (xp) xp.hidden = true;
   }
 
-  async function fetchProfile(id) {
+  async function fetchProfile(id, selfId) {
     const res = await api.request('GET', `${API}/builders/${encodeURIComponent(id)}/profile`);
     if (res.status === 404) {
       showMessage('No builder found with that id.');
       return;
     }
     if (!res.ok) throw new Error(`profile → ${res.status}`);
-    renderProfile(res.data || {});
+    renderProfile(res.data || {}, selfId);
+  }
+
+  // The viewer's own builder id, or null when signed out / unresolvable. Used
+  // ONLY for client-side self-detection (ADR 0171 D4 — the profile response is
+  // viewer-independent); a failure here just means no self link renders.
+  async function resolveSelfId() {
+    try {
+      const me = await api.request('GET', `${API}/me`);
+      if (!me.ok) return null;
+      const builder = (me.data && me.data.builder) ? me.data.builder : me.data;
+      return (builder && builder.id) || null;
+    } catch (err) {
+      console.error('[profile] /me self-detect failed', err);
+      return null;
+    }
   }
 
   async function load() {
     const idParam = new URLSearchParams(location.search).get('id');
     try {
       if (idParam) {
-        await fetchProfile(idParam);
+        await fetchProfile(idParam, await resolveSelfId());
         return;
       }
       // No id — soft-resolve the viewer's OWN id from /me (no hard redirect; a
@@ -230,7 +323,7 @@
         renderEmpty();
         return;
       }
-      await fetchProfile(selfId);
+      await fetchProfile(selfId, selfId);
     } catch (err) {
       console.error('[profile] failed to load', err);
       showMessage('Could not load this profile. Return to the hall and try again.');

package/modules/hall-ui/public/settings.html

@@ -79,6 +79,20 @@
               <p class="section-note">Saves when you press Save; shows everywhere at once.</p>
             </section>
 
+            <!-- Cross-project record (platform-identity module, ADR 0171 / task 1002279).
+                 Revealed only when the module's own endpoint answers; hidden on a
+                 vanilla instance. P04 later moves this into the Profile rail group. -->
+            <section class="scroll" id="cross-project-scroll" aria-labelledby="cross-project-h" data-group="account" hidden>
+              <h2 id="cross-project-h" class="scroll__h">Cross-project record</h2>
+              <p class="scroll__lede">
+                Your track record across every project you build on, shown on your
+                public profile. Hiding it takes effect immediately everywhere —
+                your profile, the People directory, and recruiting views.
+              </p>
+              <div id="cross-project-rows"></div>
+              <p class="settings-status" id="cross-project-status" role="status" aria-live="polite"></p>
+            </section>
+
             <!-- CRAFT — discipline preferences (GET /me, PATCH /me/disciplines). -->
             <section class="scroll" id="craft-scroll" aria-labelledby="craft-h" data-group="account" hidden>
               <h2 id="craft-h" class="scroll__h">Preferred disciplines</h2>

