@bongos/core 1.19.421 → 1.19.423

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.421",
-  "core_contract": "1.19.421",
-  "source_commit": "ea6e65fb6df2e2ca09fcb0769b194b3ccb407878",
+  "core_version": "1.19.423",
+  "core_contract": "1.19.423",
+  "source_commit": "4766551ebf3debe1bd66da9feb7974ea29a9fc7d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-29T17:49:20.389Z",
+  "built_at": "2026-08-29T18:48:03.289Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 359,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1719,
+    "functional_verbatim": 1720,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2101,
-  "tree_sha256": "9528e100c022a131a7ee286c52e98c8bd5544beec72d013af6aea2a668a8e487",
+  "file_count": 2102,
+  "tree_sha256": "e08d232a8919912b3eaa5b098b0ad5e505a24ec5c55e56f236762ef12684ba97",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1937,7 +1937,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "54aad52c9bf29c0443c656e9ccc606b886e241bd6f0f1f6ea178d6e0ff4ce46a"
+      "sha256": "13dba1ab067b238b37395e6e23728b198a7f944bb15e0a4b4850ceefdfafb2b1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5497,12 +5497,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c735a709aeb39ba8d543a0d1a116c6c4c99398fdee629b719228b21dc351e931"
+      "sha256": "c6703f3be312d7ab5830f5f4aceda03cb1e5689ac3d82568f835d8a9ee3eeb4a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "82dbf5b00684863b19d987b3aed3abbf668b38f2aa8133081993a3dc6ec37b57"
+      "sha256": "5fca13b9621fcb29a90b4c4ea608a0083a9fc3574dfeecf8b35fed342d147491"
     },
     {
       "path": "public-docs/index.html",
@@ -5742,7 +5742,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "85797e1405425d852572a796f56fde0928b596af49b04214b576c7e4067fbfcd"
+      "sha256": "282ec017ecdd9ecde6ef3c80df5b7874b392e2b4d97ae29b4222a87c2ed51f3a"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -5962,7 +5962,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "8f74c9a2d3eda52bc91d04c0b1b13fc4752688fdf864bcc0ae8cb9e242c7b8d3"
+      "sha256": "4174cf9209dd56e38944462d62f178bf684a7fb593d3c20b81620f004e64a57b"
     },
     {
       "path": "public-landing/projects.probes.json",
@@ -6842,7 +6842,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "29ee6bd76bdfb65522170808b6e636032079a145df4f995570901fb4f05b6035"
+      "sha256": "9a173b5e307f5c1396f1d72b88d0b05534cccbff53af0a39a620001df69bf1a8"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -7632,7 +7632,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1dda5c82cffdacd548fa5f46dace55a9967f8b43b3ddd3eff267ddf9002f0020"
+      "sha256": "187cad1863a33d5e9c7db35bad173525124dbc8534a87ecf2b760397fab37d12"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9654,6 +9654,11 @@
       "mode": "0000644",
       "sha256": "a7f70fa612494593438565f4bd1e3d454a3dbca862c8396a7dcb252d38e3e489"
     },
+    {
+      "path": "tests/profile_privacy_owner_view.mjs",
+      "mode": "0000644",
+      "sha256": "7ccf39b7557fdb7f906210a8d2e58079b92c860d25bc906d8243b8477b02a02a"
+    },
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
@@ -9682,12 +9687,12 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "27a10d25acbf114ba0939325bf225399503b54149d3c24f25592c82d7bbe5f85"
+      "sha256": "b40e405b673524ad0d33c041730771d1ebf9c95198062ebf307aed5fa1e7d501"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "ecf1a225759d8d8475bac145727c006fe7341c4b945690ffd47a620e42e8140e"
+      "sha256": "48b314b096c67793dba8f5faeec5b03d043c42a17a38466e072e6bf9c7ae9ec5"
     },
     {
       "path": "tests/promote_goal_id.mjs",

package/docs/module-api-changelog.md

@@ -1279,5 +1279,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.419 with no explicit bump. run 33266034679. (task 1002620)
   1.19.421 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.420 with no explicit bump. run 33266605270. (task 1002620)
+  1.19.422 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.421 with no explicit bump. run 33267393283. (task 1002620)
+  1.19.423 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.422 with no explicit bump. run 33269205170. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.421",
+  "version": "1.19.423",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.421",
+      "version": "1.19.423",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.421",
+  "version": "1.19.423",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -903,17 +903,30 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl td.right{text-align:right;}
 /* Nothing in an action or status cell may wrap: "Manage →" breaking after the
    space and the chip's recency dropping to a second line both read as a broken
-   control rather than a tight column. Those two cells claim their width and the
-   name cell absorbs the slack. */
+   control rather than a tight column. */
 .tbl .btn,.tbl .chip{white-space:nowrap;}
-.tbl .colStatus{width:1%;white-space:nowrap;}
-.tbl .colGo{width:1%;white-space:nowrap;padding-left:8px;}
-.tbl .colName{width:auto;}
-.tbl .colType{width:1%;white-space:nowrap;}
+.tbl .colStatus,.tbl .colGo,.tbl .colType{white-space:nowrap;}
+.tbl .colGo{padding-left:8px;}
+/* ── FIXED tracks (task 1003348; the owner: "the columns don't look aligned").
