@bongos/core 1.19.425 → 1.19.427

package/modules/hall-ui/public/profile-connections.js

@@ -0,0 +1,304 @@
+// modules/hall-ui/public/profile-connections.js — section 6 of the builder
+// profile page: connections, degree labels, and the connect button (R20,
+// task 1002296 / goal 1000045 criterion C6; ADR 0202, ADR 0207).
+//
+// WHAT IT RENDERS, and to whom:
+//   * on YOUR OWN profile — the pending requests in both directions (incoming
+//     ones you Accept or Decline, outgoing ones you Withdraw) and your accepted
+//     connections, each 1st degree by definition, each removable.
+//   * on ANOTHER builder's profile — the viewer-relative degree label, the
+//     mutual connections it was computed from, and the connect affordance.
+//
+// HUB-ONLY, AND IT DEGRADES TO NOTHING. Connections are account-to-account on
+// the platform hub (modules/platform-identity); on an instance without that
+// module every route here is absent, every call 404s, and the section never
+// reveals — the same "reveal only when the data is there" contract the
+// cross-project section already keeps on this page.
+//
+// FOUR THINGS THIS FILE MUST NOT DO. Each is a privacy decision the API made
+// deliberately, and the UI is the last place it can be undone:
+//
+//   1. `degree: null` is OUT OF NETWORK, never "not connected" (ADR 0202
+//      Consequences). Past the fan-out caps or past three hops the API stops
+//      searching and says so honestly; rendering that as the absence of a
+//      relationship states something the query never established.
+//   2. The uncertainty copy beside an out-of-network label is CONSTANT. The
+//      API's `truncated` describes the VIEWER's own expansion; the target's
+//      1-hop truncation is deliberately unreported (ADR 0207 L2) because
+//      reporting it leaks a bit about a third party's degree. Copy that varied
+//      with `truncated` would rebuild that side channel in words.
+//   3. A sent request claims exactly `201 { status: 'pending' }` and nothing
+//      more (ADR 0207 D6) — no id, no timestamp, no "they will be notified",
+//      and no remark when a re-ask inside the 90-day decline cooldown is
+//      silently swallowed (ADR 0207 L1). "Request sent" is the whole claim.
+//   4. `seen_at` never reaches the screen. It was stripped from outgoing rows
+//      so a requester cannot learn when their request was read; rendering it on
+//      the incoming side re-creates that signal the moment a screenshot passes
+//      between the two people.
+//
+// COUNTS ARE ARRAY LENGTHS. Every number here is the length of the list the
+// viewer was actually handed — never a total carried beside a filtered list,
+// which is a leak by subtraction (ADR 0171 D4 / ADR 0202 D4).
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016): a connection grants no rank, no credits
+// and no admission. Nothing rendered here is rollup-derived either, which is
+// why `hide_stats` does not suppress it — hiding your stats hides the numbers
+// beside an edge, not the edge itself (ADR 0202 D4 §3).
+//
+// ADDRESSING. The connections API names a counterparty by HANDLE; this page
+// knows only a builder's github_login. It hands that login to
+// GET /connections/degree/:handle, which resolves the current handle or the
+// single previous-handle rename slot and echoes the CANONICAL handle back —
+// and that echoed handle, never the login, is what every write here sends. A
+// login resolving to neither answers 404 and the section stays hidden, the same
+// fail-closed answer a private or provisional account gets. The handle-addressed
+// hub page (/u/<handle>) will not need this hop at all.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg, { duration: 2600, clear: true });
+
+  // The only degrees that have a name. Anything else — null, or a number the
+  // API never promised — falls through to "out of network" rather than being
+  // invented a label (note 1 above).
+  const DEGREE_SHORT = { 0: 'You', 1: '1st', 2: '2nd', 3: '3rd' };
+  const DEGREE_LINE = {
+    0: 'This is your own profile.',
+    1: 'You are connected.',