package/modules/hall-ui/public/settings.js

@@ -550,6 +550,86 @@
     }
   }
 
+  // ---- section: CROSS-PROJECT RECORD (hide flag — ADR 0171 D4, task 1002279)
+  //
+  // GET/PATCH /api/bongos/me/cross-project (platform-identity module — hub only).
+  // One on/off toggle: "show my cross-project record on my public profile".
+  // Enforcement is server-side in the module's read functions, so flipping it
+  // takes effect immediately on the profile, /people, and /scouting. The section
+  // reveals ONLY when the module's endpoint answers (404 on a vanilla instance →
+  // stays hidden, no error state). P04 later re-homes this in the Profile rail
+  // group; storage is account-global on the hub (not behavior_prefs).
+  function renderCrossProject(data) {
+    const wrap = $('#cross-project-rows');
+    if (!wrap) return;
+    const hidden = !!(data && data.hide_stats);
+    const on = !hidden; // the toggle reads as "shown"
+    const cp = data && data.cross_project;
+    const totals = cp && cp.totals ? cp.totals : null;
+    const totalsLine = totals
+      ? `Your record: ${totals.projects} project${totals.projects === 1 ? '' : 's'} · ` +
+        `${totals.credits} credits · ${totals.works_shipped} works shipped · ${totals.karma} karma.`
+      : 'No cross-project activity reported yet.';
+    const consentNote = data && data.profile_state !== 'active'
+      ? ' Your profile publishes after your next sign-in at the hub.'
+      : '';
+    wrap.innerHTML =
+      '<div class="sound-row" data-cross-project="hide">' +
+      '<div class="sound-row__text">' +
+      '<div class="sound-row__label">Show my cross-project record</div>' +
+      `<div class="sound-row__desc">${escapeHtml(totalsLine + consentNote)} You always see your own numbers here.</div>` +
+      '</div>' +
+      `<button type="button" class="sound-toggle" data-on="${on ? '1' : '0'}" aria-pressed="${on ? 'true' : 'false'}">${on ? 'Shown' : 'Hidden'}</button>` +
+      '</div>';
+  }
+
+  // PATCH the hide flag. Body: { hide_stats: <bool> } (routes/profile.js).
+  async function saveCrossProject(hide, btn) {
+    const status = $('#cross-project-status');
+    if (status) status.textContent = 'Saving…';
+    if (btn) btn.disabled = true;
+    try {
+      const res = await api.request('PATCH', `${API}/me/cross-project`, { body: { hide_stats: hide } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) throw new Error(`cross-project PATCH → ${res.status}`);
+      await loadCrossProject(); // re-render from the server's truth (flag + record)
+      const msg = hide
+        ? 'Cross-project record hidden — removed from your profile and directories immediately.'
+        : 'Cross-project record shown on your public profile.';
+      if (status) status.textContent = msg;
+      toast(msg);
+    } catch (err) {
+      console.error('[settings] save cross-project failed', err);
+      if (status) status.textContent = 'Could not save. Try again.';
+      toast('Could not save your cross-project preference. Try again.');
+      if (btn) btn.disabled = false;
+    }
+  }
+
+  let crossProjectWired = false;
+  async function loadCrossProject() {
+    const section = $('#cross-project-scroll');
+    if (!section) return;
+    try {
+      const res = await api.request('GET', `${API}/me/cross-project`);
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) return; // module off / route absent → the section stays hidden
+      renderCrossProject(res.data);
+      section.hidden = false;
+      if (!crossProjectWired) {
+        crossProjectWired = true;
+        $('#cross-project-rows').addEventListener('click', (e) => {
+          const b = e.target.closest('.sound-toggle');
+          if (!b || b.disabled) return;
+          saveCrossProject(b.dataset.on === '1', b); // shown → hide; hidden → show
+        });
+      }
+    } catch (err) {
+      // Network/parse failure on an optional module section — stay hidden, log only.
+      console.error('[settings] failed to load cross-project', err);
+    }
+  }
+
   // ---- section 2: CRAFT (discipline preferences) ---------------------------
 
   // Valid disciplines are limited (see me.js + db.updateBuilderDisciplines):
@@ -1098,6 +1178,7 @@
   const PANEL_ANCHORS = {
     'connections': 'connections-scroll',
     'display-name': 'display-name-scroll',
+    'cross-project': 'cross-project-scroll',
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
     'art-key': 'art-key',
@@ -1250,6 +1331,9 @@
     await loadWandering();
     // Rendering loads independently too (rich in-feed cards on/off, task 1279).
     await loadRender();
+    // Cross-project record (hide flag) — reveals only where the platform-identity
+    // module answers (the hub); silent no-op elsewhere (task 1002279).
+    await loadCrossProject();
     // Image key (per-builder Gemini key, task 1013) — own try/catch; `me` carries
     // the `needs` art_key item that drives the covered/action-needed banner.
     await loadArtKey(me);

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile"],
     "migrations": true,
     "pollers": ["code-sweep"]
   },

package/modules/platform-identity/platform-identity.js

@@ -601,6 +601,26 @@ async function getOwnProfileExtras(githubId, { pool = defaultPool } = {}) {
   return getRollupForBuilder(githubId, { pool });
 }
 