+   An auto table sized every column by its content, so the status column hugged
+   its widest chip and the headers drifted off their cells. table-layout:fixed
+   takes the widths from the header row — one set of tracks for every row, each
+   column edge one vertical line — and the name column absorbs the slack. The
+   Project header sits over the NAME (past the 10px dot and its 12px gap), and a
+   right-aligned column's header is right-aligned too. Below the table's minimum
+   the wrap scrolls (#sub-table-body), never the page. ── */
+.tbl{table-layout:fixed;min-width:860px;}
+.tbl th.colName{padding-left:22px;}
+.tbl th.right{text-align:right;}
+.tbl th.colType{width:88px;}
+.tbl th.colBuilders{width:96px;}
+.tbl th.colTags{width:168px;}
+.tbl th.colStatus{width:224px;}
+.tbl th.colGo{width:112px;}
 /* the declared-type tag (task 1002772) — its own vocabulary: not the relationship
    .pill, not the liveness .chip. Two different facts never wear the same chrome. */
 .typeTag{font-family:var(--font-mono);font-size:10.5px;font-weight:500;color:var(--ink-soft);border:1px solid var(--rule);border-radius:999px;padding:2px 9px;white-space:nowrap;}
-@media (max-width:780px){.tbl .colTags,.tbl .colType{display:none;}}
+@media (max-width:780px){.tbl .colTags,.tbl .colType{display:none;}.tbl{min-width:600px;}}
 @media (max-width:900px){
   .tblMast{gap:16px;padding:22px 0 20px;}
   .tblTitle{font-size:clamp(28px,7.4vw,34px);}
@@ -1065,7 +1078,6 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .rowHall{display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;margin-left:10px;
   vertical-align:middle;color:var(--accent-deep);border-radius:var(--radius-pill);}
 .rowHall:hover{background:var(--glass);}
-.tbl .colGo{white-space:nowrap;}
 @media (max-width:640px){
   .projCard h3{font-size:26px;padding:0 20px;}
   .projCard .cardTag,.projCard .cardRel,.projCard .cardFaces,.projCard .cardFigs,.projCard .cardMeta,
@@ -1154,8 +1166,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    structure, the project's own planet as the row's object, the strip drawn
    as the lifecycle rail, the doors as hairline pills with the accent only on
    the one that acts. One set of FIXED tracks across every row, so the list
-   reads as one ledger (task 1003348). Dark only (ADR 0204); every colour a
-   token; halos are outlines, never box-shadow (DESIGN.md).
+   reads as one ledger — the same column grammar the every-project table takes
+   in its `.tbl` rules (table-layout:fixed, the header row's widths; task
+   1003348, both halves pinned together in tests/projects_hub.mjs). Dark only
+   (ADR 0204); every colour a token; halos are outlines, never box-shadow.
    ═══════════════════════════════════════════════════════════════════════ */
 #view-mine .wrap,#view-manage .wrap{max-width:1180px;}
 #view-mine .card,#view-manage .card{background:none;border-radius:0;box-shadow:none;padding:0;margin:0;}

package/public-landing/projects.html

@@ -489,7 +489,7 @@ summary{min-height:24px;padding:3px 0;}
         <tr>
           <th class="colName" data-sort="name" aria-sort="ascending"><button type="button" class="thSort">Project</button></th>
           <th class="colType">Type</th>
-          <th class="right" data-sort="builders"><button type="button" class="thSort">Builders</button></th>
+          <th class="right colBuilders" data-sort="builders"><button type="button" class="thSort">Builders</button></th>
           <th class="colTags">Runs</th>
           <th class="right colStatus">Status</th>
           <th class="colGo"></th>

package/scripts/gds/run-unit-tests.js

@@ -106,7 +106,14 @@ const INTEGRATION = new Set([
   // the DISTINCT, and that a deactivated builder or a machine principal still
   // never governs under the widened predicate.