+    2: 'You know someone they know.',
+    3: 'Three connections away in your network.',
+  };
+  const OUT_OF_NETWORK = 'Out of network';
+  // CONSTANT by decision — it must read the same whether or not the response
+  // said `truncated` (note 2 above).
+  const OUT_OF_NETWORK_WHY = 'No path to this builder through the connections you can see. '
+    + 'There may be none, or it may run through someone whose account is not visible to you.';
+  // The whole claim a 201 supports, in markup, used by both the first render
+  // and the click that earns it.
+  const SENT_HTML = '<p class="conn-act"><button class="btn-ghost" type="button" disabled>Request sent</button></p>';
+
+  const known = (degree) => Object.prototype.hasOwnProperty.call(DEGREE_SHORT, degree);
+  const arr = (v) => (Array.isArray(v) ? v : []);
+  const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
+
+  // The last render's inputs, so an accept/decline/remove can repaint the
+  // section from the server rather than patching the DOM it just changed.
+  let last = null;
+
+  // ---- shared cells ---------------------------------------------------------
+
+  // One counterparty, rendered from the only three columns the API projects
+  // for one (handle, display_name, avatar_url) — nothing rollup-derived, so
+  // there is nothing here for hide_stats to suppress.
+  function personHtml(row) {
+    const name = escapeHtml(row.display_name || row.handle || 'Builder');
+    const avatar = row.avatar_url
+      ? `<img class="conn-person__avatar" src="${escapeHtml(row.avatar_url)}" alt="">`
+      : '<span class="conn-person__avatar" aria-hidden="true"></span>';
+    const handle = row.handle ? `<span class="conn-person__handle">@${escapeHtml(row.handle)}</span>` : '';
+    return `<span class="conn-person">${avatar}<span class="conn-person__name">${name}</span>${handle}</span>`;
+  }
+
+  function btn(act, id, label) {
+    return `<button class="btn-ghost" type="button" data-act="${escapeHtml(act)}" data-id="${escapeHtml(id)}">${escapeHtml(label)}</button>`;
+  }
+
+  // ---- your own profile -----------------------------------------------------
+
+  // Every row is an accepted connection of yours, so its degree is 1 by
+  // definition — no per-row query, and no chance of a fan-out cap making the
+  // label wrong (ADR 0207 D2: a cap may make an answer less specific, never
+  // wrong). `connected_at` is the edge's own timestamp, not a rollup number.
+  function connectionRow(row) {
+    return `<tr>
+      <td>${personHtml(row)}</td>
+      <td><span class="conn-degree conn-degree--1">1st</span></td>
+      <td class="ledger__date">${row.connected_at ? escapeHtml(fmtDate(row.connected_at)) : '—'}</td>
+      <td>${btn('remove', row.id, 'Remove')}</td>
+    </tr>`;
+  }
+
+  function requestsHtml(incoming, outgoing) {
+    const inbox = incoming.map((r) => `<li class="conn-req">${personHtml(r)}`
+      + (r.note ? `<p class="conn-req__note">${escapeHtml(r.note)}</p>` : '')
+      + `<span class="conn-req__acts">${btn('accept', r.id, 'Accept')}${btn('decline', r.id, 'Decline')}</span></li>`).join('');
+    const outbox = outgoing.map((r) => `<li class="conn-req">${personHtml(r)}`
+      + '<span class="conn-req__state">Request sent</span>'
+      + `<span class="conn-req__acts">${btn('withdraw', r.id, 'Withdraw')}</span></li>`).join('');
+    return (incoming.length ? `<h3 class="conn-sub">${escapeHtml(plural(incoming.length, 'builder'))} asking to connect</h3><ul class="conn-reqs">${inbox}</ul>` : '')
+      + (outgoing.length ? `<h3 class="conn-sub">${escapeHtml(plural(outgoing.length, 'request'))} you have sent</h3><ul class="conn-reqs">${outbox}</ul>` : '');
+  }
+
+  // Your own connections + both request queues. Returns false when the hub
+  // routes are absent or the session is gone, so the caller leaves the section
+  // hidden rather than rendering an empty shell.
+  async function renderOwn(body) {
+    const [list, reqs] = await Promise.all([
+      api.request('GET', `${API}/connections`),
+      api.request('GET', `${API}/connections/requests`),
+    ]);
+    if (!list.ok || !reqs.ok) return false;