+// The C2 hide-stats WRITE (ADR 0171 D4, task 1002279): own-scoped — callers key
+// this by the AUTHENTICATED session's github_id. Upserts so a hub builder who
+// never federated (no account row yet) can still hide ahead of time: the insert
+// creates a fail-closed provisional account already carrying the flag; the
+// UPDATE branch touches ONLY hide_stats (never identity fields, never
+// profile_state — activation stays /sso/authorize's alone, D3).
+async function setAccountHideStats({ githubId, githubLogin, displayName, avatarUrl, hide }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return null;
+  const { rows } = await pool.query(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, hide_stats)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (github_id) DO UPDATE SET
+       hide_stats = EXCLUDED.hide_stats,
+       updated_at = now()
+     RETURNING github_id, github_login, profile_state, hide_stats`,
+    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null, !!hide],
+  );
+  return rows[0];
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -700,6 +720,7 @@ module.exports = {
   getRollupForBuilder,
   getPublicProfileExtras,
   getOwnProfileExtras,
+  setAccountHideStats,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/profile.js

@@ -0,0 +1,77 @@
+// modules/platform-identity/routes/profile.js — the builder's OWN cross-project
+// profile controls (ADR 0171 D4, task 1002279 / goal 1000045). Two own-scoped
+// endpoints behind a live session; both key on req.builder.github_id — never a
+// caller-named id — so a builder can only ever read or flip their own flag.
+//
+//   GET   /me/cross-project — the Settings self view: the hide flag + consent
+//                             state + the builder's own rollup, served regardless
+//                             of flags (getOwnProfileExtras — a hidden builder
+//                             inspects their numbers HERE, not on the public
+//                             route, which stays viewer-independent).
+//   PATCH /me/cross-project — flip hide_stats. Takes effect immediately on every
+//                             public surface (profile cross_project, /people,
+//                             /scouting): enforcement lives in the module's read
+//                             functions (D2) and the hub profile response is
+//                             no-store (D5), so there is no cache to outwait.
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, requireBuilder, validateOrRespond } = api;
+
+module.exports = function profileRoutes() {
+  const router = express.Router();
+
+  // rank: any-builder — the caller's OWN cross-project record + hide flag (own data).
+  router.get('/me/cross-project', requireBuilder, async (req, res) => {
+    try {
+      // Core builders include system:* principals whose github_id is not numeric;
+      // they have no platform identity — answer the empty shape, not a 500.
+      if (!pi.isNumericGithubId(req.builder.github_id)) {
+        return res.json({ hide_stats: false, profile_state: null, cross_project: null });
+      }
+      const [acct, extras] = await Promise.all([
+        pi.getAccount(req.builder.github_id, { pool }),
+        pi.getOwnProfileExtras(req.builder.github_id, { pool }),
+      ]);
+      res.json({
+        hide_stats: !!(acct && acct.hide_stats),
+        profile_state: acct ? acct.profile_state : null,
+        cross_project: extras,
+      });
+    } catch (err) {
+      console.error('[platform-identity] GET /me/cross-project', err);
+      res.fail('cross_project_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — flip the caller's OWN hide flag (C2's self-serve opt-out;
+  // own data, keyed on the authenticated github_id).
+  router.patch('/me/cross-project', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      hide_stats: { required: true, type: 'boolean' },
+    })) return;
+    try {
+      if (!pi.isNumericGithubId(req.builder.github_id)) {
+        return res.fail('no_platform_identity', 400);
+      }
+      const row = await pi.setAccountHideStats({
+        githubId: req.builder.github_id,
+        githubLogin: req.builder.github_login,
+        displayName: req.builder.display_name,
+        avatarUrl: req.builder.avatar_url,
+        hide: req.body.hide_stats,
+      }, { pool });
+      res.json({ hide_stats: !!(row && row.hide_stats) });
+    } catch (err) {
+      console.error('[platform-identity] PATCH /me/cross-project', err);
+      res.fail('cross_project_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/platform-identity/tests/platform-identity.mjs

@@ -486,6 +486,28 @@ await ta('getPublicProfileExtras returns the rollup for an active, visible accou
   assert.equal(out.more_projects, 0);
 });
 