   'government_board_membership_db',
-  'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
+  'government_fold_bench', 'government_live_proof',
+  // task 1002806: these three declare "in the INTEGRATION set" in their own headers
+  // and were never in it. Every one boots a real Postgres and self-skips without one,
+  // so in the DB-free lane they ran, skipped, exited 0 and asserted NOTHING — while
+  // the --integration lane never saw them either, because it runs only this set. A
+  // test that cannot fail in either lane is a file that looks like a gate.
+  'handle_machinery', 'hub_profile_leak', 'profile_fields',
+  'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent',
   // task 1003145: whether the PLANNER uses the migration 225 index for the recall
   // freshness probe. The DB-free sibling (recall_corpus_health) pins the query

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.421'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.423'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/profile_privacy_owner_view.mjs

@@ -0,0 +1,477 @@
+// tests/profile_privacy_owner_view.mjs — P10 (task 1002806, goal 1000045):
+// "a private account's profile 404s to a stranger and RENDERS TO ITS OWNER",
+// and a stats-hidden account renders NO PARTIAL NUMBERS.
+//
+// WHAT THIS FILE IS, AND WHAT IT DELIBERATELY IS NOT. The 404 half of P10 was
+// already landed by task 1002967 in tests/effective_visibility_predicate.mjs:
+// private / provisional / private-discoverable / private-previous-handle all
+// 404 on GET /profiles/:handle, never 403, byte-identically for an anonymous
+// viewer, a signed-in stranger and the owner. Re-asserting that here would buy
+// nothing. This file is the OTHER half — the two things that proof left open:
+//
+//   1. THE OWNER'S PAGE, OVER REAL HTTP. 1002967 proves the own-scope side door
+//      at the FUNCTION level (pi.getOwnProfileExtras). But the page shell reads
+//      GET /me/cross-project, and that route is what must hand it the banner
+//      input (account_visibility='private') alongside the owner's own numbers.
+//      A function that behaves is not a route that behaves.
+//
+//   2. THE BYPASS THAT WOULD NULLIFY EVERY 404. The public read is viewer-
+//      independent precisely because the owner gets their page from the
+//      own-scope door instead. That door is therefore load-bearing for the
+//      privacy model: if it ever answered a CALLER-NAMED github_id instead of
+//      the session's, every 404 in 1002967 becomes a speed bump — ask the side
+//      door for the private account instead. Nothing tested that. This does.
+//
+//   3. NO PARTIAL NUMBERS, PROVED BY SUBTRACTION. 1002967 asserts the hidden
+//      account's body matches /"cross_project":null/. That is necessary and not
+//      sufficient: a future response that added `projects_count: 7` beside a
+//      null cross_project still matches it. So here every rollup-derived value
+//      is a PLANTED SENTINEL and the assertion is that none of them appears
+//      ANYWHERE in the hidden account's response text — with two controls that
+//      stop it passing vacuously (a public account's body DOES carry its
+//      sentinels; the hidden account's own numbers DO exist behind the door).
+//
+// THE RULE THIS FOLLOWS IS THE CODE'S, NOT THE PROFILE-PAGE SPEC'S. The spec
+// docs/specs/bongos-v1-builder-profile-page.md says 404 "to everyone but the
+// account itself", which reads as a viewer-dependent public response. The
+// AUTHORITATIVE model — the privacy spec (task 1002785) D2 — reconciles it the
+// other way and the code implements the reconciliation: the PUBLIC read 404s to
+// everyone INCLUDING the owner, and the owner's page is composed from the
+// own-scope endpoint. Both halves are asserted below.
+//
+// MECHANISM (tests/connections_ownership.mjs + tests/own_session_revoke.mjs):
+// an in-memory accounts + activity table whose row filter is built FROM EACH
+// STATEMENT'S OWN WHERE CLAUSE, refusing any statement whose placeholders or
+// literal comparisons it did not consume — so a predicate the fake cannot read
+// is a loud error rather than a silently absent filter. Everything above the
+// pool is real: the real routers, the real domain module, real HTTP.