+    const connections = arr(list.data && list.data.connections);
+    const incoming = arr(reqs.data && reqs.data.incoming);
+    const outgoing = arr(reqs.data && reqs.data.outgoing);
+    body.innerHTML = requestsHtml(incoming, outgoing)
+      + `<p class="scroll__lede">${escapeHtml(plural(connections.length, 'connection'))}.</p>`
+      + '<div id="conn-ledger"></div>';
+    const mount = $('#conn-ledger');
+    if (mount) {
+      const pager = window.OTBKit.makePager('conn', 'profile.connections.perPage');
+      window.OTBKit.makeLedger({
+        mount,
+        columns: ['Builder', 'Degree', { label: 'Connected', class: 'ledger__date' }, ''],
+        rowHtml: connectionRow,
+        emptyMsg: 'No connections yet.',
+        pager,
+      }).render(connections);
+    }
+    return true;
+  }
+
+  // ---- someone else's profile -----------------------------------------------
+
+  function degreeHtml(degree, mutuals) {
+    const chip = `<span class="conn-degree conn-degree--${known(degree) ? degree : 'out'}">`
+      + `${escapeHtml(known(degree) ? DEGREE_SHORT[degree] : OUT_OF_NETWORK)}</span>`;
+    const line = known(degree) ? DEGREE_LINE[degree] : OUT_OF_NETWORK_WHY;
+    // The count is the length of the names beside it — never a total the
+    // response carried, which would disclose a filtered mutual by subtraction.
+    const mutual = mutuals.length
+      ? `<p class="scroll__lede">${escapeHtml(plural(mutuals.length, 'connection'))} in common: `
+        + `${mutuals.map((m) => escapeHtml(`@${m.handle || 'unknown'}`)).join(', ')}</p>`
+      : '';
+    return `<p class="conn-degree-line">${chip} ${escapeHtml(line)}</p>${mutual}`;
+  }
+
+  // Which pending request, if any, already stands with this handle — read from
+  // the caller's OWN inbox and outbox, the only place the API says anything
+  // about one. An empty outbox is not evidence a request was refused: a re-ask
+  // inside the decline cooldown writes nothing (ADR 0207 L1), so absence means
+  // "nothing is pending" and the UI draws no further conclusion from it.
+  async function pendingWith(handle) {
+    const res = await api.request('GET', `${API}/connections/requests`);
+    if (!res.ok) return null;
+    const same = (r) => r && typeof r.handle === 'string' && r.handle.toLowerCase() === handle.toLowerCase();
+    const incoming = arr(res.data && res.data.incoming).find(same);
+    if (incoming) return { dir: 'incoming', id: incoming.id };
+    const outgoing = arr(res.data && res.data.outgoing).find(same);
+    return outgoing ? { dir: 'outgoing', id: outgoing.id } : null;
+  }
+
+  function actionHtml(degree, handle, pending) {
+    if (degree === 0) return ''; // your own account reached by ?id= — nothing to ask
+    if (degree === 1) return '<p class="conn-act"><span class="conn-state">Connected</span></p>';
+    if (pending && pending.dir === 'incoming') {
+      return '<p class="conn-act"><span class="conn-state">They have asked to connect.</span>'
+        + `${btn('accept', pending.id, 'Accept')}${btn('decline', pending.id, 'Decline')}</p>`;
+    }
+    if (pending && pending.dir === 'outgoing') return SENT_HTML;
+    return `<p class="conn-act"><button class="btn-ghost" type="button" data-act="connect" data-handle="${escapeHtml(handle)}">Connect</button></p>`;
+  }
+
+  // The viewer-relative view. A 404 here is the deliberately indistinguishable
+  // set — unknown handle, provisional account, private stranger — and all of
+  // them mean the same thing to this page: there is nothing to offer, so the
+  // section stays hidden and no connect button is drawn.
+  async function renderOther(body, login) {
+    if (!login) return false;
+    const res = await api.request('GET', `${API}/connections/degree/${encodeURIComponent(login)}`);
+    if (res.status === 403) {
+      // About the VIEWER, not the target: their own account has not been
+      // activated at the hub yet, so they cannot take part at all.
+      body.innerHTML = '<p class="scroll__lede">Sign in to the platform once to activate your profile before connecting.</p>';