+await ta('setAccountHideStats flips ONLY the hide flag (never identity, never profile_state)', async () => {
+  const pool = mockPool([{ rows: [{ github_id: '42', hide_stats: true, profile_state: 'provisional' }] }]);
+  const out = await P.setAccountHideStats(
+    { githubId: 42, githubLogin: 'octo', displayName: 'Octo', avatarUrl: 'a', hide: true }, { pool });
+  assert.equal(out.hide_stats, true);
+  const c = pool.calls[0];
+  assert.match(c.text, /ON CONFLICT \(github_id\) DO UPDATE/);
+  // The UPDATE branch may set hide_stats + updated_at and NOTHING else — a
+  // settings toggle is not an identity refresh and must never touch consent.
+  const updateBranch = c.text.slice(c.text.indexOf('DO UPDATE'), c.text.indexOf('RETURNING'));
+  assert.match(updateBranch, /hide_stats = EXCLUDED\.hide_stats/);
+  assert.doesNotMatch(updateBranch, /github_login|display_name|avatar_url|profile_state/,
+    'the update branch must not clobber identity or consent');
+  assert.equal(c.params[4], true, 'hide passed as a boolean');
+});
+
+await ta('setAccountHideStats guards non-numeric github_id (system:* principals) → null, no query', async () => {
+  const pool = mockPool([]);
+  assert.equal(await P.setAccountHideStats({ githubId: 'system:bfg', hide: true }, { pool }), null);
+  assert.equal(pool.calls.length, 0);
+});
+
 await ta('getOwnProfileExtras serves the self view regardless of flags (no flags lookup)', async () => {
   const pool = mockPool([
     { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.169",
+  "version": "1.19.171",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.169",
+      "version": "1.19.171",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.169",
+  "version": "1.19.171",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/hall-preview/server.js

@@ -81,6 +81,7 @@ const FIXTURE_FALLBACKS = [
   [/^blockers\/\d+$/, 'blockers__detail'],
   [/^analytics\/builder\/\d+$/, 'analytics__builder'],
   [/^builders\/\d+\/active-claims$/, 'builders__active-claims'],
+  [/^builders\/\d+\/profile$/, 'builders__profile'],
 ];
 
 function loadFixture(name) {

package/src/module-api.js

@@ -765,8 +765,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.167 with no explicit bump. run 31962256201. (task 1002620)
 //   1.19.169 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.168 with no explicit bump. run 31964702865. (task 1002620)
+//   1.19.170 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.169 with no explicit bump. run 31965483417. (task 1002620)
+//   1.19.171 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.170 with no explicit bump. run 31967255167. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.169'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.171'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/profile_rollup_consent.mjs

@@ -142,6 +142,31 @@ try {
   acct = await pi.getAccount(LAZY, { pool });
   ok(acct.profile_state === 'active', 'a later plain upsert never demotes an active account');
 
+  // 4b — the live hide toggle (R03, task 1002279): flipping hide_stats takes
+  // effect IMMEDIATELY on every public read — the profile port and the
+  // /people + /scouting rollup — while the self view keeps serving.
+  await pi.setAccountHideStats({ githubId: ACTIVE, githubLogin: 'active-b', hide: true }, { pool });
+  ok(await pi.getPublicProfileExtras(ACTIVE, { pool }) === null, 'hide ON → public read drops to null immediately');
+  const hiddenListed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
+  ok(!hiddenListed.includes(ACTIVE), 'hide ON → the builder drops out of /people + /scouting immediately');
+  const stillOwn = await pi.getOwnProfileExtras(ACTIVE, { pool });
+  ok(stillOwn && stillOwn.totals.credits === 175, 'hide ON → the self view still serves their own numbers');
+  let hiddenAcct = await pi.getAccount(ACTIVE, { pool });
+  ok(hiddenAcct.profile_state === 'active', 'the toggle never touches profile_state');
+  ok(hiddenAcct.github_login === 'active-b', 'the toggle never clobbers identity fields');
+  await pi.setAccountHideStats({ githubId: ACTIVE, githubLogin: 'active-b', hide: false }, { pool });
+  const backPub = await pi.getPublicProfileExtras(ACTIVE, { pool });
+  ok(backPub && backPub.totals.credits === 175, 'hide OFF → the public read returns immediately');
+
+  // 4c — hide-before-federating: a builder with NO account row can still hide;
+  // the insert creates a fail-closed provisional account carrying the flag.
+  const EARLY = 90002282;
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = $1`, [EARLY]).catch(() => {});
+  const early = await pi.setAccountHideStats({ githubId: EARLY, githubLogin: 'early-b', hide: true }, { pool });
+  ok(early.hide_stats === true && early.profile_state === 'provisional',
+    'hide with no account row creates a provisional, hidden account');
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = $1`, [EARLY]).catch(() => {});
+
   // 5 — rollup payload sanitization against the real columns (D7).
   await pi.upsertActivity({
     clientId: PUB_CLIENT, githubId: LAZY, credits: 1,