+//
+// DB-free by construction. Runs in the lane that actually executes (the last
+// test in this file proves that).
+//
+// Run:  node tests/profile_privacy_owner_view.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// ===========================================================================
+// The fixture: four accounts, and a sentinel for every rollup-derived value
+// ===========================================================================
+//
+// Sentinels are per-account so a cross-wired response is caught too, and they
+// are improbable literals so "absent from the body" means absent, not merely
+// "did not collide with a 0 or a 1".
+
+const OCTO = '4242';   // active · public · shown  — the CONTROL
+const GHOST = '5150';  // active · PRIVATE         — the owner-renders subject
+const SHY = '6060';    // active · public · HIDDEN — the no-partial-numbers subject
+const NOSY = '7777';   // active · public          — the stranger at the side door
+
+const ACCOUNTS = [
+  { id: 1, github_id: OCTO, github_login: 'octo', display_name: 'Octo', avatar_url: null,
+    handle: 'octo', previous_handle: null, handle_changed_at: null, bio: null, links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  { id: 2, github_id: GHOST, github_login: 'ghost', display_name: 'Ghost', avatar_url: null,
+    handle: 'ghost', previous_handle: null, handle_changed_at: null, bio: 'ghost-bio-515007', links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+  { id: 3, github_id: SHY, github_login: 'shy', display_name: 'Shy', avatar_url: null,
+    handle: 'shy', previous_handle: null, handle_changed_at: null, bio: null, links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+  { id: 4, github_id: NOSY, github_login: 'nosy', display_name: 'Nosy', avatar_url: null,
+    handle: 'nosy', previous_handle: null, handle_changed_at: null, bio: null, links: null,
+    display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+];
+
+// Every number and name the cross-project rollup can produce, per account.
+const ROLLUP = {
+  [OCTO]: {
+    agg: { projects: 811008, credits: 811001, works_shipped: 811002, karma: 811003, last_active: 'octo-active-811007', disciplines: ['octo-craft-811004'] },
+    projects: [{ name: 'Octo-Project-811005', origin: 'https://octo.example', rank_held: 'metic', recent_ships: ['Octo-Ship-811006'], is_public: true }],
+  },
+  [GHOST]: {
+    agg: { projects: 515008, credits: 515001, works_shipped: 515002, karma: 515003, last_active: 'ghost-active-515007', disciplines: ['ghost-craft-515004'] },
+    projects: [{ name: 'Ghost-Project-515005', origin: 'https://ghost.example', rank_held: 'metic', recent_ships: ['Ghost-Ship-515006'], is_public: true }],
+  },
+  [SHY]: {
+    agg: { projects: 606008, credits: 606001, works_shipped: 606002, karma: 606003, last_active: 'shy-active-606007', disciplines: ['shy-craft-606004'] },
+    projects: [{ name: 'Shy-Project-606005', origin: 'https://shy.example', rank_held: 'metic', recent_ships: ['Shy-Ship-606006'], is_public: true }],
+  },
+  [NOSY]: {
+    agg: { projects: 777008, credits: 777001, works_shipped: 777002, karma: 777003, last_active: 'nosy-active-777007', disciplines: ['nosy-craft-777004'] },
+    projects: [{ name: 'Nosy-Project-777005', origin: 'https://nosy.example', rank_held: 'metic', recent_ships: ['Nosy-Ship-777006'], is_public: true }],
+  },
+};
+
+// Every sentinel belonging to one account, as strings — the "did any of this
+// leak?" alphabet. Numbers are included as their serialized form.
+function sentinelsOf(githubId) {
+  const r = ROLLUP[githubId];
+  return [
+    String(r.agg.projects),
+    String(r.agg.credits), String(r.agg.works_shipped), String(r.agg.karma),
+    r.agg.last_active, ...r.agg.disciplines,
+    ...r.projects.flatMap((p) => [p.name, p.origin, ...p.recent_ships]),
+  ];
+}
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+// The columns this interpreter can filter on. A literal comparison against
+// anything else throws — a WHERE it cannot read must never degrade to no WHERE.
+const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
+
+/**
+ * Build a row test from a statement's own WHERE text. Literal comparisons carry
+ * as much weight as placeholders here: the effective-visibility predicate is
+ * made ENTIRELY of literal comparisons, so a fake that modelled only $N filters
+ * would score the privacy terms as absent and pass however the code changed.