+      return true;
+    }
+    if (!res.ok) return false;
+    const data = res.data || {};
+    const handle = typeof data.handle === 'string' ? data.handle : null;
+    if (!handle) return false;
+    const mutuals = arr(data.mutuals);
+    body.innerHTML = degreeHtml(data.degree, mutuals) + actionHtml(data.degree, handle, await pendingWith(handle));
+    return true;
+  }
+
+  // ---- actions --------------------------------------------------------------
+
+  async function connect(handle) {
+    const res = await api.request('POST', `${API}/connections`, { body: { handle } });
+    // 201 { status: 'pending' } is byte-identical for a request that was written
+    // and one swallowed by the cooldown. "Request sent" claims exactly that.
+    if (res.status === 201) return { html: SENT_HTML, message: 'Request sent.' };
+    if (res.status === 409) return { message: 'There is already a request or a connection between you.' };
+    if (res.status === 403) return { message: 'Activate your platform profile before connecting.' };
+    // 404 is absent / provisional / private, indistinguishable on purpose.
+    if (res.status === 404) return { message: 'That builder cannot be connected with right now.' };
+    return { message: 'Could not send the request.' };
+  }
+
+  const ROW_ACTIONS = {
+    accept: { call: (id) => api.request('POST', `${API}/connections/${encodeURIComponent(id)}/accept`), message: 'Connected.' },
+    decline: { call: (id) => api.request('POST', `${API}/connections/${encodeURIComponent(id)}/decline`), message: 'Declined.' },
+    remove: { call: (id) => api.request('DELETE', `${API}/connections/${encodeURIComponent(id)}`), message: 'Connection removed.' },
+    withdraw: { call: (id) => api.request('DELETE', `${API}/connections/${encodeURIComponent(id)}`), message: 'Request withdrawn.' },
+  };
+
+  async function onClick(ev) {
+    const el = ev.target && ev.target.closest ? ev.target.closest('button[data-act]') : null;
+    if (!el) return;
+    const act = el.dataset.act;
+    el.disabled = true;
+    try {
+      if (act === 'connect') {
+        const out = await connect(el.dataset.handle);
+        // Replace only the action line: a 201 tells us nothing about the rest
+        // of the page, so nothing else is restated.
+        if (out.html) { const body = $('#conn-body'); if (body) body.innerHTML = body.innerHTML.replace(/<p class="conn-act">[\s\S]*?<\/p>/, out.html); }
+        toast(out.message);
+        return;
+      }
+      const spec = ROW_ACTIONS[act];
+      if (!spec) return;
+      const res = await spec.call(el.dataset.id);
+      if (!res.ok && res.status !== 204) { toast('That request is no longer available.'); }
+      else toast(spec.message);
+      if (last) await render(last.data, last.selfId);
+    } catch (err) {
+      console.error('[profile-connections] action failed', err);
+      toast('Something went wrong. Try again.');
+    } finally {
+      el.disabled = false;
+    }
+  }
+
+  // ---- entry ----------------------------------------------------------------
+
+  // Called by profile.js once the profile response has landed. Reveals the
+  // section only when the hub answered with something to show; any other
+  // outcome — module absent, signed out, target not addressable — leaves the
+  // markup's `hidden` in place.
+  async function render(data, selfId) {
+    const section = $('#conn-scroll');
+    const body = $('#conn-body');
+    if (!section || !body) return;
+    last = { data, selfId };
+    const builder = (data && data.builder) || {};
+    const isSelf = selfId != null && String(builder.id) === String(selfId);
+    try {
+      const shown = isSelf ? await renderOwn(body) : await renderOther(body, builder.github_login);
+      section.hidden = !shown;
+      if (shown && body.addEventListener && !body.dataset.connWired) {
+        body.dataset.connWired = '1';
+        body.addEventListener('click', onClick);
+      }
+    } catch (err) {
+      console.error('[profile-connections] failed to load', err);
+      section.hidden = true;
+    }
+  }
+
+  window.OTBConnections = { render };
+})();