package/tests/profile_ui_cross_project.mjs

@@ -0,0 +1,182 @@
+// tests/profile_ui_cross_project.mjs — the profile page's cross-project section
+// (task 1002280, R04 · goal 1000045, ADR 0171).
+//
+// EXECUTES the real modules/hall-ui/public/profile.js in a minimal DOM stub
+// (the hall_signout.mjs pattern) against canned API responses, and asserts the
+// consent-sensitive render contract:
+//
+//   - no `cross_project` key in the response (vanilla instance) → the section
+//     stays hidden entirely;
+//   - `cross_project: null` (hidden / provisional / none — indistinguishable by
+//     design) → the "keeps their track record private" line renders and NOTHING
+//     derived from the rollup does (no tiles, no digits — a count plus a hidden
+//     total is a leak by subtraction);
+//   - the self hide-toggle is client-side only (ADR 0171 D4): the Settings link
+//     renders iff the /me id matches the profile id, on both the ?id= and the
+//     own-profile load paths;
+//   - the full object renders totals tiles, named project rows (https origins
+//     linked, anything else plain text), `rank_held` as plain text — never the
+//     local rank-badge component (spec Decision 1) — and the counted-never-named
+//     "+N more" line.
+//
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
+const HTML = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.html'), 'utf8');
+
+// ---- fixtures -------------------------------------------------------------
+
+const BUILDER = {
+  id: 7, github_login: 'pheidias', display_name: 'Pheidias', avatar_url: null,
+  rank: 'metic', total_credits: 120, karma: 3, created_at: '2026-01-01T00:00:00.000Z',
+  preferred_disciplines: ['engineer'],
+};
+
+const CP_FULL = {
+  totals: { projects: 3, credits: 150, works_shipped: 7, karma: 4 },
+  disciplines: ['engineer', 'ui'],
+  last_active: '2026-08-01T00:00:00.000Z',
+  projects: [
+    { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic' },
+    { name: 'Odd Origin', origin: 'http://insecure.example', rank_held: null },
+  ],
+  more_projects: 1,
+};
+
+const baseProfile = () => ({ builder: { ...BUILDER }, shipped_count: 1, recent_ships: [], achievements: [] });
+
+// ---- harness --------------------------------------------------------------
+
+// Boot profile.js with canned /me + profile responses; returns the memoised
+// element map after the async load() settles.
+async function boot({ search = '', me, profile } = {}) {
+  const els = new Map();
+  const makeEl = () => ({
+    hidden: false, textContent: '', _html: '',
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const $ = (sel) => { if (!els.has(sel)) els.set(sel, makeEl()); return els.get(sel); };
+  // Mirror the markup: the section ships with the `hidden` attribute.
+  $('#xp-scroll').hidden = true;
+
+  const escapeHtml = (s) => String(s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const api = {
+    async request(_method, url) {
+      if (url === '/api/bongos/me') return me ?? { status: 401, ok: false, data: null };
+      if (/\/builders\/[^/]+\/profile$/.test(url)) return profile ?? { status: 404, ok: false, data: null };
+      return { status: 404, ok: false, data: null };
+    },
+  };
+  const windowObj = {
+    __BRANDING__: {},
+    BongosClient: { createClient: () => api },
+    OTB: {
+      $, escapeHtml,
+      fmtNum: (n) => String(Number(n) || 0),
+      fmtDate: (d) => String(d).slice(0, 10),
+      rankLabel: (r) => r,
+      toast() {},
+    },
+  };
+  const sandbox = {
+    window: windowObj, location: { search }, URLSearchParams, console,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'profile.js' });
+  // load() is fire-and-forget; let its await chain settle.
+  for (let i = 0; i < 4; i++) await new Promise((r) => setImmediate(r));
+  return { els, $ };
+}
+
+const meOk = (id) => ({ status: 200, ok: true, data: { builder: { id } } });
+const profileOk = (data) => ({ status: 200, ok: true, data });
+
+// ---- the markup ships the section hidden ----------------------------------
+
+test('profile.html carries the hidden cross-project section + reserved slots', () => {
+  assert.match(HTML, /<section[^>]*id="xp-scroll"[^>]*hidden>/, 'the section must ship hidden — it reveals only when the response carries a cross_project key');