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+
+  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
+  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
+
+  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
+  if (byId) {
+    consumed.add(byId[1]);
+    const v = params[Number(byId[1]) - 1];
+    tests.push((r) => String(r.github_id) === String(v));
+  }
+
+  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
+  if (byHandle) {
+    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
+    const v = String(params[Number(byHandle[1]) - 1]);
+    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
+  }
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_COLUMNS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+// The github_id an activity statement is scoped to, read from its own WHERE.
+function activityScope(sql, params) {
+  const m = /\ba\.github_id = \$(\d+)/.exec(sql);
+  if (!m) throw new Error(`fake pool: an activity read with no github_id scope — ${sql.slice(0, 120)}`);
+  return String(params[Number(m[1]) - 1]);
+}
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+
+    if (/FROM platform_identity_accounts/.test(sql)) {
+      const where = sql.includes(' WHERE ')
+        ? sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '')
+        : '';
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      let rows = ACCOUNTS.filter(accountFilter(where, params));
+      if (/is_current/.test(cols)) {
+        // resolveHandle asks the row whether the handle it matched is the CURRENT
+        // one — the flag that forks 200 from 301. Derived, never assumed.
+        const asked = String(params[0]).toLowerCase();
+        rows = rows
+          .map((r) => ({ ...r, is_current: String(r.handle || '').toLowerCase() === asked }))
+          .sort((a, b) => Number(b.is_current) - Number(a.is_current))
+          .slice(0, /LIMIT 1/.test(sql) ? 1 : rows.length);
+      }
+      return { rows: rows.map((r) => ({ ...r })), rowCount: rows.length };
+    }
+
+    // The rollup aggregate — one row, always (an aggregate with no GROUP BY).
+    if (/WITH agg AS/.test(sql) && /platform_identity_builder_project_activity/.test(sql)) {
+      const who = ROLLUP[activityScope(sql, params)];
+      const agg = who ? who.agg : { projects: 0, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null };
+      return { rows: [{ ...agg }], rowCount: 1 };
+    }
+
+    // The per-project rows the rollup names (or collapses into more_projects).
+    if (/platform_identity_builder_project_activity/.test(sql)) {
+      const who = ROLLUP[activityScope(sql, params)];
+      const rows = who ? who.projects.map((p) => ({ ...p })) : [];
+      return { rows, rowCount: rows.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql.slice(0, 140)}`);
+  },
+};
+
+// ===========================================================================
+// The real routers over those tables
+// ===========================================================================
+
+// The viewer the stubbed session middleware presents. Real requireBuilder reads
+// it from the session; the route body under test is untouched, and the route
+// body is the whole point — a route that reached for req.query.github_id would
+// be just as wrong with real auth in front of it.
+let viewer = null;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    // The public route's CORS wrapper is not under test; a pass-through keeps
+    // the doorway honest without dragging core config in.
+    corsPublicGet: () => (_req, _res, next) => next(),
+    requireBuilder: (req, res, next) => {
+      if (!viewer) return res.fail('unauthenticated', 401);
+      req.builder = { ...viewer };
+      next();
+    },
+  },
+};
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildProfileRoutes = require('../modules/platform-identity/routes/profile.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildProfileRoutes());
+app.use('/api/bongos', buildPublicProfileRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function get(path_, headers = {}) {
+  calls = [];
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: path_, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, text, json });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const asAccount = (githubId) => {
+  const a = ACCOUNTS.find((x) => x.github_id === githubId);
+  viewer = { github_id: a.github_id, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url };
+};
+
+// ===========================================================================
+// 0. The instrument is calibrated before it is trusted
+// ===========================================================================
+
+test('the interpreter refuses a predicate it cannot read, rather than ignoring it', () => {
+  assert.throws(
+    () => accountFilter('github_id = $1 AND some_new_flag = $2', [OCTO, true]),
+    /unread predicate on \$2/,
+    'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens',
+  );
+  assert.throws(
+    () => accountFilter("github_id = $1 AND shadow_banned = 'yes'", [OCTO]),
+    /unrecognised literal comparison on shadow_banned/,
+    'the privacy predicate is made of LITERAL comparisons — an unmodelled one must not read as absent',
+  );
+});
+
+test('the interpreter really does narrow on the visibility literals', () => {
+  const gated = ACCOUNTS.filter(accountFilter("(profile_state = 'active' AND account_visibility = 'public') AND (lower(handle) = $1 OR lower(previous_handle) = $1)", ['ghost']));
+  const ungated = ACCOUNTS.filter(accountFilter('(lower(handle) = $1 OR lower(previous_handle) = $1)', ['ghost']));
+  assert.equal(gated.length, 0, 'with the predicate, the private account is not reachable by handle');
+  assert.equal(ungated.length, 1, 'without it the SAME shape finds them — so dropping it genuinely changes this fixture');
+});
+
+// ===========================================================================
+// 1. No partial numbers: the hidden account leaks nothing by subtraction
+// ===========================================================================
+
+test('CONTROL: a public account really does serve every rollup sentinel', async () => {
+  // Without this, "no sentinels in the hidden body" could just mean the rollup
+  // never ran at all, and every assertion below would be vacuous.