package/modules/hall-ui/public/profile.html

@@ -107,9 +107,20 @@
           </div>
         </section>
 
+        <!-- Connections — section 6 of the profile-page spec (R20, task
+             1002296; ADR 0202). Hub-only, like the cross-project record:
+             profile-connections.js reveals it only when the hub's connections
+             API answers, so on an instance without platform-identity the
+             routes are absent and the section never renders. -->
+        <section class="scroll" id="conn-scroll" aria-labelledby="conn-h" hidden>
+          <h2 id="conn-h" class="scroll__h">Connections</h2>
+          <div id="conn-body"></div>
+        </section>
+
         <!-- Reserved slots — connections, guilds, and actions (profile-page
              spec sections 6–8) mount here in later phases; keeping the order
-             fixed now means the page is not re-laid-out twice (Decision 5). -->
+             fixed now means the page is not re-laid-out twice (Decision 5).
+             Section 6 landed above (task 1002296); 7 and 8 are still to come. -->
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>
@@ -130,6 +141,10 @@
 <!-- hall-kit (window.OTBKit) — profile.js renders ship-time task visuals through
      its shared thumbnail helper (task 1003109), so it must load first. -->
 <script src="/builders/hall-kit.js?v=2026-08-27-activity"></script>
+<!-- Connections (section 6). Loaded BEFORE profile.js so window.OTBConnections
+     exists by the time renderProfile runs; profile.js guards on it anyway, so a
+     page that omits this script simply has no connections section. -->
+<script src="/builders/profile-connections.js?v=2026-08-29-r20"></script>
 <script src="/builders/profile.js?v=2026-08-27-activity"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -534,6 +534,10 @@
     // The activity log needs a session (private goals + the idea trail), so it
     // keys off whether /me resolved — the same signal the self-detect uses.
     renderActivity(builder.id, selfId != null);
+    // Connections (section 6, task 1002296) — a separate hub-only script that
+    // reveals its own section or leaves it hidden. Optional by design: a page
+    // that does not load it simply has no connections section.
+    if (window.OTBConnections) window.OTBConnections.render(data, selfId);
   }
 
   // Render the friendly "no builder chosen" empty state for a signed-out visitor
@@ -557,6 +561,7 @@
     const worksLede = $('#works-lede'); if (worksLede) worksLede.hidden = true;
     const xp = $('#xp-scroll'); if (xp) xp.hidden = true;
     const act = $('#activity-scroll'); if (act) act.hidden = true;
+    const conn = $('#conn-scroll'); if (conn) conn.hidden = true;
   }
 
   async function fetchProfile(id, selfId) {

package/modules/hall-ui/public/settings.html

@@ -108,8 +108,8 @@
               <div id="privacy-rows"></div>
               <p class="settings-status" id="privacy-status" role="status" aria-live="polite"></p>
               <p class="section-note">Your profile page setting applies now — private already answers "not found"
-                everywhere your profile is read. Recruiter discoverability is saved to your
-                account and starts applying as the recruiting surfaces land.</p>
+                everywhere your profile is read. Recruiter discoverability applies now too — switching
+                it off takes you out of the People directory immediately, and back on puts you there again.</p>
             </section>
 