+  assert.match(HTML, /Reserved slots[\s\S]*connections, guilds, and actions/, 'the spec Decision 5 slot reservation must stay in the layout');
+});
+
+// ---- vanilla instance: key absent → section absent -------------------------
+
+test('no cross_project key (vanilla instance) → the section stays hidden', async () => {
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk(baseProfile()) });
+  assert.equal($('#xp-scroll').hidden, true);
+  assert.equal($('#xp-body').innerHTML, '');
+});
+
+// ---- cross_project: null → private line, nothing derived -------------------
+
+test('cross_project null, stranger view → private line only, no numbers, no self link', async () => {
+  const data = { ...baseProfile(), cross_project: null };
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk(data) });
+  const xp = $('#xp-scroll');
+  const html = $('#xp-body').innerHTML;
+  assert.equal(xp.hidden, false, 'on the hub the section reveals even when the record is private');
+  assert.match(html, /keeps their track record private/);
+  assert.ok(!html.includes('stat-tile'), 'no tiles in the private state');
+  assert.ok(!/\d/.test(html), 'no digits at all — no partial numbers (leak by subtraction)');
+  assert.ok(!html.includes('/settings#cross-project'), 'no self link for a stranger');
+});
+
+test('cross_project null, self view via ?id= → private line + the Settings link', async () => {
+  const data = { ...baseProfile(), cross_project: null };
+  // /me id as a STRING (pg bigint serialization) against the numeric profile id
+  // — self-detection must be serialization-proof.
+  const { $ } = await boot({ search: '?id=7', me: meOk('7'), profile: profileOk(data) });
+  const html = $('#xp-body').innerHTML;
+  assert.match(html, /keeps their track record private/);
+  assert.ok(html.includes('/settings#cross-project'), 'the self hide-toggle links to Settings → Cross-project record');
+});
+
+test('self view with no ?id= (own-profile path) also gets the Settings link', async () => {
+  const data = { ...baseProfile(), cross_project: null };
+  const { $ } = await boot({ search: '', me: meOk(7), profile: profileOk(data) });
+  assert.ok($('#xp-body').innerHTML.includes('/settings#cross-project'));
+});
+
+// ---- the full record -------------------------------------------------------
+
+test('full cross_project → tiles, named rows, plain-text standing, +N more', async () => {
+  const data = { ...baseProfile(), cross_project: CP_FULL };
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk(data) });
+  const xp = $('#xp-scroll');
+  const html = $('#xp-body').innerHTML;
+  assert.equal(xp.hidden, false);
+  assert.equal((html.match(/stat-tile__num/g) || []).length, 4, 'projects / works shipped / credits / karma tiles');
+  assert.match(html, /Public Proj/);
+  assert.ok(html.includes('href="https://pub.example"'), 'a well-formed https origin links out');
+  assert.match(html, /Odd Origin/);
+  assert.ok(!html.includes('href="http://insecure.example"'), 'a non-https origin renders as plain text');
+  assert.match(html, /Metic/, 'rank_held renders capitalized as that project\'s own standing');
+  assert.ok(!html.includes('rank-badge'), 'never the local rank-badge component for another project\'s rank (spec Decision 1)');
+  assert.match(html, /\+ 1 more project/, 'non-public projects are counted, never named');
+  assert.match(html, /Disciplines: engineer, ui/);
+  assert.match(html, /Last active 2026-08-01/);
+  assert.ok(!html.includes('/settings#cross-project'), 'no self link for a stranger');
+});
+
+test('zero-activity record → the empty line, no project table', async () => {
+  const cp = { ...CP_FULL, projects: [], more_projects: 0 };
+  const { $ } = await boot({ search: '?id=7', me: meOk(99), profile: profileOk({ ...baseProfile(), cross_project: cp }) });
+  const html = $('#xp-body').innerHTML;
+  assert.match(html, /No cross-project activity reported yet\./);
+  assert.ok(!html.includes('<table'), 'no empty ledger');
+});
+
+// ---- signed-out empty state ------------------------------------------------
+
+test('signed-out visitor with no ?id= → empty state keeps the section hidden', async () => {
+  const { $ } = await boot({ search: '', me: { status: 401, ok: false, data: null } });
+  assert.equal($('#xp-scroll').hidden, true);
+});