+  viewer = null;
+  const res = await get('/api/bongos/profiles/octo');
+  assert.equal(res.status, 200);
+  for (const s of sentinelsOf(OCTO)) {
+    assert.ok(res.text.includes(s), `a public account's body must carry its rollup value ${s} — otherwise the leak test proves nothing`);
+  }
+  assert.ok(res.json.cross_project && res.json.cross_project.totals, 'and the payload really is the rollup shape');
+});
+
+test('CONTROL: the hidden account HAS numbers — they exist, they are withheld', async () => {
+  // The other vacuity guard: prove the sentinels are real data behind the door,
+  // not an empty fixture that trivially cannot appear in any response.
+  const own = await pi.getOwnProfileExtras(SHY, { pool });
+  assert.equal(own.totals.credits, 606001, 'the hidden account has real numbers');
+  assert.equal(own.totals.works_shipped, 606002);
+  assert.deepEqual(own.projects.map((p) => p.name), ['Shy-Project-606005']);
+});
+
+test('a stats-hidden account renders NO PARTIAL NUMBERS — not one sentinel survives', async () => {
+  viewer = null;
+  const res = await get('/api/bongos/profiles/shy');
+  assert.equal(res.status, 200, 'hide removes the ROLLUP, not the page (spec D2) — the identity band still resolves');
+
+  // The whole point of P10: a count beside a hidden total is a leak by
+  // subtraction, so the test is not "cross_project is null" (which a stray
+  // sibling key would satisfy) but "none of these values is anywhere".
+  for (const s of sentinelsOf(SHY)) {
+    assert.ok(!res.text.includes(s), `the hidden account's ${s} appears in the response — a count beside a hidden total is a leak by subtraction`);
+  }
+
+  // ...and the withholding is TOTAL, not a hollowed-out object. An empty
+  // {totals:{}} would tell a reader the rollup exists and is being suppressed.
+  assert.equal(res.json.cross_project, null, 'cross_project must be exactly null, never a partial or emptied object');
+  assert.ok(!('totals' in res.json), 'no rollup key may be hoisted to the top level to survive the null');
+  assert.deepEqual(Object.keys(res.json).sort(), ['account', 'cross_project'],
+    'the hidden response must carry no extra key — a new sibling key is exactly how a partial number arrives');
+
+  // The identity band is the other place a stray number can dock. The route
+  // whitelists it, and this pins that whitelist: a field added here reaches the
+  // world, so it must be a deliberate act that fails a test first.
+  assert.deepEqual(Object.keys(res.json.account).sort(),
+    ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since'],
+    'a new key on the identity band of a HIDDEN account is how a count arrives beside a hidden total');
+});
+
+test('the withholding is indistinguishable from having no numbers at all', async () => {
+  // A distinct "hidden" marker would be the same disclosure as a 403: it tells
+  // a stranger the account has a track record it is choosing not to show.
+  viewer = null;
+  const shy = await get('/api/bongos/profiles/shy');
+  assert.doesNotMatch(shy.text, /hidden|hide_stats|private|withheld|suppressed/i,
+    'the response must not name WHY the numbers are absent — that is itself the disclosure');
+});
+
+// ===========================================================================
+// 2. Renders to its owner: the own-scope door, over real HTTP
+// ===========================================================================
+
+test('the private account gets its OWN page from the own-scope door', async () => {
+  // The half the public 404 exists to make safe. GET /me/cross-project is what
+  // the page shell reads when the viewer is the account.
+  asAccount(GHOST);
+  const res = await get('/api/bongos/me/cross-project');
+  assert.equal(res.status, 200, 'a private account is still a full participant in its own scope');
+
+  // The banner input: the shell renders "private" from this field, and it must
+  // be the STORED value, not a default.