             <!-- CRAFT — discipline preferences (GET /me, PATCH /me/disciplines). -->

package/modules/hall-ui/public/settings.js

@@ -596,15 +596,15 @@
   // toggle is deliberately BINARY (spec D1: "one column, one settings toggle");
   // resetting back to null stays an API affordance, not a third UI state.
   //
-  // COPY RULE — a toggle may promise exactly what is enforced, and the two rows
-  // are at different stages, so they speak in different tenses (task 1002967).
-  // VISIBILITY is live: every public read joins the shared effective-visibility
-  // predicate, so private really does 404 — including to the owner, which the
-  // row must say out loud, because a page that vanishes for you too is
-  // surprising unless you are told where your own record went (here, Settings).
-  // DISCOVERABILITY is still stored-only: no recruiting surface reads it yet, so
-  // its row keeps the future tense until that lands. A toggle that claims
-  // protection it does not have is worse than no toggle.
+  // COPY RULE — a toggle may promise exactly what is enforced, and BOTH rows now
+  // are, one task apart. VISIBILITY went live with task 1002967: every public
+  // read joins the shared effective-visibility predicate, so private really does
+  // 404 — including to the owner, which the row must say out loud: a page that
+  // vanishes for you too is surprising unless you are told where your record went
+  // (here, Settings). DISCOVERABILITY went live with task 1002290:
+  // listScoutingRollup joins the reach predicate, so opting out really does empty
+  // the People directory of you. It names THAT surface and no wider set: the D3
+  // sliver is unbuilt, and no guard holds a promise about a surface that is not.
   function renderPrivacy(data) {
     const wrap = $('#privacy-rows');
     if (!wrap) return;
@@ -618,7 +618,7 @@
       privacyRow('visibility', 'Public profile page', isPublic ? 'Public' : 'Private', isPublic,
         'Public means anyone can open your profile page and find you by name. Private hides the page from everyone — including you: it answers "not found" to every visitor, and you read your own record here in Settings instead.', '') +
       privacyRow('discoverable', 'Discoverable by recruiters', discoverable ? 'On' : 'Off', discoverable,
-        `Recruiters looking for builders will be able to find you. ${grant}`,
+        `Recruiters looking for builders can find you. ${grant} Turning this off takes you out of the People directory straight away.`,
         follows ? ' <span class="voices__default">· follows your profile setting</span>' : '');
   }
 
@@ -645,8 +645,8 @@
         : 'Saved — your profile page is set to private.';
     }
     return on
-      ? 'Saved — you are set to be findable by recruiters.'
-      : 'Saved — you are set to stay out of recruiting search.';
+      ? 'Saved — recruiters can find you.'
+      : 'Saved — you are out of the People directory.';
   }
 
   // PATCH any own-scoped privacy flag (routes/profile.js): { hide_stats } and/or

package/modules/hall-ui/public/style.css

@@ -1107,6 +1107,44 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 
 .disc-pref { margin-right: 4px; }
 
+/* ---------- connections (profile section 6, task 1002296) ---------- */
+
+.conn-person { display: inline-flex; align-items: center; gap: 7px; min-width: 0; }
+.conn-person__avatar {
+  width: 22px; height: 22px; border-radius: 50%; flex: none;
+  background: var(--surface-2); border: 1px solid var(--border); object-fit: cover;
+}
+.conn-person__name { font-weight: 500; }
+.conn-person__handle { color: var(--ink-faint); font-size: 12.5px; }
+
+/* The degree chip. `--out` is the null answer — deliberately the quietest of
+   the four, because "out of network" is an absence of knowledge, not a rank. */
+/* nowrap + flex:none — "Out of network" is the longest label and must stay one
+   pill; wrapped, it reads as two chips. */
+.conn-degree {
+  display: inline-block; flex: none; white-space: nowrap;
+  padding: 1px 7px; border-radius: 999px;
+  font-size: 11.5px; font-weight: 600; letter-spacing: 0.02em;
+  border: 1px solid var(--border-strong); background: var(--surface-2); color: var(--ink-soft);
+}
+.conn-degree--1 { background: var(--ok-weak); color: var(--ok); border-color: color-mix(in srgb, var(--ok) 30%, transparent); }
+.conn-degree--2 { background: var(--info-weak); color: var(--info); border-color: color-mix(in srgb, var(--info) 30%, transparent); }
+.conn-degree--3 { background: var(--surface-2); color: var(--ink-soft); }
+.conn-degree--out { background: none; color: var(--ink-faint); border-style: dashed; }
+
+.conn-degree-line { display: flex; align-items: baseline; gap: 8px; flex-wrap: wrap; margin: 0 0 6px; font-size: 13.5px; color: var(--ink-soft); }
+.conn-act { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; margin: 10px 0 0; }
+.conn-state { font-size: 13px; color: var(--ink-faint); }
+.conn-sub { margin: 14px 0 6px; font-size: 12px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink-faint); }
+.conn-reqs { list-style: none; margin: 0; padding: 0; display: grid; gap: 6px; }
+.conn-req {
+  display: flex; align-items: center; gap: 10px; flex-wrap: wrap;
+  padding: 8px 10px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface-1);
+}
+.conn-req__note { flex: 1 1 100%; margin: 0; font-size: 13px; color: var(--ink-soft); }
+.conn-req__state { font-size: 13px; color: var(--ink-faint); }
+.conn-req__acts { margin-left: auto; display: flex; gap: 6px; }
+
 @media (max-width: 640px) {
   .profile { grid-template-columns: 48px minmax(0, 1fr); }
   .profile__avatar { width: 48px; height: 48px; }

package/modules/platform-identity/account-visibility.js

@@ -28,8 +28,11 @@
 //   rollupVisibleSql / isRollupVisible     NUMBERS    — visible AND NOT
 //       hide_stats. ADR 0171 D2's predicate EXTENDED with the existence axis,
 //       and COMPOSED from accountVisibleSql rather than restated.
-//   isRecruiterDiscoverable                REACH      — the COALESCE, privacy
+//   recruiterReachSql / isRecruiterDiscoverable  REACH — the COALESCE, privacy
 //       spec D1. A reach predicate only: it never buys addressability.
+//   scoutingListableSql                    THE DIRECTORY — numbers AND reach,
+//       the ONE predicate the recruiting directory joins (ADR 0210, task
+//       1002290). Composed, never restated.
 //
 // The rollup pair was originally left to "the rollup readers" to apply. Task
 // 1002967 moved it here for the reason this file exists: there are two such
@@ -137,6 +140,47 @@ function isRecruiterDiscoverable(account) {
   return account.account_visibility === 'public';
 }
 