+  assert.equal(res.json.account_visibility, 'private',
+    'without this the owner cannot be told their page is private — the banner has no input');
+  assert.equal(res.json.handle, 'ghost', 'and it is their own record, identified');
+  assert.equal(res.json.bio, 'ghost-bio-515007');
+
+  // Their numbers are theirs: the side door is deliberately flag-blind.
+  assert.ok(res.json.cross_project, 'a private account must be able to read its own track record');
+  assert.equal(res.json.cross_project.totals.credits, 515001);
+  assert.equal(res.json.cross_project.totals.works_shipped, 515002);
+  assert.deepEqual(res.json.cross_project.projects.map((p) => p.name), ['Ghost-Project-515005']);
+
+  // ...and the reason it is a SIDE door: no visibility predicate is applied.
+  assert.ok(!calls.some((c) => /account_visibility = '|profile_state = '/.test(c.sql)),
+    'the self view must apply no visibility predicate — that is what makes it a side door, not a second public read');
+});
+
+test('BOTH HALVES AT ONCE: the same account, same instant — 404 public, 200 own', async () => {
+  // P10 stated as one assertion. The public response is viewer-independent, so
+  // the owner sees 404 there too (privacy spec D2, reconciling the profile-page
+  // spec's looser "404 to everyone but the account itself"); the page they
+  // actually see is composed from the own-scope door.
+  asAccount(GHOST);
+  const publicRead = await get('/api/bongos/profiles/ghost');
+  assert.equal(publicRead.status, 404, 'the PUBLIC read 404s even for the owner — it takes no viewer, so it cannot vary by one');
+  assert.notEqual(publicRead.status, 403, 'a 403 would confirm the handle exists, which is the disclosure the 404 rule prevents');
+  assert.ok(!publicRead.text.includes('Ghost'), 'and nothing about the account rides in the 404 body');
+  assert.ok(!publicRead.text.includes('ghost-bio-515007'));
+
+  const ownRead = await get('/api/bongos/me/cross-project');
+  assert.equal(ownRead.status, 200, 'and the very same account, in the very same state, renders to itself');
+  assert.equal(ownRead.json.handle, 'ghost');
+});
+
+test('a HIDDEN owner still sees their own numbers — hide is a public rule, not a self rule', async () => {
+  asAccount(SHY);
+  const res = await get('/api/bongos/me/cross-project');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.hide_stats, true, 'the toggle reads back, so Settings can render its state');
+  assert.equal(res.json.cross_project.totals.credits, 606001,
+    'ADR 0171 D2: a hidden builder inspects their numbers HERE, which is why the public route may return null');
+});
+
+// ===========================================================================
+// 3. The bypass that would nullify every 404
+// ===========================================================================
+
+test('the own-scope door answers the SESSION, never a caller-named account', async () => {
+  // If this door ever honoured a caller-named id, every 404 the public read
+  // returns becomes a speed bump: ask the side door for the private account
+  // instead. It is the single most load-bearing assertion in this file.
+  asAccount(NOSY);
+  const attempts = [
+    ['/api/bongos/me/cross-project?github_id=' + GHOST, {}],
+    ['/api/bongos/me/cross-project?id=' + GHOST, {}],
+    ['/api/bongos/me/cross-project?handle=ghost', {}],
+    ['/api/bongos/me/cross-project?github_login=ghost', {}],
+    ['/api/bongos/me/cross-project', { 'x-github-id': GHOST }],
+    ['/api/bongos/me/cross-project', { 'x-builder-id': GHOST, 'x-github-login': 'ghost' }],
+  ];
+  for (const [path_, headers] of attempts) {
+    const res = await get(path_, headers);
+    assert.equal(res.status, 200, `${path_} must still serve the caller`);
+    assert.equal(res.json.handle, 'nosy', `${path_} returned someone else's account — the own-scope door is not own-scoped`);
+    assert.equal(res.json.account_visibility, 'public', `${path_} leaked another account's privacy state`);
+    for (const s of sentinelsOf(GHOST)) {
+      assert.ok(!res.text.includes(s), `${path_} leaked the private account's ${s}`);
+    }
+  }
+});
+
+test('the own-scope door is closed to an unauthenticated caller', async () => {
+  viewer = null;
+  const res = await get('/api/bongos/me/cross-project');
+  assert.equal(res.status, 401, 'no session, no self — otherwise "own scope" means "anyone\'s scope"');
+});
+
+// ===========================================================================
+// 4. Lane proof — a test that never runs is not a gate (task 1002282)
+// ===========================================================================
+
+test('this proof runs in the DB-free lane that executes on every PR', () => {
+  const runner = fs.readFileSync(join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(
+    !/profile_privacy_owner_view/.test(runner),
+    'named in run-unit-tests.js means parked into INTEGRATION or KNOWN_FAILING — where CI has no Postgres, this file would self-skip forever and gate nothing',
+  );
+});

package/tests/projects_hub.mjs

@@ -1655,3 +1655,24 @@ test('the kit proves the field path: the fixture carries a curated template and
   assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
   assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material gold')), 'the material reaches the orb as its own attribute');
 });
+
+/* ── the table's columns on FIXED tracks (task 1003348; the owner, 2026-08-29: "the
+   columns in that projects table view dont look aligned") ── */
+test('one column grammar: the table lays every row on one set of fixed tracks (each header over its cells), and the mine list shares the rule', () => {
+  assert.match(COSMOS, /\.tbl\{table-layout:fixed;min-width:860px;\}/, 'the header row\'s widths are the table\'s — no per-row content sizing');
+  // the task's other half — the Your projects list — landed with task 1003345 and is pinned above
+  // ('the mine list lays every row on one set of FIXED tracks'); it is asserted here too so the two
+  // halves of the grammar can never drift apart: fixed planet + doors, ratio tracks with no content minimum
+  assert.match(COSMOS, /#view-mine \.proj\{display:grid;grid-template-columns:72px minmax\(0,1fr\);/, 'the mine row: the planet track is a width');
+  assert.match(COSMOS, /#view-mine \.projBody\{display:grid;grid-template-columns:minmax\(0,1\.1fr\) minmax\(0,1\.3fr\) minmax\(0,1fr\) 232px;/, 'the mine row: name, facts and rail by ratio with no content minimum, the doors a width');
+  assert.match(COSMOS, /the same column grammar the every-project table takes/, 'the mine block names the table as its twin');
+  for (const [col, w] of [['colType', 88], ['colBuilders', 96], ['colTags', 168], ['colStatus', 224], ['colGo', 112]]) {
+    assert.match(COSMOS, new RegExp(`\\.tbl th\\.${col}\\{width:${w}px;\\}`), `${col} is a width, not a 1% hug`);
+  }
+  assert.doesNotMatch(COSMOS, /\.tbl \.col\w+\{width:1%/, 'no column hugs its widest cell any more');
+  assert.match(COSMOS, /\.tbl th\.colName\{padding-left:22px;\}/, 'the Project header sits over the name, past the dot and its gap');
+  assert.match(COSMOS, /\.tbl th\.right\{text-align:right;\}/, 'a right-aligned column\'s header is right-aligned too');
+  assert.match(HUB, /<th class="right colBuilders" data-sort="builders">/, 'the builders header names its column so its width can be set');
+  assert.match(COSMOS, /@media \(max-width:780px\)\{\.tbl \.colTags,\.tbl \.colType\{display:none;\}\.tbl\{min-width:600px;\}\}/, 'a phone scrolls the table inside its wrap');
+  assert.match(COSMOS, /#sub-table-body\{overflow-x:auto;\}/, 'the wrap scrolls, never the page');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -560,7 +560,7 @@ test('the done panel’s progress region is stable, change-only, and says each s
 
 test('the map table sorts from the keyboard and an owned row’s name is a real link', () => {
   assert.match(HUB, /<th class="colName" data-sort="name" aria-sort="ascending"><button type="button" class="thSort">Project<\/button><\/th>/);
-  assert.match(HUB, /<th class="right" data-sort="builders"><button type="button" class="thSort">Builders<\/button><\/th>/);
+  assert.match(HUB, /<th class="right colBuilders" data-sort="builders"><button type="button" class="thSort">Builders<\/button><\/th>/);
   assert.match(SCRIPT, /var btn = th\.querySelector\('button'\);\n\s*if \(!btn\) return;\n\s*btn\.addEventListener\('click'/, 'the listener sits on the button, not the th');
   assert.doesNotMatch(SCRIPT, /th\.style\.cursor/, 'no JS-set cursor on the th');
   assert.match(COSMOS, /\.tbl th button\{all:unset;cursor:pointer;\}/);