+// The SAME reach answer as a SQL fragment, for the read that filters in the
+// database (task 1002290). It is the ONE spelling of that COALESCE outside the
+// JS twin above — tests/effective_visibility_predicate.mjs fails any other file
+// that writes it — so a directory query and a route can never disagree about who
+// opted out. NULL still means "follow visibility", exactly as the column comment
+// in platform_identity_012_account_privacy.sql says.
+function recruiterReachSql(alias) {
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('recruiterReachSql: alias must be a bare SQL identifier');
+  }
+  const q = alias ? `${alias}.` : '';
+  return `COALESCE(${q}recruiter_discoverable, ${q}account_visibility = 'public')`;
+}
+
+// scoutingListableSql — THE predicate the recruiting directory joins: the rollup
+// axis AND the reach axis (ADR 0210, task 1002290). listScoutingRollup is the
+// one reader; /scouting and the hall's /people are its two surfaces.
+//
+// WHY REACH BELONGS HERE AND NOT IN rollupVisibleSql. The two axes answer
+// different questions and only one surface asks both. `hide_stats` suppresses
+// NUMBERS everywhere, for every reader; the recruiting opt-out removes an
+// account from the RECRUITING SURFACE only. The community spec's D3 leaderboards
+// say so out loud — "the recruiting opt-out does not affect leaderboards; it
+// governs the recruiting surface only" — so folding reach into rollupVisibleSql
+// would silently empty a future public leaderboard of every opted-out builder.
+// A leaderboard reader must therefore join rollupVisibleSql, never this.
+//
+// Composed from rollupVisibleSql and recruiterReachSql rather than restated, so
+// changing what "visible", "hidden" or "reachable" means moves this with it.
+function scoutingListableSql(alias) {
+  // Validated HERE as well as in both delegates. The delegates do refuse a bad
+  // alias, but only because rollupVisibleSql happens to be evaluated first in the
+  // template literal below — a security property should not rest on the
+  // evaluation order of a string interpolation, and the error a caller sees
+  // should name the function they actually called.
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('scoutingListableSql: alias must be a bare SQL identifier');
+  }
+  return `(${rollupVisibleSql(alias)} AND ${recruiterReachSql(alias)})`;
+}
+
 module.exports = {
   isAccountVisible,
   accountVisibleSql,
@@ -146,4 +190,6 @@ module.exports = {
   isRollupVisible,
   ACCOUNT_VISIBILITY,
   isRecruiterDiscoverable,
+  recruiterReachSql,
+  scoutingListableSql,
 };

package/modules/platform-identity/platform-identity.js

@@ -20,7 +20,7 @@ const api = require('../../src/module-api');
 const visibility = require('./account-visibility');
 
 const { pool: defaultPool } = api;
-const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible } = visibility;
+const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
 
 // Default authorization-code lifetime — deliberately short (~60s). A code is a
 // bearer secret that travels through the browser; a tight TTL bounds the replay
@@ -722,15 +722,18 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 // disciplines union is computed separately in `disc`. Proven against real SQL by
 // tests/scouting_rollup_fanout.mjs.
 //
-// Consent by construction (ADR 0171 D2/D3, extended by task 1002967): only
-// builders whose account passes rollupVisibleSql — active, publicly visible, not
-// hidden — appear. /people and /scouting are live cross-project surfaces, so the
-// predicate lives IN the query, not in any caller's memory, and it is the SHARED
-// one so this list can never disagree with /profiles/:handle about who is
-// visible. Provisional, private and hidden builders drop out entirely; the
-// projection stays an explicit whitelist (no raw-row spread). A private account
-// that is recruiter-discoverable is absent here on purpose: the full rollup is
-// never its disclosure — the D3 sliver is (a separate authorization-scoped port).
+// Consent by construction (ADR 0171 D2/D3, extended by tasks 1002967 + 1002290):
+// only builders whose account passes scoutingListableSql — active, publicly
+// visible, not hidden, AND not opted out of recruiting — appear. /people and
+// /scouting are live cross-project surfaces, so the predicate lives IN the query,
+// not in any caller's memory, and it is the SHARED one so this list can never
+// disagree with /profiles/:handle about who is visible. Provisional, private,
+// hidden and opted-out builders drop out entirely; the projection stays an
+// explicit whitelist. A private account that is recruiter-discoverable is absent
+// here on purpose: the full rollup is never its disclosure — the D3 sliver is.
+// THIS IS THE RECRUITING DIRECTORY: a public LEADERBOARD must not reuse this
+// reader (community spec D3 — the opt-out governs the recruiting surface only);
+// it joins rollupVisibleSql instead. Full argument: scoutingListableSql.
 async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `WITH agg AS (
@@ -744,7 +747,7 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
         WHERE EXISTS (
                 SELECT 1 FROM platform_identity_accounts pa
                  WHERE pa.github_id = a.github_id
-                   AND ${rollupVisibleSql('pa')})
+                   AND ${scoutingListableSql('pa')})
         GROUP BY a.github_id
      ), disc AS (
        SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines